Skip to content

R
raspberrypi-kernel

openeuler / raspberrypi-kernel

通知 13
Star 1
Fork 0
R
raspberrypi-kernel
切换分支/标签
  1. 10 12月, 2009 2 次提交
  3. 06 9月, 2009 5 次提交
  5. 23 6月, 2009 1 次提交
  7. 28 4月, 2009 1 次提交
  9. 22 4月, 2009 2 次提交
  11. 21 4月, 2009 2 次提交
  13. 13 3月, 2009 1 次提交
    • F
      RDMA/nes: Don't allow userspace QPs to use STag zero · c12e56ef
      由 Faisal Latif 提交于 
      STag zero is a special STag that allows consumers to access any bus
address without registering memory.  The nes driver unfortunately
allows STag zero to be used even with QPs created by unprivileged
userspace consumers, which means that any process with direct verbs
access to the nes device can read and write any memory accessible to
the underlying PCI device (usually any memory in the system).  Such
access is usually given for cluster software such as MPI to use, so
this is a local privilege escalation bug on most systems running this
driver.

The driver was using STag zero to receive the last streaming mode
data; to allow STag zero to be disabled for unprivileged QPs, the
driver now registers a special MR for this data.

Cc: <stable@kernel.org>
Signed-off-by: NFaisal Latif <faisal.latif@intel.com>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      c12e56ef
  15. 07 3月, 2009 3 次提交
  17. 06 12月, 2008 1 次提交
  19. 03 11月, 2008 3 次提交
  21. 21 9月, 2008 1 次提交
  23. 25 7月, 2008 1 次提交
    • F
      RDMA/nes: CM connection setup/teardown rework · 6492cdf3
      由 Faisal Latif 提交于 
      Major rework of CM connection setup/teardown.  We had a number of issues
with MPI applications not starting/terminating properly over time.
With these changes we were able to run longer on larger clusters.

* Remove memory allocation from nes_connect() and nes_cm_connect().
* Fix mini_cm_dec_refcnt_listen() when destroying listener.
* Remove unnecessary code from schedule_nes_timer() and nes_cm_timer_tick().
* Functionalize mini_cm_recv_pkt() and process_packet().
* Clean up cm_node->ref_count usage.
* Reuse skbs if available.
Signed-off-by: NFaisal Latif <flatif@neteffect.com>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>
      6492cdf3
  25. 15 7月, 2008 2 次提交
    • R
      RDMA/nes: Get rid of ring_doorbell parameter of nes_post_cqp_request() · 8294f297
      由 Roland Dreier 提交于 
      Every caller of nes_post_cqp_request() passed it NES_CQP_REQUEST_RING_DOORBELL,
so just remove that parameter and always ring the doorbell.
Signed-off-by: NRoland Dreier <rolandd@cisco.com>
Acked-by: NFaisal Latif <flatif@neteffect.com>
      8294f297
    • R
      RDMA/nes: Encapsulate logic nes_put_cqp_request() · 1ff66e8c
      由 Roland Dreier 提交于 
      The iw_nes driver repeats the logic

	if (atomic_dec_and_test(&cqp_request->refcount)) {
		if (cqp_request->dynamic) {
			kfree(cqp_request);
		} else {
			spin_lock_irqsave(&nesdev->cqp.lock, flags);
			list_add_tail(&cqp_request->list, &nesdev->cqp_avail_reqs);
			spin_unlock_irqrestore(&nesdev->cqp.lock, flags);
		}
	}

over and over.  Wrap this up in functions nes_free_cqp_request() and
nes_put_cqp_request() to simplify such code.

In addition to making the source smaller and more readable, this shrinks
the compiled code quite a bit:

add/remove: 2/0 grow/shrink: 0/13 up/down: 164/-1692 (-1528)
function                                     old     new   delta
nes_free_cqp_request                           -     147    +147
nes_put_cqp_request                            -      17     +17
nes_modify_qp                               2316    2293     -23
nes_hw_modify_qp                             737     657     -80
nes_dereg_mr                                 945     860     -85
flush_wqes                                   501     416     -85
nes_manage_apbvt                             648     560     -88
nes_reg_mr                                  1117    1026     -91
nes_cqp_ce_handler                           927     769    -158
nes_alloc_mw                                1052     884    -168
nes_create_qp                               5314    5141    -173
nes_alloc_fmr                               2212    2035    -177
nes_destroy_cq                              1097     918    -179
nes_create_cq                               2787    2598    -189
nes_dealloc_mw                               762     566    -196
Signed-off-by: NRoland Dreier <rolandd@cisco.com>
Acked-by: NFaisal Latif <flatif@neteffect.com>
      1ff66e8c
  27. 11 6月, 2008 1 次提交
    • R
      RDMA/nes: Fix off-by-one in nes_reg_user_mr() error path · 24797a34
      由 Roland Dreier 提交于 
      nes_reg_user_mr() should fail if page_count becomes >= 1024 * 512
rather than just testing for strict >, because page_count is
essentially used as an index into an array with 1024 * 512 entries, so
allowing the loop to continue with page_count == 1024 * 512 means that
memory after the end of the array is corrupted.  This leads to a crash
triggerable by a userspace application that requests registration of a
too-big region.

Also get rid of the call to pci_free_consistent() here to avoid
corrupting state with a double free, since the same memory will be
freed in the code jumped to at reg_user_mr_err.
Signed-off-by: NRoland Dreier <rolandd@cisco.com>
      24797a34
  29. 30 4月, 2008 1 次提交
  31. 29 4月, 2008 1 次提交
    • A
      IB: expand ib_umem_get() prototype · cb9fbc5c
      由 Arthur Kepner 提交于 
      Add a new parameter, dmasync, to the ib_umem_get() prototype.  Use dmasync = 1
when mapping user-allocated CQs with ib_umem_get().
Signed-off-by: NArthur Kepner <akepner@sgi.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
Cc: Jes Sorensen <jes@sgi.com>
Cc: Randy Dunlap <randy.dunlap@oracle.com>
Cc: Roland Dreier <rdreier@cisco.com>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: David Miller <davem@davemloft.net>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Grant Grundler <grundler@parisc-linux.org>
Cc: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      cb9fbc5c
  33. 24 4月, 2008 1 次提交
    • R
      RDMA/nes: Remove volatile qualifier from struct nes_hw_cq.cq_vbase · 31d1e340
      由 Roland Dreier 提交于 
      Remove the volatile qualifier from the cq_vbase member of struct
nes_hw_cq, and add an rmb() in the one place where it looks like
access order might make a difference.  As usual, removing a volatile
qualifier in a declaration is actually a bug fix, since a volatile
qualifier is not sufficient to make sure that aggressively
out-of-order CPUs don't reorder things and cause incorrect results.

For example, a CPU might speculatively execute reads of other cqe
fields before the NIC hardware has written those fields and before it
has set the NES_CQE_VALID bit (even though those reads come after the
test of the NES_CQE_VALID bit in program order), but then when the CPU
actually executes the conditional test of the NES_CQE_VALID, the bit
has been set, and the CPU will proceed with the results of the earlier
speculative execution and end up using bogus data.

This also gets rid of the warning:

    drivers/infiniband/hw/nes/nes_verbs.c: In function 'nes_destroy_cq':
    drivers/infiniband/hw/nes/nes_verbs.c:1978: warning: passing argument 3 of 'pci_free_consistent' discards qualifiers from pointer target type
Signed-off-by: NRoland Dreier <rolandd@cisco.com>
      31d1e340
  35. 20 4月, 2008 1 次提交
  37. 17 4月, 2008 5 次提交
  39. 27 2月, 2008 1 次提交
  41. 26 2月, 2008 2 次提交
  43. 19 2月, 2008 1 次提交
    • R
      RDMA/nes: Fix possible array overrun · 51af33e8
      由 Roland Dreier 提交于 
      In nes_create_qp(), the test

	if (nesqp->mmap_sq_db_index > NES_MAX_USER_WQ_REGIONS) {

is used to error out if the db_index is too large; however, if the
test doesn't trigger, then the index is used as

	nes_ucontext->mmap_nesqp[nesqp->mmap_sq_db_index] = nesqp;

and mmap_nesqp is declared as

	struct nes_qp      *mmap_nesqp[NES_MAX_USER_WQ_REGIONS];

which leads to an array overrun if the index is exactly equal to
NES_MAX_USER_WQ_REGIONS.  Fix this by bailing out if the index is
greater than or equal to NES_MAX_USER_WQ_REGIONS.

This was spotted by the Coverity checker (CID 2162).
Acked-by: NGlenn Streiff <gstreiff@neteffect.com>
Signed-off-by: NRoland Dreier <rolandd@cisco.com>
      51af33e8
  45. 05 2月, 2008 1 次提交