Merge branch 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband

* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband:
  IB/cm: Improve local id allocation
  IPoIB/cm: Fix SRQ WR leak
  IB/ipoib: Fix typos in error messages
  IB/mlx4: Check if SRQ is full when posting receive
  IB/mlx4: Pass send queue sizes from userspace to kernel
  IB/mlx4: Fix check of opcode in mlx4_ib_post_send()
  mlx4_core: Fix array overrun in dump_dev_cap_flags()
  IB/mlx4: Fix RESET to RESET and RESET to ERROR transitions
  IB/mthca: Fix RESET to ERROR transition
  IB/mlx4: Set GRH:HopLimit when sending globally routed MADs
  IB/mthca: Set GRH:HopLimit when building MLX headers
  IB/mlx4: Fix check of max_qp_dest_rdma in modify QP
  IB/mthca: Fix use-after-free on device restart
  IB/ehca: Return proper error code if register_mr fails
  IPoIB: Handle P_Key table reordering
  IB/core: Use start_port() and end_port()
  IB/core: Add helpers for uncached GID and P_Key searches
  IB/ipath: Fix potential deadlock with multicast spinlocks
  IB/core: Free umem when mm is already gone

1 files changed, 129 insertions, 52 deletions

diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 5cd706908450..a824bc5f79fd 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -188,14 +188,32 @@ static int send_wqe_overhead(enum ib_qp_type type)
         }
 }
 
-static int set_qp_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
-                       enum ib_qp_type type, struct mlx4_ib_qp *qp)
+static int set_rq_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
+                       struct mlx4_ib_qp *qp)
 {
-        /* Sanity check QP size before proceeding */
+        /* Sanity check RQ size before proceeding */
+        if (cap->max_recv_wr  > dev->dev->caps.max_wqes  ||
+            cap->max_recv_sge > dev->dev->caps.max_rq_sg)
+                return -EINVAL;
+
+        qp->rq.max = cap->max_recv_wr ? roundup_pow_of_two(cap->max_recv_wr) : 0;
+
+        qp->rq.wqe_shift = ilog2(roundup_pow_of_two(cap->max_recv_sge *
+                                                    sizeof (struct mlx4_wqe_data_seg)));
+        qp->rq.max_gs    = (1 << qp->rq.wqe_shift) / sizeof (struct mlx4_wqe_data_seg);
+
+        cap->max_recv_wr  = qp->rq.max;
+        cap->max_recv_sge = qp->rq.max_gs;
+
+        return 0;
+}
+
+static int set_kernel_sq_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
+                              enum ib_qp_type type, struct mlx4_ib_qp *qp)
+{
+        /* Sanity check SQ size before proceeding */
         if (cap->max_send_wr     > dev->dev->caps.max_wqes  ||
-            cap->max_recv_wr     > dev->dev->caps.max_wqes  ||
             cap->max_send_sge    > dev->dev->caps.max_sq_sg ||
-            cap->max_recv_sge    > dev->dev->caps.max_rq_sg ||
             cap->max_inline_data + send_wqe_overhead(type) +
             sizeof (struct mlx4_wqe_inline_seg) > dev->dev->caps.max_sq_desc_sz)
                 return -EINVAL;
@@ -208,12 +226,7 @@ static int set_qp_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
             cap->max_send_sge + 2 > dev->dev->caps.max_sq_sg)
                 return -EINVAL;
 
-        qp->rq.max = cap->max_recv_wr ? roundup_pow_of_two(cap->max_recv_wr) : 0;
-        qp->sq.max = cap->max_send_wr ? roundup_pow_of_two(cap->max_send_wr) : 0;
-
-        qp->rq.wqe_shift = ilog2(roundup_pow_of_two(cap->max_recv_sge *
-                                                    sizeof (struct mlx4_wqe_data_seg)));
-        qp->rq.max_gs    = (1 << qp->rq.wqe_shift) / sizeof (struct mlx4_wqe_data_seg);
+        qp->sq.max = cap->max_send_wr ? roundup_pow_of_two(cap->max_send_wr) : 1;
 
         qp->sq.wqe_shift = ilog2(roundup_pow_of_two(max(cap->max_send_sge *
                                                         sizeof (struct mlx4_wqe_data_seg),
@@ -233,16 +246,26 @@ static int set_qp_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
                 qp->sq.offset = 0;
         }
 
-        cap->max_send_wr  = qp->sq.max;
-        cap->max_recv_wr  = qp->rq.max;
-        cap->max_send_sge = qp->sq.max_gs;
-        cap->max_recv_sge = qp->rq.max_gs;
+        cap->max_send_wr     = qp->sq.max;
+        cap->max_send_sge    = qp->sq.max_gs;
         cap->max_inline_data = (1 << qp->sq.wqe_shift) - send_wqe_overhead(type) -
                 sizeof (struct mlx4_wqe_inline_seg);
 
         return 0;
 }
 
+static int set_user_sq_size(struct mlx4_ib_qp *qp,
+                            struct mlx4_ib_create_qp *ucmd)
+{
+        qp->sq.max       = 1 << ucmd->log_sq_bb_count;
+        qp->sq.wqe_shift = ucmd->log_sq_stride;
+
+        qp->buf_size = (qp->rq.max << qp->rq.wqe_shift) +
+                (qp->sq.max << qp->sq.wqe_shift);
+
+        return 0;
+}
+
 static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
                             struct ib_qp_init_attr *init_attr,
                             struct ib_udata *udata, int sqpn, struct mlx4_ib_qp *qp)
@@ -264,7 +287,7 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
         qp->sq.head         = 0;
         qp->sq.tail         = 0;
 
-        err = set_qp_size(dev, &init_attr->cap, init_attr->qp_type, qp);
+        err = set_rq_size(dev, &init_attr->cap, qp);
         if (err)
                 goto err;
 
@@ -276,6 +299,10 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
                         goto err;
                 }
 
+                err = set_user_sq_size(qp, &ucmd);
+                if (err)
+                        goto err;
+
                 qp->umem = ib_umem_get(pd->uobject->context, ucmd.buf_addr,
                                        qp->buf_size, 0);
                 if (IS_ERR(qp->umem)) {
@@ -297,6 +324,10 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
                 if (err)
                         goto err_mtt;
         } else {
+                err = set_kernel_sq_size(dev, &init_attr->cap, init_attr->qp_type, qp);
+                if (err)
+                        goto err;
+
                 err = mlx4_ib_db_alloc(dev, &qp->db, 0);
                 if (err)
                         goto err;
@@ -573,7 +604,7 @@ static int to_mlx4_st(enum ib_qp_type type)
         }
 }
 
-static __be32 to_mlx4_access_flags(struct mlx4_ib_qp *qp, struct ib_qp_attr *attr,
+static __be32 to_mlx4_access_flags(struct mlx4_ib_qp *qp, const struct ib_qp_attr *attr,
                                    int attr_mask)
 {
         u8 dest_rd_atomic;
@@ -603,7 +634,7 @@ static __be32 to_mlx4_access_flags(struct mlx4_ib_qp *qp, struct ib_qp_attr *att
         return cpu_to_be32(hw_access_flags);
 }
 
-static void store_sqp_attrs(struct mlx4_ib_sqp *sqp, struct ib_qp_attr *attr,
+static void store_sqp_attrs(struct mlx4_ib_sqp *sqp, const struct ib_qp_attr *attr,
                             int attr_mask)
 {
         if (attr_mask & IB_QP_PKEY_INDEX)
@@ -619,7 +650,7 @@ static void mlx4_set_sched(struct mlx4_qp_path *path, u8 port)
         path->sched_queue = (path->sched_queue & 0xbf) | ((port - 1) << 6);
 }
 
-static int mlx4_set_path(struct mlx4_ib_dev *dev, struct ib_ah_attr *ah,
+static int mlx4_set_path(struct mlx4_ib_dev *dev, const struct ib_ah_attr *ah,
                          struct mlx4_qp_path *path, u8 port)
 {
         path->grh_mylmc     = ah->src_path_bits & 0x7f;
@@ -655,14 +686,14 @@ static int mlx4_set_path(struct mlx4_ib_dev *dev, struct ib_ah_attr *ah,
         return 0;
 }
 
-int mlx4_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
-                      int attr_mask, struct ib_udata *udata)
+static int __mlx4_ib_modify_qp(struct ib_qp *ibqp,
+                               const struct ib_qp_attr *attr, int attr_mask,
+                               enum ib_qp_state cur_state, enum ib_qp_state new_state)
 {
         struct mlx4_ib_dev *dev = to_mdev(ibqp->device);
         struct mlx4_ib_qp *qp = to_mqp(ibqp);
         struct mlx4_qp_context *context;
         enum mlx4_qp_optpar optpar = 0;
-        enum ib_qp_state cur_state, new_state;
         int sqd_event;
         int err = -EINVAL;
 
@@ -670,34 +701,6 @@ int mlx4_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
         if (!context)
                 return -ENOMEM;
 
-        mutex_lock(&qp->mutex);
-
-        cur_state = attr_mask & IB_QP_CUR_STATE ? attr->cur_qp_state : qp->state;
-        new_state = attr_mask & IB_QP_STATE ? attr->qp_state : cur_state;
-
-        if (!ib_modify_qp_is_ok(cur_state, new_state, ibqp->qp_type, attr_mask))
-                goto out;
-
-        if ((attr_mask & IB_QP_PKEY_INDEX) &&
-             attr->pkey_index >= dev->dev->caps.pkey_table_len) {
-                goto out;
-        }
-
-        if ((attr_mask & IB_QP_PORT) &&
-            (attr->port_num == 0 || attr->port_num > dev->dev->caps.num_ports)) {
-                goto out;
-        }
-
-        if (attr_mask & IB_QP_MAX_QP_RD_ATOMIC &&
-            attr->max_rd_atomic > dev->dev->caps.max_qp_init_rdma) {
-                goto out;
-        }
-
-        if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC &&
-            attr->max_dest_rd_atomic > 1 << dev->dev->caps.max_qp_dest_rdma) {
-                goto out;
-        }
-
         context->flags = cpu_to_be32((to_mlx4_state(new_state) << 28) |
                                      (to_mlx4_st(ibqp->qp_type) << 16));
         context->flags     |= cpu_to_be32(1 << 8); /* DE? */
@@ -920,11 +923,84 @@ int mlx4_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
         }
 
 out:
-        mutex_unlock(&qp->mutex);
         kfree(context);
         return err;
 }
 
+static const struct ib_qp_attr mlx4_ib_qp_attr = { .port_num = 1 };
+static const int mlx4_ib_qp_attr_mask_table[IB_QPT_UD + 1] = {
+                [IB_QPT_UD]  = (IB_QP_PKEY_INDEX                |
+                                IB_QP_PORT                      |
+                                IB_QP_QKEY),
+                [IB_QPT_UC]  = (IB_QP_PKEY_INDEX                |
+                                IB_QP_PORT                      |
+                                IB_QP_ACCESS_FLAGS),
+                [IB_QPT_RC]  = (IB_QP_PKEY_INDEX                |
+                                IB_QP_PORT                      |
+                                IB_QP_ACCESS_FLAGS),
+                [IB_QPT_SMI] = (IB_QP_PKEY_INDEX                |
+                                IB_QP_QKEY),
+                [IB_QPT_GSI] = (IB_QP_PKEY_INDEX                |
+                                IB_QP_QKEY),
+};
+
+int mlx4_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+                      int attr_mask, struct ib_udata *udata)
+{
+        struct mlx4_ib_dev *dev = to_mdev(ibqp->device);
+        struct mlx4_ib_qp *qp = to_mqp(ibqp);
+        enum ib_qp_state cur_state, new_state;
+        int err = -EINVAL;
+
+        mutex_lock(&qp->mutex);
+
+        cur_state = attr_mask & IB_QP_CUR_STATE ? attr->cur_qp_state : qp->state;
+        new_state = attr_mask & IB_QP_STATE ? attr->qp_state : cur_state;
+
+        if (!ib_modify_qp_is_ok(cur_state, new_state, ibqp->qp_type, attr_mask))
+                goto out;
+
+        if ((attr_mask & IB_QP_PKEY_INDEX) &&
+             attr->pkey_index >= dev->dev->caps.pkey_table_len) {
+                goto out;
+        }
+
+        if ((attr_mask & IB_QP_PORT) &&
+            (attr->port_num == 0 || attr->port_num > dev->dev->caps.num_ports)) {
+                goto out;
+        }
+
+        if (attr_mask & IB_QP_MAX_QP_RD_ATOMIC &&
+            attr->max_rd_atomic > dev->dev->caps.max_qp_init_rdma) {
+                goto out;
+        }
+
+        if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC &&
+            attr->max_dest_rd_atomic > dev->dev->caps.max_qp_dest_rdma) {
+                goto out;
+        }
+
+        if (cur_state == new_state && cur_state == IB_QPS_RESET) {
+                err = 0;
+                goto out;
+        }
+
+        if (cur_state == IB_QPS_RESET && new_state == IB_QPS_ERR) {
+                err = __mlx4_ib_modify_qp(ibqp, &mlx4_ib_qp_attr,
+                                          mlx4_ib_qp_attr_mask_table[ibqp->qp_type],
+                                          IB_QPS_RESET, IB_QPS_INIT);
+                if (err)
+                        goto out;
+                cur_state = IB_QPS_INIT;
+        }
+
+        err = __mlx4_ib_modify_qp(ibqp, attr, attr_mask, cur_state, new_state);
+
+out:
+        mutex_unlock(&qp->mutex);
+        return err;
+}
+
 static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_send_wr *wr,
                             void *wqe)
 {
@@ -952,6 +1028,7 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_send_wr *wr,
                         (be32_to_cpu(ah->av.sl_tclass_flowlabel) >> 20) & 0xff;
                 sqp->ud_header.grh.flow_label    =
                         ah->av.sl_tclass_flowlabel & cpu_to_be32(0xfffff);
+                sqp->ud_header.grh.hop_limit     = ah->av.hop_limit;
                 ib_get_cached_gid(ib_dev, be32_to_cpu(ah->av.port_pd) >> 24,
                                   ah->av.gid_index, &sqp->ud_header.grh.source_gid);
                 memcpy(sqp->ud_header.grh.destination_gid.raw,
@@ -1192,7 +1269,7 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                  */
                 wmb();
 
-                if (wr->opcode < 0 || wr->opcode > ARRAY_SIZE(mlx4_ib_opcode)) {
+                if (wr->opcode < 0 || wr->opcode >= ARRAY_SIZE(mlx4_ib_opcode)) {
                         err = -EINVAL;
                         goto out;
                 }