kernel/linux.git/drivers/infiniband, branch linux-2.6.22.y

IB/uverbs: Fix checking of userspace object ownership

2007-11-05T17:56:06+00:00

Upstream as cbfb50e6e2e9c580848c0f51d37c24cdfb1cb704 Commit 9ead190b ("IB/uverbs: Don't serialize with ib_uverbs_idr_mutex") rewrote how userspace objects are looked up in the uverbs module's idrs, and introduced a severe bug in the process: there is no checking that an operation is being performed by the right process any more. Fix this by adding the missing check of uobj->context in __idr_get_uobj(). Apparently everyone is being very careful to only touch their own objects, because this bug was introduced in June 2006 in 2.6.18, and has gone undetected until now. Signed-off-by: Roland Dreier Signed-off-by: Greg Kroah-Hartman

IPoIB/cm: Partial error clean up unmaps wrong address

2007-07-03T03:48:31+00:00

If a page can't be allocated for the frag list of a skb, the code to unmap the partially allocated list is off by one. For exaple, if 'frags' equals one, i == 0, and the alloc_page() fails, then the old loop would have unmapped mapping[1] which is uninitialized. The same would happen if the call to ib_dma_map_page() failed. Signed-off-by: Ralph Campbell Acked-by: Michael S. Tsirkin Signed-off-by: Roland Dreier

IB/mlx4: Correct max_srq_wr returned from mlx4_ib_query_device()

2007-06-21T20:39:10+00:00

We need to keep a spare entry in the SRQ so that there always is a next WQE available when posting receives (so that we can tell the difference between a full queue and an empty queue). So subtract 1 from the value HW gives us before reporting the limit on SRQ entries to consumers. Found by Mellanox QA. Signed-off-by: Jack Morgenstein Signed-off-by: Roland Dreier

IPoIB/cm: Remove dead definition of struct ipoib_cm_id

2007-06-21T20:39:08+00:00

It's completely unused. Signed-off-by: Roland Dreier

IPoIB/cm: Fix interoperability when MTU doesn't match

2007-06-21T20:38:08+00:00

IPoIB connected mode currently rejects a connection request unless the supported MTU is >= the local netdevice MTU. This breaks interoperability with implementations that might have tweaked IPOIB_CM_MTU, and there's real no longer a reason to do so: this test is just a leftover from when we did not tweak MTU per-connection. Fix this by making the test as permissive as possible. Signed-off-by: Michael S. Tsirkin Signed-off-by: Roland Dreier

IPoIB/cm: Initialize RX before moving QP to RTR

2007-06-21T20:03:50+00:00

Fix a crasher bug in IPoIB CM: once a QP is in the RTR state, a receive completion (or even an asynchronous error) might be observed on this QP, so we have to initialize all of our receive data structures before moving to the RTR state. As an optimization (since modify_qp might take a long time), the jiffies update done when moving RX to the passive_ids list is also left in place to reduce the chance of the RX being misdetected as stale. This fixes bug . Signed-off-by: Michael S. Tsirkin Signed-off-by: Roland Dreier

IB/umem: Fix possible hang on process exit

2007-06-21T18:05:58+00:00

If ib_umem_release() is called after ib_uverbs_close() sets context->closing, then a process can get stuck in a D state, because the code boils down to if (down_write_trylock(&mm->mmap_sem)) down_write(&mm->mmap_sem); which is obviously a stupid instant deadlock. Fix the code so that we only try to take the lock once. This bug was introduced in commit f7c6a7b5 ("IB/uverbs: Export ib_umem_get()/ib_umem_release() to modules") which fortunately never made it into a release, and was reported by Pete Wyckoff . Signed-off-by: Roland Dreier

IB/mlx4: Make sure inline data segments don't cross a 64 byte boundary

2007-06-18T16:23:47+00:00

Inline data segments in send WQEs are not allowed to cross a 64 byte boundary. We use inline data segments to hold the UD headers for MLX QPs (QP0 and QP1). A send with GRH on QP1 will have a UD header that is too big to fit in a single inline data segment without crossing a 64 byte boundary, so split the header into two inline data segments. Signed-off-by: Roland Dreier

IB/mlx4: Handle FW command interface rev 3

2007-06-18T15:15:02+00:00

Upcoming firmware introduces command interface revision 3, which changes the way port capabilities are queried and set. Update the driver to handle both the new and old command interfaces by adding a new MLX4_FLAG_OLD_PORT_CMDS that it is set after querying the firmware interface revision and then using the correct interface based on the setting of the flag. Signed-off-by: Roland Dreier

IB/mlx4: Handle buffer wraparound in __mlx4_ib_cq_clean()

2007-06-18T15:13:59+00:00

When compacting CQ entries, we need to set the correct value of the ownership bit in case the value is different between the index we copy the CQE from and the index we copy it to. Found by Ronni Zimmerman of Mellanox. Signed-off-by: Jack Morgenstein Signed-off-by: Roland Dreier