IB/mlx4: Avoid null pointer dereference in mlx4_ib_scan_netdevs()
[deliverable/linux.git] / drivers / infiniband / hw / mlx4 / mr.c
1 /*
2 * Copyright (c) 2007 Cisco Systems, Inc. All rights reserved.
3 * Copyright (c) 2007, 2008 Mellanox Technologies. All rights reserved.
4 *
5 * This software is available to you under a choice of one of two
6 * licenses. You may choose to be licensed under the terms of the GNU
7 * General Public License (GPL) Version 2, available from the file
8 * COPYING in the main directory of this source tree, or the
9 * OpenIB.org BSD license below:
10 *
11 * Redistribution and use in source and binary forms, with or
12 * without modification, are permitted provided that the following
13 * conditions are met:
14 *
15 * - Redistributions of source code must retain the above
16 * copyright notice, this list of conditions and the following
17 * disclaimer.
18 *
19 * - Redistributions in binary form must reproduce the above
20 * copyright notice, this list of conditions and the following
21 * disclaimer in the documentation and/or other materials
22 * provided with the distribution.
23 *
24 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
25 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
26 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
27 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
28 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
29 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
30 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
31 * SOFTWARE.
32 */
33
34 #include <linux/slab.h>
35
36 #include "mlx4_ib.h"
37
38 static u32 convert_access(int acc)
39 {
40 return (acc & IB_ACCESS_REMOTE_ATOMIC ? MLX4_PERM_ATOMIC : 0) |
41 (acc & IB_ACCESS_REMOTE_WRITE ? MLX4_PERM_REMOTE_WRITE : 0) |
42 (acc & IB_ACCESS_REMOTE_READ ? MLX4_PERM_REMOTE_READ : 0) |
43 (acc & IB_ACCESS_LOCAL_WRITE ? MLX4_PERM_LOCAL_WRITE : 0) |
44 (acc & IB_ACCESS_MW_BIND ? MLX4_PERM_BIND_MW : 0) |
45 MLX4_PERM_LOCAL_READ;
46 }
47
48 static enum mlx4_mw_type to_mlx4_type(enum ib_mw_type type)
49 {
50 switch (type) {
51 case IB_MW_TYPE_1: return MLX4_MW_TYPE_1;
52 case IB_MW_TYPE_2: return MLX4_MW_TYPE_2;
53 default: return -1;
54 }
55 }
56
57 struct ib_mr *mlx4_ib_get_dma_mr(struct ib_pd *pd, int acc)
58 {
59 struct mlx4_ib_mr *mr;
60 int err;
61
62 mr = kmalloc(sizeof *mr, GFP_KERNEL);
63 if (!mr)
64 return ERR_PTR(-ENOMEM);
65
66 err = mlx4_mr_alloc(to_mdev(pd->device)->dev, to_mpd(pd)->pdn, 0,
67 ~0ull, convert_access(acc), 0, 0, &mr->mmr);
68 if (err)
69 goto err_free;
70
71 err = mlx4_mr_enable(to_mdev(pd->device)->dev, &mr->mmr);
72 if (err)
73 goto err_mr;
74
75 mr->ibmr.rkey = mr->ibmr.lkey = mr->mmr.key;
76 mr->umem = NULL;
77
78 return &mr->ibmr;
79
80 err_mr:
81 (void) mlx4_mr_free(to_mdev(pd->device)->dev, &mr->mmr);
82
83 err_free:
84 kfree(mr);
85
86 return ERR_PTR(err);
87 }
88
89 int mlx4_ib_umem_write_mtt(struct mlx4_ib_dev *dev, struct mlx4_mtt *mtt,
90 struct ib_umem *umem)
91 {
92 u64 *pages;
93 int i, k, entry;
94 int n;
95 int len;
96 int err = 0;
97 struct scatterlist *sg;
98
99 pages = (u64 *) __get_free_page(GFP_KERNEL);
100 if (!pages)
101 return -ENOMEM;
102
103 i = n = 0;
104
105 for_each_sg(umem->sg_head.sgl, sg, umem->nmap, entry) {
106 len = sg_dma_len(sg) >> mtt->page_shift;
107 for (k = 0; k < len; ++k) {
108 pages[i++] = sg_dma_address(sg) +
109 umem->page_size * k;
110 /*
111 * Be friendly to mlx4_write_mtt() and
112 * pass it chunks of appropriate size.
113 */
114 if (i == PAGE_SIZE / sizeof (u64)) {
115 err = mlx4_write_mtt(dev->dev, mtt, n,
116 i, pages);
117 if (err)
118 goto out;
119 n += i;
120 i = 0;
121 }
122 }
123 }
124
125 if (i)
126 err = mlx4_write_mtt(dev->dev, mtt, n, i, pages);
127
128 out:
129 free_page((unsigned long) pages);
130 return err;
131 }
132
133 struct ib_mr *mlx4_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
134 u64 virt_addr, int access_flags,
135 struct ib_udata *udata)
136 {
137 struct mlx4_ib_dev *dev = to_mdev(pd->device);
138 struct mlx4_ib_mr *mr;
139 int shift;
140 int err;
141 int n;
142
143 mr = kmalloc(sizeof *mr, GFP_KERNEL);
144 if (!mr)
145 return ERR_PTR(-ENOMEM);
146
147 /* Force registering the memory as writable. */
148 /* Used for memory re-registeration. HCA protects the access */
149 mr->umem = ib_umem_get(pd->uobject->context, start, length,
150 access_flags | IB_ACCESS_LOCAL_WRITE, 0);
151 if (IS_ERR(mr->umem)) {
152 err = PTR_ERR(mr->umem);
153 goto err_free;
154 }
155
156 n = ib_umem_page_count(mr->umem);
157 shift = ilog2(mr->umem->page_size);
158
159 err = mlx4_mr_alloc(dev->dev, to_mpd(pd)->pdn, virt_addr, length,
160 convert_access(access_flags), n, shift, &mr->mmr);
161 if (err)
162 goto err_umem;
163
164 err = mlx4_ib_umem_write_mtt(dev, &mr->mmr.mtt, mr->umem);
165 if (err)
166 goto err_mr;
167
168 err = mlx4_mr_enable(dev->dev, &mr->mmr);
169 if (err)
170 goto err_mr;
171
172 mr->ibmr.rkey = mr->ibmr.lkey = mr->mmr.key;
173
174 return &mr->ibmr;
175
176 err_mr:
177 (void) mlx4_mr_free(to_mdev(pd->device)->dev, &mr->mmr);
178
179 err_umem:
180 ib_umem_release(mr->umem);
181
182 err_free:
183 kfree(mr);
184
185 return ERR_PTR(err);
186 }
187
188 int mlx4_ib_rereg_user_mr(struct ib_mr *mr, int flags,
189 u64 start, u64 length, u64 virt_addr,
190 int mr_access_flags, struct ib_pd *pd,
191 struct ib_udata *udata)
192 {
193 struct mlx4_ib_dev *dev = to_mdev(mr->device);
194 struct mlx4_ib_mr *mmr = to_mmr(mr);
195 struct mlx4_mpt_entry *mpt_entry;
196 struct mlx4_mpt_entry **pmpt_entry = &mpt_entry;
197 int err;
198
199 /* Since we synchronize this call and mlx4_ib_dereg_mr via uverbs,
200 * we assume that the calls can't run concurrently. Otherwise, a
201 * race exists.
202 */
203 err = mlx4_mr_hw_get_mpt(dev->dev, &mmr->mmr, &pmpt_entry);
204
205 if (err)
206 return err;
207
208 if (flags & IB_MR_REREG_PD) {
209 err = mlx4_mr_hw_change_pd(dev->dev, *pmpt_entry,
210 to_mpd(pd)->pdn);
211
212 if (err)
213 goto release_mpt_entry;
214 }
215
216 if (flags & IB_MR_REREG_ACCESS) {
217 err = mlx4_mr_hw_change_access(dev->dev, *pmpt_entry,
218 convert_access(mr_access_flags));
219
220 if (err)
221 goto release_mpt_entry;
222 }
223
224 if (flags & IB_MR_REREG_TRANS) {
225 int shift;
226 int err;
227 int n;
228
229 mlx4_mr_rereg_mem_cleanup(dev->dev, &mmr->mmr);
230 ib_umem_release(mmr->umem);
231 mmr->umem = ib_umem_get(mr->uobject->context, start, length,
232 mr_access_flags |
233 IB_ACCESS_LOCAL_WRITE,
234 0);
235 if (IS_ERR(mmr->umem)) {
236 err = PTR_ERR(mmr->umem);
237 /* Prevent mlx4_ib_dereg_mr from free'ing invalid pointer */
238 mmr->umem = NULL;
239 goto release_mpt_entry;
240 }
241 n = ib_umem_page_count(mmr->umem);
242 shift = ilog2(mmr->umem->page_size);
243
244 err = mlx4_mr_rereg_mem_write(dev->dev, &mmr->mmr,
245 virt_addr, length, n, shift,
246 *pmpt_entry);
247 if (err) {
248 ib_umem_release(mmr->umem);
249 goto release_mpt_entry;
250 }
251 mmr->mmr.iova = virt_addr;
252 mmr->mmr.size = length;
253
254 err = mlx4_ib_umem_write_mtt(dev, &mmr->mmr.mtt, mmr->umem);
255 if (err) {
256 mlx4_mr_rereg_mem_cleanup(dev->dev, &mmr->mmr);
257 ib_umem_release(mmr->umem);
258 goto release_mpt_entry;
259 }
260 }
261
262 /* If we couldn't transfer the MR to the HCA, just remember to
263 * return a failure. But dereg_mr will free the resources.
264 */
265 err = mlx4_mr_hw_write_mpt(dev->dev, &mmr->mmr, pmpt_entry);
266 if (!err && flags & IB_MR_REREG_ACCESS)
267 mmr->mmr.access = mr_access_flags;
268
269 release_mpt_entry:
270 mlx4_mr_hw_put_mpt(dev->dev, pmpt_entry);
271
272 return err;
273 }
274
275 int mlx4_ib_dereg_mr(struct ib_mr *ibmr)
276 {
277 struct mlx4_ib_mr *mr = to_mmr(ibmr);
278 int ret;
279
280 ret = mlx4_mr_free(to_mdev(ibmr->device)->dev, &mr->mmr);
281 if (ret)
282 return ret;
283 if (mr->umem)
284 ib_umem_release(mr->umem);
285 kfree(mr);
286
287 return 0;
288 }
289
290 struct ib_mw *mlx4_ib_alloc_mw(struct ib_pd *pd, enum ib_mw_type type)
291 {
292 struct mlx4_ib_dev *dev = to_mdev(pd->device);
293 struct mlx4_ib_mw *mw;
294 int err;
295
296 mw = kmalloc(sizeof(*mw), GFP_KERNEL);
297 if (!mw)
298 return ERR_PTR(-ENOMEM);
299
300 err = mlx4_mw_alloc(dev->dev, to_mpd(pd)->pdn,
301 to_mlx4_type(type), &mw->mmw);
302 if (err)
303 goto err_free;
304
305 err = mlx4_mw_enable(dev->dev, &mw->mmw);
306 if (err)
307 goto err_mw;
308
309 mw->ibmw.rkey = mw->mmw.key;
310
311 return &mw->ibmw;
312
313 err_mw:
314 mlx4_mw_free(dev->dev, &mw->mmw);
315
316 err_free:
317 kfree(mw);
318
319 return ERR_PTR(err);
320 }
321
322 int mlx4_ib_bind_mw(struct ib_qp *qp, struct ib_mw *mw,
323 struct ib_mw_bind *mw_bind)
324 {
325 struct ib_send_wr wr;
326 struct ib_send_wr *bad_wr;
327 int ret;
328
329 memset(&wr, 0, sizeof(wr));
330 wr.opcode = IB_WR_BIND_MW;
331 wr.wr_id = mw_bind->wr_id;
332 wr.send_flags = mw_bind->send_flags;
333 wr.wr.bind_mw.mw = mw;
334 wr.wr.bind_mw.bind_info = mw_bind->bind_info;
335 wr.wr.bind_mw.rkey = ib_inc_rkey(mw->rkey);
336
337 ret = mlx4_ib_post_send(qp, &wr, &bad_wr);
338 if (!ret)
339 mw->rkey = wr.wr.bind_mw.rkey;
340
341 return ret;
342 }
343
344 int mlx4_ib_dealloc_mw(struct ib_mw *ibmw)
345 {
346 struct mlx4_ib_mw *mw = to_mmw(ibmw);
347
348 mlx4_mw_free(to_mdev(ibmw->device)->dev, &mw->mmw);
349 kfree(mw);
350
351 return 0;
352 }
353
354 struct ib_mr *mlx4_ib_alloc_fast_reg_mr(struct ib_pd *pd,
355 int max_page_list_len)
356 {
357 struct mlx4_ib_dev *dev = to_mdev(pd->device);
358 struct mlx4_ib_mr *mr;
359 int err;
360
361 mr = kmalloc(sizeof *mr, GFP_KERNEL);
362 if (!mr)
363 return ERR_PTR(-ENOMEM);
364
365 err = mlx4_mr_alloc(dev->dev, to_mpd(pd)->pdn, 0, 0, 0,
366 max_page_list_len, 0, &mr->mmr);
367 if (err)
368 goto err_free;
369
370 err = mlx4_mr_enable(dev->dev, &mr->mmr);
371 if (err)
372 goto err_mr;
373
374 mr->ibmr.rkey = mr->ibmr.lkey = mr->mmr.key;
375 mr->umem = NULL;
376
377 return &mr->ibmr;
378
379 err_mr:
380 (void) mlx4_mr_free(dev->dev, &mr->mmr);
381
382 err_free:
383 kfree(mr);
384 return ERR_PTR(err);
385 }
386
387 struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device *ibdev,
388 int page_list_len)
389 {
390 struct mlx4_ib_dev *dev = to_mdev(ibdev);
391 struct mlx4_ib_fast_reg_page_list *mfrpl;
392 int size = page_list_len * sizeof (u64);
393
394 if (page_list_len > MLX4_MAX_FAST_REG_PAGES)
395 return ERR_PTR(-EINVAL);
396
397 mfrpl = kmalloc(sizeof *mfrpl, GFP_KERNEL);
398 if (!mfrpl)
399 return ERR_PTR(-ENOMEM);
400
401 mfrpl->ibfrpl.page_list = kmalloc(size, GFP_KERNEL);
402 if (!mfrpl->ibfrpl.page_list)
403 goto err_free;
404
405 mfrpl->mapped_page_list = dma_alloc_coherent(&dev->dev->pdev->dev,
406 size, &mfrpl->map,
407 GFP_KERNEL);
408 if (!mfrpl->mapped_page_list)
409 goto err_free;
410
411 WARN_ON(mfrpl->map & 0x3f);
412
413 return &mfrpl->ibfrpl;
414
415 err_free:
416 kfree(mfrpl->ibfrpl.page_list);
417 kfree(mfrpl);
418 return ERR_PTR(-ENOMEM);
419 }
420
421 void mlx4_ib_free_fast_reg_page_list(struct ib_fast_reg_page_list *page_list)
422 {
423 struct mlx4_ib_dev *dev = to_mdev(page_list->device);
424 struct mlx4_ib_fast_reg_page_list *mfrpl = to_mfrpl(page_list);
425 int size = page_list->max_page_list_len * sizeof (u64);
426
427 dma_free_coherent(&dev->dev->pdev->dev, size, mfrpl->mapped_page_list,
428 mfrpl->map);
429 kfree(mfrpl->ibfrpl.page_list);
430 kfree(mfrpl);
431 }
432
433 struct ib_fmr *mlx4_ib_fmr_alloc(struct ib_pd *pd, int acc,
434 struct ib_fmr_attr *fmr_attr)
435 {
436 struct mlx4_ib_dev *dev = to_mdev(pd->device);
437 struct mlx4_ib_fmr *fmr;
438 int err = -ENOMEM;
439
440 fmr = kmalloc(sizeof *fmr, GFP_KERNEL);
441 if (!fmr)
442 return ERR_PTR(-ENOMEM);
443
444 err = mlx4_fmr_alloc(dev->dev, to_mpd(pd)->pdn, convert_access(acc),
445 fmr_attr->max_pages, fmr_attr->max_maps,
446 fmr_attr->page_shift, &fmr->mfmr);
447 if (err)
448 goto err_free;
449
450 err = mlx4_fmr_enable(to_mdev(pd->device)->dev, &fmr->mfmr);
451 if (err)
452 goto err_mr;
453
454 fmr->ibfmr.rkey = fmr->ibfmr.lkey = fmr->mfmr.mr.key;
455
456 return &fmr->ibfmr;
457
458 err_mr:
459 (void) mlx4_mr_free(to_mdev(pd->device)->dev, &fmr->mfmr.mr);
460
461 err_free:
462 kfree(fmr);
463
464 return ERR_PTR(err);
465 }
466
467 int mlx4_ib_map_phys_fmr(struct ib_fmr *ibfmr, u64 *page_list,
468 int npages, u64 iova)
469 {
470 struct mlx4_ib_fmr *ifmr = to_mfmr(ibfmr);
471 struct mlx4_ib_dev *dev = to_mdev(ifmr->ibfmr.device);
472
473 return mlx4_map_phys_fmr(dev->dev, &ifmr->mfmr, page_list, npages, iova,
474 &ifmr->ibfmr.lkey, &ifmr->ibfmr.rkey);
475 }
476
477 int mlx4_ib_unmap_fmr(struct list_head *fmr_list)
478 {
479 struct ib_fmr *ibfmr;
480 int err;
481 struct mlx4_dev *mdev = NULL;
482
483 list_for_each_entry(ibfmr, fmr_list, list) {
484 if (mdev && to_mdev(ibfmr->device)->dev != mdev)
485 return -EINVAL;
486 mdev = to_mdev(ibfmr->device)->dev;
487 }
488
489 if (!mdev)
490 return 0;
491
492 list_for_each_entry(ibfmr, fmr_list, list) {
493 struct mlx4_ib_fmr *ifmr = to_mfmr(ibfmr);
494
495 mlx4_fmr_unmap(mdev, &ifmr->mfmr, &ifmr->ibfmr.lkey, &ifmr->ibfmr.rkey);
496 }
497
498 /*
499 * Make sure all MPT status updates are visible before issuing
500 * SYNC_TPT firmware command.
501 */
502 wmb();
503
504 err = mlx4_SYNC_TPT(mdev);
505 if (err)
506 pr_warn("SYNC_TPT error %d when "
507 "unmapping FMRs\n", err);
508
509 return 0;
510 }
511
512 int mlx4_ib_fmr_dealloc(struct ib_fmr *ibfmr)
513 {
514 struct mlx4_ib_fmr *ifmr = to_mfmr(ibfmr);
515 struct mlx4_ib_dev *dev = to_mdev(ibfmr->device);
516 int err;
517
518 err = mlx4_fmr_free(dev->dev, &ifmr->mfmr);
519
520 if (!err)
521 kfree(ifmr);
522
523 return err;
524 }
This page took 0.054427 seconds and 5 git commands to generate.