[PATCH for-rc 0/2] RDMA/bnxt_re: Fix QP table fixes

[PATCH for-rc 0/2] RDMA/bnxt_re: Fix QP table fixes

[Selvin Xavier]

This series fixes couple issues with the QP table
allocation/teardown.

Please review and apply

Thanks,
Selvin Xavier

Abhishek Mohapatra (1):
  RDMA/bnxt_re: Use kvzalloc for QP table allocation

Selvin Xavier (1):
  RDMA/bnxt_re: Unpublish QP table before freeing it

 drivers/infiniband/hw/bnxt_re/qplib_rcfw.c |  4 ++++
 drivers/infiniband/hw/bnxt_re/qplib_res.c  | 14 +++++++++++---
 2 files changed, 15 insertions(+), 3 deletions(-)

-- 
2.39.3

[PATCH for-rc 1/2] RDMA/bnxt_re: Use kvzalloc for QP table allocation

[Selvin Xavier]

From: Abhishek Mohapatra <abhishek.mohapatra@broadcom.com>

The QP table size depends on the firmware reported max_qp, so it can
be large and a physically contiguous kzalloc may fail. Use kvzalloc_objs()
and free it with kvfree().

Fixes: 82f1f575aa13 ("RDMA/bnxt_re: Fix allocation of QP table")
Signed-off-by: Abhishek Mohapatra <abhishek.mohapatra@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
---
 drivers/infiniband/hw/bnxt_re/qplib_res.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c
index 756f8b5f042a..086cf9fe3920 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c
@@ -909,7 +909,7 @@ int bnxt_qplib_init_res(struct bnxt_qplib_res *res)
 
 void bnxt_qplib_free_res(struct bnxt_qplib_res *res)
 {
-	kfree(res->rcfw->qp_tbl);
+	kvfree(res->rcfw->qp_tbl);
 	bnxt_qplib_free_sgid_tbl(res, &res->sgid_tbl);
 	bnxt_qplib_free_pd_tbl(&res->pd_tbl);
 	bnxt_qplib_free_dpi_tbl(res, &res->dpi_tbl);
@@ -926,8 +926,8 @@ int bnxt_qplib_alloc_res(struct bnxt_qplib_res *res, struct net_device *netdev)
 
 	/* Allocate one extra to hold the QP1 entries */
 	rcfw->qp_tbl_size = max_t(u32, BNXT_RE_MAX_QPC_COUNT + 1, dev_attr->max_qp);
-	rcfw->qp_tbl = kzalloc_objs(struct bnxt_qplib_qp_node,
-				    rcfw->qp_tbl_size);
+	rcfw->qp_tbl = kvzalloc_objs(struct bnxt_qplib_qp_node,
+				     rcfw->qp_tbl_size);
 	if (!rcfw->qp_tbl)
 		return -ENOMEM;
 
-- 
2.39.3

Re: [PATCH for-rc 1/2] RDMA/bnxt_re: Use kvzalloc for QP table allocation

[sashiko-bot]

> From: Abhishek Mohapatra <abhishek.mohapatra@broadcom.com>
> 
> The QP table size depends on the firmware reported max_qp, so it can
> be large and a physically contiguous kzalloc may fail. Use kvzalloc_objs()
> and free it with kvfree().
> 
> Fixes: 82f1f575aa13 ("RDMA/bnxt_re: Fix allocation of QP table")
> Signed-off-by: Abhishek Mohapatra <abhishek.mohapatra@broadcom.com>
> Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013140427.256612-1-selvin.xavier@broadcom.com?part=1

[PATCH for-rc 2/2] RDMA/bnxt_re: Unpublish QP table before freeing it

[Selvin Xavier]

bnxt_re_dev_uninit() frees the QP table before the RCFW channel is
disabled, so the CREQ tasklet can still look up rcfw->qp_tbl while it
is being freed.

Clear rcfw->qp_tbl under tbl_lock before freeing it, and have the QP
error notification handler bail out if the table is gone.

Fixes: 82f1f575aa13 ("RDMA/bnxt_re: Fix allocation of QP table")
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
---
 drivers/infiniband/hw/bnxt_re/qplib_rcfw.c |  4 ++++
 drivers/infiniband/hw/bnxt_re/qplib_res.c  | 10 +++++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 9ee0d500436c..34d8aa12265d 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -638,6 +638,10 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
 		err_event = (struct creq_qp_error_notification *)qp_event;
 		qp_id = le32_to_cpu(err_event->xid);
 		spin_lock(&rcfw->tbl_lock);
+		if (!rcfw->qp_tbl) {
+			spin_unlock(&rcfw->tbl_lock);
+			break;
+		}
 		tbl_indx = map_qp_id_to_tbl_indx(qp_id, rcfw);
 		qp = rcfw->qp_tbl[tbl_indx].qp_handle;
 		if (!qp) {
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c
index 086cf9fe3920..3faaec28201e 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c
@@ -909,7 +909,15 @@ int bnxt_qplib_init_res(struct bnxt_qplib_res *res)
 
 void bnxt_qplib_free_res(struct bnxt_qplib_res *res)
 {
-	kvfree(res->rcfw->qp_tbl);
+	struct bnxt_qplib_rcfw *rcfw = res->rcfw;
+	struct bnxt_qplib_qp_node *qp_tbl;
+
+	/* The CREQ tasklet may still be running; unpublish the table first */
+	spin_lock_bh(&rcfw->tbl_lock);
+	qp_tbl = rcfw->qp_tbl;
+	rcfw->qp_tbl = NULL;
+	spin_unlock_bh(&rcfw->tbl_lock);
+	kvfree(qp_tbl);
 	bnxt_qplib_free_sgid_tbl(res, &res->sgid_tbl);
 	bnxt_qplib_free_pd_tbl(&res->pd_tbl);
 	bnxt_qplib_free_dpi_tbl(res, &res->dpi_tbl);
-- 
2.39.3

Re: [PATCH for-rc 2/2] RDMA/bnxt_re: Unpublish QP table before freeing it

[sashiko-bot]

> bnxt_re_dev_uninit() frees the QP table before the RCFW channel is
> disabled, so the CREQ tasklet can still look up rcfw->qp_tbl while it
> is being freed.
> 
> Clear rcfw->qp_tbl under tbl_lock before freeing it, and have the QP
> error notification handler bail out if the table is gone.
> 
> Fixes: 82f1f575aa13 ("RDMA/bnxt_re: Fix allocation of QP table")
> Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013140427.256612-1-selvin.xavier@broadcom.com?part=2