1. 19 Mar, 2018 3 commits
    • Jason Gunthorpe's avatar
      RDMA/bnxt: Fix structure layout for bnxt_re_pd_resp · 958d2c1b
      Jason Gunthorpe authored
      What is going on here is a bit subtle, in the kernel there is no
      problem because the struct is copied using copy_from_user, so it
      can safely have an 8 byte alignment, however in userspace it must
      be constructed by concatenation with the ib_uverbs_alloc_pd_resp
      struct. This is due to the required memory layout to execute the
      command.
      
      Since ibv_uverbs_alloc_pd_resp is only 4 bytes long, this causes
      misalignment, and the user space will experience an unexpected padding.
      Currently it works around this via pointer maths.
      
      Make everything more robust by having the compiler reduce the alignment
      of the struct to 4. The userspace has assertions to ensure this
      works properly in all situations.
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      958d2c1b
    • Honggang Li's avatar
      IB/mlx5: Set the default active rate and width to QDR and 4X · 7672ed33
      Honggang Li authored
      Before commit f1b65df5 ("IB/mlx5: Add support for active_width and
      active_speed in RoCE"), the mlx5_ib driver set the default active_width
      and active_speed to IB_WIDTH_4X and IB_SPEED_QDR.
      
      When the RoCE port is down, the RoCE port does not negotiate the active
      width with the remote side, causing the active width to be zero. When
      running userspace ibstat to view the port status, ibstat will panic as it
      reads an invalid width from sys file.
      
      This patch restores the original behavior.
      
      Fixes: f1b65df5 ("IB/mlx5: Add support for active_width and active_speed in RoCE").
      Signed-off-by: default avatarHonggang Li <honli@redhat.com>
      Reviewed-by: default avatarHal Rosenstock <hal@mellanox.com>
      Reviewed-by: default avatarNoa Osherovich <noaos@mellanox.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      7672ed33
    • Honggang Li's avatar
      IB/core: Set speed string to SDR for invalid active rates · 311d0da9
      Honggang Li authored
      Before commit f1b65df5 ("IB/mlx5: Add support for active_width and
      active_speed in RoCE"), the mlx5_ib driver set default active_width and
      active_speed to IB_WIDTH_4X and IB_SPEED_QDR.
      
      Now, the active_width and active_speed are zeros if the RoCE port
      is in DOWN state. The speed string should be set to " SDR" instead of
      a blank string when active_speed is zero.
      Signed-off-by: default avatarHonggang Li <honli@redhat.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      311d0da9
  2. 16 Mar, 2018 1 commit
    • Leon Romanovsky's avatar
      RDMA/restrack: Don't rely on uninitialized variable in restrack_add flow · 7d9a935e
      Leon Romanovsky authored
      The restrack code relies on the fact that object structures are zeroed at
      the allocation stage, the mlx4 CQ wasn't allocated with kzalloc and it
      caused to the following crash.
      
      [  137.392209] general protection fault: 0000 [#1] SMP KASAN PTI
      [  137.392972] CPU: 0 PID: 622 Comm: ibv_rc_pingpong Tainted: G        W        4.16.0-rc1-00099-g00313983 #11
      [  137.395079] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014
      [  137.396866] RIP: 0010:rdma_restrack_del+0xc8/0xf0
      [  137.397762] RSP: 0018:ffff8801b54e7968 EFLAGS: 00010206
      [  137.399008] RAX: 0000000000000000 RBX: ffff8801d8bcbae8 RCX: ffffffffb82314df
      [  137.400055] RDX: dffffc0000000000 RSI: dffffc0000000000 RDI: 70696b533d454741
      [  137.401103] RBP: ffff8801d90c07a0 R08: ffff8801d8bcbb00 R09: 0000000000000000
      [  137.402470] R10: 0000000000000001 R11: ffffed0036a9cf52 R12: ffff8801d90c0ad0
      [  137.403318] R13: ffff8801d853fb20 R14: ffff8801d8bcbb28 R15: 0000000000000014
      [  137.404736] FS:  00007fb415d43740(0000) GS:ffff8801e5c00000(0000) knlGS:0000000000000000
      [  137.406074] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  137.407101] CR2: 00007fb41557df20 CR3: 00000001b580c001 CR4: 00000000003606b0
      [  137.408308] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [  137.409352] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [  137.410385] Call Trace:
      [  137.411058]  ib_destroy_cq+0x23/0x60
      [  137.411460]  uverbs_free_cq+0x37/0xa0
      [  137.412040]  remove_commit_idr_uobject+0x38/0xf0
      [  137.413042]  _rdma_remove_commit_uobject+0x5c/0x160
      [  137.413782]  ? lookup_get_idr_uobject+0x39/0x50
      [  137.414737]  rdma_remove_commit_uobject+0x3b/0x70
      [  137.415742]  ib_uverbs_destroy_cq+0x114/0x1d0
      [  137.416260]  ? ib_uverbs_req_notify_cq+0x160/0x160
      [  137.417073]  ? kernel_text_address+0x5c/0x90
      [  137.417805]  ? __kernel_text_address+0xe/0x30
      [  137.418766]  ? unwind_get_return_address+0x2f/0x50
      [  137.419558]  ib_uverbs_write+0x453/0x6a0
      [  137.420220]  ? show_ibdev+0x90/0x90
      [  137.420653]  ? __kasan_slab_free+0x136/0x180
      [  137.421155]  ? kmem_cache_free+0x78/0x1e0
      [  137.422192]  ? remove_vma+0x83/0x90
      [  137.422614]  ? do_munmap+0x447/0x6c0
      [  137.423045]  ? vm_munmap+0xb0/0x100
      [  137.423481]  ? SyS_munmap+0x1d/0x30
      [  137.424120]  ? do_syscall_64+0xeb/0x250
      [  137.424984]  ? entry_SYSCALL_64_after_hwframe+0x21/0x86
      [  137.425611]  ? lru_add_drain_all+0x270/0x270
      [  137.426116]  ? lru_add_drain_cpu+0xa3/0x170
      [  137.426616]  ? lru_add_drain+0x11/0x20
      [  137.427058]  ? free_pages_and_swap_cache+0xa6/0x120
      [  137.427672]  ? tlb_flush_mmu_free+0x78/0x90
      [  137.428168]  ? arch_tlb_finish_mmu+0x6d/0xb0
      [  137.428680]  __vfs_write+0xc4/0x350
      [  137.430917]  ? kernel_read+0xa0/0xa0
      [  137.432758]  ? remove_vma+0x90/0x90
      [  137.434781]  ? __kasan_slab_free+0x14b/0x180
      [  137.437486]  ? remove_vma+0x83/0x90
      [  137.439836]  ? kmem_cache_free+0x78/0x1e0
      [  137.442195]  ? percpu_counter_add_batch+0x1d/0x90
      [  137.444389]  vfs_write+0xf7/0x280
      [  137.446030]  SyS_write+0xa1/0x120
      [  137.447867]  ? SyS_read+0x120/0x120
      [  137.449670]  ? mm_fault_error+0x180/0x180
      [  137.451539]  ? _cond_resched+0x16/0x50
      [  137.453697]  ? SyS_read+0x120/0x120
      [  137.455883]  do_syscall_64+0xeb/0x250
      [  137.457686]  entry_SYSCALL_64_after_hwframe+0x21/0x86
      [  137.459595] RIP: 0033:0x7fb415637b94
      [  137.461315] RSP: 002b:00007ffdebea7d88 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
      [  137.463879] RAX: ffffffffffffffda RBX: 00005565022d1bd0 RCX: 00007fb415637b94
      [  137.466519] RDX: 0000000000000018 RSI: 00007ffdebea7da0 RDI: 0000000000000003
      [  137.469543] RBP: 00007ffdebea7d98 R08: 0000000000000000 R09: 00005565022d40c0
      [  137.472479] R10: 00000000000009cf R11: 0000000000000246 R12: 00005565022d2520
      [  137.475125] R13: 00000000000003e8 R14: 0000000000000000 R15: 00007ffdebea7fd0
      [  137.477760] Code: f7 e8 dd 0d 0b ff 48 c7 43 40 00 00 00 00 48 89 df e8 0d 0b 0b ff 48 8d 7b 28 c6 03 00 e8 41 0d 0b ff 48 8b 7b 28 48 85 ff 74 06 <f0> ff 4f 48 74 10 5b 48 89 ef 5d 41 5c 41 5d 41 5e e9 32 b0 ee
      [  137.483375] RIP: rdma_restrack_del+0xc8/0xf0 RSP: ffff8801b54e7968
      [  137.486436] ---[ end trace 81835a1ea6722eed ]---
      [  137.488566] Kernel panic - not syncing: Fatal exception
      [  137.491162] Kernel Offset: 0x36000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
      
      Fixes: 00313983 ("RDMA/nldev: provide detailed CM_ID information")
      Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
      Reviewed-by: default avatarSteve Wise <swise@opengridcomputing.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      7d9a935e
  3. 15 Mar, 2018 29 commits
  4. 14 Mar, 2018 7 commits
    • Doug Ledford's avatar
      Merge branch 'k.o/wip/dl-for-rc' into k.o/wip/dl-for-next · 2d873449
      Doug Ledford authored
      Due to bug fixes found by the syzkaller bot and taken into the for-rc
      branch after development for the 4.17 merge window had already started
      being taken into the for-next branch, there were fairly non-trivial
      merge issues that would need to be resolved between the for-rc branch
      and the for-next branch.  This merge resolves those conflicts and
      provides a unified base upon which ongoing development for 4.17 can
      be based.
      
      Conflicts:
      	drivers/infiniband/hw/mlx5/main.c - Commit 42cea83f
      	(IB/mlx5: Fix cleanup order on unload) added to for-rc and
      	commit b5ca15ad (IB/mlx5: Add proper representors support)
      	add as part of the devel cycle both needed to modify the
      	init/de-init functions used by mlx5.  To support the new
      	representors, the new functions added by the cleanup patch
      	needed to be made non-static, and the init/de-init list
      	added by the representors patch needed to be modified to
      	match the init/de-init list changes made by the cleanup
      	patch.
      Updates:
      	drivers/infiniband/hw/mlx5/mlx5_ib.h - Update function
      	prototypes added by representors patch to reflect new function
      	names as changed by cleanup patch
      	drivers/infiniband/hw/mlx5/ib_rep.c - Update init/de-init
      	stage list to match new order from cleanup patch
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      2d873449
    • Arnd Bergmann's avatar
      infiniband: bnxt_re: use BIT_ULL() for 64-bit bit masks · bd8602ca
      Arnd Bergmann authored
      On 32-bit targets, we otherwise get a warning about an impossible constant
      integer expression:
      
      In file included from include/linux/kernel.h:11,
                       from include/linux/interrupt.h:6,
                       from drivers/infiniband/hw/bnxt_re/ib_verbs.c:39:
      drivers/infiniband/hw/bnxt_re/ib_verbs.c: In function 'bnxt_re_query_device':
      include/linux/bitops.h:7:24: error: left shift count >= width of type [-Werror=shift-count-overflow]
       #define BIT(nr)   (1UL << (nr))
                              ^~
      drivers/infiniband/hw/bnxt_re/bnxt_re.h:61:34: note: in expansion of macro 'BIT'
       #define BNXT_RE_MAX_MR_SIZE_HIGH BIT(39)
                                        ^~~
      drivers/infiniband/hw/bnxt_re/bnxt_re.h:62:30: note: in expansion of macro 'BNXT_RE_MAX_MR_SIZE_HIGH'
       #define BNXT_RE_MAX_MR_SIZE  BNXT_RE_MAX_MR_SIZE_HIGH
                                    ^~~~~~~~~~~~~~~~~~~~~~~~
      drivers/infiniband/hw/bnxt_re/ib_verbs.c:149:25: note: in expansion of macro 'BNXT_RE_MAX_MR_SIZE'
        ib_attr->max_mr_size = BNXT_RE_MAX_MR_SIZE;
                               ^~~~~~~~~~~~~~~~~~~
      
      Fixes: 872f3578 ("RDMA/bnxt_re: Add support for MRs with Huge pages")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      bd8602ca
    • Arnd Bergmann's avatar
      infiniband: qplib_fp: fix pointer cast · 5388a508
      Arnd Bergmann authored
      Building for a 32-bit target results in a couple of warnings from casting
      between a 32-bit pointer and a 64-bit integer:
      
      drivers/infiniband/hw/bnxt_re/qplib_fp.c: In function 'bnxt_qplib_service_nq':
      drivers/infiniband/hw/bnxt_re/qplib_fp.c:333:23: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
          bnxt_qplib_arm_srq((struct bnxt_qplib_srq *)q_handle,
                             ^
      drivers/infiniband/hw/bnxt_re/qplib_fp.c:336:12: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
                  (struct bnxt_qplib_srq *)q_handle,
                  ^
      In file included from include/linux/byteorder/little_endian.h:5,
                       from arch/arm/include/uapi/asm/byteorder.h:22,
                       from include/asm-generic/bitops/le.h:6,
                       from arch/arm/include/asm/bitops.h:342,
                       from include/linux/bitops.h:38,
                       from include/linux/kernel.h:11,
                       from include/linux/interrupt.h:6,
                       from drivers/infiniband/hw/bnxt_re/qplib_fp.c:39:
      drivers/infiniband/hw/bnxt_re/qplib_fp.c: In function 'bnxt_qplib_create_srq':
      include/uapi/linux/byteorder/little_endian.h:31:43: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast]
       #define __cpu_to_le64(x) ((__force __le64)(__u64)(x))
                                                 ^
      include/linux/byteorder/generic.h:86:21: note: in expansion of macro '__cpu_to_le64'
       #define cpu_to_le64 __cpu_to_le64
                           ^~~~~~~~~~~~~
      drivers/infiniband/hw/bnxt_re/qplib_fp.c:569:19: note: in expansion of macro 'cpu_to_le64'
        req.srq_handle = cpu_to_le64(srq);
      
      Using a uintptr_t as an intermediate works on all architectures.
      
      Fixes: 37cb11ac ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      5388a508
    • Andrew Morton's avatar
      drivers/infiniband/ulp/srpt/ib_srpt.c: fix build with gcc-4.4.4 · 06892cc1
      Andrew Morton authored
      gcc-4.4.4 has issues with initialization of anonymous unions:
      
      drivers/infiniband/ulp/srpt/ib_srpt.c: In function 'srpt_zerolength_write':
      drivers/infiniband/ulp/srpt/ib_srpt.c:854: error: unknown field 'wr_cqe' specified in initializer
      drivers/infiniband/ulp/srpt/ib_srpt.c:854: warning: initialization makes integer from pointer without a cast
      
      Work aound this.
      
      Fixes: 2a78cb4d ("IB/srpt: Fix an out-of-bounds stack access in srpt_zerolength_write()")
      Cc: Bart Van Assche <bart.vanassche@wdc.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Jason Gunthorpe <jgg@mellanox.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      06892cc1
    • Andrew Morton's avatar
      drivers/infiniband/core/verbs.c: fix build with gcc-4.4.4 · 6ee68773
      Andrew Morton authored
      gcc-4.4.4 has issues with initialization of anonymous unions.
      
      drivers/infiniband/core/verbs.c: In function '__ib_drain_sq':
      drivers/infiniband/core/verbs.c:2204: error: unknown field 'wr_cqe' specified in initializer
      drivers/infiniband/core/verbs.c:2204: warning: initialization makes integer from pointer without a cast
      
      Work around this.
      
      Fixes: a1ae7d03 ("RDMA/core: Avoid that ib_drain_qp() triggers an out-of-bounds stack access")
      Cc: Bart Van Assche <bart.vanassche@wdc.com>
      Cc: Steve Wise <swise@opengridcomputing.com>
      Cc: Sagi Grimberg <sagi@grimberg.me>
      Cc: Jason Gunthorpe <jgg@mellanox.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      6ee68773
    • Mark Bloch's avatar
      IB/mlx5: Fix cleanup order on unload · 42cea83f
      Mark Bloch authored
      On load we create private CQ/QP/PD in order to be used by UMR, we create
      those resources after we register ourself as an IB device, and we destroy
      them after we unregister as an IB device. This was changed by commit
      16c1975f ("IB/mlx5: Create profile infrastructure to add and remove
      stages") which moved the destruction before we unregistration. This
      allowed to trigger an invalid memory access when unloading mlx5_ib while
      there are open resources:
      
      BUG: unable to handle kernel paging request at 00000001002c012c
      ...
      Call Trace:
       mlx5_ib_post_send_wait+0x75/0x110 [mlx5_ib]
       __slab_free+0x9a/0x2d0
       delay_time_func+0x10/0x10 [mlx5_ib]
       unreg_umr.isra.15+0x4b/0x50 [mlx5_ib]
       mlx5_mr_cache_free+0x46/0x150 [mlx5_ib]
       clean_mr+0xc9/0x190 [mlx5_ib]
       dereg_mr+0xba/0xf0 [mlx5_ib]
       ib_dereg_mr+0x13/0x20 [ib_core]
       remove_commit_idr_uobject+0x16/0x70 [ib_uverbs]
       uverbs_cleanup_ucontext+0xe8/0x1a0 [ib_uverbs]
       ib_uverbs_cleanup_ucontext.isra.9+0x19/0x40 [ib_uverbs]
       ib_uverbs_remove_one+0x162/0x2e0 [ib_uverbs]
       ib_unregister_device+0xd4/0x190 [ib_core]
       __mlx5_ib_remove+0x2e/0x40 [mlx5_ib]
       mlx5_remove_device+0xf5/0x120 [mlx5_core]
       mlx5_unregister_interface+0x37/0x90 [mlx5_core]
       mlx5_ib_cleanup+0xc/0x225 [mlx5_ib]
       SyS_delete_module+0x153/0x230
       do_syscall_64+0x62/0x110
       entry_SYSCALL_64_after_hwframe+0x21/0x86
      ...
      
      We restore the original behavior by breaking the UMR stage into two parts,
      pre and post IB registration stages, this way we can restore the original
      functionality and maintain clean separation of logic between stages.
      
      Fixes: 16c1975f ("IB/mlx5: Create profile infrastructure to add and remove stages")
      Signed-off-by: default avatarMark Bloch <markb@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      42cea83f
    • Martin Wilck's avatar
      rdma_rxe: make rxe work over 802.1q VLAN devices · 43c9fc50
      Martin Wilck authored
      This patch fixes RDMA/rxe over 802.1q VLAN devices.
      
      Without it, I observed the following behavior:
      
      a) adding a VLAN device to RXE via rxe_net_add() creates a non-functional
         RDMA device. This is caused by the logic in enum_all_gids_of_dev_cb() /
         is_eth_port_of_netdev(), which only considers networks connected to
         "upper devices" of the configured network device, resulting in an empty
         set of gids for a VLAN interface that is an "upper device" itself.
         Later attempts to connect via this rdma device fail in cma_acuire_dev()
         because no gids can be resolved.
      
      b) adding the master device of the VLAN device instead seems to work
         initially, target addresses via VLAN devices are resolved successfully.
         But the connection times out because no 802.1q VLAN headers are
         inserted in the ethernet packets, which are therefore never received.
         This happens because the RXE layer sends the packets via the master
         device rather than the VLAN device.
      
      The problem could be solved by changing either a) or b). My thinking was
      that the logic in a) was created deliberately, thus I decided to work on
      b). It turns out that the information about the VLAN interface for the gid
      at hand is available in the AV information. My patch converts the RXE code
      to use this netdev instead of rxe->ndev. With this change, RXE over vlan
      works on my test system.
      Signed-off-by: default avatarMartin Wilck <mwilck@suse.com>
      Reviewed-by: default avatarMoni Shoua <monis@mellanox.com>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      43c9fc50