3 files changed, 34 insertions, 8 deletions

diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 5cef8f87b96b..7522008fda86 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -2,6 +2,7 @@
  * Copyright (c) 2004-2007 Voltaire, Inc. All rights reserved.
  * Copyright (c) 2005 Intel Corporation.  All rights reserved.
  * Copyright (c) 2005 Mellanox Technologies Ltd.  All rights reserved.
+ * Copyright (c) 2009 HNR Consulting. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -45,6 +46,14 @@ MODULE_DESCRIPTION("kernel IB MAD API");
 MODULE_AUTHOR("Hal Rosenstock");
 MODULE_AUTHOR("Sean Hefty");
 
+int mad_sendq_size = IB_MAD_QP_SEND_SIZE;
+int mad_recvq_size = IB_MAD_QP_RECV_SIZE;
+
+module_param_named(send_queue_size, mad_sendq_size, int, 0444);
+MODULE_PARM_DESC(send_queue_size, "Size of send queue in number of work requests");
+module_param_named(recv_queue_size, mad_recvq_size, int, 0444);
+MODULE_PARM_DESC(recv_queue_size, "Size of receive queue in number of work requests");
+
 static struct kmem_cache *ib_mad_cache;
 
 static struct list_head ib_mad_port_list;
@@ -1973,7 +1982,7 @@ static void adjust_timeout(struct ib_mad_agent_private *mad_agent_priv)
         unsigned long delay;
 
         if (list_empty(&mad_agent_priv->wait_list)) {
-                cancel_delayed_work(&mad_agent_priv->timed_work);
+                __cancel_delayed_work(&mad_agent_priv->timed_work);
         } else {
                 mad_send_wr = list_entry(mad_agent_priv->wait_list.next,
                                          struct ib_mad_send_wr_private,
@@ -1982,7 +1991,7 @@ static void adjust_timeout(struct ib_mad_agent_private *mad_agent_priv)
                 if (time_after(mad_agent_priv->timeout,
                                mad_send_wr->timeout)) {
                         mad_agent_priv->timeout = mad_send_wr->timeout;
-                        cancel_delayed_work(&mad_agent_priv->timed_work);
+                        __cancel_delayed_work(&mad_agent_priv->timed_work);
                         delay = mad_send_wr->timeout - jiffies;
                         if ((long)delay <= 0)
                                 delay = 1;
@@ -2022,7 +2031,7 @@ static void wait_for_response(struct ib_mad_send_wr_private *mad_send_wr)
 
         /* Reschedule a work item if we have a shorter timeout */
         if (mad_agent_priv->wait_list.next == &mad_send_wr->agent_list) {
-                cancel_delayed_work(&mad_agent_priv->timed_work);
+                __cancel_delayed_work(&mad_agent_priv->timed_work);
                 queue_delayed_work(mad_agent_priv->qp_info->port_priv->wq,
                                    &mad_agent_priv->timed_work, delay);
         }
@@ -2735,8 +2744,8 @@ static int create_mad_qp(struct ib_mad_qp_info *qp_info,
         qp_init_attr.send_cq = qp_info->port_priv->cq;
         qp_init_attr.recv_cq = qp_info->port_priv->cq;
         qp_init_attr.sq_sig_type = IB_SIGNAL_ALL_WR;
-        qp_init_attr.cap.max_send_wr = IB_MAD_QP_SEND_SIZE;
-        qp_init_attr.cap.max_recv_wr = IB_MAD_QP_RECV_SIZE;
+        qp_init_attr.cap.max_send_wr = mad_sendq_size;
+        qp_init_attr.cap.max_recv_wr = mad_recvq_size;
         qp_init_attr.cap.max_send_sge = IB_MAD_SEND_REQ_MAX_SG;
         qp_init_attr.cap.max_recv_sge = IB_MAD_RECV_REQ_MAX_SG;
         qp_init_attr.qp_type = qp_type;
@@ -2751,8 +2760,8 @@ static int create_mad_qp(struct ib_mad_qp_info *qp_info,
                 goto error;
         }
         /* Use minimum queue sizes unless the CQ is resized */
-        qp_info->send_queue.max_active = IB_MAD_QP_SEND_SIZE;
-        qp_info->recv_queue.max_active = IB_MAD_QP_RECV_SIZE;
+        qp_info->send_queue.max_active = mad_sendq_size;
+        qp_info->recv_queue.max_active = mad_recvq_size;
         return 0;
 
 error:
@@ -2791,7 +2800,7 @@ static int ib_mad_port_open(struct ib_device *device,
         init_mad_qp(port_priv, &port_priv->qp_info[0]);
         init_mad_qp(port_priv, &port_priv->qp_info[1]);
 
-        cq_size = (IB_MAD_QP_SEND_SIZE + IB_MAD_QP_RECV_SIZE) * 2;
+        cq_size = (mad_sendq_size + mad_recvq_size) * 2;
         port_priv->cq = ib_create_cq(port_priv->device,
                                      ib_mad_thread_completion_handler,
                                      NULL, port_priv, cq_size, 0);
@@ -2983,6 +2992,12 @@ static int __init ib_mad_init_module(void)
 {
         int ret;
 
+        mad_recvq_size = min(mad_recvq_size, IB_MAD_QP_MAX_SIZE);
+        mad_recvq_size = max(mad_recvq_size, IB_MAD_QP_MIN_SIZE);
+
+        mad_sendq_size = min(mad_sendq_size, IB_MAD_QP_MAX_SIZE);
+        mad_sendq_size = max(mad_sendq_size, IB_MAD_QP_MIN_SIZE);
+
         ib_mad_cache = kmem_cache_create("ib_mad",
                                          sizeof(struct ib_mad_private),
                                          0,
diff --git a/drivers/infiniband/core/mad_priv.h b/drivers/infiniband/core/mad_priv.h
index 05ce331733b0..9430ab4969c5 100644
--- a/drivers/infiniband/core/mad_priv.h
+++ b/drivers/infiniband/core/mad_priv.h
@@ -2,6 +2,7 @@
  * Copyright (c) 2004, 2005, Voltaire, Inc. All rights reserved.
  * Copyright (c) 2005 Intel Corporation. All rights reserved.
  * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
+ * Copyright (c) 2009 HNR Consulting. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -49,6 +50,8 @@
 /* QP and CQ parameters */
 #define IB_MAD_QP_SEND_SIZE     128
 #define IB_MAD_QP_RECV_SIZE     512
+#define IB_MAD_QP_MIN_SIZE      64
+#define IB_MAD_QP_MAX_SIZE      8192
 #define IB_MAD_SEND_REQ_MAX_SG  2
 #define IB_MAD_RECV_REQ_MAX_SG  1
 
diff --git a/drivers/infiniband/core/smi.c b/drivers/infiniband/core/smi.c
index 87236753bce9..5855e4405d9b 100644
--- a/drivers/infiniband/core/smi.c
+++ b/drivers/infiniband/core/smi.c
@@ -52,6 +52,10 @@ enum smi_action smi_handle_dr_smp_send(struct ib_smp *smp,
         hop_cnt = smp->hop_cnt;
 
         /* See section 14.2.2.2, Vol 1 IB spec */
+        /* C14-6 -- valid hop_cnt values are from 0 to 63 */
+        if (hop_cnt >= IB_SMP_MAX_PATH_HOPS)
+                return IB_SMI_DISCARD;
+
         if (!ib_get_smp_direction(smp)) {
                 /* C14-9:1 */
                 if (hop_cnt && hop_ptr == 0) {
@@ -133,6 +137,10 @@ enum smi_action smi_handle_dr_smp_recv(struct ib_smp *smp, u8 node_type,
         hop_cnt = smp->hop_cnt;
 
         /* See section 14.2.2.2, Vol 1 IB spec */
+        /* C14-6 -- valid hop_cnt values are from 0 to 63 */
+        if (hop_cnt >= IB_SMP_MAX_PATH_HOPS)
+                return IB_SMI_DISCARD;
+
         if (!ib_get_smp_direction(smp)) {
                 /* C14-9:1 -- sender should have incremented hop_ptr */
                 if (hop_cnt && hop_ptr == 0)