linux-stable.git/drivers/infiniband, branch v4.13.4

IB/mlx5: Fix cached MR allocation flow

2017-09-27T12:43:11+00:00

commit 4c25b7a39005c9243a492b577c3e940eeac36a25 upstream.

When we have a miss in one order of the mkey cache, we try to get
an mkey from a higher order.

We still need to check that the higher order can be used with UMR
before using it. Otherwise, we will get an mkey with 0 entries and
the post send operation that is used to fill it will complete with
the following error:

mlx5_0:dump_cqe:275:(pid 0): dump error cqe
00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000
00000000 0f007806 25000025 49ce59d2

Fixes: 49780d42dfc9 ("IB/mlx5: Expose MR cache for mlx5_ib")
Signed-off-by: Majd Dibbiny 
Reviewed-by: Ilya Lesokhin 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/{qib, hfi1}: Avoid flow control testing for RDMA write operation

2017-09-27T12:43:11+00:00

commit 5b0ef650bd0f820e922fcc42f1985d4621ae19cf upstream.

Section 9.7.7.2.5 of the 1.3 IBTA spec clearly says that receive
credits should never apply to RDMA write.

qib and hfi1 were doing that.  The following situation will result
in a QP hang:
- A prior SEND or RDMA_WRITE with immmediate consumed the last
  credit for a QP using RC receive buffer credits
- The prior op is acked so there are no more acks
- The peer ULP fails to post receive for some reason
- An RDMA write sees that the credits are exhausted and waits
- The peer ULP posts receive buffers
- The ULP posts a send or RDMA write that will be hung

The fix is to avoid the credit test for the RDMA write operation.

Reviewed-by: Kaike Wan 
Signed-off-by: Mike Marciniszyn 
Signed-off-by: Dennis Dalessandro 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/hfi1: Revert egress pkey check enforcement

2017-09-27T12:43:11+00:00

commit ecdb19f4b513033e6f2c4326cd5b81e04393e5e1 upstream.

Current code has some serious flaws. Disarm the flag
pending an appropriate patch.

Fixes: 53526500f301 ("IB/hfi1: Permanently enable P_Key checking in HFI")
Reviewed-by: Mike Marciniszyn 
Signed-off-by: Alex Estrin 
Signed-off-by: Dennis Dalessandro 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/hfi1: update to new mmu_notifier semantic

2017-08-31T23:12:59+00:00

Calls to mmu_notifier_invalidate_page() were replaced by calls to
mmu_notifier_invalidate_range() and are now bracketed by calls to
mmu_notifier_invalidate_range_start()/end()

Remove now useless invalidate_page callback.

Signed-off-by: Jérôme Glisse 
Cc: linux-rdma@vger.kernel.org
Cc: Dean Luick 
Cc: Ira Weiny 
Cc: Doug Ledford 
Cc: Kirill A. Shutemov 
Cc: Andrew Morton 
Cc: Andrea Arcangeli 
Signed-off-by: Linus Torvalds

IB/umem: update to new mmu_notifier semantic

2017-08-31T23:12:59+00:00

Calls to mmu_notifier_invalidate_page() were replaced by calls to
mmu_notifier_invalidate_range() and are now bracketed by calls to
mmu_notifier_invalidate_range_start()/end()

Remove now useless invalidate_page callback.

Signed-off-by: Jérôme Glisse 
Tested-by: Leon Romanovsky 
Cc: linux-rdma@vger.kernel.org
Cc: Artemy Kovalyov 
Cc: Doug Ledford 
Cc: Kirill A. Shutemov 
Cc: Andrew Morton 
Cc: Andrea Arcangeli 
Signed-off-by: Linus Torvalds

IB/mlx5: Always return success for RoCE modify port

2017-08-24T19:33:33+00:00

CM layer calls ib_modify_port() regardless of the link layer.

For the Ethernet ports, qkey violation and Port capabilities
are meaningless. Therefore, always return success for ib_modify_port
calls on the Ethernet ports.

Cc: Selvin Xavier 
Signed-off-by: Majd Dibbiny 
Reviewed-by: Moni Shoua 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford

IB/mlx5: Fix Raw Packet QP event handler assignment

2017-08-24T19:33:33+00:00

In case we have SQ and RQ for Raw Packet QP, the SQ's event handler
wasn't assigned.

Fixing this by assigning event handler for each WQ after creation.

[ 1877.145243] Call Trace:
[ 1877.148644] 
[ 1877.150580] [] ? mlx5_rsc_event+0x105/0x210 [mlx5_core]
[ 1877.159581] [] ? mlx5_cq_event+0x57/0xd0 [mlx5_core]
[ 1877.167137] [] mlx5_eq_int+0x53e/0x6c0 [mlx5_core]
[ 1877.174526] [] ? sched_clock+0x9/0x10
[ 1877.180753] [] handle_irq_event_percpu+0x3e/0x1e0
[ 1877.188014] [] handle_irq_event+0x3d/0x60
[ 1877.194567] [] handle_edge_irq+0x77/0x130
[ 1877.201129] [] handle_irq+0xbf/0x150
[ 1877.207244] [] ? atomic_notifier_call_chain+0x1a/0x20
[ 1877.214829] [] do_IRQ+0x4f/0xf0
[ 1877.220498] [] common_interrupt+0x6d/0x6d
[ 1877.227025] 
[ 1877.228967] [] ? cpuidle_enter_state+0x52/0xc0
[ 1877.236990] [] cpuidle_idle_call+0xc5/0x200
[ 1877.243676] [] arch_cpu_idle+0xe/0x30
[ 1877.249831] [] cpu_startup_entry+0xf5/0x290
[ 1877.256513] [] start_secondary+0x265/0x27b
[ 1877.263111] Code: Bad RIP value.
[ 1877.267296] RIP [< (null)>] (null)
[ 1877.273264] RSP 
[ 1877.277531] CR2: 0000000000000000

Fixes: 19098df2da78 ("IB/mlx5: Refactor mlx5_ib_qp to accommodate other QP types")
Signed-off-by: Majd Dibbiny 
Reviewed-by: Yishai Hadas 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford

IB/core: Avoid accessing non-allocated memory when inferring port type

2017-08-24T19:33:33+00:00

Commit 44c58487d51a ("IB/core: Define 'ib' and 'roce' rdma_ah_attr types")
introduced the concept of type in ah_attr:
 * During ib_register_device, each port is checked for its type which
   is stored in ib_device's port_immutable array.
 * During uverbs' modify_qp, the type is inferred using the port number
   in ib_uverbs_qp_dest struct (address vector) by accessing the
   relevant port_immutable array and the type is passed on to
   providers.

IB spec (version 1.3) enforces a valid port value only in Reset to
Init. During Init to RTR, the address vector must be valid but port
number is not mentioned as a field in the address vector, so its
value is not validated, which leads to accesses to a non-allocated
memory when inferring the port type.

Save the real port number in ib_qp during modify to Init (when the
comp_mask indicates that the port number is valid) and use this value
to infer the port type.

Avoid copying the address vector fields if the matching bit is not set
in the attr_mask. Address vector can't be modified before the port, so
no valid flow is affected.

Fixes: 44c58487d51a ('IB/core: Define 'ib' and 'roce' rdma_ah_attr types')
Signed-off-by: Noa Osherovich 
Reviewed-by: Yishai Hadas 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford

RDMA/uverbs: Initialize cq_context appropriately

2017-08-22T17:55:47+00:00

Initializing cq_context with ev_queue in create_cq(), leads to NULL pointer
dereference in ib_uverbs_comp_handler(), if application doesnot use completion
channel. This patch fixes the cq_context initialization.

Fixes: 1e7710f3f65 ("IB/core: Change completion channel to use the reworked")
Cc: stable@vger.kernel.org # 4.12
Signed-off-by: Potnuri Bharat Teja 
Reviewed-by: Matan Barak 
Signed-off-by: Doug Ledford 
(cherry picked from commit 699a2d5b1b880b4e4e1c7d55fa25659322cf5b51)

IB/uverbs: Fix NULL pointer dereference during device removal

2017-08-16T16:53:15+00:00

As part of ib_uverbs_remove_one which might be triggered upon
reset flow, we trigger IB_EVENT_DEVICE_FATAL event to userspace
application.
If device was removed after uverbs fd was opened but before
ib_uverbs_get_context was called, the event file will be accessed
before it was allocated, result in NULL pointer dereference:

[ 72.325873] BUG: unable to handle kernel NULL pointer dereference at (null)
...
[ 72.325984] IP: _raw_spin_lock_irqsave+0x22/0x40
[ 72.327123] Call Trace:
[ 72.327168] ib_uverbs_async_handler.isra.8+0x2e/0x160 [ib_uverbs]
[ 72.327216] ? synchronize_srcu_expedited+0x27/0x30
[ 72.327269] ib_uverbs_remove_one+0x120/0x2c0 [ib_uverbs]
[ 72.327330] ib_unregister_device+0xd0/0x180 [ib_core]
[ 72.327373] mlx5_ib_remove+0x74/0x140 [mlx5_ib]
[ 72.327422] mlx5_remove_device+0xfb/0x110 [mlx5_core]
[ 72.327466] mlx5_unregister_interface+0x3c/0xa0 [mlx5_core]
[ 72.327509] mlx5_ib_cleanup+0x10/0x962 [mlx5_ib]
[ 72.327546] SyS_delete_module+0x155/0x230
[ 72.328472] ? exit_to_usermode_loop+0x70/0xa6
[ 72.329370] do_syscall_64+0x54/0xc0
[ 72.330262] entry_SYSCALL64_slow_path+0x25/0x25

Fix it by checking that user context was allocated before
trigger the event.

Fixes: 036b10635739 ('IB/uverbs: Enable device removal when there are active user space applications')
Signed-off-by: Maor Gottlieb 
Reviewed-by: Matan Barak 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford