Mellanox ConnectX-3/ConnectX-4 fixes for 4.10

Hi Doug,

Please find below four different fixes to ConnectX-3/ConnectX-4.

This patchset was generated against v4.9-rc6 and targeted for 4.10.

Available in the "topic/mlx-fixes-4.10" topic branch of this git repo:
git://git.kernel.org/pub/scm/linux/kernel/git/leon/linux-rdma.git

Or for browsing:
https://git.kernel.org/cgit/linux/kernel/git/leon/linux-rdma.git/log/?h=topic/mlx-fixes-4.10

Thanks

Eli Cohen (1):
IB/mlx5: Avoid system crash when enabling many VFs

Jack Morgenstein (1):
IB/mlx4: Fix out-of-range array index in destroy qp flow

Maor Gottlieb (2):
IB/mlx5: Assign SRQ type earlier
IB/mlx5: Use u64 for UMR length

 drivers/infiniband/hw/mlx4/qp.c      | 3 ++-
 drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +-
 drivers/infiniband/hw/mlx5/mr.c      | 3 ++-
 drivers/infiniband/hw/mlx5/srq.c     | 2 +-
 4 files changed, 6 insertions(+), 4 deletions(-)

--
2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

From: Jack Morgenstein <[email protected]>

For non-special QPs, the port value becomes non-zero only at the RESET-to-INIT transition. If the QP has not undergone that transition, its port number value is still zero.

If such a QP is destroyed before being moved out of the RESET state, subtracting one from the qp port number results in a negative value. Using that negative value as an index into the qp1_proxy array results in an out-of-bounds array reference.

Fix this by testing that the QP type is one that uses qp1_proxy before using the port number. For special QPs of all types, the port number is specified at QP creation time.

---
 drivers/infiniband/hw/mlx4/qp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 570bc86..6973947 100644
@@ -1280,7 +1280,8 @@ static int _mlx4_ib_destroy_qp(struct ib_qp *qp)
 	if (is_qp0(dev, mqp))
 		mlx4_CLOSE_PORT(dev->dev, mqp->port);
 
-	if (dev->qp1_proxy[mqp->port - 1] == mqp) {
+	if (mqp->mlx4_ib_qp_type == MLX4_IB_QPT_PROXY_GSI &&
+	    dev->qp1_proxy[mqp->port - 1] == mqp) {
 		mutex_lock(&dev->qp1_proxy_lock[mqp->port - 1]);
 		dev->qp1_proxy[mqp->port - 1] = NULL;
 		mutex_unlock(&dev->qp1_proxy_lock[mqp->port - 1]);

2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Hello Leon,

Commit ID 9433c188915c refers to a patch that was merged in kernel version v3.15. Shouldn't a "Cc: stable" tag be added to this patch and also to the other patches in this series?

Bart.
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

I'm extra cautions with stable tags and prefer to finalize my stable checker in my submissions scripts first, before adding it manually and I have plans to use it next kernel release.

Thanks

Hello Leon,

Thanks for explaining your workflow. However, the question remains whether or not stable tags should be added to the patches in this series?

Bart.
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

It can be added but I don't see any real advantage of it. Do you know about real users who run RDMA stack from stable trees and don't rely on distro kernel and/or OFED?

Hello Leon,

Many users who build an iSER or SRP storage target themselves use a recent stable kernel without OFED.

Bart.

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

Hello Bart,

I'll take into account these users in my future submissions. Meanwhile this series can be easily picked by various automatic scripts which stable maintainers are running.

Thanks.

From: Maor Gottlieb <maorg-VPRAkNaXOzVWk0Htik3J/[email protected]>

Move the SRQ type assignment to be before actually using it in create_srq_user() and in create_srq_kernel() functions.

---
 drivers/infiniband/hw/mlx5/srq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 3857dbd..729b069 100644
@@ -282,6 +282,7 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
 	mlx5_ib_dbg(dev, "desc_size 0x%x, req wr 0x%x, srq size 0x%x, max_gs 0x%x, max_avail_gather 0x%x\n",
 		    desc_size, init_attr->attr.max_wr, srq->msrq.max, srq->msrq.max_gs,
 		    srq->msrq.max_avail_gather);
+	in.type = init_attr->srq_type;
 
 	if (pd->uobject)
 		err = create_srq_user(pd, srq, &in, udata, buf_size);

@@ -294,7 +295,6 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
 		goto err_srq;
 	}
 
-	in.type = init_attr->srq_type;
 	in.log_size = ilog2(srq->msrq.max);
 	in.wqe_shift = srq->msrq.wqe_shift - 4;
 	if (srq->wq_sig)

2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

From: Eli Cohen <eli-VPRAkNaXOzVWk0Htik3J/[email protected]>

When enabling many VFs, the total amount of DMA mappings increase significantly. This causes DMA allocations to take a lot of time since they are serialized in the kernel.

As a result the driver enters into fatal condition due to timeout and the system hangs. To recover from this we disable MR cache for VFs.

PFs will still have a full cache and VFs cache can be manipulated as usual after driver load.

---
 drivers/infiniband/hw/mlx5/mr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 4e90124..501af9e 100644
@@ -628,7 +628,8 @@ int mlx5_mr_cache_init(struct mlx5_ib_dev *dev)
 		ent->order = i + 2;
 		ent->dev = dev;
 
-		if (dev->mdev->profile->mask & MLX5_PROF_MASK_MR_CACHE)
+		if ((dev->mdev->profile->mask & MLX5_PROF_MASK_MR_CACHE) &&
+		    (mlx5_core_is_pf(dev->mdev)))
 			limit = dev->mdev->profile->mr_cache[i].limit;
 		else
 			limit = 0;

2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

From: Maor Gottlieb <maorg-VPRAkNaXOzVWk0Htik3J/[email protected]>

The fast_registration length is used to convey length for memory registrations through UMR which can be of any size up to 2^64.

Change the length type to be u64.

---
 drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 7d68990..0b938ad 100644
@@ -418,7 +418,7 @@ struct mlx5_umr_wr {
 	struct ib_pd		       *pd;
 	unsigned int			page_shift;
 	unsigned int			npages;
-	u32				length;
+	u64				length;
 	int				access_flags;
 	u32				mkey;
 };

2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Series applied, thanks.

Doug Ledford <[email protected]>
    GPG Key ID: 0E572FDD