releases/4.19.42/rdma-hns-fix-bug-that-caused-srq-creation-to-fail.patch

   1 From 7e7d0318ecdd65f91bfbbe02391bd731832e0c26 Mon Sep 17 00:00:00 2001
   2 From: Lijun Ou <oulijun@huawei.com>
   3 Date: Sun, 7 Apr 2019 13:23:38 +0800
   4 Subject: RDMA/hns: Fix bug that caused srq creation to fail
   5
   6 [ Upstream commit 4772e03d239484f3461e33c79d721c8ea03f7416 ]
   7
   8 Due to the incorrect use of the seg and obj information, the position of
   9 the mtt is calculated incorrectly, and the free space of the page is not
  10 enough to store the entire mtt, resulting in access to the next page. This
  11 patch fixes this problem.
  12
  13  Unable to handle kernel paging request at virtual address ffff00006e3cd000
  14  ...
  15  Call trace:
  16   hns_roce_write_mtt+0x154/0x2f0 [hns_roce]
  17   hns_roce_buf_write_mtt+0xa8/0xd8 [hns_roce]
  18   hns_roce_create_srq+0x74c/0x808 [hns_roce]
  19   ib_create_srq+0x28/0xc8
  20
  21 Fixes: 0203b14c4f32 ("RDMA/hns: Unify the calculation for hem index in hip08")
  22 Signed-off-by: chenglang <chenglang@huawei.com>
  23 Signed-off-by: Lijun Ou <oulijun@huawei.com>
  24 Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
  25 Signed-off-by: Sasha Levin <sashal@kernel.org>
  26 ---
  27  drivers/infiniband/hw/hns/hns_roce_hem.c | 6 ++++--
  28  drivers/infiniband/hw/hns/hns_roce_mr.c  | 4 ++--
  29  2 files changed, 6 insertions(+), 4 deletions(-)
  30
  31 diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
  32 index f6faefed96e8b..a73d388b70930 100644
  33 --- a/drivers/infiniband/hw/hns/hns_roce_hem.c
  34 +++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
  35 @@ -745,6 +745,8 @@ void *hns_roce_table_find(struct hns_roce_dev *hr_dev,
  36                 idx_offset = (obj & (table->num_obj - 1)) % obj_per_chunk;
  37                 dma_offset = offset = idx_offset * table->obj_size;
  38         } else {
  39 +               u32 seg_size = 64; /* 8 bytes per BA and 8 BA per segment */
  40 +
  41                 hns_roce_calc_hem_mhop(hr_dev, table, &mhop_obj, &mhop);
  42                 /* mtt mhop */
  43                 i = mhop.l0_idx;
  44 @@ -756,8 +758,8 @@ void *hns_roce_table_find(struct hns_roce_dev *hr_dev,
  45                         hem_idx = i;
  46
  47                 hem = table->hem[hem_idx];
  48 -               dma_offset = offset = (obj & (table->num_obj - 1)) *
  49 -                                      table->obj_size % mhop.bt_chunk_size;
  50 +               dma_offset = offset = (obj & (table->num_obj - 1)) * seg_size %
  51 +                                      mhop.bt_chunk_size;
  52                 if (mhop.hop_num == 2)
  53                         dma_offset = offset = 0;
  54         }
  55 diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
  56 index eb26a5f6fc58c..41a538d23b802 100644
  57 --- a/drivers/infiniband/hw/hns/hns_roce_mr.c
  58 +++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
  59 @@ -707,7 +707,6 @@ static int hns_roce_write_mtt_chunk(struct hns_roce_dev *hr_dev,
  60         struct hns_roce_hem_table *table;
  61         dma_addr_t dma_handle;
  62         __le64 *mtts;
  63 -       u32 s = start_index * sizeof(u64);
  64         u32 bt_page_size;
  65         u32 i;
  66
  67 @@ -730,7 +729,8 @@ static int hns_roce_write_mtt_chunk(struct hns_roce_dev *hr_dev,
  68                 table = &hr_dev->mr_table.mtt_cqe_table;
  69
  70         mtts = hns_roce_table_find(hr_dev, table,
  71 -                               mtt->first_seg + s / hr_dev->caps.mtt_entry_sz,
  72 +                               mtt->first_seg +
  73 +                               start_index / HNS_ROCE_MTT_ENTRY_PER_SEG,
  74                                 &dma_handle);
  75         if (!mtts)
  76                 return -ENOMEM;
  77 --
  78 2.20.1
  79