2020-08-27 09:54:40 -05:00
|
|
|
// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB
|
2016-06-16 16:45:23 +03:00
|
|
|
/*
|
|
|
|
* Copyright (c) 2016 Mellanox Technologies Ltd. All rights reserved.
|
|
|
|
* Copyright (c) 2015 System Fabric Works, Inc. All rights reserved.
|
|
|
|
*/
|
|
|
|
|
2019-02-15 11:03:57 -08:00
|
|
|
#include <rdma/rdma_netlink.h>
|
2017-03-14 16:01:57 +02:00
|
|
|
#include <net/addrconf.h>
|
2016-06-16 16:45:23 +03:00
|
|
|
#include "rxe.h"
|
|
|
|
#include "rxe_loc.h"
|
|
|
|
|
|
|
|
MODULE_AUTHOR("Bob Pearson, Frank Zago, John Groves, Kamal Heib");
|
|
|
|
MODULE_DESCRIPTION("Soft RDMA transport");
|
|
|
|
MODULE_LICENSE("Dual BSD/GPL");
|
|
|
|
|
|
|
|
/* free resources for a rxe device all objects created for this device must
|
|
|
|
* have been destroyed
|
|
|
|
*/
|
2019-01-22 16:27:24 -07:00
|
|
|
void rxe_dealloc(struct ib_device *ib_dev)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
2019-01-22 16:27:24 -07:00
|
|
|
struct rxe_dev *rxe = container_of(ib_dev, struct rxe_dev, ib_dev);
|
|
|
|
|
2016-06-16 16:45:23 +03:00
|
|
|
rxe_pool_cleanup(&rxe->uc_pool);
|
|
|
|
rxe_pool_cleanup(&rxe->pd_pool);
|
|
|
|
rxe_pool_cleanup(&rxe->ah_pool);
|
|
|
|
rxe_pool_cleanup(&rxe->srq_pool);
|
|
|
|
rxe_pool_cleanup(&rxe->qp_pool);
|
|
|
|
rxe_pool_cleanup(&rxe->cq_pool);
|
|
|
|
rxe_pool_cleanup(&rxe->mr_pool);
|
|
|
|
rxe_pool_cleanup(&rxe->mw_pool);
|
|
|
|
|
2022-02-23 17:07:03 -06:00
|
|
|
WARN_ON(!RB_EMPTY_ROOT(&rxe->mcg_tree));
|
|
|
|
|
2024-03-14 07:51:40 +01:00
|
|
|
mutex_destroy(&rxe->usdev_lock);
|
2016-06-16 16:45:23 +03:00
|
|
|
}
|
|
|
|
|
2025-05-22 11:19:54 +00:00
|
|
|
static const struct ib_device_ops rxe_ib_dev_odp_ops = {
|
|
|
|
.advise_mr = rxe_ib_advise_mr,
|
|
|
|
};
|
|
|
|
|
2016-06-16 16:45:23 +03:00
|
|
|
/* initialize rxe device parameters */
|
RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests
In rdma-core, the following failures appear.
"
$ ./build/bin/run_tests.py -k device
ssssssss....FF........s
======================================================================
FAIL: test_query_device (tests.test_device.DeviceTest.test_query_device)
Test ibv_query_device()
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/ubuntu/rdma-core/tests/test_device.py", line 63, in
test_query_device
self.verify_device_attr(attr, dev)
File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in
verify_device_attr
assert attr.sys_image_guid != 0
^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError
======================================================================
FAIL: test_query_device_ex (tests.test_device.DeviceTest.test_query_device_ex)
Test ibv_query_device_ex()
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/ubuntu/rdma-core/tests/test_device.py", line 222, in
test_query_device_ex
self.verify_device_attr(attr_ex.orig_attr, dev)
File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in
verify_device_attr
assert attr.sys_image_guid != 0
^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError
"
The root cause is: before a net device is set with rxe, this net device
is used to generate a sys_image_guid.
Fixes: 2ac5415022d1 ("RDMA/rxe: Remove the direct link to net_device")
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20250302215444.3742072-1-yanjun.zhu@linux.dev
Reviewed-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
Tested-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-03-02 22:54:44 +01:00
|
|
|
static void rxe_init_device_param(struct rxe_dev *rxe, struct net_device *ndev)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
|
|
|
rxe->max_inline_data = RXE_MAX_INLINE_DATA;
|
|
|
|
|
RDMA/rxe: Set default vendor ID
The RXE driver doesn't set vendor_id and user space applications see
zeros. This causes to pyverbs tests to fail with the following traceback,
because the expectation is to have valid vendor_id.
Traceback (most recent call last):
File "tests/test_device.py", line 51, in test_query_device
self.verify_device_attr(attr)
File "tests/test_device.py", line 77, in verify_device_attr
assert attr.vendor_id != 0
In order to fix it, we will set vendor_id 0XFFFFFF, according to the IBTA
v1.4 A3.3.1 VENDOR INFORMATION section.
"""
A vendor that produces a generic controller (i.e., one that supports a
standard I/O protocol such as SRP), which does not have vendor specific
device drivers, may use the value of 0xFFFFFF in the VendorID field.
"""
Before:
hca_id: rxe0
transport: InfiniBand (0)
fw_ver: 0.0.0
node_guid: 5054:00ff:feaa:5363
sys_image_guid: 5054:00ff:feaa:5363
vendor_id: 0x0000
After:
hca_id: rxe0
transport: InfiniBand (0)
fw_ver: 0.0.0
node_guid: 5054:00ff:feaa:5363
sys_image_guid: 5054:00ff:feaa:5363
vendor_id: 0xffffff
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Link: https://lore.kernel.org/r/20200406173501.1466273-1-leon@kernel.org
Signed-off-by: Zhu Yanjun <yanjunz@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2020-04-06 20:35:01 +03:00
|
|
|
rxe->attr.vendor_id = RXE_VENDOR_ID;
|
2016-06-16 16:45:23 +03:00
|
|
|
rxe->attr.max_mr_size = RXE_MAX_MR_SIZE;
|
|
|
|
rxe->attr.page_size_cap = RXE_PAGE_SIZE_CAP;
|
|
|
|
rxe->attr.max_qp = RXE_MAX_QP;
|
|
|
|
rxe->attr.max_qp_wr = RXE_MAX_QP_WR;
|
|
|
|
rxe->attr.device_cap_flags = RXE_DEVICE_CAP_FLAGS;
|
2022-04-04 12:26:42 -03:00
|
|
|
rxe->attr.kernel_cap_flags = IBK_ALLOW_USER_UNREG;
|
2018-06-18 08:05:26 -07:00
|
|
|
rxe->attr.max_send_sge = RXE_MAX_SGE;
|
|
|
|
rxe->attr.max_recv_sge = RXE_MAX_SGE;
|
2016-06-16 16:45:23 +03:00
|
|
|
rxe->attr.max_sge_rd = RXE_MAX_SGE_RD;
|
|
|
|
rxe->attr.max_cq = RXE_MAX_CQ;
|
|
|
|
rxe->attr.max_cqe = (1 << RXE_MAX_LOG_CQE) - 1;
|
|
|
|
rxe->attr.max_mr = RXE_MAX_MR;
|
2021-06-07 23:25:46 -05:00
|
|
|
rxe->attr.max_mw = RXE_MAX_MW;
|
2016-06-16 16:45:23 +03:00
|
|
|
rxe->attr.max_pd = RXE_MAX_PD;
|
|
|
|
rxe->attr.max_qp_rd_atom = RXE_MAX_QP_RD_ATOM;
|
|
|
|
rxe->attr.max_res_rd_atom = RXE_MAX_RES_RD_ATOM;
|
|
|
|
rxe->attr.max_qp_init_rd_atom = RXE_MAX_QP_INIT_RD_ATOM;
|
2018-09-26 22:12:23 -07:00
|
|
|
rxe->attr.atomic_cap = IB_ATOMIC_HCA;
|
2016-06-16 16:45:23 +03:00
|
|
|
rxe->attr.max_mcast_grp = RXE_MAX_MCAST_GRP;
|
|
|
|
rxe->attr.max_mcast_qp_attach = RXE_MAX_MCAST_QP_ATTACH;
|
|
|
|
rxe->attr.max_total_mcast_qp_attach = RXE_MAX_TOT_MCAST_QP_ATTACH;
|
|
|
|
rxe->attr.max_ah = RXE_MAX_AH;
|
|
|
|
rxe->attr.max_srq = RXE_MAX_SRQ;
|
|
|
|
rxe->attr.max_srq_wr = RXE_MAX_SRQ_WR;
|
|
|
|
rxe->attr.max_srq_sge = RXE_MAX_SRQ_SGE;
|
|
|
|
rxe->attr.max_fast_reg_page_list_len = RXE_MAX_FMR_PAGE_LIST_LEN;
|
|
|
|
rxe->attr.max_pkeys = RXE_MAX_PKEYS;
|
|
|
|
rxe->attr.local_ca_ack_delay = RXE_LOCAL_CA_ACK_DELAY;
|
RDMA/rxe: Remove the direct link to net_device
The similar patch in siw is in the link:
https://git.kernel.org/rdma/rdma/c/16b87037b48889
This problem also occurred in RXE. The following analyze this problem.
In the following Call Traces:
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c:8782
Read of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295
CPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted
6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0
Hardware name: Google Compute Engine/Google Compute Engine,
BIOS Google 09/13/2024
Workqueue: infiniband ib_cache_event_task
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
dev_get_flags+0x188/0x1d0 net/core/dev.c:8782
rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60
__ib_query_port drivers/infiniband/core/device.c:2111 [inline]
ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143
ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494
ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f2/0x390 kernel/kthread.c:389
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
"
1). In the link [1],
"
infiniband syz2: set down
"
This means that on 839.350575, the event ib_cache_event_task was sent andi
queued in ib_wq.
2). In the link [1],
"
team0 (unregistering): Port device team_slave_0 removed
"
It indicates that before 843.251853, the net device should be freed.
3). In the link [1],
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0
"
This means that on 850.559070, this slab-use-after-free problem occurred.
In all, on 839.350575, the event ib_cache_event_task was sent and queued
in ib_wq,
before 843.251853, the net device veth was freed.
on 850.559070, this event was executed, and the mentioned freed net device
was called. Thus, the above call trace occurred.
[1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000
Reported-by: syzbot+4b87489410b4efd181bf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4b87489410b4efd181bf
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20241220222325.2487767-1-yanjun.zhu@linux.dev
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2024-12-20 23:23:25 +01:00
|
|
|
|
2025-01-19 18:28:29 +01:00
|
|
|
if (ndev->addr_len) {
|
|
|
|
memcpy(rxe->raw_gid, ndev->dev_addr,
|
|
|
|
min_t(unsigned int, ndev->addr_len, ETH_ALEN));
|
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* This device does not have a HW address, but
|
|
|
|
* connection mangagement requires a unique gid.
|
|
|
|
*/
|
|
|
|
eth_random_addr(rxe->raw_gid);
|
|
|
|
}
|
|
|
|
|
2020-03-23 13:28:00 +02:00
|
|
|
addrconf_addr_eui48((unsigned char *)&rxe->attr.sys_image_guid,
|
2025-01-19 18:28:29 +01:00
|
|
|
rxe->raw_gid);
|
RDMA/rxe: Remove the direct link to net_device
The similar patch in siw is in the link:
https://git.kernel.org/rdma/rdma/c/16b87037b48889
This problem also occurred in RXE. The following analyze this problem.
In the following Call Traces:
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c:8782
Read of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295
CPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted
6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0
Hardware name: Google Compute Engine/Google Compute Engine,
BIOS Google 09/13/2024
Workqueue: infiniband ib_cache_event_task
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
dev_get_flags+0x188/0x1d0 net/core/dev.c:8782
rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60
__ib_query_port drivers/infiniband/core/device.c:2111 [inline]
ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143
ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494
ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f2/0x390 kernel/kthread.c:389
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
"
1). In the link [1],
"
infiniband syz2: set down
"
This means that on 839.350575, the event ib_cache_event_task was sent andi
queued in ib_wq.
2). In the link [1],
"
team0 (unregistering): Port device team_slave_0 removed
"
It indicates that before 843.251853, the net device should be freed.
3). In the link [1],
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0
"
This means that on 850.559070, this slab-use-after-free problem occurred.
In all, on 839.350575, the event ib_cache_event_task was sent and queued
in ib_wq,
before 843.251853, the net device veth was freed.
on 850.559070, this event was executed, and the mentioned freed net device
was called. Thus, the above call trace occurred.
[1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000
Reported-by: syzbot+4b87489410b4efd181bf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4b87489410b4efd181bf
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20241220222325.2487767-1-yanjun.zhu@linux.dev
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2024-12-20 23:23:25 +01:00
|
|
|
|
2016-06-16 16:45:23 +03:00
|
|
|
rxe->max_ucontext = RXE_MAX_UCONTEXT;
|
2024-12-20 19:09:34 +09:00
|
|
|
|
|
|
|
if (IS_ENABLED(CONFIG_INFINIBAND_ON_DEMAND_PAGING)) {
|
|
|
|
rxe->attr.kernel_cap_flags |= IBK_ON_DEMAND_PAGING;
|
|
|
|
|
|
|
|
/* IB_ODP_SUPPORT_IMPLICIT is not supported right now. */
|
|
|
|
rxe->attr.odp_caps.general_caps |= IB_ODP_SUPPORT;
|
2024-12-20 19:09:35 +09:00
|
|
|
|
|
|
|
rxe->attr.odp_caps.per_transport_caps.ud_odp_caps |= IB_ODP_SUPPORT_SEND;
|
|
|
|
rxe->attr.odp_caps.per_transport_caps.ud_odp_caps |= IB_ODP_SUPPORT_RECV;
|
|
|
|
rxe->attr.odp_caps.per_transport_caps.ud_odp_caps |= IB_ODP_SUPPORT_SRQ_RECV;
|
|
|
|
|
|
|
|
rxe->attr.odp_caps.per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_SEND;
|
|
|
|
rxe->attr.odp_caps.per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_RECV;
|
|
|
|
rxe->attr.odp_caps.per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_WRITE;
|
|
|
|
rxe->attr.odp_caps.per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_READ;
|
2024-12-20 19:09:36 +09:00
|
|
|
rxe->attr.odp_caps.per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_ATOMIC;
|
2024-12-20 19:09:35 +09:00
|
|
|
rxe->attr.odp_caps.per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_SRQ_RECV;
|
2025-03-24 16:56:48 +09:00
|
|
|
rxe->attr.odp_caps.per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_FLUSH;
|
2025-03-24 16:56:49 +09:00
|
|
|
rxe->attr.odp_caps.per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_ATOMIC_WRITE;
|
2025-05-22 11:19:54 +00:00
|
|
|
|
|
|
|
/* set handler for ODP prefetching API - ibv_advise_mr(3) */
|
|
|
|
ib_set_device_ops(&rxe->ib_dev, &rxe_ib_dev_odp_ops);
|
2024-12-20 19:09:34 +09:00
|
|
|
}
|
2016-06-16 16:45:23 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
/* initialize port attributes */
|
2020-07-05 13:43:11 +03:00
|
|
|
static void rxe_init_port_param(struct rxe_port *port)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
2018-09-26 22:12:23 -07:00
|
|
|
port->attr.state = IB_PORT_DOWN;
|
|
|
|
port->attr.max_mtu = IB_MTU_4096;
|
|
|
|
port->attr.active_mtu = IB_MTU_256;
|
2016-06-16 16:45:23 +03:00
|
|
|
port->attr.gid_tbl_len = RXE_PORT_GID_TBL_LEN;
|
|
|
|
port->attr.port_cap_flags = RXE_PORT_PORT_CAP_FLAGS;
|
|
|
|
port->attr.max_msg_sz = RXE_PORT_MAX_MSG_SZ;
|
|
|
|
port->attr.bad_pkey_cntr = RXE_PORT_BAD_PKEY_CNTR;
|
|
|
|
port->attr.qkey_viol_cntr = RXE_PORT_QKEY_VIOL_CNTR;
|
|
|
|
port->attr.pkey_tbl_len = RXE_PORT_PKEY_TBL_LEN;
|
|
|
|
port->attr.lid = RXE_PORT_LID;
|
|
|
|
port->attr.sm_lid = RXE_PORT_SM_LID;
|
|
|
|
port->attr.lmc = RXE_PORT_LMC;
|
|
|
|
port->attr.max_vl_num = RXE_PORT_MAX_VL_NUM;
|
|
|
|
port->attr.sm_sl = RXE_PORT_SM_SL;
|
|
|
|
port->attr.subnet_timeout = RXE_PORT_SUBNET_TIMEOUT;
|
|
|
|
port->attr.init_type_reply = RXE_PORT_INIT_TYPE_REPLY;
|
|
|
|
port->attr.active_width = RXE_PORT_ACTIVE_WIDTH;
|
|
|
|
port->attr.active_speed = RXE_PORT_ACTIVE_SPEED;
|
|
|
|
port->attr.phys_state = RXE_PORT_PHYS_STATE;
|
2018-09-26 22:12:23 -07:00
|
|
|
port->mtu_cap = ib_mtu_enum_to_int(IB_MTU_256);
|
2016-06-16 16:45:23 +03:00
|
|
|
port->subnet_prefix = cpu_to_be64(RXE_PORT_SUBNET_PREFIX);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* initialize port state, note IB convention that HCA ports are always
|
|
|
|
* numbered from 1
|
|
|
|
*/
|
RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests
In rdma-core, the following failures appear.
"
$ ./build/bin/run_tests.py -k device
ssssssss....FF........s
======================================================================
FAIL: test_query_device (tests.test_device.DeviceTest.test_query_device)
Test ibv_query_device()
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/ubuntu/rdma-core/tests/test_device.py", line 63, in
test_query_device
self.verify_device_attr(attr, dev)
File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in
verify_device_attr
assert attr.sys_image_guid != 0
^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError
======================================================================
FAIL: test_query_device_ex (tests.test_device.DeviceTest.test_query_device_ex)
Test ibv_query_device_ex()
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/ubuntu/rdma-core/tests/test_device.py", line 222, in
test_query_device_ex
self.verify_device_attr(attr_ex.orig_attr, dev)
File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in
verify_device_attr
assert attr.sys_image_guid != 0
^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError
"
The root cause is: before a net device is set with rxe, this net device
is used to generate a sys_image_guid.
Fixes: 2ac5415022d1 ("RDMA/rxe: Remove the direct link to net_device")
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20250302215444.3742072-1-yanjun.zhu@linux.dev
Reviewed-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
Tested-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-03-02 22:54:44 +01:00
|
|
|
static void rxe_init_ports(struct rxe_dev *rxe, struct net_device *ndev)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
|
|
|
struct rxe_port *port = &rxe->port;
|
|
|
|
|
|
|
|
rxe_init_port_param(port);
|
2017-03-14 16:01:57 +02:00
|
|
|
addrconf_addr_eui48((unsigned char *)&port->port_guid,
|
2025-01-19 18:28:29 +01:00
|
|
|
rxe->raw_gid);
|
2016-06-16 16:45:23 +03:00
|
|
|
spin_lock_init(&port->port_lock);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* init pools of managed objects */
|
2022-03-03 18:08:04 -06:00
|
|
|
static void rxe_init_pools(struct rxe_dev *rxe)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
2022-03-03 18:08:04 -06:00
|
|
|
rxe_pool_init(rxe, &rxe->uc_pool, RXE_TYPE_UC);
|
|
|
|
rxe_pool_init(rxe, &rxe->pd_pool, RXE_TYPE_PD);
|
|
|
|
rxe_pool_init(rxe, &rxe->ah_pool, RXE_TYPE_AH);
|
|
|
|
rxe_pool_init(rxe, &rxe->srq_pool, RXE_TYPE_SRQ);
|
|
|
|
rxe_pool_init(rxe, &rxe->qp_pool, RXE_TYPE_QP);
|
|
|
|
rxe_pool_init(rxe, &rxe->cq_pool, RXE_TYPE_CQ);
|
|
|
|
rxe_pool_init(rxe, &rxe->mr_pool, RXE_TYPE_MR);
|
|
|
|
rxe_pool_init(rxe, &rxe->mw_pool, RXE_TYPE_MW);
|
2016-06-16 16:45:23 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
/* initialize rxe device state */
|
RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests
In rdma-core, the following failures appear.
"
$ ./build/bin/run_tests.py -k device
ssssssss....FF........s
======================================================================
FAIL: test_query_device (tests.test_device.DeviceTest.test_query_device)
Test ibv_query_device()
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/ubuntu/rdma-core/tests/test_device.py", line 63, in
test_query_device
self.verify_device_attr(attr, dev)
File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in
verify_device_attr
assert attr.sys_image_guid != 0
^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError
======================================================================
FAIL: test_query_device_ex (tests.test_device.DeviceTest.test_query_device_ex)
Test ibv_query_device_ex()
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/ubuntu/rdma-core/tests/test_device.py", line 222, in
test_query_device_ex
self.verify_device_attr(attr_ex.orig_attr, dev)
File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in
verify_device_attr
assert attr.sys_image_guid != 0
^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError
"
The root cause is: before a net device is set with rxe, this net device
is used to generate a sys_image_guid.
Fixes: 2ac5415022d1 ("RDMA/rxe: Remove the direct link to net_device")
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20250302215444.3742072-1-yanjun.zhu@linux.dev
Reviewed-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
Tested-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-03-02 22:54:44 +01:00
|
|
|
static void rxe_init(struct rxe_dev *rxe, struct net_device *ndev)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
|
|
|
/* init default device parameters */
|
RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests
In rdma-core, the following failures appear.
"
$ ./build/bin/run_tests.py -k device
ssssssss....FF........s
======================================================================
FAIL: test_query_device (tests.test_device.DeviceTest.test_query_device)
Test ibv_query_device()
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/ubuntu/rdma-core/tests/test_device.py", line 63, in
test_query_device
self.verify_device_attr(attr, dev)
File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in
verify_device_attr
assert attr.sys_image_guid != 0
^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError
======================================================================
FAIL: test_query_device_ex (tests.test_device.DeviceTest.test_query_device_ex)
Test ibv_query_device_ex()
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/ubuntu/rdma-core/tests/test_device.py", line 222, in
test_query_device_ex
self.verify_device_attr(attr_ex.orig_attr, dev)
File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in
verify_device_attr
assert attr.sys_image_guid != 0
^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError
"
The root cause is: before a net device is set with rxe, this net device
is used to generate a sys_image_guid.
Fixes: 2ac5415022d1 ("RDMA/rxe: Remove the direct link to net_device")
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20250302215444.3742072-1-yanjun.zhu@linux.dev
Reviewed-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
Tested-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-03-02 22:54:44 +01:00
|
|
|
rxe_init_device_param(rxe, ndev);
|
2016-06-16 16:45:23 +03:00
|
|
|
|
RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests
In rdma-core, the following failures appear.
"
$ ./build/bin/run_tests.py -k device
ssssssss....FF........s
======================================================================
FAIL: test_query_device (tests.test_device.DeviceTest.test_query_device)
Test ibv_query_device()
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/ubuntu/rdma-core/tests/test_device.py", line 63, in
test_query_device
self.verify_device_attr(attr, dev)
File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in
verify_device_attr
assert attr.sys_image_guid != 0
^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError
======================================================================
FAIL: test_query_device_ex (tests.test_device.DeviceTest.test_query_device_ex)
Test ibv_query_device_ex()
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/ubuntu/rdma-core/tests/test_device.py", line 222, in
test_query_device_ex
self.verify_device_attr(attr_ex.orig_attr, dev)
File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in
verify_device_attr
assert attr.sys_image_guid != 0
^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError
"
The root cause is: before a net device is set with rxe, this net device
is used to generate a sys_image_guid.
Fixes: 2ac5415022d1 ("RDMA/rxe: Remove the direct link to net_device")
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20250302215444.3742072-1-yanjun.zhu@linux.dev
Reviewed-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
Tested-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-03-02 22:54:44 +01:00
|
|
|
rxe_init_ports(rxe, ndev);
|
2022-03-03 18:08:04 -06:00
|
|
|
rxe_init_pools(rxe);
|
2016-06-16 16:45:23 +03:00
|
|
|
|
|
|
|
/* init pending mmap list */
|
|
|
|
spin_lock_init(&rxe->mmap_offset_lock);
|
|
|
|
spin_lock_init(&rxe->pending_lock);
|
|
|
|
INIT_LIST_HEAD(&rxe->pending_mmaps);
|
|
|
|
|
2022-02-08 15:16:39 -06:00
|
|
|
/* init multicast support */
|
2022-02-08 15:16:35 -06:00
|
|
|
spin_lock_init(&rxe->mcg_lock);
|
2022-02-08 15:16:39 -06:00
|
|
|
rxe->mcg_tree = RB_ROOT;
|
2022-02-08 15:16:35 -06:00
|
|
|
|
2016-06-16 16:45:23 +03:00
|
|
|
mutex_init(&rxe->usdev_lock);
|
|
|
|
}
|
|
|
|
|
2018-04-20 10:30:54 -04:00
|
|
|
void rxe_set_mtu(struct rxe_dev *rxe, unsigned int ndev_mtu)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
|
|
|
struct rxe_port *port = &rxe->port;
|
|
|
|
enum ib_mtu mtu;
|
|
|
|
|
|
|
|
mtu = eth_mtu_int_to_enum(ndev_mtu);
|
|
|
|
|
|
|
|
/* Make sure that new MTU in range */
|
2018-09-26 22:12:23 -07:00
|
|
|
mtu = mtu ? min_t(enum ib_mtu, mtu, IB_MTU_4096) : IB_MTU_256;
|
2016-06-16 16:45:23 +03:00
|
|
|
|
|
|
|
port->attr.active_mtu = mtu;
|
|
|
|
port->mtu_cap = ib_mtu_enum_to_int(mtu);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* called by ifc layer to create new rxe device.
|
|
|
|
* The caller should allocate memory for rxe by calling ib_alloc_device.
|
|
|
|
*/
|
RDMA/rxe: Remove the direct link to net_device
The similar patch in siw is in the link:
https://git.kernel.org/rdma/rdma/c/16b87037b48889
This problem also occurred in RXE. The following analyze this problem.
In the following Call Traces:
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c:8782
Read of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295
CPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted
6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0
Hardware name: Google Compute Engine/Google Compute Engine,
BIOS Google 09/13/2024
Workqueue: infiniband ib_cache_event_task
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
dev_get_flags+0x188/0x1d0 net/core/dev.c:8782
rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60
__ib_query_port drivers/infiniband/core/device.c:2111 [inline]
ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143
ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494
ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f2/0x390 kernel/kthread.c:389
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
"
1). In the link [1],
"
infiniband syz2: set down
"
This means that on 839.350575, the event ib_cache_event_task was sent andi
queued in ib_wq.
2). In the link [1],
"
team0 (unregistering): Port device team_slave_0 removed
"
It indicates that before 843.251853, the net device should be freed.
3). In the link [1],
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0
"
This means that on 850.559070, this slab-use-after-free problem occurred.
In all, on 839.350575, the event ib_cache_event_task was sent and queued
in ib_wq,
before 843.251853, the net device veth was freed.
on 850.559070, this event was executed, and the mentioned freed net device
was called. Thus, the above call trace occurred.
[1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000
Reported-by: syzbot+4b87489410b4efd181bf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4b87489410b4efd181bf
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20241220222325.2487767-1-yanjun.zhu@linux.dev
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2024-12-20 23:23:25 +01:00
|
|
|
int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name,
|
|
|
|
struct net_device *ndev)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests
In rdma-core, the following failures appear.
"
$ ./build/bin/run_tests.py -k device
ssssssss....FF........s
======================================================================
FAIL: test_query_device (tests.test_device.DeviceTest.test_query_device)
Test ibv_query_device()
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/ubuntu/rdma-core/tests/test_device.py", line 63, in
test_query_device
self.verify_device_attr(attr, dev)
File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in
verify_device_attr
assert attr.sys_image_guid != 0
^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError
======================================================================
FAIL: test_query_device_ex (tests.test_device.DeviceTest.test_query_device_ex)
Test ibv_query_device_ex()
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/ubuntu/rdma-core/tests/test_device.py", line 222, in
test_query_device_ex
self.verify_device_attr(attr_ex.orig_attr, dev)
File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in
verify_device_attr
assert attr.sys_image_guid != 0
^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError
"
The root cause is: before a net device is set with rxe, this net device
is used to generate a sys_image_guid.
Fixes: 2ac5415022d1 ("RDMA/rxe: Remove the direct link to net_device")
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20250302215444.3742072-1-yanjun.zhu@linux.dev
Reviewed-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
Tested-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2025-03-02 22:54:44 +01:00
|
|
|
rxe_init(rxe, ndev);
|
2018-04-20 10:30:54 -04:00
|
|
|
rxe_set_mtu(rxe, mtu);
|
2016-06-16 16:45:23 +03:00
|
|
|
|
RDMA/rxe: Remove the direct link to net_device
The similar patch in siw is in the link:
https://git.kernel.org/rdma/rdma/c/16b87037b48889
This problem also occurred in RXE. The following analyze this problem.
In the following Call Traces:
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c:8782
Read of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295
CPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted
6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0
Hardware name: Google Compute Engine/Google Compute Engine,
BIOS Google 09/13/2024
Workqueue: infiniband ib_cache_event_task
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
dev_get_flags+0x188/0x1d0 net/core/dev.c:8782
rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60
__ib_query_port drivers/infiniband/core/device.c:2111 [inline]
ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143
ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494
ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f2/0x390 kernel/kthread.c:389
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
"
1). In the link [1],
"
infiniband syz2: set down
"
This means that on 839.350575, the event ib_cache_event_task was sent andi
queued in ib_wq.
2). In the link [1],
"
team0 (unregistering): Port device team_slave_0 removed
"
It indicates that before 843.251853, the net device should be freed.
3). In the link [1],
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0
"
This means that on 850.559070, this slab-use-after-free problem occurred.
In all, on 839.350575, the event ib_cache_event_task was sent and queued
in ib_wq,
before 843.251853, the net device veth was freed.
on 850.559070, this event was executed, and the mentioned freed net device
was called. Thus, the above call trace occurred.
[1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000
Reported-by: syzbot+4b87489410b4efd181bf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4b87489410b4efd181bf
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20241220222325.2487767-1-yanjun.zhu@linux.dev
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2024-12-20 23:23:25 +01:00
|
|
|
return rxe_register_device(rxe, ibdev_name, ndev);
|
2016-06-16 16:45:23 +03:00
|
|
|
}
|
|
|
|
|
2019-02-15 11:03:57 -08:00
|
|
|
static int rxe_newlink(const char *ibdev_name, struct net_device *ndev)
|
|
|
|
{
|
2023-03-03 16:16:21 -06:00
|
|
|
struct rxe_dev *rxe;
|
2019-02-15 11:03:57 -08:00
|
|
|
int err = 0;
|
|
|
|
|
2020-08-11 18:04:15 +03:00
|
|
|
if (is_vlan_dev(ndev)) {
|
2024-01-09 16:32:52 +08:00
|
|
|
rxe_err("rxe creation allowed on top of a real device only\n");
|
2020-08-11 18:04:15 +03:00
|
|
|
err = -EPERM;
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
|
2023-03-03 16:16:21 -06:00
|
|
|
rxe = rxe_get_dev_from_net(ndev);
|
|
|
|
if (rxe) {
|
|
|
|
ib_device_put(&rxe->ib_dev);
|
2024-01-09 16:32:52 +08:00
|
|
|
rxe_err_dev(rxe, "already configured on %s\n", ndev->name);
|
2019-02-15 11:03:57 -08:00
|
|
|
err = -EEXIST;
|
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
|
|
|
|
err = rxe_net_add(ibdev_name, ndev);
|
|
|
|
if (err) {
|
2023-03-03 16:16:23 -06:00
|
|
|
rxe_err("failed to add %s\n", ndev->name);
|
2019-02-15 11:03:57 -08:00
|
|
|
goto err;
|
|
|
|
}
|
|
|
|
err:
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static struct rdma_link_ops rxe_link_ops = {
|
|
|
|
.type = "rxe",
|
|
|
|
.newlink = rxe_newlink,
|
|
|
|
};
|
|
|
|
|
2016-06-16 16:45:23 +03:00
|
|
|
static int __init rxe_module_init(void)
|
|
|
|
{
|
|
|
|
int err;
|
|
|
|
|
2023-04-28 12:13:22 -05:00
|
|
|
err = rxe_alloc_wq();
|
2016-09-28 20:26:26 +00:00
|
|
|
if (err)
|
|
|
|
return err;
|
2016-06-16 16:45:23 +03:00
|
|
|
|
2023-04-28 12:13:22 -05:00
|
|
|
err = rxe_net_init();
|
|
|
|
if (err) {
|
|
|
|
rxe_destroy_wq();
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
2019-02-15 11:03:57 -08:00
|
|
|
rdma_link_register(&rxe_link_ops);
|
2016-09-28 20:26:26 +00:00
|
|
|
pr_info("loaded\n");
|
2016-06-16 16:45:23 +03:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __exit rxe_module_exit(void)
|
|
|
|
{
|
2019-02-15 11:03:57 -08:00
|
|
|
rdma_link_unregister(&rxe_link_ops);
|
2019-01-22 16:27:24 -07:00
|
|
|
ib_unregister_driver(RDMA_DRIVER_RXE);
|
2016-06-16 16:45:23 +03:00
|
|
|
rxe_net_exit();
|
2023-04-28 12:13:22 -05:00
|
|
|
rxe_destroy_wq();
|
2016-06-16 16:45:23 +03:00
|
|
|
|
2016-09-28 20:26:26 +00:00
|
|
|
pr_info("unloaded\n");
|
2016-06-16 16:45:23 +03:00
|
|
|
}
|
|
|
|
|
2016-09-23 09:32:11 -06:00
|
|
|
late_initcall(rxe_module_init);
|
2016-06-16 16:45:23 +03:00
|
|
|
module_exit(rxe_module_exit);
|
2019-02-15 11:03:57 -08:00
|
|
|
|
|
|
|
MODULE_ALIAS_RDMA_LINK("rxe");
|