From 11205342a2c7cca2843992bd389b69d3f99f9a44 Mon Sep 17 00:00:00 2001 From: Denis Kirjanov Date: Dec 01 2020 09:01:51 +0000 Subject: Merge remote-tracking branch 'origin/SLE15-SP1' into SLE12-SP5 --- diff --git a/blacklist.conf b/blacklist.conf index 7b5bf9d..770da46 100644 --- a/blacklist.conf +++ b/blacklist.conf @@ -1699,3 +1699,6 @@ da6a496a34f2fdcab14362cdc5068aac385e7b47 # mlx5 ODP too much overall and kABI ch 1769c4c575489be28891c98f1e3f0a4252ca750a # mlx5 ODP too much overall and kABI changes 5eb29f0d13a66502b91954597270003c90fb66c5 # mlx5 ODP too much overall and kABI changes f3bc432aa8a7a2bfe9ebb432502be5c5d979d7fe # USB: depends on %px support (7b1924a1d930) +c87e65cfb97c7f325132a68288ed76ba7bdcd2c6 # Move debug counters within sysfs +eb52c0333f06b88bca5bac0dc0aeca729de6eb11 # Applies but broken. Fixes requires bits_per() +777a8b32bc0f9bb25848a025f72a9febc30d9033 # Used functions break kABI \ No newline at end of file diff --git a/patches.suse/IB-cma-Fix-ports-memory-leak-in-cma_configfs.patch b/patches.suse/IB-cma-Fix-ports-memory-leak-in-cma_configfs.patch new file mode 100644 index 0000000..dcfad80 --- /dev/null +++ b/patches.suse/IB-cma-Fix-ports-memory-leak-in-cma_configfs.patch @@ -0,0 +1,53 @@ +From 63a3345c2d42a9b29e1ce2d3a4043689b3995cea Mon Sep 17 00:00:00 2001 +From: Maor Gottlieb +Date: Thu, 21 May 2020 10:26:50 +0300 +Subject: [PATCH 1/1] IB/cma: Fix ports memory leak in cma_configfs +Git-commit: 63a3345c2d42a9b29e1ce2d3a4043689b3995cea +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +The allocated ports structure in never freed. The free function should be +called by release_cma_ports_group, but the group is never released since +we don't remove its default group. + +Remove default groups when device group is deleted. + +Fixes: 045959db65c6 ("IB/cma: Add configfs for rdma_cm") +Link: https://lore.kernel.org/r/20200521072650.567908-1-leon@kernel.org +Signed-off-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/core/cma_configfs.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/infiniband/core/cma_configfs.c b/drivers/infiniband/core/cma_configfs.c +index c672a4978bfd..3c1e2ca564fe 100644 +--- a/drivers/infiniband/core/cma_configfs.c ++++ b/drivers/infiniband/core/cma_configfs.c +@@ -322,8 +322,21 @@ fail: + return ERR_PTR(err); + } + ++static void drop_cma_dev(struct config_group *cgroup, struct config_item *item) ++{ ++ struct config_group *group = ++ container_of(item, struct config_group, cg_item); ++ struct cma_dev_group *cma_dev_group = ++ container_of(group, struct cma_dev_group, device_group); ++ ++ configfs_remove_default_groups(&cma_dev_group->ports_group); ++ configfs_remove_default_groups(&cma_dev_group->device_group); ++ config_item_put(item); ++} ++ + static struct configfs_group_operations cma_subsys_group_ops = { + .make_group = make_cma_dev, ++ .drop_item = drop_cma_dev, + }; + + static struct config_item_type cma_subsys_type = { +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/IB-hfi1-Call-kobject_put-when-kobject_init_and_add-f.patch b/patches.suse/IB-hfi1-Call-kobject_put-when-kobject_init_and_add-f.patch new file mode 100644 index 0000000..35a0e6b --- /dev/null +++ b/patches.suse/IB-hfi1-Call-kobject_put-when-kobject_init_and_add-f.patch @@ -0,0 +1,82 @@ +From dfb5394f804ed4fcea1fc925be275a38d66712ab Mon Sep 17 00:00:00 2001 +From: Kaike Wan +Date: Thu, 26 Mar 2020 12:38:14 -0400 +Subject: [PATCH 1/1] IB/hfi1: Call kobject_put() when kobject_init_and_add() +Git-commit: dfb5394f804ed4fcea1fc925be275a38d66712ab +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + fails + +When kobject_init_and_add() returns an error in the function +hfi1_create_port_files(), the function kobject_put() is not called for the +corresponding kobject, which potentially leads to memory leak. + +This patch fixes the issue by calling kobject_put() even if +kobject_init_and_add() fails. + +Cc: +Link: https://lore.kernel.org/r/20200326163813.21129.44280.stgit@awfm-01.aw.intel.com +Reviewed-by: Mike Marciniszyn +Signed-off-by: Kaike Wan +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/hfi1/sysfs.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/sysfs.c b/drivers/infiniband/hw/hfi1/sysfs.c +index f1bcecf92535..074ec71772d2 100644 +--- a/drivers/infiniband/hw/hfi1/sysfs.c ++++ b/drivers/infiniband/hw/hfi1/sysfs.c +@@ -674,7 +674,11 @@ int hfi1_create_port_files(struct ib_device *ibdev, u8 port_num, + dd_dev_err(dd, + "Skipping sc2vl sysfs info, (err %d) port %u\n", + ret, port_num); +- goto bail; ++ /* ++ * Based on the documentation for kobject_init_and_add(), the ++ * caller should call kobject_put even if this call fails. ++ */ ++ goto bail_sc2vl; + } + kobject_uevent(&ppd->sc2vl_kobj, KOBJ_ADD); + +@@ -684,7 +688,7 @@ int hfi1_create_port_files(struct ib_device *ibdev, u8 port_num, + dd_dev_err(dd, + "Skipping sl2sc sysfs info, (err %d) port %u\n", + ret, port_num); +- goto bail_sc2vl; ++ goto bail_sl2sc; + } + kobject_uevent(&ppd->sl2sc_kobj, KOBJ_ADD); + +@@ -694,7 +698,7 @@ int hfi1_create_port_files(struct ib_device *ibdev, u8 port_num, + dd_dev_err(dd, + "Skipping vl2mtu sysfs info, (err %d) port %u\n", + ret, port_num); +- goto bail_sl2sc; ++ goto bail_vl2mtu; + } + kobject_uevent(&ppd->vl2mtu_kobj, KOBJ_ADD); + +@@ -704,7 +708,7 @@ int hfi1_create_port_files(struct ib_device *ibdev, u8 port_num, + dd_dev_err(dd, + "Skipping Congestion Control sysfs info, (err %d) port %u\n", + ret, port_num); +- goto bail_vl2mtu; ++ goto bail_cc; + } + + kobject_uevent(&ppd->pport_cc_kobj, KOBJ_ADD); +@@ -742,7 +746,6 @@ bail_sl2sc: + kobject_put(&ppd->sl2sc_kobj); + bail_sc2vl: + kobject_put(&ppd->sc2vl_kobj); +-bail: + return ret; + } + +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/IB-hfi1-Fix-memory-leaks-in-sysfs-registration-and-u.patch b/patches.suse/IB-hfi1-Fix-memory-leaks-in-sysfs-registration-and-u.patch new file mode 100644 index 0000000..b122fa8 --- /dev/null +++ b/patches.suse/IB-hfi1-Fix-memory-leaks-in-sysfs-registration-and-u.patch @@ -0,0 +1,85 @@ +From 5c15abc4328ad696fa61e2f3604918ed0c207755 Mon Sep 17 00:00:00 2001 +From: Kaike Wan +Date: Thu, 26 Mar 2020 12:38:07 -0400 +Subject: [PATCH 1/1] IB/hfi1: Fix memory leaks in sysfs registration and +Git-commit: 5c15abc4328ad696fa61e2f3604918ed0c207755 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + unregistration + +When the hfi1 driver is unloaded, kmemleak will report the following +issue: + +unreferenced object 0xffff8888461a4c08 (size 8): +comm "kworker/0:0", pid 5, jiffies 4298601264 (age 2047.134s) +hex dump (first 8 bytes): +73 64 6d 61 30 00 ff ff sdma0... +backtrace: +[<00000000311a6ef5>] kvasprintf+0x62/0xd0 +[<00000000ade94d9f>] kobject_set_name_vargs+0x1c/0x90 +[<0000000060657dbb>] kobject_init_and_add+0x5d/0xb0 +[<00000000346fe72b>] 0xffffffffa0c5ecba +[<000000006cfc5819>] 0xffffffffa0c866b9 +[<0000000031c65580>] 0xffffffffa0c38e87 +[<00000000e9739b3f>] local_pci_probe+0x41/0x80 +[<000000006c69911d>] work_for_cpu_fn+0x16/0x20 +[<00000000601267b5>] process_one_work+0x171/0x380 +[<0000000049a0eefa>] worker_thread+0x1d1/0x3f0 +[<00000000909cf2b9>] kthread+0xf8/0x130 +[<0000000058f5f874>] ret_from_fork+0x35/0x40 + +This patch fixes the issue by: + +- Releasing dd->per_sdma[i].kobject in hfi1_unregister_sysfs(). + - This will fix the memory leak. + +- Calling kobject_put() to unwind operations only for those entries in + dd->per_sdma[] whose operations have succeeded (including the current + one that has just failed) in hfi1_verbs_register_sysfs(). + +Cc: +Fixes: 0cb2aa690c7e ("IB/hfi1: Add sysfs interface for affinity setup") +Link: https://lore.kernel.org/r/20200326163807.21129.27371.stgit@awfm-01.aw.intel.com +Reviewed-by: Mike Marciniszyn +Signed-off-by: Kaike Wan +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/hfi1/sysfs.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/sysfs.c b/drivers/infiniband/hw/hfi1/sysfs.c +index 90f62c4bddba..f1bcecf92535 100644 +--- a/drivers/infiniband/hw/hfi1/sysfs.c ++++ b/drivers/infiniband/hw/hfi1/sysfs.c +@@ -853,8 +853,13 @@ int hfi1_verbs_register_sysfs(struct hfi1_devdata *dd) + + return 0; + bail: +- for (i = 0; i < dd->num_sdma; i++) +- kobject_del(&dd->per_sdma[i].kobj); ++ /* ++ * The function kobject_put() will call kobject_del() if the kobject ++ * has been added successfully. The sysfs files created under the ++ * kobject directory will also be removed during the process. ++ */ ++ for (; i >= 0; i--) ++ kobject_put(&dd->per_sdma[i].kobj); + + return ret; + } +@@ -867,6 +872,10 @@ void hfi1_verbs_unregister_sysfs(struct hfi1_devdata *dd) + struct hfi1_pportdata *ppd; + int i; + ++ /* Unwind operations in hfi1_verbs_register_sysfs() */ ++ for (i = 0; i < dd->num_sdma; i++) ++ kobject_put(&dd->per_sdma[i].kobj); ++ + for (i = 0; i < dd->num_pports; i++) { + ppd = &dd->pport[i]; + +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/IB-ipoib-Fix-double-free-of-skb-in-case-of-multicast.patch b/patches.suse/IB-ipoib-Fix-double-free-of-skb-in-case-of-multicast.patch new file mode 100644 index 0000000..e0bb89c --- /dev/null +++ b/patches.suse/IB-ipoib-Fix-double-free-of-skb-in-case-of-multicast.patch @@ -0,0 +1,242 @@ +From 1acba6a817852d4aa7916d5c4f2c82f702ee9224 Mon Sep 17 00:00:00 2001 +From: Valentine Fatiev +Date: Wed, 27 May 2020 16:47:05 +0300 +Subject: [PATCH 1/1] IB/ipoib: Fix double free of skb in case of multicast +Git-commit: 1acba6a817852d4aa7916d5c4f2c82f702ee9224 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + traffic in CM mode + +When connected mode is set, and we have connected and datagram traffic in +parallel, ipoib might crash with double free of datagram skb. + +The current mechanism assumes that the order in the completion queue is +the same as the order of sent packets for all QPs. Order is kept only for +specific QP, in case of mixed UD and CM traffic we have few QPs (one UD and +few CM's) in parallel. + +The problem: +---------------------------------------------------------- + +Transmit queue: +----------------- +UD skb pointer kept in queue itself, CM skb kept in spearate queue and +uses transmit queue as a placeholder to count the number of total +transmitted packets. + +0 1 2 3 4 5 6 7 8 9 10 11 12 13 .........127 +------------------------------------------------------------ +NL ud1 UD2 CM1 ud3 cm2 cm3 ud4 cm4 ud5 NL NL NL ........... +------------------------------------------------------------ + ^ ^ + tail head + +Completion queue (problematic scenario) - the order not the same as in +the transmit queue: + + 1 2 3 4 5 6 7 8 9 +------------------------------------ + ud1 CM1 UD2 ud3 cm2 cm3 ud4 cm4 ud5 +------------------------------------ + +1. CM1 'wc' processing + - skb freed in cm separate ring. + - tx_tail of transmit queue increased although UD2 is not freed. + Now driver assumes UD2 index is already freed and it could be used for + new transmitted skb. + +0 1 2 3 4 5 6 7 8 9 10 11 12 13 .........127 +------------------------------------------------------------ +NL NL UD2 CM1 ud3 cm2 cm3 ud4 cm4 ud5 NL NL NL ........... +------------------------------------------------------------ + ^ ^ ^ + (Bad)tail head +(Bad - Could be used for new SKB) + +In this case (due to heavy load) UD2 skb pointer could be replaced by new +transmitted packet UD_NEW, as the driver assumes its free. At this point +we will have to process two 'wc' with same index but we have only one +pointer to free. + +During second attempt to free the same skb we will have NULL pointer +exception. + +2. UD2 'wc' processing + - skb freed according the index we got from 'wc', but it was already + overwritten by mistake. So actually the skb that was released is the + skb of the new transmitted packet and not the original one. + +3. UD_NEW 'wc' processing + - attempt to free already freed skb. NUll pointer exception. + +The fix: +----------------------------------------------------------------------- + +The fix is to stop using the UD ring as a placeholder for CM packets, the +cyclic ring variables tx_head and tx_tail will manage the UD tx_ring, a +new cyclic variables global_tx_head and global_tx_tail are introduced for +managing and counting the overall outstanding sent packets, then the send +queue will be stopped and waken based on these variables only. + +Note that no locking is needed since global_tx_head is updated in the xmit +flow and global_tx_tail is updated in the NAPI flow only. A previous +attempt tried to use one variable to count the outstanding sent packets, +but it did not work since xmit and NAPI flows can run at the same time and +the counter will be updated wrongly. Thus, we use the same simple cyclic +head and tail scheme that we have today for the UD tx_ring. + +Fixes: 2c104ea68350 ("IB/ipoib: Get rid of the tx_outstanding variable in all modes") +Link: https://lore.kernel.org/r/20200527134705.480068-1-leon@kernel.org +Signed-off-by: Valentine Fatiev +Signed-off-by: Alaa Hleihel +Signed-off-by: Leon Romanovsky +Acked-by: Doug Ledford +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/ulp/ipoib/ipoib.h | 4 ++++ + drivers/infiniband/ulp/ipoib/ipoib_cm.c | 15 +++++++++------ + drivers/infiniband/ulp/ipoib/ipoib_ib.c | 9 +++++++-- + drivers/infiniband/ulp/ipoib/ipoib_main.c | 10 ++++++---- + 4 files changed, 26 insertions(+), 12 deletions(-) + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h +index e188a95984b5..9a3379c49541 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib.h ++++ b/drivers/infiniband/ulp/ipoib/ipoib.h +@@ -377,8 +377,12 @@ struct ipoib_dev_priv { + struct ipoib_rx_buf *rx_ring; + + struct ipoib_tx_buf *tx_ring; ++ /* cyclic ring variables for managing tx_ring, for UD only */ + unsigned int tx_head; + unsigned int tx_tail; ++ /* cyclic ring variables for counting overall outstanding send WRs */ ++ unsigned int global_tx_head; ++ unsigned int global_tx_tail; + struct ib_sge tx_sge[MAX_SKB_FRAGS + 1]; + struct ib_ud_wr tx_wr; + struct ib_wc send_wc[MAX_SEND_CQE]; +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +index c59e00a0881f..9bf0fa30df28 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -756,7 +756,8 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_ + return; + } + +- if ((priv->tx_head - priv->tx_tail) == ipoib_sendq_size - 1) { ++ if ((priv->global_tx_head - priv->global_tx_tail) == ++ ipoib_sendq_size - 1) { + ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n", + tx->qp->qp_num); + netif_stop_queue(dev); +@@ -786,7 +787,7 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_ + } else { + netif_trans_update(dev); + ++tx->tx_head; +- ++priv->tx_head; ++ ++priv->global_tx_head; + } + } + +@@ -820,10 +821,11 @@ void ipoib_cm_handle_tx_wc(struct net_device *dev, struct ib_wc *wc) + netif_tx_lock(dev); + + ++tx->tx_tail; +- ++priv->tx_tail; ++ ++priv->global_tx_tail; + + if (unlikely(netif_queue_stopped(dev) && +- (priv->tx_head - priv->tx_tail) <= ipoib_sendq_size >> 1 && ++ ((priv->global_tx_head - priv->global_tx_tail) <= ++ ipoib_sendq_size >> 1) && + test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags))) + netif_wake_queue(dev); + +@@ -1232,8 +1234,9 @@ timeout: + dev_kfree_skb_any(tx_req->skb); + netif_tx_lock_bh(p->dev); + ++p->tx_tail; +- ++priv->tx_tail; +- if (unlikely(priv->tx_head - priv->tx_tail == ipoib_sendq_size >> 1) && ++ ++priv->global_tx_tail; ++ if (unlikely((priv->global_tx_head - priv->global_tx_tail) <= ++ ipoib_sendq_size >> 1) && + netif_queue_stopped(p->dev) && + test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags)) + netif_wake_queue(p->dev); +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +index c332b4761816..da3c5315bbb5 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +@@ -407,9 +407,11 @@ static void ipoib_ib_handle_tx_wc(struct net_device *dev, struct ib_wc *wc) + dev_kfree_skb_any(tx_req->skb); + + ++priv->tx_tail; ++ ++priv->global_tx_tail; + + if (unlikely(netif_queue_stopped(dev) && +- ((priv->tx_head - priv->tx_tail) <= ipoib_sendq_size >> 1) && ++ ((priv->global_tx_head - priv->global_tx_tail) <= ++ ipoib_sendq_size >> 1) && + test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags))) + netif_wake_queue(dev); + +@@ -634,7 +636,8 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb, + else + priv->tx_wr.wr.send_flags &= ~IB_SEND_IP_CSUM; + /* increase the tx_head after send success, but use it for queue state */ +- if (priv->tx_head - priv->tx_tail == ipoib_sendq_size - 1) { ++ if ((priv->global_tx_head - priv->global_tx_tail) == ++ ipoib_sendq_size - 1) { + ipoib_dbg(priv, "TX ring full, stopping kernel net queue\n"); + netif_stop_queue(dev); + } +@@ -662,6 +665,7 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb, + + rc = priv->tx_head; + ++priv->tx_head; ++ ++priv->global_tx_head; + } + return rc; + } +@@ -807,6 +811,7 @@ int ipoib_ib_dev_stop_default(struct net_device *dev) + ipoib_dma_unmap_tx(priv, tx_req); + dev_kfree_skb_any(tx_req->skb); + ++priv->tx_tail; ++ ++priv->global_tx_tail; + } + + for (i = 0; i < ipoib_recvq_size; ++i) { +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index 81b8227214f1..ceec24d45185 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -1184,9 +1184,11 @@ static void ipoib_timeout(struct net_device *dev, unsigned int txqueue) + + ipoib_warn(priv, "transmit timeout: latency %d msecs\n", + jiffies_to_msecs(jiffies - dev_trans_start(dev))); +- ipoib_warn(priv, "queue stopped %d, tx_head %u, tx_tail %u\n", +- netif_queue_stopped(dev), +- priv->tx_head, priv->tx_tail); ++ ipoib_warn(priv, ++ "queue stopped %d, tx_head %u, tx_tail %u, global_tx_head %u, global_tx_tail %u\n", ++ netif_queue_stopped(dev), priv->tx_head, priv->tx_tail, ++ priv->global_tx_head, priv->global_tx_tail); ++ + /* XXX reset QP, etc. */ + } + +@@ -1701,7 +1703,7 @@ static int ipoib_dev_init_default(struct net_device *dev) + goto out_rx_ring_cleanup; + } + +- /* priv->tx_head, tx_tail & tx_outstanding are already 0 */ ++ /* priv->tx_head, tx_tail and global_tx_tail/head are already 0 */ + + if (ipoib_transport_dev_init(dev, priv->ca)) { + pr_warn("%s: ipoib_transport_dev_init failed\n", +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/IB-mlx4-Add-and-improve-logging.patch b/patches.suse/IB-mlx4-Add-and-improve-logging.patch new file mode 100644 index 0000000..4d86e48 --- /dev/null +++ b/patches.suse/IB-mlx4-Add-and-improve-logging.patch @@ -0,0 +1,216 @@ +From 094619449a16672f9815964e1ad39e11ff84ae2c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?H=C3=A5kon=20Bugge?= +Date: Mon, 3 Aug 2020 08:19:36 +0200 +Subject: [PATCH 1/1] IB/mlx4: Add and improve logging +Git-commit: 094619449a16672f9815964e1ad39e11ff84ae2c +Patch-mainline: v5.10-rc1 +References: bsc#1111666 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Add missing check for success after call to mlx4_ib_send_to_wire() in +mlx4_ib_multiplex_mad(). + +Amended the existing pr_debug() in mlx4_ib_multiplex_cm_handler() and +mlx4_ib_demux_cm_handler() with attr_id during a lookup failure. + +Removed two noisy pr_debug() in mad.c + +Fixes: 3cf69cc8dbeb ("IB/mlx4: Add CM paravirtualization") +Link: https://lore.kernel.org/r/20200803061941.1139994-2-haakon.bugge@oracle.com +Signed-off-by: Håkon Bugge +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/mlx4/cm.c | 7 +-- + drivers/infiniband/hw/mlx4/mad.c | 80 ++++++++++++++------------------ + 2 files changed, 40 insertions(+), 47 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c +index b591861934b3..302ea7ec2008 100644 +--- a/drivers/infiniband/hw/mlx4/cm.c ++++ b/drivers/infiniband/hw/mlx4/cm.c +@@ -314,8 +314,8 @@ int mlx4_ib_multiplex_cm_handler(struct ib_device *ibdev, int port, int slave_id + } + + if (!id) { +- pr_debug("id{slave: %d, sl_cm_id: 0x%x} is NULL!\n", +- slave_id, sl_cm_id); ++ pr_debug("id{slave: %d, sl_cm_id: 0x%x} is NULL! attr_id: 0x%x\n", ++ slave_id, sl_cm_id, be16_to_cpu(mad->mad_hdr.attr_id)); + return -EINVAL; + } + +@@ -354,7 +354,8 @@ int mlx4_ib_demux_cm_handler(struct ib_device *ibdev, int port, int *slave, + id = id_map_get(ibdev, (int *)&pv_cm_id, -1, -1); + + if (!id) { +- pr_debug("Couldn't find an entry for pv_cm_id 0x%x\n", pv_cm_id); ++ pr_debug("Couldn't find an entry for pv_cm_id 0x%x, attr_id 0x%x\n", ++ pv_cm_id, be16_to_cpu(mad->mad_hdr.attr_id)); + return -ENOENT; + } + +diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c +index abe68708d6d6..932786b0689e 100644 +--- a/drivers/infiniband/hw/mlx4/mad.c ++++ b/drivers/infiniband/hw/mlx4/mad.c +@@ -500,6 +500,13 @@ static int get_gids_from_l3_hdr(struct ib_grh *grh, union ib_gid *sgid, + sgid, dgid); + } + ++static int is_proxy_qp0(struct mlx4_ib_dev *dev, int qpn, int slave) ++{ ++ int proxy_start = dev->dev->phys_caps.base_proxy_sqpn + 8 * slave; ++ ++ return (qpn >= proxy_start && qpn <= proxy_start + 1); ++} ++ + int mlx4_ib_send_to_slave(struct mlx4_ib_dev *dev, int slave, u8 port, + enum ib_qp_type dest_qpt, struct ib_wc *wc, + struct ib_grh *grh, struct ib_mad *mad) +@@ -520,8 +527,10 @@ int mlx4_ib_send_to_slave(struct mlx4_ib_dev *dev, int slave, u8 port, + u16 cached_pkey; + u8 is_eth = dev->dev->caps.port_type[port] == MLX4_PORT_TYPE_ETH; + +- if (dest_qpt > IB_QPT_GSI) ++ if (dest_qpt > IB_QPT_GSI) { ++ pr_debug("dest_qpt (%d) > IB_QPT_GSI\n", dest_qpt); + return -EINVAL; ++ } + + tun_ctx = dev->sriov.demux[port-1].tun[slave]; + +@@ -538,12 +547,20 @@ int mlx4_ib_send_to_slave(struct mlx4_ib_dev *dev, int slave, u8 port, + if (dest_qpt) { + u16 pkey_ix; + ret = ib_get_cached_pkey(&dev->ib_dev, port, wc->pkey_index, &cached_pkey); +- if (ret) ++ if (ret) { ++ pr_debug("unable to get %s cached pkey for index %d, ret %d\n", ++ is_proxy_qp0(dev, wc->src_qp, slave) ? "SMI" : "GSI", ++ wc->pkey_index, ret); + return -EINVAL; ++ } + + ret = find_slave_port_pkey_ix(dev, slave, port, cached_pkey, &pkey_ix); +- if (ret) ++ if (ret) { ++ pr_debug("unable to get %s pkey ix for pkey 0x%x, ret %d\n", ++ is_proxy_qp0(dev, wc->src_qp, slave) ? "SMI" : "GSI", ++ cached_pkey, ret); + return -EINVAL; ++ } + tun_pkey_ix = pkey_ix; + } else + tun_pkey_ix = dev->pkeys.virt2phys_pkey[slave][port - 1][0]; +@@ -715,7 +732,8 @@ static int mlx4_ib_demux_mad(struct ib_device *ibdev, u8 port, + + err = mlx4_ib_send_to_slave(dev, slave, port, wc->qp->qp_type, wc, grh, mad); + if (err) +- pr_debug("failed sending to slave %d via tunnel qp (%d)\n", ++ pr_debug("failed sending %s to slave %d via tunnel qp (%d)\n", ++ is_proxy_qp0(dev, wc->src_qp, slave) ? "SMI" : "GSI", + slave, err); + return 0; + } +@@ -794,7 +812,8 @@ static int mlx4_ib_demux_mad(struct ib_device *ibdev, u8 port, + + err = mlx4_ib_send_to_slave(dev, slave, port, wc->qp->qp_type, wc, grh, mad); + if (err) +- pr_debug("failed sending to slave %d via tunnel qp (%d)\n", ++ pr_debug("failed sending %s to slave %d via tunnel qp (%d)\n", ++ is_proxy_qp0(dev, wc->src_qp, slave) ? "SMI" : "GSI", + slave, err); + return 0; + } +@@ -807,27 +826,6 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num, + int err; + struct ib_port_attr pattr; + +- if (in_wc && in_wc->qp) { +- pr_debug("received MAD: port:%d slid:%d sqpn:%d " +- "dlid_bits:%d dqpn:%d wc_flags:0x%x tid:%016llx cls:%x mtd:%x atr:%x\n", +- port_num, +- in_wc->slid, in_wc->src_qp, +- in_wc->dlid_path_bits, +- in_wc->qp->qp_num, +- in_wc->wc_flags, +- be64_to_cpu(in_mad->mad_hdr.tid), +- in_mad->mad_hdr.mgmt_class, in_mad->mad_hdr.method, +- be16_to_cpu(in_mad->mad_hdr.attr_id)); +- if (in_wc->wc_flags & IB_WC_GRH) { +- pr_debug("sgid_hi:0x%016llx sgid_lo:0x%016llx\n", +- be64_to_cpu(in_grh->sgid.global.subnet_prefix), +- be64_to_cpu(in_grh->sgid.global.interface_id)); +- pr_debug("dgid_hi:0x%016llx dgid_lo:0x%016llx\n", +- be64_to_cpu(in_grh->dgid.global.subnet_prefix), +- be64_to_cpu(in_grh->dgid.global.interface_id)); +- } +- } +- + slid = in_wc ? ib_lid_cpu16(in_wc->slid) : be16_to_cpu(IB_LID_PERMISSIVE); + + if (in_mad->mad_hdr.method == IB_MGMT_METHOD_TRAP && slid == 0) { +@@ -1341,14 +1339,6 @@ static int mlx4_ib_multiplex_sa_handler(struct ib_device *ibdev, int port, + return ret; + } + +-static int is_proxy_qp0(struct mlx4_ib_dev *dev, int qpn, int slave) +-{ +- int proxy_start = dev->dev->phys_caps.base_proxy_sqpn + 8 * slave; +- +- return (qpn >= proxy_start && qpn <= proxy_start + 1); +-} +- +- + int mlx4_ib_send_to_wire(struct mlx4_ib_dev *dev, int slave, u8 port, + enum ib_qp_type dest_qpt, u16 pkey_index, + u32 remote_qpn, u32 qkey, struct rdma_ah_attr *attr, +@@ -1484,6 +1474,7 @@ static void mlx4_ib_multiplex_mad(struct mlx4_ib_demux_pv_ctx *ctx, struct ib_wc + u16 vlan_id; + u8 qos; + u8 *dmac; ++ int sts; + + /* Get slave that sent this packet */ + if (wc->src_qp < dev->dev->phys_caps.base_proxy_sqpn || +@@ -1580,13 +1571,17 @@ static void mlx4_ib_multiplex_mad(struct mlx4_ib_demux_pv_ctx *ctx, struct ib_wc + &vlan_id, &qos)) + rdma_ah_set_sl(&ah_attr, qos); + +- mlx4_ib_send_to_wire(dev, slave, ctx->port, +- is_proxy_qp0(dev, wc->src_qp, slave) ? +- IB_QPT_SMI : IB_QPT_GSI, +- be16_to_cpu(tunnel->hdr.pkey_index), +- be32_to_cpu(tunnel->hdr.remote_qpn), +- be32_to_cpu(tunnel->hdr.qkey), +- &ah_attr, wc->smac, vlan_id, &tunnel->mad); ++ sts = mlx4_ib_send_to_wire(dev, slave, ctx->port, ++ is_proxy_qp0(dev, wc->src_qp, slave) ? ++ IB_QPT_SMI : IB_QPT_GSI, ++ be16_to_cpu(tunnel->hdr.pkey_index), ++ be32_to_cpu(tunnel->hdr.remote_qpn), ++ be32_to_cpu(tunnel->hdr.qkey), ++ &ah_attr, wc->smac, vlan_id, &tunnel->mad); ++ if (sts) ++ pr_debug("failed sending %s to wire on behalf of slave %d (%d)\n", ++ is_proxy_qp0(dev, wc->src_qp, slave) ? "SMI" : "GSI", ++ slave, sts); + } + + static int mlx4_ib_alloc_pv_bufs(struct mlx4_ib_demux_pv_ctx *ctx, +@@ -1744,9 +1739,6 @@ static void mlx4_ib_tunnel_comp_worker(struct work_struct *work) + "buf:%lld\n", wc.wr_id); + break; + case IB_WC_SEND: +- pr_debug("received tunnel send completion:" +- "wrid=0x%llx, status=0x%x\n", +- wc.wr_id, wc.status); + rdma_destroy_ah(tun_qp->tx_ring[wc.wr_id & + (MLX4_NUM_TUNNEL_BUFS - 1)].ah); + tun_qp->tx_ring[wc.wr_id & (MLX4_NUM_TUNNEL_BUFS - 1)].ah +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/IB-mlx4-Add-support-for-MRA.patch b/patches.suse/IB-mlx4-Add-support-for-MRA.patch new file mode 100644 index 0000000..48c7128 --- /dev/null +++ b/patches.suse/IB-mlx4-Add-support-for-MRA.patch @@ -0,0 +1,45 @@ +From e7d087fce63fada387afcc6c31a2eaf81452baee Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?H=C3=A5kon=20Bugge?= +Date: Mon, 3 Aug 2020 08:19:37 +0200 +Subject: [PATCH 1/1] IB/mlx4: Add support for MRA +Git-commit: e7d087fce63fada387afcc6c31a2eaf81452baee +Patch-mainline: v5.10-rc1 +References: bsc#1111666 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Using CX-3 in virtualized mode, MAD packets are proxied through the PF +driver. However, the handling lacks support of the MRA (Message Receipt +Acknowledgment) packet. When having dynamic debug enabled, we see tons of: + +mlx4_ib_multiplex_cm_handler: id{slave: 7, sl_cm_id: 0x8fcb45a0} is NULL! attr_id: 0x11 + +Fixes: 3cf69cc8dbeb ("IB/mlx4: Add CM paravirtualization") +Link: https://lore.kernel.org/r/20200803061941.1139994-3-haakon.bugge@oracle.com +Signed-off-by: Håkon Bugge +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/mlx4/cm.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c +index 302ea7ec2008..6f0ffd0906e6 100644 +--- a/drivers/infiniband/hw/mlx4/cm.c ++++ b/drivers/infiniband/hw/mlx4/cm.c +@@ -293,8 +293,9 @@ int mlx4_ib_multiplex_cm_handler(struct ib_device *ibdev, int port, int slave_id + int pv_cm_id = -1; + + if (mad->mad_hdr.attr_id == CM_REQ_ATTR_ID || +- mad->mad_hdr.attr_id == CM_REP_ATTR_ID || +- mad->mad_hdr.attr_id == CM_SIDR_REQ_ATTR_ID) { ++ mad->mad_hdr.attr_id == CM_REP_ATTR_ID || ++ mad->mad_hdr.attr_id == CM_MRA_ATTR_ID || ++ mad->mad_hdr.attr_id == CM_SIDR_REQ_ATTR_ID) { + sl_cm_id = get_local_comm_id(mad); + id = id_map_get(ibdev, &pv_cm_id, slave_id, sl_cm_id); + if (id) +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/IB-mlx4-Adjust-delayed-work-when-a-dup-is-observed.patch b/patches.suse/IB-mlx4-Adjust-delayed-work-when-a-dup-is-observed.patch new file mode 100644 index 0000000..6dc1fa9 --- /dev/null +++ b/patches.suse/IB-mlx4-Adjust-delayed-work-when-a-dup-is-observed.patch @@ -0,0 +1,40 @@ +From 785167a114855c5aa75efca97000e405c2cc85bf Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?H=C3=A5kon=20Bugge?= +Date: Mon, 3 Aug 2020 08:19:41 +0200 +Subject: [PATCH 1/1] IB/mlx4: Adjust delayed work when a dup is observed +Git-commit: 785167a114855c5aa75efca97000e405c2cc85bf +Patch-mainline: v5.10-rc1 +References: bsc#1111666 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When scheduling delayed work to clean up the cache, if the entry already +has been scheduled for deletion, we adjust the delay. + +Fixes: 3cf69cc8dbeb ("IB/mlx4: Add CM paravirtualization") +Link: https://lore.kernel.org/r/20200803061941.1139994-7-haakon.bugge@oracle.com +Signed-off-by: Håkon Bugge +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/mlx4/cm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c +index b10737f74449..0ce4b5a3ffa7 100644 +--- a/drivers/infiniband/hw/mlx4/cm.c ++++ b/drivers/infiniband/hw/mlx4/cm.c +@@ -291,6 +291,9 @@ static void schedule_delayed(struct ib_device *ibdev, struct id_map_entry *id) + if (!sriov->is_going_down && !id->scheduled_delete) { + id->scheduled_delete = 1; + schedule_delayed_work(&id->timeout, CM_CLEANUP_CACHE_TIMEOUT); ++ } else if (id->scheduled_delete) { ++ /* Adjust timeout if already scheduled */ ++ mod_delayed_work(system_wq, &id->timeout, CM_CLEANUP_CACHE_TIMEOUT); + } + spin_unlock_irqrestore(&sriov->going_down_lock, flags); + spin_unlock(&sriov->id_map_lock); +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/IB-mlx4-Fix-starvation-in-paravirt-mux-demux.patch b/patches.suse/IB-mlx4-Fix-starvation-in-paravirt-mux-demux.patch new file mode 100644 index 0000000..88489b9 --- /dev/null +++ b/patches.suse/IB-mlx4-Fix-starvation-in-paravirt-mux-demux.patch @@ -0,0 +1,180 @@ +From 7fd1507df7cee9c533f38152fcd1dd769fcac6ce Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?H=C3=A5kon=20Bugge?= +Date: Mon, 3 Aug 2020 08:19:39 +0200 +Subject: [PATCH 1/1] IB/mlx4: Fix starvation in paravirt mux/demux +Git-commit: 7fd1507df7cee9c533f38152fcd1dd769fcac6ce +Patch-mainline: v5.10-rc1 +References: bsc#1111666 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The mlx4 driver will proxy MAD packets through the PF driver. A VM or an +instantiated VF will send its MAD packets to the PF driver using +loop-back. The PF driver will be informed by an interrupt, but defer the +handling and polling of CQEs to a worker thread running on an ordered +work-queue. + +Consider the following scenario: the VMs will in short proximity in time, +for example due to a network event, send many MAD packets to the PF +driver. Lets say there are K VMs, each sending N packets. + +The interrupt from the first VM will start the worker thread, which will +poll N CQEs. A common case here is where the PF driver will multiplex the +packets received from the VMs out on the wire QP. + +But before the wire QP has returned a send CQE and associated interrupt, +the other K - 1 VMs have sent their N packets as well. + +The PF driver has to multiplex K * N packets out on the wire QP. But the +send-queue on the wire QP has a finite capacity. + +So, in this scenario, if K * N is larger than the send-queue capacity of +the wire QP, we will get MAD packets dropped on the floor with this +dynamic debug message: + +mlx4_ib_multiplex_mad: failed sending GSI to wire on behalf of slave 2 (-11) + +and this despite the fact that the wire send-queue could have capacity, +but the PF driver isn't aware, because the wire send CQEs have not yet +been polled. + +We can also have a similar scenario inbound, with a wire recv-queue larger +than the tunnel QP's send-queue. If many remote peers send MAD packets to +the very same VM, the tunnel send-queue destined to the VM could allegedly +be construed to be full by the PF driver. + +This starvation is fixed by introducing separate work queues for the wire +QPs vs. the tunnel QPs. + +With this fix, using a dual ported HCA, 8 VFs instantiated, we could run +cmtime on each of the 18 interfaces towards a similar configured peer, +each cmtime instance with 800 QPs (all in all 14400 QPs) without a single +CM packet getting lost. + +Fixes: 3cf69cc8dbeb ("IB/mlx4: Add CM paravirtualization") +Link: https://lore.kernel.org/r/20200803061941.1139994-5-haakon.bugge@oracle.com +Signed-off-by: Håkon Bugge +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/mlx4/mad.c | 34 +++++++++++++++++++++++++--- + drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 ++ + 2 files changed, 33 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c +index e1310820352e..8bd16474708f 100644 +--- a/drivers/infiniband/hw/mlx4/mad.c ++++ b/drivers/infiniband/hw/mlx4/mad.c +@@ -1297,6 +1297,18 @@ static void mlx4_ib_tunnel_comp_handler(struct ib_cq *cq, void *arg) + spin_unlock_irqrestore(&dev->sriov.going_down_lock, flags); + } + ++static void mlx4_ib_wire_comp_handler(struct ib_cq *cq, void *arg) ++{ ++ unsigned long flags; ++ struct mlx4_ib_demux_pv_ctx *ctx = cq->cq_context; ++ struct mlx4_ib_dev *dev = to_mdev(ctx->ib_dev); ++ ++ spin_lock_irqsave(&dev->sriov.going_down_lock, flags); ++ if (!dev->sriov.is_going_down && ctx->state == DEMUX_PV_STATE_ACTIVE) ++ queue_work(ctx->wi_wq, &ctx->work); ++ spin_unlock_irqrestore(&dev->sriov.going_down_lock, flags); ++} ++ + static int mlx4_ib_post_pv_qp_buf(struct mlx4_ib_demux_pv_ctx *ctx, + struct mlx4_ib_demux_pv_qp *tun_qp, + int index) +@@ -1997,7 +2009,8 @@ static int create_pv_resources(struct ib_device *ibdev, int slave, int port, + cq_size *= 2; + + cq_attr.cqe = cq_size; +- ctx->cq = ib_create_cq(ctx->ib_dev, mlx4_ib_tunnel_comp_handler, ++ ctx->cq = ib_create_cq(ctx->ib_dev, ++ create_tun ? mlx4_ib_tunnel_comp_handler : mlx4_ib_wire_comp_handler, + NULL, ctx, &cq_attr); + if (IS_ERR(ctx->cq)) { + ret = PTR_ERR(ctx->cq); +@@ -2034,6 +2047,7 @@ static int create_pv_resources(struct ib_device *ibdev, int slave, int port, + INIT_WORK(&ctx->work, mlx4_ib_sqp_comp_worker); + + ctx->wq = to_mdev(ibdev)->sriov.demux[port - 1].wq; ++ ctx->wi_wq = to_mdev(ibdev)->sriov.demux[port - 1].wi_wq; + + ret = ib_req_notify_cq(ctx->cq, IB_CQ_NEXT_COMP); + if (ret) { +@@ -2177,7 +2191,7 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, + goto err_mcg; + } + +- snprintf(name, sizeof name, "mlx4_ibt%d", port); ++ snprintf(name, sizeof(name), "mlx4_ibt%d", port); + ctx->wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM); + if (!ctx->wq) { + pr_err("Failed to create tunnelling WQ for port %d\n", port); +@@ -2185,7 +2199,15 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, + goto err_wq; + } + +- snprintf(name, sizeof name, "mlx4_ibud%d", port); ++ snprintf(name, sizeof(name), "mlx4_ibwi%d", port); ++ ctx->wi_wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM); ++ if (!ctx->wi_wq) { ++ pr_err("Failed to create wire WQ for port %d\n", port); ++ ret = -ENOMEM; ++ goto err_wiwq; ++ } ++ ++ snprintf(name, sizeof(name), "mlx4_ibud%d", port); + ctx->ud_wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM); + if (!ctx->ud_wq) { + pr_err("Failed to create up/down WQ for port %d\n", port); +@@ -2196,6 +2218,10 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, + return 0; + + err_udwq: ++ destroy_workqueue(ctx->wi_wq); ++ ctx->wi_wq = NULL; ++ ++err_wiwq: + destroy_workqueue(ctx->wq); + ctx->wq = NULL; + +@@ -2243,12 +2269,14 @@ static void mlx4_ib_free_demux_ctx(struct mlx4_ib_demux_ctx *ctx) + ctx->tun[i]->state = DEMUX_PV_STATE_DOWNING; + } + flush_workqueue(ctx->wq); ++ flush_workqueue(ctx->wi_wq); + for (i = 0; i < dev->dev->caps.sqp_demux; i++) { + destroy_pv_resources(dev, i, ctx->port, ctx->tun[i], 0); + free_pv_object(dev, i, ctx->port); + } + kfree(ctx->tun); + destroy_workqueue(ctx->ud_wq); ++ destroy_workqueue(ctx->wi_wq); + destroy_workqueue(ctx->wq); + } + } +diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h +index db3cc61de0db..27bb23756663 100644 +--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h ++++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h +@@ -455,6 +455,7 @@ struct mlx4_ib_demux_pv_ctx { + struct ib_pd *pd; + struct work_struct work; + struct workqueue_struct *wq; ++ struct workqueue_struct *wi_wq; + struct mlx4_ib_demux_pv_qp qp[2]; + }; + +@@ -462,6 +463,7 @@ struct mlx4_ib_demux_ctx { + struct ib_device *ib_dev; + int port; + struct workqueue_struct *wq; ++ struct workqueue_struct *wi_wq; + struct workqueue_struct *ud_wq; + spinlock_t ud_lock; + atomic64_t subnet_prefix; +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/IB-mlx4-Test-return-value-of-calls-to-ib_get_cached_.patch b/patches.suse/IB-mlx4-Test-return-value-of-calls-to-ib_get_cached_.patch new file mode 100644 index 0000000..e918780 --- /dev/null +++ b/patches.suse/IB-mlx4-Test-return-value-of-calls-to-ib_get_cached_.patch @@ -0,0 +1,67 @@ +From 6693ca95bd4330a0ad7326967e1f9bcedd6b0800 Mon Sep 17 00:00:00 2001 +From: Jack Morgenstein +Date: Sun, 26 Apr 2020 10:59:21 +0300 +Subject: [PATCH 1/1] IB/mlx4: Test return value of calls to ib_get_cached_pkey +Git-commit: 6693ca95bd4330a0ad7326967e1f9bcedd6b0800 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +In the mlx4_ib_post_send() flow, some functions call ib_get_cached_pkey() +without checking its return value. If ib_get_cached_pkey() returns an +error code, these functions should return failure. + +Fixes: 1ffeb2eb8be9 ("IB/mlx4: SR-IOV IB context objects and proxy/tunnel SQP support") +Fixes: 225c7b1feef1 ("IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters") +Fixes: e622f2f4ad21 ("IB: split struct ib_send_wr") +Link: https://lore.kernel.org/r/20200426075921.130074-1-leon@kernel.org +Signed-off-by: Jack Morgenstein +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/mlx4/qp.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index 2f9f78912267..cf51e3cbd969 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -2891,6 +2891,7 @@ static int build_sriov_qp0_header(struct mlx4_ib_sqp *sqp, + int send_size; + int header_size; + int spc; ++ int err; + int i; + + if (wr->wr.opcode != IB_WR_SEND) +@@ -2925,7 +2926,9 @@ static int build_sriov_qp0_header(struct mlx4_ib_sqp *sqp, + + sqp->ud_header.lrh.virtual_lane = 0; + sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags & IB_SEND_SOLICITED); +- ib_get_cached_pkey(ib_dev, sqp->qp.port, 0, &pkey); ++ err = ib_get_cached_pkey(ib_dev, sqp->qp.port, 0, &pkey); ++ if (err) ++ return err; + sqp->ud_header.bth.pkey = cpu_to_be16(pkey); + if (sqp->qp.mlx4_ib_qp_type == MLX4_IB_QPT_TUN_SMI_OWNER) + sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->remote_qpn); +@@ -3212,9 +3215,14 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, const struct ib_ud_wr *wr, + } + sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags & IB_SEND_SOLICITED); + if (!sqp->qp.ibqp.qp_num) +- ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index, &pkey); ++ err = ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index, ++ &pkey); + else +- ib_get_cached_pkey(ib_dev, sqp->qp.port, wr->pkey_index, &pkey); ++ err = ib_get_cached_pkey(ib_dev, sqp->qp.port, wr->pkey_index, ++ &pkey); ++ if (err) ++ return err; ++ + sqp->ud_header.bth.pkey = cpu_to_be16(pkey); + sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->remote_qpn); + sqp->ud_header.bth.psn = cpu_to_be32((sqp->send_psn++) & ((1 << 24) - 1)); +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/IB-mthca-fix-return-value-of-error-branch-in-mthca_i.patch b/patches.suse/IB-mthca-fix-return-value-of-error-branch-in-mthca_i.patch new file mode 100644 index 0000000..0349a5b --- /dev/null +++ b/patches.suse/IB-mthca-fix-return-value-of-error-branch-in-mthca_i.patch @@ -0,0 +1,56 @@ +From 6830ff853a5764c75e56750d59d0bbb6b26f1835 Mon Sep 17 00:00:00 2001 +From: Xiongfeng Wang +Date: Fri, 20 Nov 2020 09:57:02 +0800 +Subject: [PATCH 1/1] IB/mthca: fix return value of error branch in +Git-commit: 6830ff853a5764c75e56750d59d0bbb6b26f1835 +Patch-mainline: v5.10-rc6 +References: bsc#1111666 + mthca_init_cq() + +We return 'err' in the error branch, but this variable may be set as zero +by the above code. Fix it by setting 'err' as a negative value before we +goto the error label. + +Fixes: 74c2174e7be5 ("IB uverbs: add mthca user CQ support") +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Link: https://lore.kernel.org/r/1605837422-42724-1-git-send-email-wangxiongfeng2@huawei.com +Reported-by: Hulk Robot +Signed-off-by: Xiongfeng Wang +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/mthca/mthca_cq.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c +index c3cfea243af8..119b2573c9a0 100644 +--- a/drivers/infiniband/hw/mthca/mthca_cq.c ++++ b/drivers/infiniband/hw/mthca/mthca_cq.c +@@ -803,8 +803,10 @@ int mthca_init_cq(struct mthca_dev *dev, int nent, + } + + mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL); +- if (IS_ERR(mailbox)) ++ if (IS_ERR(mailbox)) { ++ err = PTR_ERR(mailbox); + goto err_out_arm; ++ } + + cq_context = mailbox->buf; + +@@ -846,9 +848,9 @@ int mthca_init_cq(struct mthca_dev *dev, int nent, + } + + spin_lock_irq(&dev->cq_table.lock); +- if (mthca_array_set(&dev->cq_table.cq, +- cq->cqn & (dev->limits.num_cqs - 1), +- cq)) { ++ err = mthca_array_set(&dev->cq_table.cq, ++ cq->cqn & (dev->limits.num_cqs - 1), cq); ++ if (err) { + spin_unlock_irq(&dev->cq_table.lock); + goto err_out_free_mr; + } +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/IB-qib-Call-kobject_put-when-kobject_init_and_add-fa.patch b/patches.suse/IB-qib-Call-kobject_put-when-kobject_init_and_add-fa.patch new file mode 100644 index 0000000..8ca0c95 --- /dev/null +++ b/patches.suse/IB-qib-Call-kobject_put-when-kobject_init_and_add-fa.patch @@ -0,0 +1,82 @@ +From a35cd6447effd5c239b564c80fa109d05ff3d114 Mon Sep 17 00:00:00 2001 +From: Kaike Wan +Date: Mon, 11 May 2020 23:13:28 -0400 +Subject: [PATCH 1/1] IB/qib: Call kobject_put() when kobject_init_and_add() +Git-commit: a35cd6447effd5c239b564c80fa109d05ff3d114 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + fails + +When kobject_init_and_add() returns an error in the function +qib_create_port_files(), the function kobject_put() is not called for the +corresponding kobject, which potentially leads to memory leak. + +This patch fixes the issue by calling kobject_put() even if +kobject_init_and_add() fails. In addition, the ppd->diagc_kobj is released +along with other kobjects when the sysfs is unregistered. + +Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters") +Link: https://lore.kernel.org/r/20200512031328.189865.48627.stgit@awfm-01.aw.intel.com +Cc: +Suggested-by: Lin Yi +Reviewed-by: Mike Marciniszyn +Signed-off-by: Kaike Wan +Signed-off-by: Dennis Dalessandro +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/qib/qib_sysfs.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c +index 568b21eb6ea1..021df0654ba7 100644 +--- a/drivers/infiniband/hw/qib/qib_sysfs.c ++++ b/drivers/infiniband/hw/qib/qib_sysfs.c +@@ -760,7 +760,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num, + qib_dev_err(dd, + "Skipping linkcontrol sysfs info, (err %d) port %u\n", + ret, port_num); +- goto bail; ++ goto bail_link; + } + kobject_uevent(&ppd->pport_kobj, KOBJ_ADD); + +@@ -770,7 +770,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num, + qib_dev_err(dd, + "Skipping sl2vl sysfs info, (err %d) port %u\n", + ret, port_num); +- goto bail_link; ++ goto bail_sl; + } + kobject_uevent(&ppd->sl2vl_kobj, KOBJ_ADD); + +@@ -780,7 +780,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num, + qib_dev_err(dd, + "Skipping diag_counters sysfs info, (err %d) port %u\n", + ret, port_num); +- goto bail_sl; ++ goto bail_diagc; + } + kobject_uevent(&ppd->diagc_kobj, KOBJ_ADD); + +@@ -793,7 +793,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num, + qib_dev_err(dd, + "Skipping Congestion Control sysfs info, (err %d) port %u\n", + ret, port_num); +- goto bail_diagc; ++ goto bail_cc; + } + + kobject_uevent(&ppd->pport_cc_kobj, KOBJ_ADD); +@@ -854,6 +854,7 @@ void qib_verbs_unregister_sysfs(struct qib_devdata *dd) + &cc_table_bin_attr); + kobject_put(&ppd->pport_cc_kobj); + } ++ kobject_put(&ppd->diagc_kobj); + kobject_put(&ppd->sl2vl_kobj); + kobject_put(&ppd->pport_kobj); + } +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/IB-rdmavt-Fix-sizeof-mismatch.patch b/patches.suse/IB-rdmavt-Fix-sizeof-mismatch.patch new file mode 100644 index 0000000..a0eea62 --- /dev/null +++ b/patches.suse/IB-rdmavt-Fix-sizeof-mismatch.patch @@ -0,0 +1,45 @@ +From 8e71f694e0c819db39af2336f16eb9689f1ae53f Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Thu, 8 Oct 2020 10:52:04 +0100 +Subject: [PATCH 1/1] IB/rdmavt: Fix sizeof mismatch +Git-commit: 8e71f694e0c819db39af2336f16eb9689f1ae53f +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +An incorrect sizeof is being used, struct rvt_ibport ** is not correct, it +should be struct rvt_ibport *. Note that since ** is the same size as +* this is not causing any issues. Improve this fix by using +sizeof(*rdi->ports) as this allows us to not even reference the type +of the pointer. Also remove line breaks as the entire statement can +fit on one line. + +Link: https://lore.kernel.org/r/20201008095204.82683-1-colin.king@canonical.com +Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)") +Fixes: ff6acd69518e ("IB/rdmavt: Add device structure allocation") +Signed-off-by: Colin Ian King +Reviewed-by: Ira Weiny +Acked-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/sw/rdmavt/vt.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/infiniband/sw/rdmavt/vt.c b/drivers/infiniband/sw/rdmavt/vt.c +index f904bb34477a..2d534c450f3c 100644 +--- a/drivers/infiniband/sw/rdmavt/vt.c ++++ b/drivers/infiniband/sw/rdmavt/vt.c +@@ -95,9 +95,7 @@ struct rvt_dev_info *rvt_alloc_device(size_t size, int nports) + if (!rdi) + return rdi; + +- rdi->ports = kcalloc(nports, +- sizeof(struct rvt_ibport **), +- GFP_KERNEL); ++ rdi->ports = kcalloc(nports, sizeof(*rdi->ports), GFP_KERNEL); + if (!rdi->ports) + ib_dealloc_device(&rdi->ibdev); + +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/IB-srpt-Fix-memory-leak-in-srpt_add_one.patch b/patches.suse/IB-srpt-Fix-memory-leak-in-srpt_add_one.patch new file mode 100644 index 0000000..4152c95 --- /dev/null +++ b/patches.suse/IB-srpt-Fix-memory-leak-in-srpt_add_one.patch @@ -0,0 +1,84 @@ +From 372a1786283e50e7cb437ab7fdb1b95597310ad7 Mon Sep 17 00:00:00 2001 +From: Maor Gottlieb +Date: Wed, 28 Oct 2020 08:50:51 +0200 +Subject: [PATCH 1/1] IB/srpt: Fix memory leak in srpt_add_one +Git-commit: 372a1786283e50e7cb437ab7fdb1b95597310ad7 +Patch-mainline: v5.10-rc3 +References: bsc#1111666 + +Failure in srpt_refresh_port() for the second port will leave MAD +registered for the first one, however, the srpt_add_one() will be marked +as "failed" and SRPT will leak resources for that registered but not used +and released first port. + +Unregister the MAD agent for all ports in case of failure. + +Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1") +Link: https://lore.kernel.org/r/20201028065051.112430-1-leon@kernel.org +Signed-off-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Reviewed-by: Bart Van Assche +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index 0065eb17ae36..1b096305de1a 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -622,10 +622,11 @@ static int srpt_refresh_port(struct srpt_port *sport) + /** + * srpt_unregister_mad_agent - unregister MAD callback functions + * @sdev: SRPT HCA pointer. ++ * #port_cnt: number of ports with registered MAD + * + * Note: It is safe to call this function more than once for the same device. + */ +-static void srpt_unregister_mad_agent(struct srpt_device *sdev) ++static void srpt_unregister_mad_agent(struct srpt_device *sdev, int port_cnt) + { + struct ib_port_modify port_modify = { + .clr_port_cap_mask = IB_PORT_DEVICE_MGMT_SUP, +@@ -633,7 +634,7 @@ static void srpt_unregister_mad_agent(struct srpt_device *sdev) + struct srpt_port *sport; + int i; + +- for (i = 1; i <= sdev->device->phys_port_cnt; i++) { ++ for (i = 1; i <= port_cnt; i++) { + sport = &sdev->port[i - 1]; + WARN_ON(sport->port != i); + if (ib_modify_port(sdev->device, i, 0, &port_modify) < 0) +@@ -3185,7 +3186,8 @@ static int srpt_add_one(struct ib_device *device) + if (srpt_refresh_port(sport)) { + pr_err("MAD registration failed for %s-%d.\n", + dev_name(&sdev->device->dev), i); +- goto err_event; ++ i--; ++ goto err_port; + } + } + +@@ -3197,7 +3199,8 @@ static int srpt_add_one(struct ib_device *device) + pr_debug("added %s.\n", dev_name(&device->dev)); + return; + +-err_event: ++err_port: ++ srpt_unregister_mad_agent(sdev, i); + ib_unregister_event_handler(&sdev->event_handler); + err_cm: + if (sdev->cm_id) +@@ -3221,7 +3224,7 @@ static void srpt_remove_one(struct ib_device *device, void *client_data) + return; + } + +- srpt_unregister_mad_agent(sdev); ++ srpt_unregister_mad_agent(sdev, sdev->device->phys_port_cnt); + + ib_unregister_event_handler(&sdev->event_handler); + +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-bnxt_re-Fix-lifetimes-in-bnxt_re_task.patch b/patches.suse/RDMA-bnxt_re-Fix-lifetimes-in-bnxt_re_task.patch new file mode 100644 index 0000000..fdd43da --- /dev/null +++ b/patches.suse/RDMA-bnxt_re-Fix-lifetimes-in-bnxt_re_task.patch @@ -0,0 +1,44 @@ +From 8a6c61704746d3a1e004e054504ae8d98ed95697 Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Fri, 13 Mar 2020 09:33:26 -0700 +Subject: [PATCH 1/1] RDMA/bnxt_re: Fix lifetimes in bnxt_re_task +Git-commit: 8a6c61704746d3a1e004e054504ae8d98ed95697 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +A work queue cannot just rely on the ib_device not being freed, it must +hold a kref on the memory so that the BNXT_RE_FLAG_IBDEV_REGISTERED check +works. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Link: https://lore.kernel.org/r/1584117207-2664-3-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/bnxt_re/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c +index 885127c1e81b..c494e11c3fe3 100644 +--- a/drivers/infiniband/hw/bnxt_re/main.c ++++ b/drivers/infiniband/hw/bnxt_re/main.c +@@ -1670,6 +1670,7 @@ static void bnxt_re_task(struct work_struct *work) + smp_mb__before_atomic(); + atomic_dec(&rdev->sched_count); + exit: ++ put_device(&rdev->ibdev.dev); + kfree(re_work); + } + +@@ -1735,6 +1736,7 @@ static int bnxt_re_netdev_event(struct notifier_block *notifier, + /* Allocate for the deferred task */ + re_work = kzalloc(sizeof(*re_work), GFP_ATOMIC); + if (re_work) { ++ get_device(&rdev->ibdev.dev); + re_work->rdev = rdev; + re_work->event = event; + re_work->vlan_dev = (real_dev == netdev ? +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-bnxt_re-Fix-sizeof-mismatch-for-allocation-of-p.patch b/patches.suse/RDMA-bnxt_re-Fix-sizeof-mismatch-for-allocation-of-p.patch new file mode 100644 index 0000000..17a4907 --- /dev/null +++ b/patches.suse/RDMA-bnxt_re-Fix-sizeof-mismatch-for-allocation-of-p.patch @@ -0,0 +1,40 @@ +From 73c5265913b4b11a56d119396f745a57c7c272b7 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Tue, 6 Oct 2020 12:47:00 +0100 +Subject: [PATCH 1/1] RDMA/bnxt_re: Fix sizeof mismatch for allocation of +Git-commit: 73c5265913b4b11a56d119396f745a57c7c272b7 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + pbl_tbl. + +An incorrect sizeof is being used, u64 * is not correct, it should be just +u64 for a table of umem_pgs number of u64 items in the pbl_tbl. Use the +idiom sizeof(*pbl_tbl) to get the object type without the need to +explicitly use u64. + +Link: https://lore.kernel.org/r/20201006114700.537916-1-colin.king@canonical.com +Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)") +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Signed-off-by: Colin Ian King +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index e2707b27c950..cf3db9628397 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -3846,7 +3846,7 @@ struct ib_mr *bnxt_re_reg_user_mr(struct ib_pd *ib_pd, u64 start, u64 length, + } + mr->qplib_mr.total_size = length; + +- pbl_tbl = kcalloc(umem_pgs, sizeof(u64 *), GFP_KERNEL); ++ pbl_tbl = kcalloc(umem_pgs, sizeof(*pbl_tbl), GFP_KERNEL); + if (!pbl_tbl) { + rc = -ENOMEM; + goto free_umem; +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-cm-Add-missing-locking-around-id.state-in-cm_du.patch b/patches.suse/RDMA-cm-Add-missing-locking-around-id.state-in-cm_du.patch new file mode 100644 index 0000000..dcf09a6 --- /dev/null +++ b/patches.suse/RDMA-cm-Add-missing-locking-around-id.state-in-cm_du.patch @@ -0,0 +1,41 @@ +From d1de9a88074b66482443f0cd91618d7b51a7c9b6 Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Tue, 10 Mar 2020 11:25:39 +0200 +Subject: [PATCH 1/1] RDMA/cm: Add missing locking around id.state in +Git-commit: d1de9a88074b66482443f0cd91618d7b51a7c9b6 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + cm_dup_req_handler + +All accesses to id.state must be done under the spinlock. + +Fixes: a977049dacde ("[PATCH] IB: Add the kernel CM implementation") +Link: https://lore.kernel.org/r/20200310092545.251365-10-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/core/cm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index 3f125044d35e..3ce735527938 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1872,8 +1872,12 @@ static void cm_dup_req_handler(struct cm_work *work, + counter[CM_REQ_COUNTER]); + + /* Quick state check to discard duplicate REQs. */ +- if (cm_id_priv->id.state == IB_CM_REQ_RCVD) ++ spin_lock_irq(&cm_id_priv->lock); ++ if (cm_id_priv->id.state == IB_CM_REQ_RCVD) { ++ spin_unlock_irq(&cm_id_priv->lock); + return; ++ } ++ spin_unlock_irq(&cm_id_priv->lock); + + ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg); + if (ret) +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-cm-Fix-checking-for-allowed-duplicate-listens.patch b/patches.suse/RDMA-cm-Fix-checking-for-allowed-duplicate-listens.patch new file mode 100644 index 0000000..d1e480c --- /dev/null +++ b/patches.suse/RDMA-cm-Fix-checking-for-allowed-duplicate-listens.patch @@ -0,0 +1,41 @@ +From ca21cb7fb127fcba013acc66f9ebe2e3a9ae1e49 Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Tue, 10 Mar 2020 11:25:32 +0200 +Subject: [PATCH 1/1] RDMA/cm: Fix checking for allowed duplicate listens +Git-commit: ca21cb7fb127fcba013acc66f9ebe2e3a9ae1e49 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +The test here typod the cm_id_priv to use, it used the one that was +freshly allocated. By definition the allocated one has the matching +cm_handler and zero context, so the condition was always true. + +Instead check that the existing listening ID is compatible with the +proposed handler so that it can be shared, as was originally intended. + +Fixes: 067b171b8679 ("IB/cm: Share listening CM IDs") +Link: https://lore.kernel.org/r/20200310092545.251365-3-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/core/cm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index db627fa3cd39..ba35cad951e6 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1181,7 +1181,8 @@ struct ib_cm_id *ib_cm_insert_listen(struct ib_device *device, + /* Find an existing ID */ + cm_id_priv = cm_find_listen(device, service_id); + if (cm_id_priv) { +- if (cm_id->cm_handler != cm_handler || cm_id->context) { ++ if (cm_id_priv->id.cm_handler != cm_handler || ++ cm_id_priv->id.context) { + /* Sharing an ib_cm_id with different handlers is not + * supported */ + spin_unlock_irqrestore(&cm.lock, flags); +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-cm-Remove-a-race-freeing-timewait_info.patch b/patches.suse/RDMA-cm-Remove-a-race-freeing-timewait_info.patch new file mode 100644 index 0000000..a38469d --- /dev/null +++ b/patches.suse/RDMA-cm-Remove-a-race-freeing-timewait_info.patch @@ -0,0 +1,145 @@ +From bede86a39d9dc3387ac00dcb8e1ac221676b2f25 Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Tue, 10 Mar 2020 11:25:33 +0200 +Subject: [PATCH 1/1] RDMA/cm: Remove a race freeing timewait_info +Git-commit: bede86a39d9dc3387ac00dcb8e1ac221676b2f25 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +When creating a cm_id during REQ the id immediately becomes visible to the +other MAD handlers, and shortly after the state is moved to IB_CM_REQ_RCVD + +This allows cm_rej_handler() to run concurrently and free the work: + + CPU 0 CPU1 + cm_req_handler() + ib_create_cm_id() + cm_match_req() + id_priv->state = IB_CM_REQ_RCVD + cm_rej_handler() + cm_acquire_id() + spin_lock(&id_priv->lock) + switch (id_priv->state) + case IB_CM_REQ_RCVD: + cm_reset_to_idle() + kfree(id_priv->timewait_info); + goto destroy + destroy: + kfree(id_priv->timewait_info); + id_priv->timewait_info = NULL + +Causing a double free or worse. + +Do not free the timewait_info without also holding the +id_priv->lock. Simplify this entire flow by making the free unconditional +during cm_destroy_id() and removing the confusing special case error +unwind during creation of the timewait_info. + +This also fixes a leak of the timewait if cm_destroy_id() is called in +IB_CM_ESTABLISHED with an XRC TGT QP. The state machine will be left in +ESTABLISHED while it needed to transition through IB_CM_TIMEWAIT to +release the timewait pointer. + +Also fix a leak of the timewait_info if the caller mis-uses the API and +does ib_send_cm_reqs(). + +Fixes: a977049dacde ("[PATCH] IB: Add the kernel CM implementation") +Link: https://lore.kernel.org/r/20200310092545.251365-4-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/core/cm.c | 25 +++++++++++++++---------- + 1 file changed, 15 insertions(+), 10 deletions(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index ba35cad951e6..0685cb2a88c0 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1054,14 +1054,22 @@ retest: + break; + } + +- spin_lock_irq(&cm.lock); ++ spin_lock_irq(&cm_id_priv->lock); ++ spin_lock(&cm.lock); ++ /* Required for cleanup paths related cm_req_handler() */ ++ if (cm_id_priv->timewait_info) { ++ cm_cleanup_timewait(cm_id_priv->timewait_info); ++ kfree(cm_id_priv->timewait_info); ++ cm_id_priv->timewait_info = NULL; ++ } + if (!list_empty(&cm_id_priv->altr_list) && + (!cm_id_priv->altr_send_port_not_ready)) + list_del(&cm_id_priv->altr_list); + if (!list_empty(&cm_id_priv->prim_list) && + (!cm_id_priv->prim_send_port_not_ready)) + list_del(&cm_id_priv->prim_list); +- spin_unlock_irq(&cm.lock); ++ spin_unlock(&cm.lock); ++ spin_unlock_irq(&cm_id_priv->lock); + + cm_free_id(cm_id->local_id); + cm_deref_id(cm_id_priv); +@@ -1410,7 +1418,7 @@ int ib_send_cm_req(struct ib_cm_id *cm_id, + /* Verify that we're not in timewait. */ + cm_id_priv = container_of(cm_id, struct cm_id_private, id); + spin_lock_irqsave(&cm_id_priv->lock, flags); +- if (cm_id->state != IB_CM_IDLE) { ++ if (cm_id->state != IB_CM_IDLE || WARN_ON(cm_id_priv->timewait_info)) { + spin_unlock_irqrestore(&cm_id_priv->lock, flags); + ret = -EINVAL; + goto out; +@@ -1428,12 +1436,12 @@ int ib_send_cm_req(struct ib_cm_id *cm_id, + param->ppath_sgid_attr, &cm_id_priv->av, + cm_id_priv); + if (ret) +- goto error1; ++ goto out; + if (param->alternate_path) { + ret = cm_init_av_by_path(param->alternate_path, NULL, + &cm_id_priv->alt_av, cm_id_priv); + if (ret) +- goto error1; ++ goto out; + } + cm_id->service_id = param->service_id; + cm_id->service_mask = ~cpu_to_be64(0); +@@ -1451,7 +1459,7 @@ int ib_send_cm_req(struct ib_cm_id *cm_id, + + ret = cm_alloc_msg(cm_id_priv, &cm_id_priv->msg); + if (ret) +- goto error1; ++ goto out; + + req_msg = (struct cm_req_msg *) cm_id_priv->msg->mad; + cm_format_req(req_msg, cm_id_priv, param); +@@ -1474,7 +1482,6 @@ int ib_send_cm_req(struct ib_cm_id *cm_id, + return 0; + + error2: cm_free_msg(cm_id_priv->msg); +-error1: kfree(cm_id_priv->timewait_info); + out: return ret; + } + EXPORT_SYMBOL(ib_send_cm_req); +@@ -2003,7 +2010,7 @@ static int cm_req_handler(struct cm_work *work) + pr_debug("%s: local_id %d, no listen_cm_id_priv\n", __func__, + be32_to_cpu(cm_id->local_id)); + ret = -EINVAL; +- goto free_timeinfo; ++ goto destroy; + } + + cm_id_priv->id.cm_handler = listen_cm_id_priv->id.cm_handler; +@@ -2093,8 +2100,6 @@ static int cm_req_handler(struct cm_work *work) + rejected: + atomic_dec(&cm_id_priv->refcount); + cm_deref_id(listen_cm_id_priv); +-free_timeinfo: +- kfree(cm_id_priv->timewait_info); + destroy: + ib_destroy_cm_id(cm_id); + return ret; +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-cm-Update-num_paths-in-cma_resolve_iboe_route-e.patch b/patches.suse/RDMA-cm-Update-num_paths-in-cma_resolve_iboe_route-e.patch new file mode 100644 index 0000000..4ad0d6e --- /dev/null +++ b/patches.suse/RDMA-cm-Update-num_paths-in-cma_resolve_iboe_route-e.patch @@ -0,0 +1,100 @@ +From 987914ab841e2ec281a35b54348ab109b4c0bb4e Mon Sep 17 00:00:00 2001 +From: Avihai Horon +Date: Wed, 18 Mar 2020 12:17:41 +0200 +Subject: [PATCH 1/1] RDMA/cm: Update num_paths in cma_resolve_iboe_route error +Git-commit: 987914ab841e2ec281a35b54348ab109b4c0bb4e +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + flow + +After a successful allocation of path_rec, num_paths is set to 1, but any +error after such allocation will leave num_paths uncleared. + +This causes to de-referencing a NULL pointer later on. Hence, num_paths +needs to be set back to 0 if such an error occurs. + +The following crash from syzkaller revealed it. + + kasan: CONFIG_KASAN_INLINE enabled + kasan: GPF could be caused by NULL-ptr deref or user memory access + general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI + CPU: 0 PID: 357 Comm: syz-executor060 Not tainted 4.18.0+ #311 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS + rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014 + RIP: 0010:ib_copy_path_rec_to_user+0x94/0x3e0 + Code: f1 f1 f1 f1 c7 40 0c 00 00 f4 f4 65 48 8b 04 25 28 00 00 00 48 89 + 45 c8 31 c0 e8 d7 60 24 ff 48 8d 7b 4c 48 89 f8 48 c1 e8 03 <42> 0f b6 + 14 30 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 + RSP: 0018:ffff88006586f980 EFLAGS: 00010207 + RAX: 0000000000000009 RBX: 0000000000000000 RCX: 1ffff1000d5fe475 + RDX: ffff8800621e17c0 RSI: ffffffff820d45f9 RDI: 000000000000004c + RBP: ffff88006586fa50 R08: ffffed000cb0df73 R09: ffffed000cb0df72 + R10: ffff88006586fa70 R11: ffffed000cb0df73 R12: 1ffff1000cb0df30 + R13: ffff88006586fae8 R14: dffffc0000000000 R15: ffff88006aff2200 + FS: 00000000016fc880(0000) GS:ffff88006d000000(0000) + knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000020000040 CR3: 0000000063fec000 CR4: 00000000000006b0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + ? ib_copy_path_rec_from_user+0xcc0/0xcc0 + ? __mutex_unlock_slowpath+0xfc/0x670 + ? wait_for_completion+0x3b0/0x3b0 + ? ucma_query_route+0x818/0xc60 + ucma_query_route+0x818/0xc60 + ? ucma_listen+0x1b0/0x1b0 + ? sched_clock_cpu+0x18/0x1d0 + ? sched_clock_cpu+0x18/0x1d0 + ? ucma_listen+0x1b0/0x1b0 + ? ucma_write+0x292/0x460 + ucma_write+0x292/0x460 + ? ucma_close_id+0x60/0x60 + ? sched_clock_cpu+0x18/0x1d0 + ? sched_clock_cpu+0x18/0x1d0 + __vfs_write+0xf7/0x620 + ? ucma_close_id+0x60/0x60 + ? kernel_read+0x110/0x110 + ? time_hardirqs_on+0x19/0x580 + ? lock_acquire+0x18b/0x3a0 + ? finish_task_switch+0xf3/0x5d0 + ? _raw_spin_unlock_irq+0x29/0x40 + ? _raw_spin_unlock_irq+0x29/0x40 + ? finish_task_switch+0x1be/0x5d0 + ? __switch_to_asm+0x34/0x70 + ? __switch_to_asm+0x40/0x70 + ? security_file_permission+0x172/0x1e0 + vfs_write+0x192/0x460 + ksys_write+0xc6/0x1a0 + ? __ia32_sys_read+0xb0/0xb0 + ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe + ? do_syscall_64+0x1d/0x470 + do_syscall_64+0x9e/0x470 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Fixes: 3c86aa70bf67 ("RDMA/cm: Add RDMA CM support for IBoE devices") +Link: https://lore.kernel.org/r/20200318101741.47211-1-leon@kernel.org +Signed-off-by: Avihai Horon +Reviewed-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/core/cma.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 4df75ab4ee9d..26e6f7df247b 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -2978,6 +2978,7 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv) + err2: + kfree(route->path_rec); + route->path_rec = NULL; ++ route->num_paths = 0; + err1: + kfree(work); + return ret; +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-cma-Protect-bind_list-and-listen_list-while-fin.patch b/patches.suse/RDMA-cma-Protect-bind_list-and-listen_list-while-fin.patch new file mode 100644 index 0000000..34114a3 --- /dev/null +++ b/patches.suse/RDMA-cma-Protect-bind_list-and-listen_list-while-fin.patch @@ -0,0 +1,161 @@ +From 730c8912484186d4623d0c76509066d285c3a755 Mon Sep 17 00:00:00 2001 +From: Mark Zhang +Date: Tue, 16 Jun 2020 13:43:04 +0300 +Subject: [PATCH 1/1] RDMA/cma: Protect bind_list and listen_list while finding +Git-commit: 730c8912484186d4623d0c76509066d285c3a755 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + matching cm id + +The bind_list and listen_list must be accessed under a lock, add the +missing locking around the access in cm_ib_id_from_event() + +In addition add lockdep asserts to make it clearer what the locking +semantic is here. + + general protection fault: 0000 [#1] SMP NOPTI + CPU: 226 PID: 126135 Comm: kworker/226:1 Tainted: G OE 4.12.14-150.47-default #1 SLE15 + Hardware name: Cray Inc. Windom/Windom, BIOS 0.8.7 01-10-2020 + Workqueue: ib_cm cm_work_handler [ib_cm] + task: ffff9c5a60a1d2c0 task.stack: ffffc1d91f554000 + RIP: 0010:cma_ib_req_handler+0x3f1/0x11b0 [rdma_cm] + RSP: 0018:ffffc1d91f557b40 EFLAGS: 00010286 + RAX: deacffffffffff30 RBX: 0000000000000001 RCX: ffff9c2af5bb6000 + RDX: 00000000000000a9 RSI: ffff9c5aa4ed2f10 RDI: ffffc1d91f557b08 + RBP: ffffc1d91f557d90 R08: ffff9c340cc80000 R09: ffff9c2c0f901900 + R10: 0000000000000000 R11: 0000000000000001 R12: deacffffffffff30 + R13: ffff9c5a48aeec00 R14: ffffc1d91f557c30 R15: ffff9c5c2eea3688 + FS: 0000000000000000(0000) GS:ffff9c5c2fa80000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00002b5cc03fa320 CR3: 0000003f8500a000 CR4: 00000000003406e0 + Call Trace: + ? rdma_addr_cancel+0xa0/0xa0 [ib_core] + ? cm_process_work+0x28/0x140 [ib_cm] + cm_process_work+0x28/0x140 [ib_cm] + ? cm_get_bth_pkey.isra.44+0x34/0xa0 [ib_cm] + cm_work_handler+0xa06/0x1a6f [ib_cm] + ? __switch_to_asm+0x34/0x70 + ? __switch_to_asm+0x34/0x70 + ? __switch_to_asm+0x40/0x70 + ? __switch_to_asm+0x34/0x70 + ? __switch_to_asm+0x40/0x70 + ? __switch_to_asm+0x34/0x70 + ? __switch_to_asm+0x40/0x70 + ? __switch_to+0x7c/0x4b0 + ? __switch_to_asm+0x40/0x70 + ? __switch_to_asm+0x34/0x70 + process_one_work+0x1da/0x400 + worker_thread+0x2b/0x3f0 + ? process_one_work+0x400/0x400 + kthread+0x118/0x140 + ? kthread_create_on_node+0x40/0x40 + ret_from_fork+0x22/0x40 + Code: 00 66 83 f8 02 0f 84 ca 05 00 00 49 8b 84 24 d0 01 00 00 48 85 c0 0f 84 68 07 00 00 48 2d d0 01 + 00 00 49 89 c4 0f 84 59 07 00 00 <41> 0f b7 44 24 20 49 8b 77 50 66 83 f8 0a 75 9e 49 8b 7c 24 28 + +Fixes: 4c21b5bcef73 ("IB/cma: Add net_dev and private data checks to RDMA CM") +Link: https://lore.kernel.org/r/20200616104304.2426081-1-leon@kernel.org +Signed-off-by: Mark Zhang +Reviewed-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/core/cma.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 3d7cc9f0f3d4..c30cf5307ce3 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -1624,6 +1624,8 @@ static struct rdma_id_private *cma_find_listener( + { + struct rdma_id_private *id_priv, *id_priv_dev; + ++ lockdep_assert_held(&lock); ++ + if (!bind_list) + return ERR_PTR(-EINVAL); + +@@ -1670,6 +1672,7 @@ cma_ib_id_from_event(struct ib_cm_id *cm_id, + } + } + ++ mutex_lock(&lock); + /* + * Net namespace might be getting deleted while route lookup, + * cm_id lookup is in progress. Therefore, perform netdevice +@@ -1711,6 +1714,7 @@ cma_ib_id_from_event(struct ib_cm_id *cm_id, + id_priv = cma_find_listener(bind_list, cm_id, ib_event, req, *net_dev); + err: + rcu_read_unlock(); ++ mutex_unlock(&lock); + if (IS_ERR(id_priv) && *net_dev) { + dev_put(*net_dev); + *net_dev = NULL; +@@ -2492,6 +2496,8 @@ static void cma_listen_on_dev(struct rdma_id_private *id_priv, + struct net *net = id_priv->id.route.addr.dev_addr.net; + int ret; + ++ lockdep_assert_held(&lock); ++ + if (cma_family(id_priv) == AF_IB && !rdma_cap_ib_cm(cma_dev->device, 1)) + return; + +@@ -3342,6 +3348,8 @@ static void cma_bind_port(struct rdma_bind_list *bind_list, + u64 sid, mask; + __be16 port; + ++ lockdep_assert_held(&lock); ++ + addr = cma_src_addr(id_priv); + port = htons(bind_list->port); + +@@ -3370,6 +3378,8 @@ static int cma_alloc_port(enum rdma_ucm_port_space ps, + struct rdma_bind_list *bind_list; + int ret; + ++ lockdep_assert_held(&lock); ++ + bind_list = kzalloc(sizeof *bind_list, GFP_KERNEL); + if (!bind_list) + return -ENOMEM; +@@ -3396,6 +3406,8 @@ static int cma_port_is_unique(struct rdma_bind_list *bind_list, + struct sockaddr *saddr = cma_src_addr(id_priv); + __be16 dport = cma_port(daddr); + ++ lockdep_assert_held(&lock); ++ + hlist_for_each_entry(cur_id, &bind_list->owners, node) { + struct sockaddr *cur_daddr = cma_dst_addr(cur_id); + struct sockaddr *cur_saddr = cma_src_addr(cur_id); +@@ -3435,6 +3447,8 @@ static int cma_alloc_any_port(enum rdma_ucm_port_space ps, + unsigned int rover; + struct net *net = id_priv->id.route.addr.dev_addr.net; + ++ lockdep_assert_held(&lock); ++ + inet_get_local_port_range(net, &low, &high); + remaining = (high - low) + 1; + rover = prandom_u32() % remaining + low; +@@ -3482,6 +3496,8 @@ static int cma_check_port(struct rdma_bind_list *bind_list, + struct rdma_id_private *cur_id; + struct sockaddr *addr, *cur_addr; + ++ lockdep_assert_held(&lock); ++ + addr = cma_src_addr(id_priv); + hlist_for_each_entry(cur_id, &bind_list->owners, node) { + if (id_priv == cur_id) +@@ -3512,6 +3528,8 @@ static int cma_use_port(enum rdma_ucm_port_space ps, + unsigned short snum; + int ret; + ++ lockdep_assert_held(&lock); ++ + snum = ntohs(cma_port(cma_src_addr(id_priv))); + if (snum < PROT_SOCK && !capable(CAP_NET_BIND_SERVICE)) + return -EACCES; +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-core-Fix-race-between-destroy-and-release-FD-ob.patch b/patches.suse/RDMA-core-Fix-race-between-destroy-and-release-FD-ob.patch new file mode 100644 index 0000000..67aeb1c --- /dev/null +++ b/patches.suse/RDMA-core-Fix-race-between-destroy-and-release-FD-ob.patch @@ -0,0 +1,58 @@ +From f0abc761bbb9418876cc4d1ebc473e4ea6352e42 Mon Sep 17 00:00:00 2001 +From: Leon Romanovsky +Date: Thu, 23 Apr 2020 09:01:22 +0300 +Subject: [PATCH 1/1] RDMA/core: Fix race between destroy and release FD object +Git-commit: f0abc761bbb9418876cc4d1ebc473e4ea6352e42 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +The call to ->lookup_put() was too early and it caused an unlock of the +read/write protection of the uobject after the FD was put. This allows a +race: + + CPU1 CPU2 + rdma_lookup_put_uobject() + lookup_put_fd_uobject() + fput() + fput() + uverbs_uobject_fd_release() + WARN_ON(uverbs_try_lock_object(uobj, + UVERBS_LOOKUP_WRITE)); + atomic_dec(usecnt) + +Fix the code by changing the order, first unlock and call to +->lookup_put() after that. + +Fixes: 3832125624b7 ("IB/core: Add support for idr types") +Link: https://lore.kernel.org/r/20200423060122.6182-1-leon@kernel.org +Suggested-by: Jason Gunthorpe +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/core/rdma_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c +index 2947f4f83561..177333d8bcda 100644 +--- a/drivers/infiniband/core/rdma_core.c ++++ b/drivers/infiniband/core/rdma_core.c +@@ -678,7 +678,6 @@ void rdma_lookup_put_uobject(struct ib_uobject *uobj, + enum rdma_lookup_mode mode) + { + assert_uverbs_usecnt(uobj, mode); +- uobj->uapi_object->type_class->lookup_put(uobj, mode); + /* + * In order to unlock an object, either decrease its usecnt for + * read access or zero it in case of exclusive access. See +@@ -695,6 +694,7 @@ void rdma_lookup_put_uobject(struct ib_uobject *uobj, + break; + } + ++ uobj->uapi_object->type_class->lookup_put(uobj, mode); + /* Pairs with the kref obtained by type->lookup_get */ + uverbs_uobject_put(uobj); + } +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-core-Prevent-mixed-use-of-FDs-between-shared-uf.patch b/patches.suse/RDMA-core-Prevent-mixed-use-of-FDs-between-shared-uf.patch new file mode 100644 index 0000000..70290b8 --- /dev/null +++ b/patches.suse/RDMA-core-Prevent-mixed-use-of-FDs-between-shared-uf.patch @@ -0,0 +1,74 @@ +From 0fb00941dc63990a10951146df216fc7b0e20bc2 Mon Sep 17 00:00:00 2001 +From: Leon Romanovsky +Date: Tue, 21 Apr 2020 11:29:28 +0300 +Subject: [PATCH 1/1] RDMA/core: Prevent mixed use of FDs between shared ufiles +Git-commit: 0fb00941dc63990a10951146df216fc7b0e20bc2 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +FDs can only be used on the ufile that created them, they cannot be mixed +to other ufiles. We are lacking a check to prevent it. + + BUG: KASAN: null-ptr-deref in atomic64_sub_and_test include/asm-generic/atomic-instrumented.h:1547 [inline] + BUG: KASAN: null-ptr-deref in atomic_long_sub_and_test include/asm-generic/atomic-long.h:460 [inline] + BUG: KASAN: null-ptr-deref in fput_many+0x1a/0x140 fs/file_table.c:336 + Write of size 8 at addr 0000000000000038 by task syz-executor179/284 + + CPU: 0 PID: 284 Comm: syz-executor179 Not tainted 5.5.0-rc5+ #1 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 + Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0x94/0xce lib/dump_stack.c:118 + __kasan_report+0x18f/0x1b7 mm/kasan/report.c:510 + kasan_report+0xe/0x20 mm/kasan/common.c:639 + check_memory_region_inline mm/kasan/generic.c:185 [inline] + check_memory_region+0x15d/0x1b0 mm/kasan/generic.c:192 + atomic64_sub_and_test include/asm-generic/atomic-instrumented.h:1547 [inline] + atomic_long_sub_and_test include/asm-generic/atomic-long.h:460 [inline] + fput_many+0x1a/0x140 fs/file_table.c:336 + rdma_lookup_put_uobject+0x85/0x130 drivers/infiniband/core/rdma_core.c:692 + uobj_put_read include/rdma/uverbs_std_types.h:96 [inline] + _ib_uverbs_lookup_comp_file drivers/infiniband/core/uverbs_cmd.c:198 [inline] + create_cq+0x375/0xba0 drivers/infiniband/core/uverbs_cmd.c:1006 + ib_uverbs_create_cq+0x114/0x140 drivers/infiniband/core/uverbs_cmd.c:1089 + ib_uverbs_write+0xaa5/0xdf0 drivers/infiniband/core/uverbs_main.c:769 + __vfs_write+0x7c/0x100 fs/read_write.c:494 + vfs_write+0x168/0x4a0 fs/read_write.c:558 + ksys_write+0xc8/0x200 fs/read_write.c:611 + do_syscall_64+0x9c/0x390 arch/x86/entry/common.c:294 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + RIP: 0033:0x44ef99 + Code: 00 b8 00 01 00 00 eb e1 e8 74 1c 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c4 ff ff ff f7 d8 64 89 01 48 + RSP: 002b:00007ffc0b74c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 + RAX: ffffffffffffffda RBX: 00007ffc0b74c030 RCX: 000000000044ef99 + RDX: 0000000000000040 RSI: 0000000020000040 RDI: 0000000000000005 + RBP: 00007ffc0b74c038 R08: 0000000000401830 R09: 0000000000401830 + R10: 00007ffc0b74c038 R11: 0000000000000246 R12: 0000000000000000 + R13: 0000000000000000 R14: 00000000006be018 R15: 0000000000000000 + +Fixes: cf8966b3477d ("IB/core: Add support for fd objects") +Link: https://lore.kernel.org/r/20200421082929.311931-2-leon@kernel.org +Suggested-by: Jason Gunthorpe +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/core/rdma_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c +index 5128cb16bb48..8f480de5596a 100644 +--- a/drivers/infiniband/core/rdma_core.c ++++ b/drivers/infiniband/core/rdma_core.c +@@ -360,7 +360,7 @@ lookup_get_fd_uobject(const struct uverbs_api_object *obj, + * and the caller is expected to ensure that uverbs_close_fd is never + * done while a call top lookup is possible. + */ +- if (f->f_op != fd_type->fops) { ++ if (f->f_op != fd_type->fops || uobject->ufile != ufile) { + fput(f); + return ERR_PTR(-EBADF); + } +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-hns-Correct-typo-of-hns_roce_create_cq.patch b/patches.suse/RDMA-hns-Correct-typo-of-hns_roce_create_cq.patch new file mode 100644 index 0000000..44721c8 --- /dev/null +++ b/patches.suse/RDMA-hns-Correct-typo-of-hns_roce_create_cq.patch @@ -0,0 +1,36 @@ +From c19893fd9c606ffdf827a6feb0e4dbd35eae99ab Mon Sep 17 00:00:00 2001 +From: Lang Cheng +Date: Sat, 19 Sep 2020 18:03:17 +0800 +Subject: [PATCH 1/1] RDMA/hns: Correct typo of hns_roce_create_cq() +Git-commit: c19893fd9c606ffdf827a6feb0e4dbd35eae99ab +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +Change "initialze" to "initialize". + +Fixes: 8f3e9f3ea087 ("IB/hns: Add code for refreshing CQ CI using TPTR") +Link: https://lore.kernel.org/r/1600509802-44382-4-git-send-email-liweihang@huawei.com +Signed-off-by: Lang Cheng +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/hns/hns_roce_cq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c +index fff3e624e261..809b22aa5056 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_cq.c ++++ b/drivers/infiniband/hw/hns/hns_roce_cq.c +@@ -305,7 +305,7 @@ int hns_roce_create_cq(struct ib_cq *ib_cq, const struct ib_cq_init_attr *attr, + /* + * For the QP created by kernel space, tptr value should be initialized + * to zero; For the QP created by user space, it will cause synchronous +- * problems if tptr is set to zero here, so we initialze it in user ++ * problems if tptr is set to zero here, so we initialize it in user + * space. + */ + if (!context && hr_cq->tptr_addr) +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-hns-Set-the-unsupported-wr-opcode.patch b/patches.suse/RDMA-hns-Set-the-unsupported-wr-opcode.patch new file mode 100644 index 0000000..844cd57 --- /dev/null +++ b/patches.suse/RDMA-hns-Set-the-unsupported-wr-opcode.patch @@ -0,0 +1,36 @@ +From 22d3e1ed2cc837af87f76c3c8a4ccf4455e225c5 Mon Sep 17 00:00:00 2001 +From: Lijun Ou +Date: Thu, 17 Sep 2020 21:50:15 +0800 +Subject: [PATCH 1/1] RDMA/hns: Set the unsupported wr opcode +Git-commit: 22d3e1ed2cc837af87f76c3c8a4ccf4455e225c5 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +hip06 does not support IB_WR_LOCAL_INV, so the ps_opcode should be set to +an invalid value instead of being left uninitialized. + +Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") +Fixes: a2f3d4479fe9 ("RDMA/hns: Avoid unncessary initialization") +Link: https://lore.kernel.org/r/1600350615-115217-1-git-send-email-oulijun@huawei.com +Signed-off-by: Lijun Ou +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c +index 96c14e5fb7ba..1a545e2297b2 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c +@@ -271,7 +271,6 @@ static int hns_roce_v1_post_send(struct ib_qp *ibqp, + ps_opcode = HNS_ROCE_WQE_OPCODE_SEND; + break; + case IB_WR_LOCAL_INV: +- break; + case IB_WR_ATOMIC_CMP_AND_SWP: + case IB_WR_ATOMIC_FETCH_AND_ADD: + case IB_WR_LSO: +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-ipoib-Fix-ABBA-deadlock-with-ipoib_reap_ah.patch b/patches.suse/RDMA-ipoib-Fix-ABBA-deadlock-with-ipoib_reap_ah.patch new file mode 100644 index 0000000..2b74a49 --- /dev/null +++ b/patches.suse/RDMA-ipoib-Fix-ABBA-deadlock-with-ipoib_reap_ah.patch @@ -0,0 +1,215 @@ +From 65936bf25f90fe440bb2d11624c7d10fab266639 Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Thu, 25 Jun 2020 20:42:19 +0300 +Subject: [PATCH 1/1] RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah() +Git-commit: 65936bf25f90fe440bb2d11624c7d10fab266639 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +ipoib_mcast_carrier_on_task() insanely open codes a rtnl_lock() such that +the only time flush_workqueue() can be called is if it also clears +IPOIB_FLAG_OPER_UP. + +Thus the flush inside ipoib_flush_ah() will deadlock if it gets unlucky +enough, and lockdep doesn't help us to find it early: + + CPU0 CPU1 CPU2 + __ipoib_ib_dev_flush() + down_read(vlan_rwsem) + + ipoib_vlan_add() + rtnl_trylock() + down_write(vlan_rwsem) + + ipoib_mcast_carrier_on_task() + while (!rtnl_trylock()) + msleep(20); + + ipoib_flush_ah() + flush_workqueue(priv->wq) + +Clean up the ah_reaper related functions and lifecycle to make sense: + + - Start/Stop of the reaper should only be done in open/stop NDOs, not in + any other places + + - cancel and flush of the reaper should only happen in the stop NDO. + cancel is only functional when combined with IPOIB_STOP_REAPER. + + - Non-stop places were flushing the AH's just need to flush out dead AH's + synchronously and ignore the background task completely. It is fully + locked and harmless to leave running. + +Which ultimately fixes the ABBA deadlock by removing the unnecessary +flush_workqueue() from the problematic place under the vlan_rwsem. + +Fixes: efc82eeeae4e ("IB/ipoib: No longer use flush as a parameter") +Link: https://lore.kernel.org/r/20200625174219.290842-1-kamalheib1@gmail.com +Reported-by: Kamal Heib +Tested-by: Kamal Heib +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/ulp/ipoib/ipoib_ib.c | 65 ++++++++++------------- + drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 + + 2 files changed, 31 insertions(+), 36 deletions(-) + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +index 6ee64c25aaff..494f413dc3c6 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +@@ -670,13 +670,12 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb, + return rc; + } + +-static void __ipoib_reap_ah(struct net_device *dev) ++static void ipoib_reap_dead_ahs(struct ipoib_dev_priv *priv) + { +- struct ipoib_dev_priv *priv = ipoib_priv(dev); + struct ipoib_ah *ah, *tah; + unsigned long flags; + +- netif_tx_lock_bh(dev); ++ netif_tx_lock_bh(priv->dev); + spin_lock_irqsave(&priv->lock, flags); + + list_for_each_entry_safe(ah, tah, &priv->dead_ahs, list) +@@ -687,37 +686,37 @@ static void __ipoib_reap_ah(struct net_device *dev) + } + + spin_unlock_irqrestore(&priv->lock, flags); +- netif_tx_unlock_bh(dev); ++ netif_tx_unlock_bh(priv->dev); + } + + void ipoib_reap_ah(struct work_struct *work) + { + struct ipoib_dev_priv *priv = + container_of(work, struct ipoib_dev_priv, ah_reap_task.work); +- struct net_device *dev = priv->dev; + +- __ipoib_reap_ah(dev); ++ ipoib_reap_dead_ahs(priv); + + if (!test_bit(IPOIB_STOP_REAPER, &priv->flags)) + queue_delayed_work(priv->wq, &priv->ah_reap_task, + round_jiffies_relative(HZ)); + } + +-static void ipoib_flush_ah(struct net_device *dev) ++static void ipoib_start_ah_reaper(struct ipoib_dev_priv *priv) + { +- struct ipoib_dev_priv *priv = ipoib_priv(dev); +- +- cancel_delayed_work(&priv->ah_reap_task); +- flush_workqueue(priv->wq); +- ipoib_reap_ah(&priv->ah_reap_task.work); ++ clear_bit(IPOIB_STOP_REAPER, &priv->flags); ++ queue_delayed_work(priv->wq, &priv->ah_reap_task, ++ round_jiffies_relative(HZ)); + } + +-static void ipoib_stop_ah(struct net_device *dev) ++static void ipoib_stop_ah_reaper(struct ipoib_dev_priv *priv) + { +- struct ipoib_dev_priv *priv = ipoib_priv(dev); +- + set_bit(IPOIB_STOP_REAPER, &priv->flags); +- ipoib_flush_ah(dev); ++ cancel_delayed_work(&priv->ah_reap_task); ++ /* ++ * After ipoib_stop_ah_reaper() we always go through ++ * ipoib_reap_dead_ahs() which ensures the work is really stopped and ++ * does a final flush out of the dead_ah's list ++ */ + } + + static int recvs_pending(struct net_device *dev) +@@ -846,16 +845,6 @@ timeout: + return 0; + } + +-void ipoib_ib_dev_stop(struct net_device *dev) +-{ +- struct ipoib_dev_priv *priv = ipoib_priv(dev); +- +- priv->rn_ops->ndo_stop(dev); +- +- clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags); +- ipoib_flush_ah(dev); +-} +- + int ipoib_ib_dev_open_default(struct net_device *dev) + { + struct ipoib_dev_priv *priv = ipoib_priv(dev); +@@ -899,10 +888,7 @@ int ipoib_ib_dev_open(struct net_device *dev) + return -1; + } + +- clear_bit(IPOIB_STOP_REAPER, &priv->flags); +- queue_delayed_work(priv->wq, &priv->ah_reap_task, +- round_jiffies_relative(HZ)); +- ++ ipoib_start_ah_reaper(priv); + if (priv->rn_ops->ndo_open(dev)) { + pr_warn("%s: Failed to open dev\n", dev->name); + goto dev_stop; +@@ -913,13 +899,20 @@ int ipoib_ib_dev_open(struct net_device *dev) + return 0; + + dev_stop: +- set_bit(IPOIB_STOP_REAPER, &priv->flags); +- cancel_delayed_work(&priv->ah_reap_task); +- set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags); +- ipoib_ib_dev_stop(dev); ++ ipoib_stop_ah_reaper(priv); + return -1; + } + ++void ipoib_ib_dev_stop(struct net_device *dev) ++{ ++ struct ipoib_dev_priv *priv = ipoib_priv(dev); ++ ++ priv->rn_ops->ndo_stop(dev); ++ ++ clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags); ++ ipoib_stop_ah_reaper(priv); ++} ++ + void ipoib_pkey_dev_check_presence(struct net_device *dev) + { + struct ipoib_dev_priv *priv = ipoib_priv(dev); +@@ -1230,7 +1223,7 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv, + ipoib_mcast_dev_flush(dev); + if (oper_up) + set_bit(IPOIB_FLAG_OPER_UP, &priv->flags); +- ipoib_flush_ah(dev); ++ ipoib_reap_dead_ahs(priv); + } + + if (level >= IPOIB_FLUSH_NORMAL) +@@ -1305,7 +1298,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev) + * the neighbor garbage collection is stopped and reaped. + * That should all be done now, so make a final ah flush. + */ +- ipoib_stop_ah(dev); ++ ipoib_reap_dead_ahs(priv); + + clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags); + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index 3cfb682b91b0..ef60e8e4ae67 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -1976,6 +1976,8 @@ static void ipoib_ndo_uninit(struct net_device *dev) + + /* no more works over the priv->wq */ + if (priv->wq) { ++ /* See ipoib_mcast_carrier_on_task() */ ++ WARN_ON(test_bit(IPOIB_FLAG_OPER_UP, &priv->flags)); + flush_workqueue(priv->wq); + destroy_workqueue(priv->wq); + priv->wq = NULL; +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-ipoib-Return-void-from-ipoib_ib_dev_stop.patch b/patches.suse/RDMA-ipoib-Return-void-from-ipoib_ib_dev_stop.patch new file mode 100644 index 0000000..6a33bd9 --- /dev/null +++ b/patches.suse/RDMA-ipoib-Return-void-from-ipoib_ib_dev_stop.patch @@ -0,0 +1,58 @@ +From 95a5631f6c9f3045f26245e6045244652204dfdb Mon Sep 17 00:00:00 2001 +From: Kamal Heib +Date: Tue, 23 Jun 2020 13:52:36 +0300 +Subject: [PATCH 1/1] RDMA/ipoib: Return void from ipoib_ib_dev_stop() +Git-commit: 95a5631f6c9f3045f26245e6045244652204dfdb +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +The return value from ipoib_ib_dev_stop() is always 0 - change it to be +void. + +Link: https://lore.kernel.org/r/20200623105236.18683-1-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/ulp/ipoib/ipoib.h | 2 +- + drivers/infiniband/ulp/ipoib/ipoib_ib.c | 4 +--- + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h +index 15f519ce7e0b..3440dc48d02c 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib.h ++++ b/drivers/infiniband/ulp/ipoib/ipoib.h +@@ -515,7 +515,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev); + + int ipoib_ib_dev_open_default(struct net_device *dev); + int ipoib_ib_dev_open(struct net_device *dev); +-int ipoib_ib_dev_stop(struct net_device *dev); ++void ipoib_ib_dev_stop(struct net_device *dev); + void ipoib_ib_dev_up(struct net_device *dev); + void ipoib_ib_dev_down(struct net_device *dev); + int ipoib_ib_dev_stop_default(struct net_device *dev); +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +index da3c5315bbb5..6ee64c25aaff 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +@@ -846,7 +846,7 @@ timeout: + return 0; + } + +-int ipoib_ib_dev_stop(struct net_device *dev) ++void ipoib_ib_dev_stop(struct net_device *dev) + { + struct ipoib_dev_priv *priv = ipoib_priv(dev); + +@@ -854,8 +854,6 @@ int ipoib_ib_dev_stop(struct net_device *dev) + + clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags); + ipoib_flush_ah(dev); +- +- return 0; + } + + int ipoib_ib_dev_open_default(struct net_device *dev) +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-ipoib-Set-rtnl_link_ops-for-ipoib-interfaces.patch b/patches.suse/RDMA-ipoib-Set-rtnl_link_ops-for-ipoib-interfaces.patch new file mode 100644 index 0000000..37b8741 --- /dev/null +++ b/patches.suse/RDMA-ipoib-Set-rtnl_link_ops-for-ipoib-interfaces.patch @@ -0,0 +1,83 @@ +From 5ce2dced8e95e76ff7439863a118a053a7fc6f91 Mon Sep 17 00:00:00 2001 +From: Kamal Heib +Date: Sun, 4 Oct 2020 16:29:48 +0300 +Subject: [PATCH 1/1] RDMA/ipoib: Set rtnl_link_ops for ipoib interfaces +Git-commit: 5ce2dced8e95e76ff7439863a118a053a7fc6f91 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +Report the "ipoib pkey", "mode" and "umcast" netlink attributes for every +IPoiB interface type, not just children created with 'ip link add'. + +After setting the rtnl_link_ops for the parent interface, implement the +dellink() callback to block users from trying to remove it. + +Fixes: 862096a8bbf8 ("IB/ipoib: Add more rtnl_link_ops callbacks") +Link: https://lore.kernel.org/r/20201004132948.26669-1-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 ++ + drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 11 +++++++++++ + drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 2 ++ + 3 files changed, 15 insertions(+) + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index ab75b7f745d4..96b6be5d507d 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -2477,6 +2477,8 @@ static struct net_device *ipoib_add_port(const char *format, + /* call event handler to ensure pkey in sync */ + queue_work(ipoib_workqueue, &priv->flush_heavy); + ++ ndev->rtnl_link_ops = ipoib_get_link_ops(); ++ + result = register_netdev(ndev); + if (result) { + pr_warn("%s: couldn't register ipoib port %d; error %d\n", +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c +index 38c984d16996..d5a90a66b45c 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c +@@ -144,6 +144,16 @@ static int ipoib_new_child_link(struct net *src_net, struct net_device *dev, + return 0; + } + ++static void ipoib_del_child_link(struct net_device *dev, struct list_head *head) ++{ ++ struct ipoib_dev_priv *priv = ipoib_priv(dev); ++ ++ if (!priv->parent) ++ return; ++ ++ unregister_netdevice_queue(dev, head); ++} ++ + static size_t ipoib_get_size(const struct net_device *dev) + { + return nla_total_size(2) + /* IFLA_IPOIB_PKEY */ +@@ -158,6 +168,7 @@ static struct rtnl_link_ops ipoib_link_ops __read_mostly = { + .priv_size = sizeof(struct ipoib_dev_priv), + .setup = ipoib_setup_common, + .newlink = ipoib_new_child_link, ++ .dellink = ipoib_del_child_link, + .changelink = ipoib_changelink, + .get_size = ipoib_get_size, + .fill_info = ipoib_fill_info, +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c +index 30865605e098..4c50a87ed7cc 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c +@@ -195,6 +195,8 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey) + } + priv = ipoib_priv(ndev); + ++ ndev->rtnl_link_ops = ipoib_get_link_ops(); ++ + result = __ipoib_vlan_add(ppriv, priv, pkey, IPOIB_LEGACY_CHILD); + + if (result && ndev->reg_state == NETREG_UNINITIALIZED) +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-mad-Fix-possible-memory-leak-in-ib_mad_post_rec.patch b/patches.suse/RDMA-mad-Fix-possible-memory-leak-in-ib_mad_post_rec.patch new file mode 100644 index 0000000..498dd6d --- /dev/null +++ b/patches.suse/RDMA-mad-Fix-possible-memory-leak-in-ib_mad_post_rec.patch @@ -0,0 +1,38 @@ +From a17f4bed811c60712d8131883cdba11a105d0161 Mon Sep 17 00:00:00 2001 +From: Fan Guo +Date: Fri, 12 Jun 2020 14:38:24 +0800 +Subject: [PATCH 1/1] RDMA/mad: Fix possible memory leak in +Git-commit: a17f4bed811c60712d8131883cdba11a105d0161 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + ib_mad_post_receive_mads() + +If ib_dma_mapping_error() returns non-zero value, +ib_mad_post_receive_mads() will jump out of loops and return -ENOMEM +without freeing mad_priv. Fix this memory-leak problem by freeing mad_priv +in this case. + +Fixes: 2c34e68f4261 ("IB/mad: Check and handle potential DMA mapping errors") +Link: https://lore.kernel.org/r/20200612063824.180611-1-guofan5@huawei.com +Signed-off-by: Fan Guo +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/core/mad.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c +index 186e0d652e8b..5e080191a725 100644 +--- a/drivers/infiniband/core/mad.c ++++ b/drivers/infiniband/core/mad.c +@@ -2718,6 +2718,7 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, + DMA_FROM_DEVICE); + if (unlikely(ib_dma_mapping_error(qp_info->port_priv->device, + sg_list.addr))) { ++ kfree(mad_priv); + ret = -ENOMEM; + break; + } +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-mlx4-Initialize-ib_spec-on-the-stack.patch b/patches.suse/RDMA-mlx4-Initialize-ib_spec-on-the-stack.patch new file mode 100644 index 0000000..0e74914 --- /dev/null +++ b/patches.suse/RDMA-mlx4-Initialize-ib_spec-on-the-stack.patch @@ -0,0 +1,41 @@ +From c08cfb2d8d78bfe81b37cc6ba84f0875bddd0d5c Mon Sep 17 00:00:00 2001 +From: Alaa Hleihel +Date: Mon, 13 Apr 2020 16:22:35 +0300 +Subject: [PATCH 1/1] RDMA/mlx4: Initialize ib_spec on the stack +Git-commit: c08cfb2d8d78bfe81b37cc6ba84f0875bddd0d5c +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +Initialize ib_spec on the stack before using it, otherwise we will have +garbage values that will break creating default rules with invalid parsing +error. + +Fixes: a37a1a428431 ("IB/mlx4: Add mechanism to support flow steering over IB links") +Link: https://lore.kernel.org/r/20200413132235.930642-1-leon@kernel.org +Signed-off-by: Alaa Hleihel +Reviewed-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/mlx4/main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c +index a66518a5c938..275722cec8c6 100644 +--- a/drivers/infiniband/hw/mlx4/main.c ++++ b/drivers/infiniband/hw/mlx4/main.c +@@ -1499,8 +1499,9 @@ static int __mlx4_ib_create_default_rules( + int i; + + for (i = 0; i < ARRAY_SIZE(pdefault_rules->rules_create_list); i++) { ++ union ib_flow_spec ib_spec = {}; + int ret; +- union ib_flow_spec ib_spec; ++ + switch (pdefault_rules->rules_create_list[i]) { + case 0: + /* no rule */ +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-mlx4-Read-pkey-table-length-instead-of-hardcode.patch b/patches.suse/RDMA-mlx4-Read-pkey-table-length-instead-of-hardcode.patch new file mode 100644 index 0000000..56f4c32 --- /dev/null +++ b/patches.suse/RDMA-mlx4-Read-pkey-table-length-instead-of-hardcode.patch @@ -0,0 +1,47 @@ +From ec78b3bd66bc9a015505df0ef0eb153d9e64b03b Mon Sep 17 00:00:00 2001 +From: Mark Bloch +Date: Mon, 24 Aug 2020 14:02:29 +0300 +Subject: [PATCH 1/1] RDMA/mlx4: Read pkey table length instead of hardcoded +Git-commit: ec78b3bd66bc9a015505df0ef0eb153d9e64b03b +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + value + +If the pkey_table is not available (which is the case when RoCE is not +supported), the cited commit caused a regression where mlx4_devices +without RoCE are not created. + +Fix this by returning a pkey table length of zero in procedure +eth_link_query_port() if the pkey-table length reported by the device is +zero. + +Link: https://lore.kernel.org/r/20200824110229.1094376-1-leon@kernel.org +Cc: +Fixes: 1901b91f9982 ("IB/core: Fix potential NULL pointer dereference in pkey cache") +Fixes: fa417f7b520e ("IB/mlx4: Add support for IBoE") +Signed-off-by: Mark Bloch +Reviewed-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/mlx4/main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c +index 5e7910a517da..bd4f975e7f9a 100644 +--- a/drivers/infiniband/hw/mlx4/main.c ++++ b/drivers/infiniband/hw/mlx4/main.c +@@ -784,7 +784,8 @@ static int eth_link_query_port(struct ib_device *ibdev, u8 port, + props->ip_gids = true; + props->gid_tbl_len = mdev->dev->caps.gid_table_len[port]; + props->max_msg_sz = mdev->dev->caps.max_msg_sz; +- props->pkey_tbl_len = 1; ++ if (mdev->dev->caps.pkey_table_len[port]) ++ props->pkey_tbl_len = 1; + props->max_mtu = IB_MTU_4096; + props->max_vl_num = 2; + props->state = IB_PORT_DOWN; +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-mlx5-Set-GRH-fields-in-query-QP-on-RoCE.patch b/patches.suse/RDMA-mlx5-Set-GRH-fields-in-query-QP-on-RoCE.patch new file mode 100644 index 0000000..b4ef03f --- /dev/null +++ b/patches.suse/RDMA-mlx5-Set-GRH-fields-in-query-QP-on-RoCE.patch @@ -0,0 +1,46 @@ +From 2d7e3ff7b6f2c614eb21d0dc348957a47eaffb57 Mon Sep 17 00:00:00 2001 +From: Aharon Landau +Date: Mon, 13 Apr 2020 16:20:28 +0300 +Subject: [PATCH 1/1] RDMA/mlx5: Set GRH fields in query QP on RoCE +Git-commit: 2d7e3ff7b6f2c614eb21d0dc348957a47eaffb57 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +GRH fields such as sgid_index, hop limit, et. are set in the QP context +when QP is created/modified. + +Currently, when query QP is performed, we fill the GRH fields only if the +GRH bit is set in the QP context, but this bit is not set for RoCE. Adjust +the check so we will set all relevant data for the RoCE too. + +Since this data is returned to userspace, the below is an ABI regression. + +Fixes: d8966fcd4c25 ("IB/core: Use rdma_ah_attr accessor functions") +Link: https://lore.kernel.org/r/20200413132028.930109-1-leon@kernel.org +Signed-off-by: Aharon Landau +Reviewed-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/mlx5/qp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index 1456db4b6295..2210759843ba 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -5558,7 +5558,9 @@ static void to_rdma_ah_attr(struct mlx5_ib_dev *ibdev, + rdma_ah_set_path_bits(ah_attr, path->grh_mlid & 0x7f); + rdma_ah_set_static_rate(ah_attr, + path->static_rate ? path->static_rate - 5 : 0); +- if (path->grh_mlid & (1 << 7)) { ++ ++ if (path->grh_mlid & (1 << 7) || ++ ah_attr->type == RDMA_AH_ATTR_TYPE_ROCE) { + u32 tc_fl = be32_to_cpu(path->tclass_flowlabel); + + rdma_ah_set_grh(ah_attr, NULL, +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-mlx5-Verify-that-QP-is-created-with-RQ-or-SQ.patch b/patches.suse/RDMA-mlx5-Verify-that-QP-is-created-with-RQ-or-SQ.patch new file mode 100644 index 0000000..f97a1d9 --- /dev/null +++ b/patches.suse/RDMA-mlx5-Verify-that-QP-is-created-with-RQ-or-SQ.patch @@ -0,0 +1,38 @@ +From 0eacc574aae7300bf46c10c7116c3ba5825505b7 Mon Sep 17 00:00:00 2001 +From: Aharon Landau +Date: Mon, 27 Apr 2020 18:46:36 +0300 +Subject: [PATCH 1/1] RDMA/mlx5: Verify that QP is created with RQ or SQ +Git-commit: 0eacc574aae7300bf46c10c7116c3ba5825505b7 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +RAW packet QP and underlay QP must be created with either +RQ or SQ, check that. + +Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") +Link: https://lore.kernel.org/r/20200427154636.381474-37-leon@kernel.org +Signed-off-by: Aharon Landau +Reviewed-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/mlx5/qp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index 18c0a25da47a..14f4f0982e4e 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -1482,6 +1482,8 @@ static int create_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp, + u32 tdn = mucontext->tdn; + u16 uid = to_mpd(pd)->uid; + ++ if (!qp->sq.wqe_cnt && !qp->rq.wqe_cnt) ++ return -EINVAL; + if (qp->sq.wqe_cnt) { + err = create_raw_packet_qp_tis(dev, qp, sq, tdn, pd); + if (err) +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-pvrdma-Fix-missing-pci-disable-in-pvrdma_pci_pr.patch b/patches.suse/RDMA-pvrdma-Fix-missing-pci-disable-in-pvrdma_pci_pr.patch new file mode 100644 index 0000000..110ae6c --- /dev/null +++ b/patches.suse/RDMA-pvrdma-Fix-missing-pci-disable-in-pvrdma_pci_pr.patch @@ -0,0 +1,41 @@ +From db857e6ae548f0f4f4a0f63fffeeedf3cca21f9d Mon Sep 17 00:00:00 2001 +From: Qiushi Wu +Date: Fri, 22 May 2020 22:04:57 -0500 +Subject: [PATCH 1/1] RDMA/pvrdma: Fix missing pci disable in +Git-commit: db857e6ae548f0f4f4a0f63fffeeedf3cca21f9d +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + pvrdma_pci_probe() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +In function pvrdma_pci_probe(), pdev was not disabled in one error +path. Thus replace the jump target “err_free_device” by +"err_disable_pdev". + +Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver") +Link: https://lore.kernel.org/r/20200523030457.16160-1-wu000273@umn.edu +Signed-off-by: Qiushi Wu +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c +index e580ae9cc55a..780fd2dfc07e 100644 +--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c ++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c +@@ -829,7 +829,7 @@ static int pvrdma_pci_probe(struct pci_dev *pdev, + !(pci_resource_flags(pdev, 1) & IORESOURCE_MEM)) { + dev_err(&pdev->dev, "PCI BAR region not MMIO\n"); + ret = -ENOMEM; +- goto err_free_device; ++ goto err_disable_pdev; + } + + ret = pci_request_regions(pdev, DRV_NAME); +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-qedr-Endianness-warnings-cleanup.patch b/patches.suse/RDMA-qedr-Endianness-warnings-cleanup.patch new file mode 100644 index 0000000..468a2a8 --- /dev/null +++ b/patches.suse/RDMA-qedr-Endianness-warnings-cleanup.patch @@ -0,0 +1,51 @@ +From f45271acdf9eeb003296862b017806d41ec4ec55 Mon Sep 17 00:00:00 2001 +From: Alok Prasad +Date: Thu, 1 Oct 2020 10:09:59 +0000 +Subject: [PATCH 1/1] RDMA/qedr: Endianness warnings cleanup +Git-commit: f45271acdf9eeb003296862b017806d41ec4ec55 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +Making a change to fix following sparse warnings reported by kbuild bot. + + CHECK drivers/infiniband/hw/qedr/verbs.c + +drivers/infiniband/hw/qedr/verbs.c:3872:59: warning: incorrect type in assignment (different base types) +drivers/infiniband/hw/qedr/verbs.c:3872:59: expected restricted __le32 [usertype] sge_prod +drivers/infiniband/hw/qedr/verbs.c:3872:59: got unsigned int [usertype] sge_prod +drivers/infiniband/hw/qedr/verbs.c:3875:59: warning: incorrect type in assignment (different base types) +drivers/infiniband/hw/qedr/verbs.c:3875:59: expected restricted __le32 [usertype] wqe_prod +drivers/infiniband/hw/qedr/verbs.c:3875:59: got unsigned int [usertype] wqe_prod + +Link: https://lore.kernel.org/r/20201001100959.19940-1-palok@marvell.com +Reported-by: kbuild test robot +Fixes: acca72e2b031 ("RDMA/qedr: SRQ's bug fixes") +Signed-off-by: Igor Russkikh +Signed-off-by: Michal Kalderon +Signed-off-by: Alok Prasad +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/qedr/verbs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 23559f1fe96e..b5603b3ed6a4 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -3861,10 +3861,10 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr, + * in first 4 bytes and need to update WQE producer in + * next 4 bytes. + */ +- srq->hw_srq.virt_prod_pair_addr->sge_prod = hw_srq->sge_prod; ++ srq->hw_srq.virt_prod_pair_addr->sge_prod = cpu_to_le32(hw_srq->sge_prod); + /* Make sure sge producer is updated first */ + dma_wmb(); +- srq->hw_srq.virt_prod_pair_addr->wqe_prod = hw_srq->wqe_prod; ++ srq->hw_srq.virt_prod_pair_addr->wqe_prod = cpu_to_le32(hw_srq->wqe_prod); + + wr = wr->next; + } +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-qedr-Fix-doorbell-setting.patch b/patches.suse/RDMA-qedr-Fix-doorbell-setting.patch new file mode 100644 index 0000000..2b2469a --- /dev/null +++ b/patches.suse/RDMA-qedr-Fix-doorbell-setting.patch @@ -0,0 +1,36 @@ +From 0b1eddc1964351cd5ce57aff46853ed4ce9ebbff Mon Sep 17 00:00:00 2001 +From: Michal Kalderon +Date: Wed, 2 Sep 2020 19:57:35 +0300 +Subject: [PATCH 1/1] RDMA/qedr: Fix doorbell setting +Git-commit: 0b1eddc1964351cd5ce57aff46853ed4ce9ebbff +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +Change the doorbell setting so that the maximum value between the last and +current value is set. This is to avoid doorbells being lost. + +Fixes: a7efd7773e31 ("qedr: Add support for PD,PKEY and CQ verbs") +Link: https://lore.kernel.org/r/20200902165741.8355-3-michal.kalderon@marvell.com +Signed-off-by: Michal Kalderon +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/qedr/verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index bf5fa8db7837..1da0131d5042 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -989,7 +989,7 @@ int qedr_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + cq->db_addr = dev->db_addr + + DB_ADDR_SHIFT(DQ_PWM_OFFSET_UCM_RDMA_CQ_CONS_32BIT); + cq->db.data.icid = cq->icid; +- cq->db.data.params = DB_AGG_CMD_SET << ++ cq->db.data.params = DB_AGG_CMD_MAX << + RDMA_PWM_VAL32_DATA_AGG_CMD_SHIFT; + + /* point to the very last element, passing it we will toggle */ +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-qedr-Fix-use-of-uninitialized-field.patch b/patches.suse/RDMA-qedr-Fix-use-of-uninitialized-field.patch new file mode 100644 index 0000000..0408708 --- /dev/null +++ b/patches.suse/RDMA-qedr-Fix-use-of-uninitialized-field.patch @@ -0,0 +1,36 @@ +From a379ad54e55a12618cae7f6333fd1b3071de9606 Mon Sep 17 00:00:00 2001 +From: Michal Kalderon +Date: Wed, 2 Sep 2020 19:57:36 +0300 +Subject: [PATCH 1/1] RDMA/qedr: Fix use of uninitialized field +Git-commit: a379ad54e55a12618cae7f6333fd1b3071de9606 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +dev->attr.page_size_caps was used uninitialized when setting device +attributes + +Fixes: ec72fce401c6 ("qedr: Add support for RoCE HW init") +Link: https://lore.kernel.org/r/20200902165741.8355-4-michal.kalderon@marvell.com +Signed-off-by: Michal Kalderon +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/qedr/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c +index d85f992bac29..8e1365951fb6 100644 +--- a/drivers/infiniband/hw/qedr/main.c ++++ b/drivers/infiniband/hw/qedr/main.c +@@ -602,7 +602,7 @@ static int qedr_set_device_attr(struct qedr_dev *dev) + qed_attr = dev->ops->rdma_query_device(dev->rdma_ctx); + + /* Part 2 - check capabilities */ +- page_size = ~dev->attr.page_size_caps + 1; ++ page_size = ~qed_attr->page_size_caps + 1; + if (page_size > PAGE_SIZE) { + DP_ERR(dev, + "Kernel PAGE_SIZE is %ld which is smaller than minimum page size (%d) required by qedr\n", +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-qedr-SRQ-s-bug-fixes.patch b/patches.suse/RDMA-qedr-SRQ-s-bug-fixes.patch new file mode 100644 index 0000000..52f267f --- /dev/null +++ b/patches.suse/RDMA-qedr-SRQ-s-bug-fixes.patch @@ -0,0 +1,114 @@ +From acca72e2b031b9fbb4184511072bd246a0abcebc Mon Sep 17 00:00:00 2001 +From: Yuval Basson +Date: Wed, 8 Jul 2020 22:55:26 +0300 +Subject: [PATCH 1/1] RDMA/qedr: SRQ's bug fixes +Git-commit: acca72e2b031b9fbb4184511072bd246a0abcebc +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +QP's with the same SRQ, working on different CQs and running in parallel +on different CPUs could lead to a race when maintaining the SRQ consumer +count, and leads to FW running out of SRQs. Update the consumer +atomically. Make sure the wqe_prod is updated after the sge_prod due to +FW requirements. + +Fixes: 3491c9e799fb ("qedr: Add support for kernel mode SRQ's") +Link: https://lore.kernel.org/r/20200708195526.31040-1-ybason@marvell.com +Signed-off-by: Michal Kalderon +Signed-off-by: Yuval Basson +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/qedr/qedr.h | 4 ++-- + drivers/infiniband/hw/qedr/verbs.c | 22 ++++++++++------------ + 2 files changed, 12 insertions(+), 14 deletions(-) + +diff --git a/drivers/infiniband/hw/qedr/qedr.h b/drivers/infiniband/hw/qedr/qedr.h +index fdf90ecb2699..aa332027da86 100644 +--- a/drivers/infiniband/hw/qedr/qedr.h ++++ b/drivers/infiniband/hw/qedr/qedr.h +@@ -344,10 +344,10 @@ struct qedr_srq_hwq_info { + u32 wqe_prod; + u32 sge_prod; + u32 wr_prod_cnt; +- u32 wr_cons_cnt; ++ atomic_t wr_cons_cnt; + u32 num_elems; + +- u32 *virt_prod_pair_addr; ++ struct rdma_srq_producers *virt_prod_pair_addr; + dma_addr_t phy_prod_pair_addr; + }; + +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 3d7d5617818f..42273aa0b5e1 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -3686,7 +3686,7 @@ static u32 qedr_srq_elem_left(struct qedr_srq_hwq_info *hw_srq) + * count and consumer count and subtract it from max + * work request supported so that we get elements left. + */ +- used = hw_srq->wr_prod_cnt - hw_srq->wr_cons_cnt; ++ used = hw_srq->wr_prod_cnt - (u32)atomic_read(&hw_srq->wr_cons_cnt); + + return hw_srq->max_wr - used; + } +@@ -3701,7 +3701,6 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr, + unsigned long flags; + int status = 0; + u32 num_sge; +- u32 offset; + + spin_lock_irqsave(&srq->lock, flags); + +@@ -3714,7 +3713,8 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr, + if (!qedr_srq_elem_left(hw_srq) || + wr->num_sge > srq->hw_srq.max_sges) { + DP_ERR(dev, "Can't post WR (%d,%d) || (%d > %d)\n", +- hw_srq->wr_prod_cnt, hw_srq->wr_cons_cnt, ++ hw_srq->wr_prod_cnt, ++ atomic_read(&hw_srq->wr_cons_cnt), + wr->num_sge, srq->hw_srq.max_sges); + status = -ENOMEM; + *bad_wr = wr; +@@ -3748,22 +3748,20 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr, + hw_srq->sge_prod++; + } + +- /* Flush WQE and SGE information before ++ /* Update WQE and SGE information before + * updating producer. + */ +- wmb(); ++ dma_wmb(); + + /* SRQ producer is 8 bytes. Need to update SGE producer index + * in first 4 bytes and need to update WQE producer in + * next 4 bytes. + */ +- *srq->hw_srq.virt_prod_pair_addr = hw_srq->sge_prod; +- offset = offsetof(struct rdma_srq_producers, wqe_prod); +- *((u8 *)srq->hw_srq.virt_prod_pair_addr + offset) = +- hw_srq->wqe_prod; ++ srq->hw_srq.virt_prod_pair_addr->sge_prod = hw_srq->sge_prod; ++ /* Make sure sge producer is updated first */ ++ dma_wmb(); ++ srq->hw_srq.virt_prod_pair_addr->wqe_prod = hw_srq->wqe_prod; + +- /* Flush producer after updating it. */ +- wmb(); + wr = wr->next; + } + +@@ -4182,7 +4180,7 @@ static int process_resp_one_srq(struct qedr_dev *dev, struct qedr_qp *qp, + } else { + __process_resp_one(dev, qp, cq, wc, resp, wr_id); + } +- srq->hw_srq.wr_cons_cnt++; ++ atomic_inc(&srq->hw_srq.wr_cons_cnt); + + return 1; + } +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-rxe-Drop-pointless-checks-in-rxe_init_ports.patch b/patches.suse/RDMA-rxe-Drop-pointless-checks-in-rxe_init_ports.patch new file mode 100644 index 0000000..c6c6c57 --- /dev/null +++ b/patches.suse/RDMA-rxe-Drop-pointless-checks-in-rxe_init_ports.patch @@ -0,0 +1,38 @@ +From 6112ef62826e91afbae5446d5d47b38e25f47e3f Mon Sep 17 00:00:00 2001 +From: Kamal Heib +Date: Sun, 5 Jul 2020 13:43:10 +0300 +Subject: [PATCH 1/1] RDMA/rxe: Drop pointless checks in rxe_init_ports +Git-commit: 6112ef62826e91afbae5446d5d47b38e25f47e3f +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +Both pkey_tbl_len and gid_tbl_len are set in rxe_init_port_param() - so no +need to check if they aren't set. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20200705104313.283034-2-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/sw/rxe/rxe.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c +index 5642eefb4ba1..c7191b5e04a5 100644 +--- a/drivers/infiniband/sw/rxe/rxe.c ++++ b/drivers/infiniband/sw/rxe/rxe.c +@@ -147,9 +147,6 @@ static int rxe_init_ports(struct rxe_dev *rxe) + + rxe_init_port_param(port); + +- if (!port->attr.pkey_tbl_len || !port->attr.gid_tbl_len) +- return -EINVAL; +- + port->pkey_tbl = kcalloc(port->attr.pkey_tbl_len, + sizeof(*port->pkey_tbl), GFP_KERNEL); + +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-rxe-Fix-memleak-in-rxe_mem_init_user.patch b/patches.suse/RDMA-rxe-Fix-memleak-in-rxe_mem_init_user.patch new file mode 100644 index 0000000..d611161 --- /dev/null +++ b/patches.suse/RDMA-rxe-Fix-memleak-in-rxe_mem_init_user.patch @@ -0,0 +1,35 @@ +From e3ddd6067ee62f6e76ebcf61ff08b2c729ae412b Mon Sep 17 00:00:00 2001 +From: Dinghao Liu +Date: Wed, 19 Aug 2020 15:56:32 +0800 +Subject: [PATCH 1/1] RDMA/rxe: Fix memleak in rxe_mem_init_user +Git-commit: e3ddd6067ee62f6e76ebcf61ff08b2c729ae412b +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +When page_address() fails, umem should be freed just like when +rxe_mem_alloc() fails. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20200819075632.22285-1-dinghao.liu@zju.edu.cn +Signed-off-by: Dinghao Liu +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/sw/rxe/rxe_mr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c +index cdd811a45120..ce24144de16a 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mr.c ++++ b/drivers/infiniband/sw/rxe/rxe_mr.c +@@ -205,6 +205,7 @@ int rxe_mem_init_user(struct rxe_pd *pd, u64 start, + vaddr = page_address(sg_page_iter_page(&sg_iter)); + if (!vaddr) { + pr_warn("null vaddr\n"); ++ ib_umem_release(umem); + err = -ENOMEM; + goto err1; + } +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-rxe-Fix-the-parent-sysfs-read-when-the-interfac.patch b/patches.suse/RDMA-rxe-Fix-the-parent-sysfs-read-when-the-interfac.patch new file mode 100644 index 0000000..a1dbaa7 --- /dev/null +++ b/patches.suse/RDMA-rxe-Fix-the-parent-sysfs-read-when-the-interfac.patch @@ -0,0 +1,58 @@ +From 60b1af64eb35074a4f2d41cc1e503a7671e68963 Mon Sep 17 00:00:00 2001 +From: Yi Zhang +Date: Thu, 20 Aug 2020 23:36:46 +0800 +Subject: [PATCH 1/1] RDMA/rxe: Fix the parent sysfs read when the interface +Git-commit: 60b1af64eb35074a4f2d41cc1e503a7671e68963 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + has 15 chars + +'parent' sysfs reads will yield '\0' bytes when the interface name has 15 +chars, and there will no "\n" output. + +To reproduce, create one interface with 15 chars: + + [root@test ~]# ip a s enp0s29u1u7u3c2 + 2: enp0s29u1u7u3c2: mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 1000 + link/ether 02:21:28:57:47:17 brd ff:ff:ff:ff:ff:ff + inet6 fe80::ac41:338f:5bcd:c222/64 scope link noprefixroute + valid_lft forever preferred_lft forever + [root@test ~]# modprobe rdma_rxe + [root@test ~]# echo enp0s29u1u7u3c2 > /sys/module/rdma_rxe/parameters/add + [root@test ~]# cat /sys/class/infiniband/rxe0/parent + enp0s29u1u7u3c2[root@test ~]# + [root@test ~]# f="/sys/class/infiniband/rxe0/parent" + [root@test ~]# echo "$(<"$f")" + -bash: warning: command substitution: ignored null byte in input + enp0s29u1u7u3c2 + +Use scnprintf and PAGE_SIZE to fill the sysfs output buffer. + +Cc: stable@vger.kernel.org +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20200820153646.31316-1-yi.zhang@redhat.com +Suggested-by: Jason Gunthorpe +Signed-off-by: Yi Zhang +Reviewed-by: Bart Van Assche +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/sw/rxe/rxe_verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index bb61e534e468..756980f79951 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -1056,7 +1056,7 @@ static ssize_t parent_show(struct device *device, + struct rxe_dev *rxe = container_of(device, struct rxe_dev, + ib_dev.dev); + +- return snprintf(buf, 16, "%s\n", rxe_parent_name(rxe, 1)); ++ return scnprintf(buf, PAGE_SIZE, "%s\n", rxe_parent_name(rxe, 1)); + } + + static DEVICE_ATTR_RO(parent); +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-rxe-Prevent-access-to-wr-next-ptr-afrer-wr-is-p.patch b/patches.suse/RDMA-rxe-Prevent-access-to-wr-next-ptr-afrer-wr-is-p.patch new file mode 100644 index 0000000..a5dcd2c --- /dev/null +++ b/patches.suse/RDMA-rxe-Prevent-access-to-wr-next-ptr-afrer-wr-is-p.patch @@ -0,0 +1,60 @@ +From 5f0b2a6093a4d9aab093964c65083fe801ef1e58 Mon Sep 17 00:00:00 2001 +From: Mikhail Malygin +Date: Thu, 16 Jul 2020 22:03:41 +0300 +Subject: [PATCH 1/1] RDMA/rxe: Prevent access to wr->next ptr afrer wr is +Git-commit: 5f0b2a6093a4d9aab093964c65083fe801ef1e58 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + posted to send queue + +rxe_post_send_kernel() iterates over linked list of wr's, until the +wr->next ptr is NULL. However if we've got an interrupt after last wr is +posted, control may be returned to the code after send completion callback +is executed and wr memory is freed. + +As a result, wr->next pointer may contain incorrect value leading to +panic. Store the wr->next on the stack before posting it. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20200716190340.23453-1-m.malygin@yadro.com +Signed-off-by: Mikhail Malygin +Signed-off-by: Sergey Kojushev +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/sw/rxe/rxe_verbs.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index 74f071003690..c1649aec8c23 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -682,6 +682,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, + unsigned int mask; + unsigned int length = 0; + int i; ++ struct ib_send_wr *next; + + while (wr) { + mask = wr_opcode_mask(wr->opcode, qp); +@@ -698,6 +699,8 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, + break; + } + ++ next = wr->next; ++ + length = 0; + for (i = 0; i < wr->num_sge; i++) + length += wr->sg_list[i].length; +@@ -708,7 +711,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, + *bad_wr = wr; + break; + } +- wr = wr->next; ++ wr = next; + } + + rxe_run_task(&qp->req.task, 1); +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-rxe-Remove-unused-rxe_mem_map_pages.patch b/patches.suse/RDMA-rxe-Remove-unused-rxe_mem_map_pages.patch new file mode 100644 index 0000000..d662aed --- /dev/null +++ b/patches.suse/RDMA-rxe-Remove-unused-rxe_mem_map_pages.patch @@ -0,0 +1,89 @@ +From f6b4c11fc527b9ca98c219fb9a465a08278d4c2b Mon Sep 17 00:00:00 2001 +From: Kamal Heib +Date: Mon, 22 Jun 2020 13:07:31 +0300 +Subject: [PATCH 1/1] RDMA/rxe: Remove unused rxe_mem_map_pages +Git-commit: f6b4c11fc527b9ca98c219fb9a465a08278d4c2b +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +This function is not in use - delete it. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20200622100731.27359-1-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/sw/rxe/rxe_loc.h | 3 -- + drivers/infiniband/sw/rxe/rxe_mr.c | 44 ----------------------------- + 2 files changed, 47 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h +index 775c23becaec..238d6a357aac 100644 +--- a/drivers/infiniband/sw/rxe/rxe_loc.h ++++ b/drivers/infiniband/sw/rxe/rxe_loc.h +@@ -132,9 +132,6 @@ struct rxe_mem *lookup_mem(struct rxe_pd *pd, int access, u32 key, + + int mem_check_range(struct rxe_mem *mem, u64 iova, size_t length); + +-int rxe_mem_map_pages(struct rxe_dev *rxe, struct rxe_mem *mem, +- u64 *page, int num_pages, u64 iova); +- + void rxe_mem_cleanup(struct rxe_pool_entry *arg); + + int advance_dma_data(struct rxe_dma_info *dma, unsigned int length); +diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c +index e83c7b518bfa..a63cb5fac01f 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mr.c ++++ b/drivers/infiniband/sw/rxe/rxe_mr.c +@@ -587,47 +587,3 @@ struct rxe_mem *lookup_mem(struct rxe_pd *pd, int access, u32 key, + + return mem; + } +- +-int rxe_mem_map_pages(struct rxe_dev *rxe, struct rxe_mem *mem, +- u64 *page, int num_pages, u64 iova) +-{ +- int i; +- int num_buf; +- int err; +- struct rxe_map **map; +- struct rxe_phys_buf *buf; +- int page_size; +- +- if (num_pages > mem->max_buf) { +- err = -EINVAL; +- goto err1; +- } +- +- num_buf = 0; +- page_size = 1 << mem->page_shift; +- map = mem->map; +- buf = map[0]->buf; +- +- for (i = 0; i < num_pages; i++) { +- buf->addr = *page++; +- buf->size = page_size; +- buf++; +- num_buf++; +- +- if (num_buf == RXE_BUF_PER_MAP) { +- map++; +- buf = map[0]->buf; +- num_buf = 0; +- } +- } +- +- mem->iova = iova; +- mem->va = iova; +- mem->length = num_pages << mem->page_shift; +- mem->state = RXE_MEM_STATE_VALID; +- +- return 0; +- +-err1: +- return err; +-} +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-rxe-Remove-useless-rxe_init_device_param-assign.patch b/patches.suse/RDMA-rxe-Remove-useless-rxe_init_device_param-assign.patch new file mode 100644 index 0000000..7cb4a0c --- /dev/null +++ b/patches.suse/RDMA-rxe-Remove-useless-rxe_init_device_param-assign.patch @@ -0,0 +1,103 @@ +From dc2f7edcc01219fbbb517c1245dac46d30edaf93 Mon Sep 17 00:00:00 2001 +From: Leon Romanovsky +Date: Sun, 20 Oct 2019 08:57:24 +0300 +Subject: [PATCH 1/1] RDMA/rxe: Remove useless rxe_init_device_param +Git-commit: dc2f7edcc01219fbbb517c1245dac46d30edaf93 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + assignments + +IB devices are allocated with kzalloc and don't need explicit zero +assignments for their parameters. It can be removed safely. + +Link: https://lore.kernel.org/r/20191020055724.7410-1-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/sw/rxe/rxe.c | 13 ------------- + drivers/infiniband/sw/rxe/rxe_param.h | 13 ------------- + 2 files changed, 26 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c +index a8c11b5e1e94..0946a301a5c5 100644 +--- a/drivers/infiniband/sw/rxe/rxe.c ++++ b/drivers/infiniband/sw/rxe/rxe.c +@@ -77,12 +77,8 @@ static void rxe_init_device_param(struct rxe_dev *rxe) + { + rxe->max_inline_data = RXE_MAX_INLINE_DATA; + +- rxe->attr.fw_ver = RXE_FW_VER; + rxe->attr.max_mr_size = RXE_MAX_MR_SIZE; + rxe->attr.page_size_cap = RXE_PAGE_SIZE_CAP; +- rxe->attr.vendor_id = RXE_VENDOR_ID; +- rxe->attr.vendor_part_id = RXE_VENDOR_PART_ID; +- rxe->attr.hw_ver = RXE_HW_VER; + rxe->attr.max_qp = RXE_MAX_QP; + rxe->attr.max_qp_wr = RXE_MAX_QP_WR; + rxe->attr.device_cap_flags = RXE_DEVICE_CAP_FLAGS; +@@ -94,22 +90,13 @@ static void rxe_init_device_param(struct rxe_dev *rxe) + rxe->attr.max_mr = RXE_MAX_MR; + rxe->attr.max_pd = RXE_MAX_PD; + rxe->attr.max_qp_rd_atom = RXE_MAX_QP_RD_ATOM; +- rxe->attr.max_ee_rd_atom = RXE_MAX_EE_RD_ATOM; + rxe->attr.max_res_rd_atom = RXE_MAX_RES_RD_ATOM; + rxe->attr.max_qp_init_rd_atom = RXE_MAX_QP_INIT_RD_ATOM; +- rxe->attr.max_ee_init_rd_atom = RXE_MAX_EE_INIT_RD_ATOM; + rxe->attr.atomic_cap = IB_ATOMIC_HCA; +- rxe->attr.max_ee = RXE_MAX_EE; +- rxe->attr.max_rdd = RXE_MAX_RDD; +- rxe->attr.max_mw = RXE_MAX_MW; +- rxe->attr.max_raw_ipv6_qp = RXE_MAX_RAW_IPV6_QP; +- rxe->attr.max_raw_ethy_qp = RXE_MAX_RAW_ETHY_QP; + rxe->attr.max_mcast_grp = RXE_MAX_MCAST_GRP; + rxe->attr.max_mcast_qp_attach = RXE_MAX_MCAST_QP_ATTACH; + rxe->attr.max_total_mcast_qp_attach = RXE_MAX_TOT_MCAST_QP_ATTACH; + rxe->attr.max_ah = RXE_MAX_AH; +- rxe->attr.max_fmr = RXE_MAX_FMR; +- rxe->attr.max_map_per_fmr = RXE_MAX_MAP_PER_FMR; + rxe->attr.max_srq = RXE_MAX_SRQ; + rxe->attr.max_srq_wr = RXE_MAX_SRQ_WR; + rxe->attr.max_srq_sge = RXE_MAX_SRQ_SGE; +diff --git a/drivers/infiniband/sw/rxe/rxe_param.h b/drivers/infiniband/sw/rxe/rxe_param.h +index fe5207386700..353c6668249e 100644 +--- a/drivers/infiniband/sw/rxe/rxe_param.h ++++ b/drivers/infiniband/sw/rxe/rxe_param.h +@@ -60,12 +60,8 @@ static inline enum ib_mtu eth_mtu_int_to_enum(int mtu) + + /* default/initial rxe device parameter settings */ + enum rxe_device_param { +- RXE_FW_VER = 0, + RXE_MAX_MR_SIZE = -1ull, + RXE_PAGE_SIZE_CAP = 0xfffff000, +- RXE_VENDOR_ID = 0, +- RXE_VENDOR_PART_ID = 0, +- RXE_HW_VER = 0, + RXE_MAX_QP = 0x10000, + RXE_MAX_QP_WR = 0x4000, + RXE_MAX_INLINE_DATA = 400, +@@ -87,21 +83,12 @@ enum rxe_device_param { + RXE_MAX_MR = 256 * 1024, + RXE_MAX_PD = 0x7ffc, + RXE_MAX_QP_RD_ATOM = 128, +- RXE_MAX_EE_RD_ATOM = 0, + RXE_MAX_RES_RD_ATOM = 0x3f000, + RXE_MAX_QP_INIT_RD_ATOM = 128, +- RXE_MAX_EE_INIT_RD_ATOM = 0, +- RXE_MAX_EE = 0, +- RXE_MAX_RDD = 0, +- RXE_MAX_MW = 0, +- RXE_MAX_RAW_IPV6_QP = 0, +- RXE_MAX_RAW_ETHY_QP = 0, + RXE_MAX_MCAST_GRP = 8192, + RXE_MAX_MCAST_QP_ATTACH = 56, + RXE_MAX_TOT_MCAST_QP_ATTACH = 0x70000, + RXE_MAX_AH = 100, +- RXE_MAX_FMR = 0, +- RXE_MAX_MAP_PER_FMR = 0, + RXE_MAX_SRQ = 960, + RXE_MAX_SRQ_WR = 0x4000, + RXE_MIN_SRQ_WR = 1, +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-rxe-Return-void-from-rxe_init_port_param.patch b/patches.suse/RDMA-rxe-Return-void-from-rxe_init_port_param.patch new file mode 100644 index 0000000..ac4d87e --- /dev/null +++ b/patches.suse/RDMA-rxe-Return-void-from-rxe_init_port_param.patch @@ -0,0 +1,46 @@ +From 9d576eac6380534081a5ce98b0776993f7bb6a2e Mon Sep 17 00:00:00 2001 +From: Kamal Heib +Date: Sun, 5 Jul 2020 13:43:11 +0300 +Subject: [PATCH 1/1] RDMA/rxe: Return void from rxe_init_port_param() +Git-commit: 9d576eac6380534081a5ce98b0776993f7bb6a2e +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +The return value from rxe_init_port_param() is always 0 - change it to be +void. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20200705104313.283034-3-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/sw/rxe/rxe.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c +index c7191b5e04a5..efcb72c92be6 100644 +--- a/drivers/infiniband/sw/rxe/rxe.c ++++ b/drivers/infiniband/sw/rxe/rxe.c +@@ -111,7 +111,7 @@ static void rxe_init_device_param(struct rxe_dev *rxe) + } + + /* initialize port attributes */ +-static int rxe_init_port_param(struct rxe_port *port) ++static void rxe_init_port_param(struct rxe_port *port) + { + port->attr.state = IB_PORT_DOWN; + port->attr.max_mtu = IB_MTU_4096; +@@ -134,8 +134,6 @@ static int rxe_init_port_param(struct rxe_port *port) + port->attr.phys_state = RXE_PORT_PHYS_STATE; + port->mtu_cap = ib_mtu_enum_to_int(IB_MTU_256); + port->subnet_prefix = cpu_to_be64(RXE_PORT_SUBNET_PREFIX); +- +- return 0; + } + + /* initialize port state, note IB convention that HCA ports are always +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-rxe-Return-void-from-rxe_mem_init_dma.patch b/patches.suse/RDMA-rxe-Return-void-from-rxe_mem_init_dma.patch new file mode 100644 index 0000000..6992e04 --- /dev/null +++ b/patches.suse/RDMA-rxe-Return-void-from-rxe_mem_init_dma.patch @@ -0,0 +1,103 @@ +From 293d8440a0bdd246d523802f62fb1d16c238a485 Mon Sep 17 00:00:00 2001 +From: Kamal Heib +Date: Sun, 5 Jul 2020 13:43:12 +0300 +Subject: [PATCH 1/1] RDMA/rxe: Return void from rxe_mem_init_dma() +Git-commit: 293d8440a0bdd246d523802f62fb1d16c238a485 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +The return value from rxe_mem_init_dma() is always 0 - change it to be +void and fix the callers accordingly. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20200705104313.283034-4-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/sw/rxe/rxe_loc.h | 4 ++-- + drivers/infiniband/sw/rxe/rxe_mr.c | 6 ++---- + drivers/infiniband/sw/rxe/rxe_verbs.c | 20 +++----------------- + 3 files changed, 7 insertions(+), 23 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h +index 238d6a357aac..0688928cf2b1 100644 +--- a/drivers/infiniband/sw/rxe/rxe_loc.h ++++ b/drivers/infiniband/sw/rxe/rxe_loc.h +@@ -103,8 +103,8 @@ enum copy_direction { + from_mem_obj, + }; + +-int rxe_mem_init_dma(struct rxe_pd *pd, +- int access, struct rxe_mem *mem); ++void rxe_mem_init_dma(struct rxe_pd *pd, ++ int access, struct rxe_mem *mem); + + int rxe_mem_init_user(struct rxe_pd *pd, u64 start, + u64 length, u64 iova, int access, struct ib_udata *udata, +diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c +index a63cb5fac01f..cdd811a45120 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mr.c ++++ b/drivers/infiniband/sw/rxe/rxe_mr.c +@@ -144,8 +144,8 @@ err1: + return -ENOMEM; + } + +-int rxe_mem_init_dma(struct rxe_pd *pd, +- int access, struct rxe_mem *mem) ++void rxe_mem_init_dma(struct rxe_pd *pd, ++ int access, struct rxe_mem *mem) + { + rxe_mem_init(access, mem); + +@@ -153,8 +153,6 @@ int rxe_mem_init_dma(struct rxe_pd *pd, + mem->access = access; + mem->state = RXE_MEM_STATE_VALID; + mem->type = RXE_MEM_TYPE_DMA; +- +- return 0; + } + + int rxe_mem_init_user(struct rxe_pd *pd, u64 start, +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index 0472df52d36d..0f5b3c062f32 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -901,30 +901,16 @@ static struct ib_mr *rxe_get_dma_mr(struct ib_pd *ibpd, int access) + struct rxe_dev *rxe = to_rdev(ibpd->device); + struct rxe_pd *pd = to_rpd(ibpd); + struct rxe_mem *mr; +- int err; + + mr = rxe_alloc(&rxe->mr_pool); +- if (!mr) { +- err = -ENOMEM; +- goto err1; +- } ++ if (!mr) ++ return ERR_PTR(-ENOMEM); + + rxe_add_index(mr); +- + rxe_add_ref(pd); +- +- err = rxe_mem_init_dma(pd, access, mr); +- if (err) +- goto err2; ++ rxe_mem_init_dma(pd, access, mr); + + return &mr->ibmr; +- +-err2: +- rxe_drop_ref(pd); +- rxe_drop_index(mr); +- rxe_drop_ref(mr); +-err1: +- return ERR_PTR(err); + } + + static struct ib_mr *rxe_reg_user_mr(struct ib_pd *ibpd, +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-rxe-Set-default-vendor-ID.patch b/patches.suse/RDMA-rxe-Set-default-vendor-ID.patch new file mode 100644 index 0000000..78838cc --- /dev/null +++ b/patches.suse/RDMA-rxe-Set-default-vendor-ID.patch @@ -0,0 +1,85 @@ +From 0184afd15a141d7ce24c32c0d86a1e3ba6bc0eb3 Mon Sep 17 00:00:00 2001 +From: Zhu Yanjun +Date: Mon, 6 Apr 2020 20:35:01 +0300 +Subject: [PATCH 1/1] RDMA/rxe: Set default vendor ID +Git-commit: 0184afd15a141d7ce24c32c0d86a1e3ba6bc0eb3 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +The RXE driver doesn't set vendor_id and user space applications see +zeros. This causes to pyverbs tests to fail with the following traceback, +because the expectation is to have valid vendor_id. + +Traceback (most recent call last): + File "tests/test_device.py", line 51, in test_query_device + self.verify_device_attr(attr) + File "tests/test_device.py", line 77, in verify_device_attr + assert attr.vendor_id != 0 + +In order to fix it, we will set vendor_id 0XFFFFFF, according to the IBTA +v1.4 A3.3.1 VENDOR INFORMATION section. + +""" +A vendor that produces a generic controller (i.e., one that supports a +standard I/O protocol such as SRP), which does not have vendor specific +device drivers, may use the value of 0xFFFFFF in the VendorID field. +""" + +Before: + +hca_id: rxe0 + transport: InfiniBand (0) + fw_ver: 0.0.0 + node_guid: 5054:00ff:feaa:5363 + sys_image_guid: 5054:00ff:feaa:5363 + vendor_id: 0x0000 + +After: + +hca_id: rxe0 + transport: InfiniBand (0) + fw_ver: 0.0.0 + node_guid: 5054:00ff:feaa:5363 + sys_image_guid: 5054:00ff:feaa:5363 + vendor_id: 0xffffff + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20200406173501.1466273-1-leon@kernel.org +Signed-off-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/sw/rxe/rxe.c | 1 + + drivers/infiniband/sw/rxe/rxe_param.h | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c +index 4afdd2e20883..5642eefb4ba1 100644 +--- a/drivers/infiniband/sw/rxe/rxe.c ++++ b/drivers/infiniband/sw/rxe/rxe.c +@@ -77,6 +77,7 @@ static void rxe_init_device_param(struct rxe_dev *rxe) + { + rxe->max_inline_data = RXE_MAX_INLINE_DATA; + ++ rxe->attr.vendor_id = RXE_VENDOR_ID; + rxe->attr.max_mr_size = RXE_MAX_MR_SIZE; + rxe->attr.page_size_cap = RXE_PAGE_SIZE_CAP; + rxe->attr.max_qp = RXE_MAX_QP; +diff --git a/drivers/infiniband/sw/rxe/rxe_param.h b/drivers/infiniband/sw/rxe/rxe_param.h +index f59616b02477..99e9d8ba9767 100644 +--- a/drivers/infiniband/sw/rxe/rxe_param.h ++++ b/drivers/infiniband/sw/rxe/rxe_param.h +@@ -127,6 +127,9 @@ enum rxe_device_param { + + /* Delay before calling arbiter timer */ + RXE_NSEC_ARB_TIMER_DELAY = 200, ++ ++ /* IBTA v1.4 A3.3.1 VENDOR INFORMATION section */ ++ RXE_VENDOR_ID = 0XFFFFFF, + }; + + /* default/initial rxe port parameters */ +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-rxe-Set-sys_image_guid-to-be-aligned-with-HW-IB.patch b/patches.suse/RDMA-rxe-Set-sys_image_guid-to-be-aligned-with-HW-IB.patch new file mode 100644 index 0000000..2f8e0e6 --- /dev/null +++ b/patches.suse/RDMA-rxe-Set-sys_image_guid-to-be-aligned-with-HW-IB.patch @@ -0,0 +1,55 @@ +From d0ca2c35dd15a3d989955caec02beea02f735ee6 Mon Sep 17 00:00:00 2001 +From: Zhu Yanjun +Date: Mon, 23 Mar 2020 13:28:00 +0200 +Subject: [PATCH 1/1] RDMA/rxe: Set sys_image_guid to be aligned with HW IB +Git-commit: d0ca2c35dd15a3d989955caec02beea02f735ee6 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + devices + +The RXE driver doesn't set sys_image_guid and user space applications see +zeros. This causes to pyverbs tests to fail with the following traceback, +because the IBTA spec requires to have valid sys_image_guid. + + Traceback (most recent call last): + File "./tests/test_device.py", line 51, in test_query_device + self.verify_device_attr(attr) + File "./tests/test_device.py", line 74, in verify_device_attr + assert attr.sys_image_guid != 0 + +In order to fix it, set sys_image_guid to be equal to node_guid. + +Before: + 5: rxe0: ... node_guid 5054:00ff:feaa:5363 sys_image_guid + 0000:0000:0000:0000 + +After: + 5: rxe0: ... node_guid 5054:00ff:feaa:5363 sys_image_guid + 5054:00ff:feaa:5363 + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20200323112800.1444784-1-leon@kernel.org +Signed-off-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/sw/rxe/rxe.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c +index 0946a301a5c5..4afdd2e20883 100644 +--- a/drivers/infiniband/sw/rxe/rxe.c ++++ b/drivers/infiniband/sw/rxe/rxe.c +@@ -103,6 +103,8 @@ static void rxe_init_device_param(struct rxe_dev *rxe) + rxe->attr.max_fast_reg_page_list_len = RXE_MAX_FMR_PAGE_LIST_LEN; + rxe->attr.max_pkeys = RXE_MAX_PKEYS; + rxe->attr.local_ca_ack_delay = RXE_LOCAL_CA_ACK_DELAY; ++ addrconf_addr_eui48((unsigned char *)&rxe->attr.sys_image_guid, ++ rxe->ndev->dev_addr); + + rxe->max_ucontext = RXE_MAX_UCONTEXT; + } +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-rxe-Skip-dgid-check-in-loopback-mode.patch b/patches.suse/RDMA-rxe-Skip-dgid-check-in-loopback-mode.patch new file mode 100644 index 0000000..7b0eb76 --- /dev/null +++ b/patches.suse/RDMA-rxe-Skip-dgid-check-in-loopback-mode.patch @@ -0,0 +1,71 @@ +From 5c99274be8864519328aa74bc550ba410095bc1c Mon Sep 17 00:00:00 2001 +From: Zhu Yanjun +Date: Tue, 30 Jun 2020 15:36:05 +0300 +Subject: [PATCH 1/1] RDMA/rxe: Skip dgid check in loopback mode +Git-commit: 5c99274be8864519328aa74bc550ba410095bc1c +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +In the loopback tests, the following call trace occurs. + + Call Trace: + __rxe_do_task+0x1a/0x30 [rdma_rxe] + rxe_qp_destroy+0x61/0xa0 [rdma_rxe] + rxe_destroy_qp+0x20/0x60 [rdma_rxe] + ib_destroy_qp_user+0xcc/0x220 [ib_core] + uverbs_free_qp+0x3c/0xc0 [ib_uverbs] + destroy_hw_idr_uobject+0x24/0x70 [ib_uverbs] + uverbs_destroy_uobject+0x43/0x1b0 [ib_uverbs] + uobj_destroy+0x41/0x70 [ib_uverbs] + __uobj_get_destroy+0x39/0x70 [ib_uverbs] + ib_uverbs_destroy_qp+0x88/0xc0 [ib_uverbs] + ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xb9/0xf0 [ib_uverbs] + ib_uverbs_cmd_verbs+0xb16/0xc30 [ib_uverbs] + +The root cause is that the actual RDMA connection is not created in the +loopback tests and the rxe_match_dgid will fail randomly. + +To fix this call trace which appear in the loopback tests, skip check of +the dgid. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20200630123605.446959-1-leon@kernel.org +Signed-off-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/sw/rxe/rxe_recv.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c +index 831ad578a7b2..46e111c218fd 100644 +--- a/drivers/infiniband/sw/rxe/rxe_recv.c ++++ b/drivers/infiniband/sw/rxe/rxe_recv.c +@@ -330,10 +330,14 @@ err1: + + static int rxe_match_dgid(struct rxe_dev *rxe, struct sk_buff *skb) + { ++ struct rxe_pkt_info *pkt = SKB_TO_PKT(skb); + const struct ib_gid_attr *gid_attr; + union ib_gid dgid; + union ib_gid *pdgid; + ++ if (pkt->mask & RXE_LOOPBACK_MASK) ++ return 0; ++ + if (skb->protocol == htons(ETH_P_IP)) { + ipv6_addr_set_v4mapped(ip_hdr(skb)->daddr, + (struct in6_addr *)&dgid); +@@ -366,7 +370,7 @@ void rxe_rcv(struct sk_buff *skb) + if (unlikely(skb->len < pkt->offset + RXE_BTH_BYTES)) + goto drop; + +- if (unlikely(rxe_match_dgid(rxe, skb) < 0)) { ++ if (rxe_match_dgid(rxe, skb) < 0) { + pr_warn_ratelimited("failed matching dgid\n"); + goto drop; + } +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/RDMA-srpt-Fix-typo-in-srpt_unregister_mad_agent-docs.patch b/patches.suse/RDMA-srpt-Fix-typo-in-srpt_unregister_mad_agent-docs.patch new file mode 100644 index 0000000..2845d90 --- /dev/null +++ b/patches.suse/RDMA-srpt-Fix-typo-in-srpt_unregister_mad_agent-docs.patch @@ -0,0 +1,37 @@ +From 21fcdeec09ff461b2f9a9ef4fcc3a136249e58a1 Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Thu, 5 Nov 2020 11:38:29 -0400 +Subject: [PATCH 1/1] RDMA/srpt: Fix typo in srpt_unregister_mad_agent +Git-commit: 21fcdeec09ff461b2f9a9ef4fcc3a136249e58a1 +Patch-mainline: v5.10-rc3 +References: bsc#1111666 + docstring + +htmldocs fails with: + +drivers/infiniband/ulp/srpt/ib_srpt.c:630: warning: Function parameter or member 'port_cnt' not described in 'srpt_unregister_mad_agent' + +Fixes: 372a1786283e ("IB/srpt: Fix memory leak in srpt_add_one") +Reported-by: Stephen Rothwell +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index 1b096305de1a..53a8becac827 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -622,7 +622,7 @@ static int srpt_refresh_port(struct srpt_port *sport) + /** + * srpt_unregister_mad_agent - unregister MAD callback functions + * @sdev: SRPT HCA pointer. +- * #port_cnt: number of ports with registered MAD ++ * @port_cnt: number of ports with registered MAD + * + * Note: It is safe to call this function more than once for the same device. + */ +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/block-Fix-use-after-free-in-blkdev_get.patch b/patches.suse/block-Fix-use-after-free-in-blkdev_get.patch index 22aa5f6..54aa17b 100644 --- a/patches.suse/block-Fix-use-after-free-in-blkdev_get.patch +++ b/patches.suse/block-Fix-use-after-free-in-blkdev_get.patch @@ -4,7 +4,7 @@ Date: Tue, 16 Jun 2020 20:16:55 +0800 Subject: [PATCH] block: Fix use-after-free in blkdev_get() Git-commit: 2d3a8e2deddea6c89961c422ec0c5b851e648c14 Patch-mainline: v5.8-rc2 -References: bsc#1174843 +References: bsc#1173834 bsc#1179141 CVE-2020-15436 In blkdev_get() we call __blkdev_get() to do some internal jobs and if there is some errors in __blkdev_get(), the bdput() is called which diff --git a/patches.suse/i40iw-Fix-error-handling-in-i40iw_manage_arp_cache.patch b/patches.suse/i40iw-Fix-error-handling-in-i40iw_manage_arp_cache.patch new file mode 100644 index 0000000..769a17f --- /dev/null +++ b/patches.suse/i40iw-Fix-error-handling-in-i40iw_manage_arp_cache.patch @@ -0,0 +1,37 @@ +From 37e31d2d26a4124506c24e95434e9baf3405a23a Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 22 Apr 2020 12:22:11 +0300 +Subject: [PATCH 1/1] i40iw: Fix error handling in i40iw_manage_arp_cache() +Git-commit: 37e31d2d26a4124506c24e95434e9baf3405a23a +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +The i40iw_arp_table() function can return -EOVERFLOW if +i40iw_alloc_resource() fails so we can't just test for "== -1". + +Fixes: 4e9042e647ff ("i40iw: add hw and utils files") +Link: https://lore.kernel.org/r/20200422092211.GA195357@mwanda +Signed-off-by: Dan Carpenter +Acked-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/i40iw/i40iw_hw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/i40iw/i40iw_hw.c b/drivers/infiniband/hw/i40iw/i40iw_hw.c +index 55a1fbf0e670..ae8b97c30665 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_hw.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_hw.c +@@ -534,7 +534,7 @@ void i40iw_manage_arp_cache(struct i40iw_device *iwdev, + int arp_index; + + arp_index = i40iw_arp_table(iwdev, ip_addr, ipv4, mac_addr, action); +- if (arp_index == -1) ++ if (arp_index < 0) + return; + cqp_request = i40iw_get_cqp_request(&iwdev->cqp, false); + if (!cqp_request) +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/i40iw-Report-correct-firmware-version.patch b/patches.suse/i40iw-Report-correct-firmware-version.patch new file mode 100644 index 0000000..5f9cb20 --- /dev/null +++ b/patches.suse/i40iw-Report-correct-firmware-version.patch @@ -0,0 +1,356 @@ +From 4b34e23f4eaa236b918886fb90f468a6aa04997f Mon Sep 17 00:00:00 2001 +From: "Sindhu, Devale" +Date: Fri, 13 Mar 2020 16:44:06 -0500 +Subject: [PATCH 1/1] i40iw: Report correct firmware version +Git-commit: 4b34e23f4eaa236b918886fb90f468a6aa04997f +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +The driver uses a hard-coded value for FW version and reports an +inconsistent FW version between ibv_devinfo and +/sys/class/infiniband/i40iw/fw_ver. + +Retrieve the FW version via a Control QP (CQP) operation and report it +consistently across sysfs and query device. + +Fixes: d37498417947 ("i40iw: add files for iwarp interface") +Link: https://lore.kernel.org/r/20200313214406.2159-1-shiraz.saleem@intel.com +Reported-by: Jarod Wilson +Signed-off-by: Sindhu, Devale +Signed-off-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/i40iw/i40iw.h | 22 ++++- + drivers/infiniband/hw/i40iw/i40iw_ctrl.c | 96 ++++++++++++++++++++++ + drivers/infiniband/hw/i40iw/i40iw_d.h | 26 +++++- + drivers/infiniband/hw/i40iw/i40iw_main.c | 6 ++ + drivers/infiniband/hw/i40iw/i40iw_p.h | 1 + + drivers/infiniband/hw/i40iw/i40iw_status.h | 3 +- + drivers/infiniband/hw/i40iw/i40iw_type.h | 12 +++ + drivers/infiniband/hw/i40iw/i40iw_verbs.c | 10 ++- + 8 files changed, 167 insertions(+), 9 deletions(-) + +diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h +index 8feec35f95a7..3c62c9327a9c 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw.h ++++ b/drivers/infiniband/hw/i40iw/i40iw.h +@@ -67,7 +67,7 @@ + #include "i40iw_user.h" + #include "i40iw_puda.h" + +-#define I40IW_FW_VERSION 2 ++#define I40IW_FW_VER_DEFAULT 2 + #define I40IW_HW_VERSION 2 + + #define I40IW_ARP_ADD 1 +@@ -325,6 +325,26 @@ struct i40iw_handler { + struct i40e_info ldev; + }; + ++/** ++ * i40iw_fw_major_ver - get firmware major version ++ * @dev: iwarp device ++ **/ ++static inline u64 i40iw_fw_major_ver(struct i40iw_sc_dev *dev) ++{ ++ return RS_64(dev->feature_info[I40IW_FEATURE_FW_INFO], ++ I40IW_FW_VER_MAJOR); ++} ++ ++/** ++ * i40iw_fw_minor_ver - get firmware minor version ++ * @dev: iwarp device ++ **/ ++static inline u64 i40iw_fw_minor_ver(struct i40iw_sc_dev *dev) ++{ ++ return RS_64(dev->feature_info[I40IW_FEATURE_FW_INFO], ++ I40IW_FW_VER_MINOR); ++} ++ + /** + * to_iwdev - get device + * @ibdev: ib device +diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c +index 4d841a3c68f3..e8b4b3743661 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c +@@ -1021,6 +1021,95 @@ static enum i40iw_status_code i40iw_sc_commit_fpm_values( + return ret_code; + } + ++/** ++ * i40iw_sc_query_rdma_features_done - poll cqp for query features done ++ * @cqp: struct for cqp hw ++ */ ++static enum i40iw_status_code ++i40iw_sc_query_rdma_features_done(struct i40iw_sc_cqp *cqp) ++{ ++ return i40iw_sc_poll_for_cqp_op_done( ++ cqp, I40IW_CQP_OP_QUERY_RDMA_FEATURES, NULL); ++} ++ ++/** ++ * i40iw_sc_query_rdma_features - query rdma features ++ * @cqp: struct for cqp hw ++ * @feat_mem: holds PA for HW to use ++ * @scratch: u64 saved to be used during cqp completion ++ */ ++static enum i40iw_status_code ++i40iw_sc_query_rdma_features(struct i40iw_sc_cqp *cqp, ++ struct i40iw_dma_mem *feat_mem, u64 scratch) ++{ ++ u64 *wqe; ++ u64 header; ++ ++ wqe = i40iw_sc_cqp_get_next_send_wqe(cqp, scratch); ++ if (wqe) ++ return I40IW_ERR_RING_FULL; ++ ++ set_64bit_val(wqe, 32, feat_mem->pa); ++ ++ header = LS_64(I40IW_CQP_OP_QUERY_RDMA_FEATURES, I40IW_CQPSQ_OPCODE) | ++ LS_64(cqp->polarity, I40IW_CQPSQ_WQEVALID) | feat_mem->size; ++ ++ i40iw_insert_wqe_hdr(wqe, header); ++ ++ i40iw_debug_buf(cqp->dev, I40IW_DEBUG_WQE, "QUERY RDMA FEATURES WQE", ++ wqe, I40IW_CQP_WQE_SIZE * 8); ++ ++ i40iw_sc_cqp_post_sq(cqp); ++ ++ return 0; ++} ++ ++/** ++ * i40iw_get_rdma_features - get RDMA features ++ * @dev - sc device struct ++ */ ++enum i40iw_status_code i40iw_get_rdma_features(struct i40iw_sc_dev *dev) ++{ ++ enum i40iw_status_code ret_code; ++ struct i40iw_dma_mem feat_buf; ++ u64 temp; ++ u16 byte_idx, feat_type, feat_cnt; ++ ++ ret_code = i40iw_allocate_dma_mem(dev->hw, &feat_buf, ++ I40IW_FEATURE_BUF_SIZE, ++ I40IW_FEATURE_BUF_ALIGNMENT); ++ ++ if (ret_code) ++ return I40IW_ERR_NO_MEMORY; ++ ++ ret_code = i40iw_sc_query_rdma_features(dev->cqp, &feat_buf, 0); ++ if (!ret_code) ++ ret_code = i40iw_sc_query_rdma_features_done(dev->cqp); ++ ++ if (ret_code) ++ goto exit; ++ ++ get_64bit_val(feat_buf.va, 0, &temp); ++ feat_cnt = RS_64(temp, I40IW_FEATURE_CNT); ++ if (feat_cnt < I40IW_MAX_FEATURES) { ++ ret_code = I40IW_ERR_INVALID_FEAT_CNT; ++ goto exit; ++ } else if (feat_cnt > I40IW_MAX_FEATURES) { ++ i40iw_debug(dev, I40IW_DEBUG_CQP, ++ "features buf size insufficient\n"); ++ } ++ ++ for (byte_idx = 0, feat_type = 0; feat_type < I40IW_MAX_FEATURES; ++ feat_type++, byte_idx += 8) { ++ get_64bit_val((u64 *)feat_buf.va, byte_idx, &temp); ++ dev->feature_info[feat_type] = RS_64(temp, I40IW_FEATURE_INFO); ++ } ++exit: ++ i40iw_free_dma_mem(dev->hw, &feat_buf); ++ ++ return ret_code; ++} ++ + /** + * i40iw_sc_query_fpm_values_done - poll for cqp wqe completion for query fpm + * @cqp: struct for cqp hw +@@ -4265,6 +4354,13 @@ static enum i40iw_status_code i40iw_exec_cqp_cmd(struct i40iw_sc_dev *dev, + true, + I40IW_CQP_WAIT_EVENT); + break; ++ case OP_QUERY_RDMA_FEATURES: ++ values_mem.pa = pcmdinfo->in.u.query_rdma_features.cap_pa; ++ values_mem.va = pcmdinfo->in.u.query_rdma_features.cap_va; ++ status = i40iw_sc_query_rdma_features( ++ pcmdinfo->in.u.query_rdma_features.cqp, &values_mem, ++ pcmdinfo->in.u.query_rdma_features.scratch); ++ break; + default: + status = I40IW_NOT_SUPPORTED; + break; +diff --git a/drivers/infiniband/hw/i40iw/i40iw_d.h b/drivers/infiniband/hw/i40iw/i40iw_d.h +index 6ddaeec87d2f..e8367d67575d 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_d.h ++++ b/drivers/infiniband/hw/i40iw/i40iw_d.h +@@ -403,7 +403,7 @@ + #define I40IW_CQP_OP_MANAGE_ARP 0x0f + #define I40IW_CQP_OP_MANAGE_VF_PBLE_BP 0x10 + #define I40IW_CQP_OP_MANAGE_PUSH_PAGES 0x11 +-#define I40IW_CQP_OP_MANAGE_PE_TEAM 0x12 ++#define I40IW_CQP_OP_QUERY_RDMA_FEATURES 0x12 + #define I40IW_CQP_OP_UPLOAD_CONTEXT 0x13 + #define I40IW_CQP_OP_ALLOCATE_LOC_MAC_IP_TABLE_ENTRY 0x14 + #define I40IW_CQP_OP_MANAGE_HMC_PM_FUNC_TABLE 0x15 +@@ -431,6 +431,24 @@ + #define I40IW_CQP_OP_SHMC_PAGES_ALLOCATED 0x2b + #define I40IW_CQP_OP_SET_HMC_RESOURCE_PROFILE 0x2d + ++#define I40IW_FEATURE_BUF_SIZE (8 * I40IW_MAX_FEATURES) ++ ++#define I40IW_FW_VER_MINOR_SHIFT 0 ++#define I40IW_FW_VER_MINOR_MASK \ ++ (0xffffULL << I40IW_FW_VER_MINOR_SHIFT) ++ ++#define I40IW_FW_VER_MAJOR_SHIFT 16 ++#define I40IW_FW_VER_MAJOR_MASK \ ++ (0xffffULL << I40IW_FW_VER_MAJOR_SHIFT) ++ ++#define I40IW_FEATURE_INFO_SHIFT 0 ++#define I40IW_FEATURE_INFO_MASK \ ++ (0xffffULL << I40IW_FEATURE_INFO_SHIFT) ++ ++#define I40IW_FEATURE_CNT_SHIFT 32 ++#define I40IW_FEATURE_CNT_MASK \ ++ (0xffffULL << I40IW_FEATURE_CNT_SHIFT) ++ + #define I40IW_UDA_QPSQ_NEXT_HEADER_SHIFT 16 + #define I40IW_UDA_QPSQ_NEXT_HEADER_MASK ((u64)0xff << I40IW_UDA_QPSQ_NEXT_HEADER_SHIFT) + +@@ -1529,7 +1547,8 @@ enum i40iw_alignment { + I40IW_AEQ_ALIGNMENT = 0x100, + I40IW_CEQ_ALIGNMENT = 0x100, + I40IW_CQ0_ALIGNMENT = 0x100, +- I40IW_SD_BUF_ALIGNMENT = 0x80 ++ I40IW_SD_BUF_ALIGNMENT = 0x80, ++ I40IW_FEATURE_BUF_ALIGNMENT = 0x8 + }; + + #define I40IW_WQE_SIZE_64 64 +@@ -1732,6 +1751,7 @@ enum i40iw_alignment { + #define OP_REQUESTED_COMMANDS 31 + #define OP_COMPLETED_COMMANDS 32 + #define OP_GEN_AE 33 +-#define OP_SIZE_CQP_STAT_ARRAY 34 ++#define OP_QUERY_RDMA_FEATURES 34 ++#define OP_SIZE_CQP_STAT_ARRAY 35 + + #endif +diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c +index 84e1b52af15e..9c96ece5e7f3 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_main.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_main.c +@@ -1683,6 +1683,12 @@ static int i40iw_open(struct i40e_info *ldev, struct i40e_client *client) + status = i40iw_setup_ceqs(iwdev, ldev); + if (status) + break; ++ ++ status = i40iw_get_rdma_features(dev); ++ if (status) ++ dev->feature_info[I40IW_FEATURE_FW_INFO] = ++ I40IW_FW_VER_DEFAULT; ++ + iwdev->init_state = CEQ_CREATED; + status = i40iw_initialize_hw_resources(iwdev); + if (status) +diff --git a/drivers/infiniband/hw/i40iw/i40iw_p.h b/drivers/infiniband/hw/i40iw/i40iw_p.h +index 11d3a2a72100..4c429567bbb4 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_p.h ++++ b/drivers/infiniband/hw/i40iw/i40iw_p.h +@@ -105,6 +105,7 @@ enum i40iw_status_code i40iw_sc_static_hmc_pages_allocated(struct i40iw_sc_cqp * + bool poll_registers); + + enum i40iw_status_code i40iw_config_fpm_values(struct i40iw_sc_dev *dev, u32 qp_count); ++enum i40iw_status_code i40iw_get_rdma_features(struct i40iw_sc_dev *dev); + + void free_sd_mem(struct i40iw_sc_dev *dev); + +diff --git a/drivers/infiniband/hw/i40iw/i40iw_status.h b/drivers/infiniband/hw/i40iw/i40iw_status.h +index f7013f11d808..d1c5855bd8c3 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_status.h ++++ b/drivers/infiniband/hw/i40iw/i40iw_status.h +@@ -95,7 +95,8 @@ enum i40iw_status_code { + I40IW_ERR_INVALID_MAC_ADDR = -65, + I40IW_ERR_BAD_STAG = -66, + I40IW_ERR_CQ_COMPL_ERROR = -67, +- I40IW_ERR_QUEUE_DESTROYED = -68 ++ I40IW_ERR_QUEUE_DESTROYED = -68, ++ I40IW_ERR_INVALID_FEAT_CNT = -69 + + }; + #endif +diff --git a/drivers/infiniband/hw/i40iw/i40iw_type.h b/drivers/infiniband/hw/i40iw/i40iw_type.h +index adc8d2ec523d..54c323c40d96 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_type.h ++++ b/drivers/infiniband/hw/i40iw/i40iw_type.h +@@ -234,6 +234,11 @@ enum i40iw_hw_stats_index_64b { + I40IW_HW_STAT_INDEX_MAX_64 + }; + ++enum i40iw_feature_type { ++ I40IW_FEATURE_FW_INFO = 0, ++ I40IW_MAX_FEATURES ++}; ++ + struct i40iw_dev_hw_stats_offsets { + u32 stats_offset_32[I40IW_HW_STAT_INDEX_MAX_32]; + u32 stats_offset_64[I40IW_HW_STAT_INDEX_MAX_64]; +@@ -501,6 +506,7 @@ struct i40iw_sc_dev { + const struct i40iw_vf_cqp_ops *iw_vf_cqp_ops; + + struct i40iw_hmc_fpm_misc hmc_fpm_misc; ++ u64 feature_info[I40IW_MAX_FEATURES]; + u32 debug_mask; + u8 hmc_fn_id; + bool is_pf; +@@ -1340,6 +1346,12 @@ struct cqp_info { + struct i40iw_sc_qp *qp; + u64 scratch; + } suspend_resume; ++ struct { ++ struct i40iw_sc_cqp *cqp; ++ void *cap_va; ++ u64 cap_pa; ++ u64 scratch; ++ } query_rdma_features; + } u; + }; + +diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c +index fa1292932b88..1b6fb1380961 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c +@@ -64,7 +64,8 @@ static int i40iw_query_device(struct ib_device *ibdev, + return -EINVAL; + memset(props, 0, sizeof(*props)); + ether_addr_copy((u8 *)&props->sys_image_guid, iwdev->netdev->dev_addr); +- props->fw_ver = I40IW_FW_VERSION; ++ props->fw_ver = i40iw_fw_major_ver(&iwdev->sc_dev) << 32 | ++ i40iw_fw_minor_ver(&iwdev->sc_dev); + props->device_cap_flags = iwdev->device_cap_flags; + props->vendor_id = iwdev->ldev->pcidev->vendor; + props->vendor_part_id = iwdev->ldev->pcidev->device; +@@ -2534,10 +2535,11 @@ static const char * const i40iw_hw_stat_names[] = { + + static void i40iw_get_dev_fw_str(struct ib_device *dev, char *str) + { +- u32 firmware_version = I40IW_FW_VERSION; ++ struct i40iw_device *iwdev = to_iwdev(dev); + +- snprintf(str, IB_FW_VERSION_NAME_MAX, "%u.%u", firmware_version, +- (firmware_version & 0x000000ff)); ++ snprintf(str, IB_FW_VERSION_NAME_MAX, "%llu.%llu", ++ i40iw_fw_major_ver(&iwdev->sc_dev), ++ i40iw_fw_minor_ver(&iwdev->sc_dev)); + } + + /** +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/i40iw-fix-null-pointer-dereference-on-a-null-wqe-poi.patch b/patches.suse/i40iw-fix-null-pointer-dereference-on-a-null-wqe-poi.patch new file mode 100644 index 0000000..c6fc2d6 --- /dev/null +++ b/patches.suse/i40iw-fix-null-pointer-dereference-on-a-null-wqe-poi.patch @@ -0,0 +1,40 @@ +From f70968f05de4e7c24d839ca0d3e40f17c8024498 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Wed, 1 Apr 2020 23:49:21 +0100 +Subject: [PATCH 1/1] i40iw: fix null pointer dereference on a null wqe pointer +Git-commit: f70968f05de4e7c24d839ca0d3e40f17c8024498 +Patch-mainline: v5.10-rc1 +References: bsc#1111666 + +Currently the null check for wqe is incorrect and lets a null wqe +be passed to set_64bit_val and this indexes into the null pointer +causing a null pointer dereference. Fix this by fixing the null +pointer check to return an error if wqe is null. + +Link: https://lore.kernel.org/r/20200401224921.405279-1-colin.king@canonical.com +Addresses-Coverity: ("dereference after a null check") +Fixes: 4b34e23f4eaa ("i40iw: Report correct firmware version") +Signed-off-by: Colin Ian King +Acked-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Acked-by: Nicolas Morey-Chaisemartin +--- + drivers/infiniband/hw/i40iw/i40iw_ctrl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c +index e8b4b3743661..688f19667221 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c +@@ -1046,7 +1046,7 @@ i40iw_sc_query_rdma_features(struct i40iw_sc_cqp *cqp, + u64 header; + + wqe = i40iw_sc_cqp_get_next_send_wqe(cqp, scratch); +- if (wqe) ++ if (!wqe) + return I40IW_ERR_RING_FULL; + + set_64bit_val(wqe, 32, feat_mem->pa); +-- +2.29.2.405.gfdfcad78fd04 + diff --git a/patches.suse/romfs-fix-uninitialized-memory-leak-in-romfs_dev_rea.patch b/patches.suse/romfs-fix-uninitialized-memory-leak-in-romfs_dev_rea.patch new file mode 100644 index 0000000..887ac4b --- /dev/null +++ b/patches.suse/romfs-fix-uninitialized-memory-leak-in-romfs_dev_rea.patch @@ -0,0 +1,59 @@ +From bcf85fcedfdd17911982a3e3564fcfec7b01eebd Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Thu, 20 Aug 2020 17:42:11 -0700 +Subject: [PATCH] romfs: fix uninitialized memory leak in romfs_dev_read() +Git-commit: bcf85fcedfdd17911982a3e3564fcfec7b01eebd +Patch-mainline: v5.9-rc2 +References: CVE-2020-29371 bsc#1179429 + +romfs has a superblock field that limits the size of the filesystem; data +beyond that limit is never accessed. + +romfs_dev_read() fetches a caller-supplied number of bytes from the +backing device. It returns 0 on success or an error code on failure; +therefore, its API can't represent short reads, it's all-or-nothing. + +However, when romfs_dev_read() detects that the requested operation would +cross the filesystem size limit, it currently silently truncates the +requested number of bytes. This e.g. means that when the content of a +file with size 0x1000 starts one byte before the filesystem size limit, +->readpage() will only fill a single byte of the supplied page while +leaving the rest uninitialized, leaking that uninitialized memory to +userspace. + +Fix it by returning an error code instead of truncating the read when the +requested read operation would go beyond the end of the filesystem. + +Fixes: da4458bda237 ("NOMMU: Make it possible for RomFS to use MTD devices directly") +Signed-off-by: Jann Horn +Signed-off-by: Andrew Morton +Reviewed-by: Greg Kroah-Hartman +Cc: David Howells +Cc: +Link: http://lkml.kernel.org/r/20200818013202.2246365-1-jannh@google.com +Signed-off-by: Linus Torvalds +Acked-by: Takashi Iwai + +--- + fs/romfs/storage.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/fs/romfs/storage.c b/fs/romfs/storage.c +index 6b2b4362089e..b57b3ffcbc32 100644 +--- a/fs/romfs/storage.c ++++ b/fs/romfs/storage.c +@@ -217,10 +217,8 @@ int romfs_dev_read(struct super_block *sb, unsigned long pos, + size_t limit; + + limit = romfs_maxsize(sb); +- if (pos >= limit) ++ if (pos >= limit || buflen > limit - pos) + return -EIO; +- if (buflen > limit - pos) +- buflen = limit - pos; + + #ifdef CONFIG_ROMFS_ON_MTD + if (sb->s_mtd) +-- +2.26.2 + diff --git a/patches.suse/xfrm-Fix-memleak-on-xfrm-state-destroy.patch b/patches.suse/xfrm-Fix-memleak-on-xfrm-state-destroy.patch new file mode 100644 index 0000000..2a7ad8a --- /dev/null +++ b/patches.suse/xfrm-Fix-memleak-on-xfrm-state-destroy.patch @@ -0,0 +1,32 @@ +From: Steffen Klassert +Date: Wed, 6 Nov 2019 08:13:49 +0100 +Subject: xfrm: Fix memleak on xfrm state destroy +Patch-mainline: v5.4-rc8 +Git-commit: 86c6739eda7d2a03f2db30cbee67a5fb81afa8ba +References: bsc#1158775 + +We leak the page that we use to create skb page fragments +when destroying the xfrm_state. Fix this by dropping a +page reference if a page was assigned to the xfrm_state. + +Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") +Reported-by: JD +Reported-by: Paul Wouters +Signed-off-by: Steffen Klassert +Acked-by: Michal Kubecek + +--- + net/xfrm/xfrm_state.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -449,6 +449,8 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x) + x->type->destructor(x); + xfrm_put_type(x->type); + } ++ if (x->xfrag.page) ++ put_page(x->xfrag.page); + xfrm_dev_state_free(x); + security_xfrm_state_free(x); + kfree(x); diff --git a/series.conf b/series.conf index 139bd2e..9533aa7 100644 --- a/series.conf +++ b/series.conf @@ -52737,6 +52737,7 @@ patches.suse/NFC-nxp-nci-Fix-NULL-pointer-dereference-after-I2C-c.patch patches.suse/net-smc-fix-refcount-non-blocking-connect-part-2 patches.suse/dpaa2-eth-free-already-allocated-channels-on-probe-d.patch + patches.suse/xfrm-Fix-memleak-on-xfrm-state-destroy.patch patches.suse/net-usb-qmi_wwan-add-support-for-Foxconn-T77W968-LTE.patch patches.suse/slip-Fix-memory-leak-in-slip_open-error-path.patch patches.suse/net-cdc_ncm-Signedness-bug-in-cdc_ncm_set_dgram_size.patch @@ -52998,6 +52999,7 @@ patches.suse/net-wireless-ti-remove-local-VENDOR_ID-and-DEVICE_ID.patch patches.suse/RDMA-bnxt_re-Enable-SRIOV-VF-support-on-Broadcom-s-5.patch patches.suse/IB-mlx5-Remove-dead-code.patch + patches.suse/RDMA-rxe-Remove-useless-rxe_init_device_param-assign.patch patches.suse/RDMA-hns-Fix-to-support-64K-page-for-srq.patch patches.suse/RDMA-hns-Bugfix-for-qpc-cqc-timer-configuration.patch patches.suse/RDMA-qedr-Fix-memory-leak-in-user-qp-and-mr.patch @@ -54687,6 +54689,15 @@ patches.suse/RDMA-ucma-Put-a-lock-around-every-call-to-the-rdma_c.patch patches.suse/RDMA-efa-Unified-getters-setters-for-device-structs-.patch patches.suse/IB-mlx5-Fix-missing-congestion-control-debugfs-on-re.patch + patches.suse/RDMA-cm-Fix-checking-for-allowed-duplicate-listens.patch + patches.suse/RDMA-cm-Remove-a-race-freeing-timewait_info.patch + patches.suse/RDMA-cm-Add-missing-locking-around-id.state-in-cm_du.patch + patches.suse/RDMA-bnxt_re-Fix-lifetimes-in-bnxt_re_task.patch + patches.suse/i40iw-Report-correct-firmware-version.patch + patches.suse/RDMA-cm-Update-num_paths-in-cma_resolve_iboe_route-e.patch + patches.suse/RDMA-rxe-Set-sys_image_guid-to-be-aligned-with-HW-IB.patch + patches.suse/IB-hfi1-Fix-memory-leaks-in-sysfs-registration-and-u.patch + patches.suse/IB-hfi1-Call-kobject_put-when-kobject_init_and_add-f.patch patches.suse/0018-pid-Improve-the-comment-about-waiting-in-zap_pid_ns_.patch patches.suse/xfs-add-agf-freeblocks-verify-in-xfs_agf_verify.patch patches.suse/xfs-clear-PF_MEMALLOC-before-exiting-xfsaild-thread.patch @@ -55048,6 +55059,11 @@ patches.suse/cifs-ensure-correct-super-block-for-DFS-reconnect.patch patches.suse/cifs-fix-uninitialised-lease_key-in-open_shroot-.patch patches.suse/btrfs-fix-block-group-leak-when-removing-fails.patch + patches.suse/i40iw-fix-null-pointer-dereference-on-a-null-wqe-poi.patch + patches.suse/RDMA-mlx4-Initialize-ib_spec-on-the-stack.patch + patches.suse/RDMA-mlx5-Set-GRH-fields-in-query-QP-on-RoCE.patch + patches.suse/RDMA-core-Prevent-mixed-use-of-FDs-between-shared-uf.patch + patches.suse/RDMA-core-Fix-race-between-destroy-and-release-FD-ob.patch patches.suse/propagate_one-mnt_set_mountpoint-needs-mount_lock.patch patches.suse/mmc-cqhci-avoid-false-cqhci-cqe-stuck-on-by-not-open-coding-timeout-loop.patch patches.suse/mmc-sdhci-xenon-fix-annoying-1.8V-regulator-warning.patch @@ -55155,6 +55171,8 @@ patches.suse/ALSA-hda-realtek-Enable-headset-mic-of-ASUS-UX581LV-.patch patches.suse/ALSA-hda-realtek-Add-COEF-workaround-for-ASUS-ZenBoo.patch patches.suse/ALSA-hda-realtek-Limit-int-mic-boost-for-Thinkpad-T5.patch + patches.suse/i40iw-Fix-error-handling-in-i40iw_manage_arp_cache.patch + patches.suse/IB-mlx4-Test-return-value-of-calls-to-ib_get_cached_.patch patches.suse/Revert-ipv6-add-mtu-lock-check-in-__ip6_rt_update_pm.patch patches.suse/net-fix-a-potential-recursive-NETDEV_FEAT_CHANGE.patch patches.suse/dpaa2-eth-prevent-array-underflow-in-update_cls_rule.patch @@ -55229,6 +55247,9 @@ patches.suse/ALSA-usb-audio-Quirks-for-Gigabyte-TRX40-Aorus-Maste.patch patches.suse/ALSA-hda-realtek-Add-new-codec-supported-for-ALC287.patch patches.suse/mmc-block-Fix-use-after-free-issue-for-rpmb.patch + patches.suse/IB-qib-Call-kobject_put-when-kobject_init_and_add-fa.patch + patches.suse/RDMA-pvrdma-Fix-missing-pci-disable-in-pvrdma_pci_pr.patch + patches.suse/IB-ipoib-Fix-double-free-of-skb-in-case-of-multicast.patch patches.suse/iommu-fix-reference-count-leak-in-iommu_group_alloc patches.suse/libceph-ignore-pool-overlay-and-cache-logic-on-redirects.patch patches.suse/dpaa_eth-fix-usage-as-DSA-master-try-3.patch @@ -55417,8 +55438,11 @@ patches.suse/vfio-pci-invalidate-mmaps-and-block-mmio-access-on-disabled-memory patches.suse/0001-ipmi-use-vzalloc-instead-of-kmalloc-for-user-creatio.patch patches.suse/gpiolib-Document-that-GPIO-line-names-are-not-global.patch + patches.suse/RDMA-rxe-Set-default-vendor-ID.patch patches.suse/RDMA-uverbs-Make-the-event_queue-fds-return-POLLERR-.patch + patches.suse/RDMA-mlx5-Verify-that-QP-is-created-with-RQ-or-SQ.patch patches.suse/RDMA-efa-Fix-setting-of-wrong-bit-in-get-set_feature.patch + patches.suse/IB-cma-Fix-ports-memory-leak-in-cma_configfs.patch patches.suse/scsi-qla2xxx-Split-qla2x00_configure_local_loop.patch patches.suse/scsi-qla2xxx-Use-ARRAY_SIZE-instead-of-open-coding-i.patch patches.suse/scsi-lpfc-remove-duplicate-unloading-checks.patch @@ -55588,6 +55612,8 @@ patches.suse/0001-ALSA-usb-audio-Fix-potential-use-after-free-of-strea.patch patches.suse/ALSA-hda-realtek-Add-mute-LED-and-micmute-LED-suppor.patch patches.suse/RDMA-efa-Set-maximum-pkeys-device-attribute.patch + patches.suse/RDMA-cma-Protect-bind_list-and-listen_list-while-fin.patch + patches.suse/RDMA-mad-Fix-possible-memory-leak-in-ib_mad_post_rec.patch patches.suse/tracing-fix-event-trigger-to-accept-redundant-spaces.patch patches.suse/net-usb-ax88179_178a-fix-packet-alignment-padding.patch patches.suse/net-fix-memleak-in-register_netdevice.patch @@ -56002,6 +56028,15 @@ patches.suse/staging-rtl8192u-fix-a-dubious-looking-mask-before-a.patch patches.suse/Staging-rtl8188eu-rtw_mlme-Fix-uninitialized-variabl.patch patches.suse/vgacon-fix-out-of-bounds-write-to-the-scrollback-buf.patch + patches.suse/RDMA-rxe-Remove-unused-rxe_mem_map_pages.patch + patches.suse/RDMA-ipoib-Return-void-from-ipoib_ib_dev_stop.patch + patches.suse/RDMA-ipoib-Fix-ABBA-deadlock-with-ipoib_reap_ah.patch + patches.suse/RDMA-rxe-Skip-dgid-check-in-loopback-mode.patch + patches.suse/RDMA-rxe-Drop-pointless-checks-in-rxe_init_ports.patch + patches.suse/RDMA-rxe-Return-void-from-rxe_init_port_param.patch + patches.suse/RDMA-rxe-Return-void-from-rxe_mem_init_dma.patch + patches.suse/RDMA-qedr-SRQ-s-bug-fixes.patch + patches.suse/RDMA-rxe-Prevent-access-to-wr-next-ptr-afrer-wr-is-p.patch patches.suse/scsi-Fix-trivial-spelling.patch patches.suse/scsi-qla2xxx-Check-the-size-of-struct-fcp_hdr-at-com.patch patches.suse/scsi-qla2xxx-Remove-the-__packed-annotation-from-str.patch @@ -56214,6 +56249,7 @@ patches.suse/ext4-check-journal-inode-extents-more-carefully.patch patches.suse/ext4-fix-checking-of-directory-entry-validity-for-in.patch patches.suse/mm-vunmap-add-cond_resched-in-vunmap_pmd_range.patch + patches.suse/romfs-fix-uninitialized-memory-leak-in-romfs_dev_rea.patch patches.suse/kernel-relay.c-fix-memleak-on-destroy-relay-channel.patch patches.suse/scsi-qla2xxx-Use-MBX_TOV_SECONDS-for-mailbox-command.patch patches.suse/scsi-qla2xxx-Flush-all-sessions-on-zone-disable.patch @@ -56331,6 +56367,9 @@ patches.suse/scsi-libfc-Fix-for-double-free.patch patches.suse/scsi-qla2xxx-Fix-regression-on-sparc64.patch patches.suse/scsi-lpfc-Fix-setting-IRQ-affinity-with-an-empty-CPU.patch + patches.suse/RDMA-rxe-Fix-the-parent-sysfs-read-when-the-interfac.patch + patches.suse/RDMA-rxe-Fix-memleak-in-rxe_mem_init_user.patch + patches.suse/RDMA-mlx4-Read-pkey-table-length-instead-of-hardcode.patch patches.suse/drm-sun4i-Fix-dsi-dcs-long-write-function.patch patches.suse/drm-tve200-Stabilize-enable-disable.patch patches.suse/mmc-sdhci-msm-Add-retries-when-all-tuning-phases-are.patch @@ -56671,7 +56710,19 @@ patches.suse/mtd-lpddr-Fix-bad-logic-in-print_drs_error.patch patches.suse/mtd-lpddr-fix-excessive-stack-usage-with-clang.patch patches.suse/mtd-mtdoops-Don-t-write-panic-data-twice.patch + patches.suse/IB-mlx4-Add-and-improve-logging.patch + patches.suse/IB-mlx4-Add-support-for-MRA.patch + patches.suse/IB-mlx4-Fix-starvation-in-paravirt-mux-demux.patch + patches.suse/IB-mlx4-Adjust-delayed-work-when-a-dup-is-observed.patch patches.suse/RDMA-ucma-Add-missing-locking-around-rdma_leave_mult.patch + patches.suse/RDMA-qedr-Fix-doorbell-setting.patch + patches.suse/RDMA-qedr-Fix-use-of-uninitialized-field.patch + patches.suse/RDMA-hns-Set-the-unsupported-wr-opcode.patch + patches.suse/RDMA-hns-Correct-typo-of-hns_roce_create_cq.patch + patches.suse/RDMA-qedr-Endianness-warnings-cleanup.patch + patches.suse/RDMA-ipoib-Set-rtnl_link_ops-for-ipoib-interfaces.patch + patches.suse/RDMA-bnxt_re-Fix-sizeof-mismatch-for-allocation-of-p.patch + patches.suse/IB-rdmavt-Fix-sizeof-mismatch.patch patches.suse/mailbox-avoid-timer-start-from-callback.patch patches.suse/fuse-fix-page-dereference-after-free.patch patches.suse/xfs-limit-entries-returned-when-counting-fsmap-recor.patch @@ -56756,6 +56807,8 @@ patches.suse/mm-always-have-io_remap_pfn_range-set-pgprot_decrypted.patch patches.suse/tty-make-FONTX-ioctl-use-the-tty-pointer-they-were-a.patch patches.suse/regulator-defer-probe-when-trying-to-get-voltage-fro.patch + patches.suse/IB-srpt-Fix-memory-leak-in-srpt_add_one.patch + patches.suse/RDMA-srpt-Fix-typo-in-srpt_unregister_mad_agent-docs.patch patches.suse/msft-hv-2168-hv_balloon-disable-warning-when-floor-reached.patch patches.suse/msft-hv-2169-x86-hyperv-Clarify-comment-on-x2apic-mode.patch patches.suse/ftrace-fix-recursion-check-for-nmi-test.patch @@ -56836,6 +56889,7 @@ patches.suse/efi-x86-free-efi_pgd-with-free_pages.patch patches.suse/msft-hv-2172-video-hyperv_fb-Fix-the-cache-type-when-mapping-the-.patch patches.suse/platform-x86-toshiba_acpi-Fix-the-wrong-variable-ass.patch + patches.suse/IB-mthca-fix-return-value-of-error-branch-in-mthca_i.patch patches.suse/nfc-s3fwrn5-use-signed-integer-for-parsing-GPIO-numb.patch patches.suse/batman-adv-set-.owner-to-THIS_MODULE.patch patches.suse/can-gs_usb-fix-endianess-problem-with-candleLight-fi.patch