linux.git/drivers/infiniband, branch v3.2-rc4

Merge branches 'cxgb4', 'ipoib', 'misc' and 'qib' into for-next

2011-11-30T02:01:53+00:00

IB: Fix RCU lockdep splats

2011-11-29T21:37:11+00:00

Commit f2c31e32b37 ("net: fix NULL dereferences in check_peer_redir()")
forgot to take care of infiniband uses of dst neighbours.

Many thanks to Marc Aurele who provided a nice bug report and feedback.

Reported-by: Marc Aurele La France 
Signed-off-by: Eric Dumazet 
Cc: David Miller 
Cc: 
Signed-off-by: Roland Dreier

IB/ipoib: Prevent hung task or softlockup processing multicast response

2011-11-29T21:20:02+00:00

This following can occur with ipoib when processing a multicast reponse:

    BUG: soft lockup - CPU#0 stuck for 67s! [ib_mad1:982]
    Modules linked in: ...
    CPU 0:
    Modules linked in: ...
    Pid: 982, comm: ib_mad1 Not tainted 2.6.32-131.0.15.el6.x86_64 #1 ProLiant DL160 G5
    RIP: 0010:[]  [] _spin_unlock_irqrestore+0x17/0x20
    RSP: 0018:ffff8802119ed860  EFLAGS: 00000246
    0000000000000004 RBX: ffff8802119ed860 RCX: 000000000000a299
    RDX: ffff88021086c700 RSI: 0000000000000246 RDI: 0000000000000246
    RBP: ffffffff8100bc8e R08: ffff880210ac229c R09: 0000000000000000
    R10: ffff88021278aab8 R11: 0000000000000000 R12: ffff8802119ed860
    R13: ffffffff8100be6e R14: 0000000000000001 R15: 0000000000000003
    FS:  0000000000000000(0000) GS:ffff880028200000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
    CR2: 00000000006d4840 CR3: 0000000209aa5000 CR4: 00000000000406f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Call Trace:
    [] ? ipoib_mcast_send+0x157/0x480 [ib_ipoib]
    [] ? apic_timer_interrupt+0xe/0x20
    [] ? apic_timer_interrupt+0xe/0x20
    [] ? ipoib_path_lookup+0x124/0x2d0 [ib_ipoib]
    [] ? ipoib_start_xmit+0x17c/0x430 [ib_ipoib]
    [] ? dev_hard_start_xmit+0x2c8/0x3f0
    [] ? sch_direct_xmit+0x15a/0x1c0
    [] ? dev_queue_xmit+0x388/0x4d0
    [] ? ipoib_mcast_join_finish+0x2c7/0x510 [ib_ipoib]
    [] ? ipoib_mcast_sendonly_join_complete+0x1b8/0x1f0 [ib_ipoib]
    [] ? mcast_work_handler+0x1a6/0x710 [ib_sa]
    [] ? ib_send_mad+0xfe/0x3c0 [ib_mad]
    [] ? ib_get_cached_lmc+0xa3/0xb0 [ib_core]
    [] ? join_handler+0xeb/0x200 [ib_sa]
    [] ? ib_sa_mcmember_rec_callback+0x5c/0xa0 [ib_sa]
    [] ? recv_handler+0x3c/0x70 [ib_sa]
    [] ? ib_mad_completion_handler+0x844/0x9d0 [ib_mad]
    [] ? ib_mad_completion_handler+0x0/0x9d0 [ib_mad]
    [] ? worker_thread+0x170/0x2a0
    [] ? autoremove_wake_function+0x0/0x40
    [] ? worker_thread+0x0/0x2a0
    [] ? kthread+0x96/0xa0
    [] ? child_rip+0xa/0x20

Coinciding with stack trace is the following message:

    ib0: ib_address_create failed

The code below in ipoib_mcast_join_finish() will note the above
failure in the address handle but otherwise continue:

                ah = ipoib_create_ah(dev, priv->pd, &av);
                if (!ah) {
                        ipoib_warn(priv, "ib_address_create failed\n");
                } else {

The while loop at the bottom of ipoib_mcast_join_finish() will attempt
to send queued multicast packets in mcast->pkt_queue and eventually
end up in ipoib_mcast_send():

        if (!mcast->ah) {
                if (skb_queue_len(&mcast->pkt_queue) < IPOIB_MAX_MCAST_QUEUE)
                        skb_queue_tail(&mcast->pkt_queue, skb);
                else {
                        ++dev->stats.tx_dropped;
                        dev_kfree_skb_any(skb);
                }

My read is that the code will requeue the packet and return to the
ipoib_mcast_join_finish() while loop and the stage is set for the
"hung" task diagnostic as the while loop never sees a non-NULL ah, and
will do nothing to resolve.

There are GFP_ATOMIC allocates in the provider routines, so this is
possible and should be dealt with.

The test that induced the failure is associated with a host SM on the
same server during a shutdown.

This patch causes ipoib_mcast_join_finish() to exit with an error
which will flush the queued mcast packets.  Nothing is done to unwind
the QP attached state so that subsequent sends from above will retry
the join.

Reviewed-by: Ram Vepa 
Reviewed-by: Gary Leshner 
Signed-off-by: Mike Marciniszyn 
Signed-off-by: Roland Dreier

IB/qib: Fix over-scheduling of QSFP work

2011-11-28T20:17:33+00:00

Don't over-schedule QSFP work on driver initialization.  It could end
up being run simultaneously on two different CPUs resulting in bad
EEPROM reads.  In combination with setting the physical IB link state
prior to the IBC being brought out of reset, this can cause the link
state machine to start training early with wrong settings.

Signed-off-by: Mitko Haralanov 
Signed-off-by: Mike Marciniszyn 
Signed-off-by: Roland Dreier

RDMA/cxgb4: Fix retry with MPAv1 logic for MPAv2

2011-11-28T19:58:07+00:00

Fix logic so that we don't retry with MPAv1 once we have done that
already.  Otherwise, we end up retrying with MPAv1 even when its not
needed on getting peer aborts - and this could lead to kernel panic.

Signed-off-by: Kumar Sanghvi 
Signed-off-by: Roland Dreier

RDMA/cxgb4: Fix iw_cxgb4 count_rcqes() logic

2011-11-28T19:53:05+00:00

Fix another place in the code where logic dealing with the t4_cqe was
using the wrong QID.  This fixes the counting logic so that it tests
against the SQ QID instead of the RQ QID when counting RCQES.

Signed-off by: Jonathan Lallinger 
Signed-off by: Steve Wise 
Signed-off-by: Roland Dreier

IB/qib: Don't use schedule_work()

2011-11-08T18:37:53+00:00

It was mistakenly introduced by dde05cbdf8b1 ("IB/qib: Hold links
until tuning data is available").

Signed-off-by: Mike Marciniszyn 
Signed-off-by: Roland Dreier

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-07T03:44:47+00:00

* 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux: (230 commits)
  Revert "tracing: Include module.h in define_trace.h"
  irq: don't put module.h into irq.h for tracking irqgen modules.
  bluetooth: macroize two small inlines to avoid module.h
  ip_vs.h: fix implicit use of module_get/module_put from module.h
  nf_conntrack.h: fix up fallout from implicit moduleparam.h presence
  include: replace linux/module.h with "struct module" wherever possible
  include: convert various register fcns to macros to avoid include chaining
  crypto.h: remove unused crypto_tfm_alg_modname() inline
  uwb.h: fix implicit use of asm/page.h for PAGE_SIZE
  pm_runtime.h: explicitly requires notifier.h
  linux/dmaengine.h: fix implicit use of bitmap.h and asm/page.h
  miscdevice.h: fix up implicit use of lists and types
  stop_machine.h: fix implicit use of smp.h for smp_processor_id
  of: fix implicit use of errno.h in include/linux/of.h
  of_platform.h: delete needless include 
  acpi: remove module.h include from platform/aclinux.h
  miscdevice.h: delete unnecessary inclusion of module.h
  device_cgroup.h: delete needless include 
  net: sch_generic remove redundant use of 
  net: inet_timewait_sock doesnt need 
  ...

Fix up trivial conflicts (other header files, and  removal of the ab3550 mfd driver) in
 - drivers/media/dvb/frontends/dibx000_common.c
 - drivers/media/video/{mt9m111.c,ov6650.c}
 - drivers/mfd/ab3550-core.c
 - include/linux/dmaengine.h

Merge branches 'iser', 'mthca' and 'qib' into for-next

2011-11-04T16:36:04+00:00

IB/qib: Fix panic in RC error flushing logic

2011-11-04T16:35:44+00:00

The following panic can occur when flushing a QP:

    RIP: 0010:[]  [] qib_send_complete+0x3b/0x190 [ib_qib]
    RSP: 0018:ffff8803cdc6fc90  EFLAGS: 00010046
    RAX: 0000000000000000 RBX: ffff8803d84ba000 RCX: 0000000000000000
    RDX: 0000000000000005 RSI: ffffc90015a53430 RDI: ffff8803d84ba000
    RBP: ffff8803cdc6fce0 R08: ffff8803cdc6fc90 R09: 0000000000000001
    R10: 00000000ffffffff R11: 0000000000000000 R12: ffff8803d84ba0c0
    R13: ffff8803d84ba5cc R14: 0000000000000800 R15: 0000000000000246
    FS:  0000000000000000(0000) GS:ffff880036600000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
    CR2: 0000000000000034 CR3: 00000003e44f9000 CR4: 00000000000406f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Process qib/0 (pid: 1350, threadinfo ffff8803cdc6e000, task ffff88042728a100)
    Stack:
     53544c5553455201 0000000100000005 0000000000000000 ffff8803d84ba000
     0000000000000000 0000000000000000 0000000000000000 0000000000000000
     0000000000000000 0000000000000001 ffff8803cdc6fd30 ffffffffa0165d7a
    Call Trace:
     [] qib_make_rc_req+0x36a/0xe80 [ib_qib]
     [] ?  qib_make_rc_req+0x0/0xe80 [ib_qib]
     [] qib_do_send+0xf3/0xb60 [ib_qib]
     [] ? thread_return+0x4e/0x777
     [] ? qib_do_send+0x0/0xb60 [ib_qib]
     [] worker_thread+0x170/0x2a0
     [] ?  autoremove_wake_function+0x0/0x40
     [] ? worker_thread+0x0/0x2a0
     [] kthread+0x96/0xa0
     [] child_rip+0xa/0x20
     [] ? kthread+0x0/0xa0
     [] ? child_rip+0x0/0x20
    RIP  [] qib_send_complete+0x3b/0x190 [ib_qib]

The RC error state flush logic in qib_make_rc_req() could return all
of the acked wqes and potentially have emptied the queue.  It would
then unconditionally try return a flush completion via
qib_send_complete() for an invalid wqe, or worse a valid one that is
not queued. The panic results when the completion code tries to
maintain an MR reference count for a NULL MR.

This fix modifies logic to only send one completion per
qib_make_rc_req() call and changing the completion status from
IB_WC_SUCCESS to IB_WC_WR_FLUSH_ERR as the completions progress.

The outer loop will call as many times as necessary to flush the queue.

Reviewed-by: Ram Vepa 
Signed-off-by: Mike Marciniszyn 
Signed-off-by: Roland Dreier