svn commit: r356713 - head/sys/dev/cxgbe/iw_cxgbe

[Navdeep Parhar]

Author: np
Date: Tue Jan 14 01:43:04 2020
New Revision: 356713
URL: https://svnweb.freebsd.org/changeset/base/356713

Log:
  cxgbe/iw_cxgbe: Do not allow memory registrations with page size greater
  than 128MB, which is the maximum supported by the hardware in RDMA mode.
  
  Obtained from:	Chelsio Communications
  MFC after:	3 days
  Sponsored by:	Chelsio Communications

Modified:
  head/sys/dev/cxgbe/iw_cxgbe/iw_cxgbe.h
  head/sys/dev/cxgbe/iw_cxgbe/mem.c
  head/sys/dev/cxgbe/iw_cxgbe/qp.c

Modified: head/sys/dev/cxgbe/iw_cxgbe/iw_cxgbe.h
==============================================================================
--- head/sys/dev/cxgbe/iw_cxgbe/iw_cxgbe.h	Tue Jan 14 00:51:35 2020	(r356712)
+++ head/sys/dev/cxgbe/iw_cxgbe/iw_cxgbe.h	Tue Jan 14 01:43:04 2020	(r356713)
@@ -91,6 +91,7 @@ static inline void *cplhdr(struct mbuf *m)
 
 #define C4IW_ID_TABLE_F_RANDOM 1       /* Pseudo-randomize the id's returned */
 #define C4IW_ID_TABLE_F_EMPTY  2       /* Table is initially empty */
+#define C4IW_MAX_PAGE_SIZE 0x8000000
 
 struct c4iw_id_table {
 	u32 flags;

Modified: head/sys/dev/cxgbe/iw_cxgbe/mem.c
==============================================================================
--- head/sys/dev/cxgbe/iw_cxgbe/mem.c	Tue Jan 14 00:51:35 2020	(r356712)
+++ head/sys/dev/cxgbe/iw_cxgbe/mem.c	Tue Jan 14 01:43:04 2020	(r356713)
@@ -287,6 +287,8 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32
 	if (reset_tpt_entry)
 		memset(&tpt, 0, sizeof(tpt));
 	else {
+		if (page_size > ilog2(C4IW_MAX_PAGE_SIZE) - 12)
+			return -EINVAL;
 		tpt.valid_to_pdid = cpu_to_be32(F_FW_RI_TPTE_VALID |
 			V_FW_RI_TPTE_STAGKEY((*stag & M_FW_RI_TPTE_STAGKEY)) |
 			V_FW_RI_TPTE_STAGSTATE(stag_state) |

Modified: head/sys/dev/cxgbe/iw_cxgbe/qp.c
==============================================================================
--- head/sys/dev/cxgbe/iw_cxgbe/qp.c	Tue Jan 14 00:51:35 2020	(r356712)
+++ head/sys/dev/cxgbe/iw_cxgbe/qp.c	Tue Jan 14 01:43:04 2020	(r356713)
@@ -669,11 +669,14 @@ static void complete_rq_drain_wr(struct c4iw_qp *qhp, 
 	spin_unlock_irqrestore(&rchp->comp_handler_lock, flag);
 }
 
-static void build_tpte_memreg(struct fw_ri_fr_nsmr_tpte_wr *fr,
+static int build_tpte_memreg(struct fw_ri_fr_nsmr_tpte_wr *fr,
 		struct ib_reg_wr *wr, struct c4iw_mr *mhp, u8 *len16)
 {
 	__be64 *p = (__be64 *)fr->pbl;
 
+	if (wr->mr->page_size > C4IW_MAX_PAGE_SIZE)
+		return -EINVAL;
+
 	fr->r2 = cpu_to_be32(0);
 	fr->stag = cpu_to_be32(mhp->ibmr.rkey);
 
@@ -698,6 +701,7 @@ static void build_tpte_memreg(struct fw_ri_fr_nsmr_tpt
 	p[1] = cpu_to_be64((u64)mhp->mpl[1]);
 
 	*len16 = DIV_ROUND_UP(sizeof(*fr), 16);
+	return 0;
 }
 
 static int build_memreg(struct t4_sq *sq, union t4_wr *wqe,
@@ -712,6 +716,8 @@ static int build_memreg(struct t4_sq *sq, union t4_wr 
 
 	if (mhp->mpl_len > t4_max_fr_depth(use_dsgl && dsgl_supported))
 		return -EINVAL;
+	if (wr->mr->page_size > C4IW_MAX_PAGE_SIZE)
+		return -EINVAL;
 
 	wqe->fr.qpbinde_to_dcacpu = 0;
 	wqe->fr.pgsz_shift = ilog2(wr->mr->page_size) - 12;
@@ -852,16 +858,16 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_
 			if (rdev->adap->params.fr_nsmr_tpte_wr_support &&
 					!mhp->attr.state && mhp->mpl_len <= 2) {
 				fw_opcode = FW_RI_FR_NSMR_TPTE_WR;
-				build_tpte_memreg(&wqe->fr_tpte, reg_wr(wr),
+				err = build_tpte_memreg(&wqe->fr_tpte, reg_wr(wr),
 						mhp, &len16);
 			} else {
 				fw_opcode = FW_RI_FR_NSMR_WR;
 				err = build_memreg(&qhp->wq.sq, wqe, reg_wr(wr),
 					mhp, &len16,
 					rdev->adap->params.ulptx_memwrite_dsgl);
-				if (err)
-					break;
 			}
+			if (err)
+				break;
 			mhp->attr.state = 1;
 			break;
 		}