RDMA/rxe: Disallow MR dereg and invalidate when bound

Check that an MR has no bound MWs before allowing a dereg or invalidate
operation.

Link: https://lore.kernel.org/r/20210608042552.33275-11-rpearsonhpe@gmail.com
Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h
index 6e4b5e22541e16bddc037259bbaccc23057187b4..1ddb20855dee7621d4cd56f137b3413b24a4a8f0 100644 (file)
--- a/drivers/infiniband/sw/rxe/rxe_loc.h
+++ b/drivers/infiniband/sw/rxe/rxe_loc.h
@@ -87,6 +87,7 @@ struct rxe_mr *lookup_mr(struct rxe_pd *pd, int access, u32 key,
 int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length);
 int advance_dma_data(struct rxe_dma_info *dma, unsigned int length);
 int rxe_invalidate_mr(struct rxe_qp *qp, u32 rkey);
+int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata);
 void rxe_mr_cleanup(struct rxe_pool_entry *arg);
 
 /* rxe_mw.c */

diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
index 3fb58d2c7814b6acc175c903e37943456fafe177..7f169329a8bf90c7f9ffdcceae5cbbe44eecb312 100644 (file)
--- a/drivers/infiniband/sw/rxe/rxe_mr.c
+++ b/drivers/infiniband/sw/rxe/rxe_mr.c
@@ -546,6 +546,13 @@ int rxe_invalidate_mr(struct rxe_qp *qp, u32 rkey)
                goto err_drop_ref;
        }
 
+       if (atomic_read(&mr->num_mw) > 0) {
+               pr_warn("%s: Attempt to invalidate an MR while bound to MWs\n",
+                       __func__);
+               ret = -EINVAL;
+               goto err_drop_ref;
+       }
+
        mr->state = RXE_MR_STATE_FREE;
        ret = 0;
 
@@ -555,6 +562,24 @@ err:
        return ret;
 }
 
+int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata)
+{
+       struct rxe_mr *mr = to_rmr(ibmr);
+
+       if (atomic_read(&mr->num_mw) > 0) {
+               pr_warn("%s: Attempt to deregister an MR while bound to MWs\n",
+                       __func__);
+               return -EINVAL;
+       }
+
+       mr->state = RXE_MR_STATE_ZOMBIE;
+       rxe_drop_ref(mr_pd(mr));
+       rxe_drop_index(mr);
+       rxe_drop_ref(mr);
+
+       return 0;
+}
+
 void rxe_mr_cleanup(struct rxe_pool_entry *arg)
 {
        struct rxe_mr *mr = container_of(arg, typeof(*mr), pelem);

diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
index 94ae5175d22553f8b8d5ffefdaeff61d451fcad9..a055d4c76f4c3c0deda9fe682ea3236c087a3408 100644 (file)
--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
+++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
@@ -959,17 +959,6 @@ err2:
        return ERR_PTR(err);
 }
 
-static int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata)
-{
-       struct rxe_mr *mr = to_rmr(ibmr);
-
-       mr->state = RXE_MR_STATE_ZOMBIE;
-       rxe_drop_ref(mr_pd(mr));
-       rxe_drop_index(mr);
-       rxe_drop_ref(mr);
-       return 0;
-}
-
 static struct ib_mr *rxe_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type,
                                  u32 max_num_sg)
 {