mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Chris Wright <chrisw@sous-sol.org>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
	Zwane Mwaikambo <zwane@arm.linux.org.uk>,
	"Theodore Ts'o" <tytso@mit.edu>,
	Randy Dunlap <rdunlap@xenotime.net>,
	Dave Jones <davej@redhat.com>,
	Chuck Wolber <chuckw@quantumlinux.com>,
	torvalds@osdl.org, akpm@osdl.org, alan@lxorguk.ukuu.org.uk,
	Roland Dreier <rdreier@cisco.com>,
	Jack Morgenstein <jackm@mellanox.co.il>,
	"Michael S. Tsirkin" <mst@mellanox.co.il>,
	Roland Dreier <rolandd@cisco.com>
Subject: [patch 39/39] [PATCH] IB/mthca: max_inline_data handling tweaks
Date: Mon, 27 Feb 2006 14:32:39 -0800	[thread overview]
Message-ID: <20060227223408.822215000@sorel.sous-sol.org> (raw)
In-Reply-To: <20060227223200.865548000@sorel.sous-sol.org>

[-- Attachment #1: ib-mthca-max_inline_data-handling-tweaks.patch --]
[-- Type: text/plain, Size: 4488 bytes --]

-stable review patch.  If anyone has any objections, please let us know.
------------------

Fix a case where copying max_inline_data from a successful create_qp
capabilities output to create_qp input could cause EINVAL error:

mthca_set_qp_size must check max_inline_data directly against
max_desc_sz; checking qp->sq.max_gs is wrong since max_inline_data
depends on the qp type and does not involve max_sg.

Signed-off-by: Jack Morgenstein <jackm@mellanox.co.il>
Signed-off-by: "Michael S. Tsirkin" <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
fixes http://article.gmane.org/gmane.linux.drivers.openib/21118

 drivers/infiniband/hw/mthca/mthca_qp.c |   62 +++++++++++++++++++--------------
 1 files changed, 36 insertions(+), 26 deletions(-)

--- linux-2.6.15.4.orig/drivers/infiniband/hw/mthca/mthca_qp.c
+++ linux-2.6.15.4/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -885,18 +885,13 @@ int mthca_modify_qp(struct ib_qp *ibqp, 
 	return err;
 }
 
-static void mthca_adjust_qp_caps(struct mthca_dev *dev,
-				 struct mthca_pd *pd,
-				 struct mthca_qp *qp)
+static int mthca_max_data_size(struct mthca_dev *dev, struct mthca_qp *qp, int desc_sz)
 {
-	int max_data_size;
-
 	/*
 	 * Calculate the maximum size of WQE s/g segments, excluding
 	 * the next segment and other non-data segments.
 	 */
-	max_data_size = min(dev->limits.max_desc_sz, 1 << qp->sq.wqe_shift) -
-		sizeof (struct mthca_next_seg);
+	int max_data_size = desc_sz - sizeof (struct mthca_next_seg);
 
 	switch (qp->transport) {
 	case MLX:
@@ -915,11 +910,24 @@ static void mthca_adjust_qp_caps(struct 
 		break;
 	}
 
+	return max_data_size;
+}
+
+static inline int mthca_max_inline_data(struct mthca_pd *pd, int max_data_size)
+{
 	/* We don't support inline data for kernel QPs (yet). */
-	if (!pd->ibpd.uobject)
-		qp->max_inline_data = 0;
-        else
-		qp->max_inline_data = max_data_size - MTHCA_INLINE_HEADER_SIZE;
+	return pd->ibpd.uobject ? max_data_size - MTHCA_INLINE_HEADER_SIZE : 0;
+}
+
+static void mthca_adjust_qp_caps(struct mthca_dev *dev,
+				 struct mthca_pd *pd,
+				 struct mthca_qp *qp)
+{
+	int max_data_size = mthca_max_data_size(dev, qp,
+						min(dev->limits.max_desc_sz,
+						    1 << qp->sq.wqe_shift));
+
+	qp->max_inline_data = mthca_max_inline_data(pd, max_data_size);
 
 	qp->sq.max_gs = min_t(int, dev->limits.max_sg,
 			      max_data_size / sizeof (struct mthca_data_seg));
@@ -1186,13 +1194,23 @@ static int mthca_alloc_qp_common(struct 
 }
 
 static int mthca_set_qp_size(struct mthca_dev *dev, struct ib_qp_cap *cap,
-			     struct mthca_qp *qp)
+			     struct mthca_pd *pd, struct mthca_qp *qp)
 {
+	int max_data_size = mthca_max_data_size(dev, qp, dev->limits.max_desc_sz);
+
 	/* Sanity check QP size before proceeding */
-	if (cap->max_send_wr  > dev->limits.max_wqes ||
-	    cap->max_recv_wr  > dev->limits.max_wqes ||
-	    cap->max_send_sge > dev->limits.max_sg   ||
-	    cap->max_recv_sge > dev->limits.max_sg)
+	if (cap->max_send_wr  	 > dev->limits.max_wqes ||
+	    cap->max_recv_wr  	 > dev->limits.max_wqes ||
+	    cap->max_send_sge 	 > dev->limits.max_sg   ||
+	    cap->max_recv_sge 	 > dev->limits.max_sg   ||
+	    cap->max_inline_data > mthca_max_inline_data(pd, max_data_size))
+		return -EINVAL;
+
+	/*
+	 * For MLX transport we need 2 extra S/G entries:
+	 * one for the header and one for the checksum at the end
+	 */
+	if (qp->transport == MLX && cap->max_recv_sge + 2 > dev->limits.max_sg)
 		return -EINVAL;
 
 	if (mthca_is_memfree(dev)) {
@@ -1211,14 +1229,6 @@ static int mthca_set_qp_size(struct mthc
 				    MTHCA_INLINE_CHUNK_SIZE) /
 			      sizeof (struct mthca_data_seg));
 
-	/*
-	 * For MLX transport we need 2 extra S/G entries:
-	 * one for the header and one for the checksum at the end
-	 */
-	if ((qp->transport == MLX && qp->sq.max_gs + 2 > dev->limits.max_sg) ||
-	    qp->sq.max_gs > dev->limits.max_sg || qp->rq.max_gs > dev->limits.max_sg)
-		return -EINVAL;
-
 	return 0;
 }
 
@@ -1233,7 +1243,7 @@ int mthca_alloc_qp(struct mthca_dev *dev
 {
 	int err;
 
-	err = mthca_set_qp_size(dev, cap, qp);
+	err = mthca_set_qp_size(dev, cap, pd, qp);
 	if (err)
 		return err;
 
@@ -1276,7 +1286,7 @@ int mthca_alloc_sqp(struct mthca_dev *de
 	u32 mqpn = qpn * 2 + dev->qp_table.sqp_start + port - 1;
 	int err;
 
-	err = mthca_set_qp_size(dev, cap, &sqp->qp);
+	err = mthca_set_qp_size(dev, cap, pd, &sqp->qp);
 	if (err)
 		return err;
 

--

      parent reply	other threads:[~2006-02-27 22:39 UTC|newest]

Thread overview: 49+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2006-02-27 22:32 [patch 00/39] Chris Wright
2006-02-27 22:32 ` [patch 01/39] ppc32: Put cache flush routines back into .relocate_code section Chris Wright
2006-02-27 22:32 ` [patch 02/39] [PATCH] s390: add #ifdef __KERNEL__ to asm-s390/setup.h Chris Wright
2006-02-27 22:32 ` [patch 03/39] shmdt cannot detach not-alined shm segment cleanly Chris Wright
2006-02-27 22:32 ` [patch 04/39] [PATCH] [BRIDGE]: netfilter missing symbol has_bridge_parent Chris Wright
2006-02-28  2:38   ` Horms
2006-02-27 22:32 ` [patch 05/39] [PATCH] i386: Move phys_proc_id/early intel workaround to correct function Chris Wright
2006-02-27 22:32 ` [patch 06/39] [PATCH] hugetlbfs mmap ENOMEM failure Chris Wright
2006-02-27 22:32 ` [patch 07/39] [PATCH] reiserfs: disable automatic enabling of reiserfs inode attributes Chris Wright
2006-02-27 22:32 ` [patch 08/39] [NET]: Revert skb_copy_datagram_iovec() recursion elimination Chris Wright
2006-02-27 22:32 ` [patch 09/39] [IPV6]: Address autoconfiguration does not work after device down/up cycle Chris Wright
2006-02-27 22:32 ` [patch 10/39] [PATCH] i386/x86-64: Dont IPI to offline cpus on shutdown Chris Wright
2006-02-27 22:37   ` Andi Kleen
2006-02-27 23:18     ` Chris Wright
2006-02-28  7:02       ` Eric W. Biederman
2006-03-01 22:19         ` Chris Wright
2006-02-27 22:32 ` [patch 11/39] [PATCH] sys_signal: initialize ->sa_mask Chris Wright
2006-02-27 22:32 ` [patch 12/39] [PATCH] do_sigaction: cleanup ->sa_mask manipulation Chris Wright
2006-02-27 22:32 ` [patch 13/39] [PATCH] [IA64] sys32_signal() forgets to initialize ->sa_mask Chris Wright
2006-02-27 22:32 ` [patch 14/39] [PATCH] Fix s390 build failure Chris Wright
2006-02-27 22:32 ` [patch 15/39] [PATCH] [BRIDGE]: Fix deadlock in br_stp_disable_bridge Chris Wright
2006-02-27 22:32 ` [patch 16/39] [PATCH] fix zap_threads ptrace related problems Chris Wright
2006-02-27 22:32 ` [patch 17/39] [PATCH] fix deadlock in ext2 Chris Wright
2006-02-27 22:32 ` [patch 18/39] [PATCH] sys_mbind sanity checking Chris Wright
2006-03-02  4:10   ` Dave Jones
2006-03-02  6:07     ` [stable] " Chris Wright
2006-02-27 22:32 ` [patch 19/39] [PATCH] it87: Fix oops on removal Chris Wright
2006-02-27 22:32 ` [patch 20/39] [PATCH] hwmon it87: Probe i2c 0x2d only Chris Wright
2006-02-27 22:32 ` [patch 21/39] [PATCH] Fix snd-usb-audio in 32-bit compat environment Chris Wright
2006-02-27 22:32 ` [patch 22/39] [PATCH] alsa: fix bogus snd_device_free() in opl3-oss.c Chris Wright
2006-02-27 22:32 ` [patch 23/39] [PATCH] cfi: init wait queue in chip struct Chris Wright
2006-02-27 22:32 ` [patch 24/39] [PATCH] gbefb: Set default of FB_GBE_MEM to 4 MB Chris Wright
2006-02-27 22:32 ` [patch 25/39] [PATCH] dm: missing bdput/thaw_bdev at removal Chris Wright
2006-02-27 22:32 ` [patch 26/39] [PATCH] dm: free minor after unlink gendisk Chris Wright
2006-02-27 22:32 ` [patch 27/39] [PATCH] ramfs: update dir mtime and ctime Chris Wright
2006-02-27 22:32 ` [patch 28/39] [PATCH] gbefb: IP32 gbefb depth change fix Chris Wright
2006-02-27 22:32 ` [patch 29/39] [PATCH] skge: speed setting Chris Wright
2006-02-27 22:32 ` [patch 30/39] [PATCH] skge: fix NAPI/irq race Chris Wright
2006-02-27 22:32 ` [patch 31/39] [PATCH] skge: genesis phy initialization fix Chris Wright
2006-02-27 22:32 ` [patch 32/39] [PATCH] skge: fix SMP race Chris Wright
2006-02-27 22:32 ` [patch 33/39] [PATCH] x86_64: Check for bad elf entry address Chris Wright
2006-02-27 22:32 ` [patch 34/39] [NETLINK]: Fix a severe bug Chris Wright
2006-02-27 22:32 ` [patch 35/39] [PATCH] sd: fix memory corruption with broken mode page headers Chris Wright
2006-02-27 22:32 ` [patch 36/39] [PATCH] sbp2: fix another deadlock after disconnection Chris Wright
2006-02-27 22:32 ` [patch 37/39] [PATCH] XFS ftruncate() bug could expose stale data (CVE-2006-0554) Chris Wright
2006-02-27 22:32 ` [patch 38/39] Normal user can panic NFS client with direct I/O (CVE-2006-0555) Chris Wright
2006-03-02  4:33   ` Dave Jones
2006-03-02  7:25     ` [stable] " Chris Wright
2006-02-27 22:32 ` Chris Wright [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20060227223408.822215000@sorel.sous-sol.org \
    --to=chrisw@sous-sol.org \
    --cc=akpm@osdl.org \
    --cc=alan@lxorguk.ukuu.org.uk \
    --cc=chuckw@quantumlinux.com \
    --cc=davej@redhat.com \
    --cc=jackm@mellanox.co.il \
    --cc=jmforbes@linuxtx.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mst@mellanox.co.il \
    --cc=rdreier@cisco.com \
    --cc=rdunlap@xenotime.net \
    --cc=rolandd@cisco.com \
    --cc=stable@kernel.org \
    --cc=torvalds@osdl.org \
    --cc=tytso@mit.edu \
    --cc=zwane@arm.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®