1. 22 10月, 2019 2 次提交
  2. 28 8月, 2019 5 次提交
  3. 14 8月, 2019 3 次提交
    • X
      RDMA/hns: bugfix for slab-out-of-bounds when loading hip08 driver · bf8c02f9
      Xi Wang 提交于
      kasan will report a BUG when run command 'insmod hns_roce_hw_v2.ko', the
      calltrace is as follows:
      
      ==================================================================
      BUG: KASAN: slab-out-of-bounds in hns_roce_v2_init_eq_table+0x1324/0x1948
      [hns_roce_hw_v2]
      Read of size 8 at addr ffff8020e7a10608 by task insmod/256
      
      CPU: 0 PID: 256 Comm: insmod Tainted: G           O      5.2.0-rc4 #1
      Hardware name: Huawei D06 /D06, BIOS Hisilicon D06 UEFI RC0
      Call trace:
      dump_backtrace+0x0/0x1e8
      show_stack+0x14/0x20
      dump_stack+0xc4/0xfc
      print_address_description+0x60/0x270
      __kasan_report+0x164/0x1b8
      kasan_report+0xc/0x18
      __asan_load8+0x84/0xa8
      hns_roce_v2_init_eq_table+0x1324/0x1948 [hns_roce_hw_v2]
      hns_roce_init+0xf8/0xfe0 [hns_roce]
      __hns_roce_hw_v2_init_instance+0x284/0x330 [hns_roce_hw_v2]
      hns_roce_hw_v2_init_instance+0xd0/0x1b8 [hns_roce_hw_v2]
      hclge_init_roce_client_instance+0x180/0x310 [hclge]
      hclge_init_client_instance+0xcc/0x508 [hclge]
      hnae3_init_client_instance.part.3+0x3c/0x80 [hnae3]
      hnae3_register_client+0x134/0x1a8 [hnae3]
      hns_roce_hw_v2_init+0x14/0x10000 [hns_roce_hw_v2]
      do_one_initcall+0x9c/0x3e0
      do_init_module+0xd4/0x2d8
      load_module+0x3284/0x3690
      __se_sys_init_module+0x274/0x308
      __arm64_sys_init_module+0x40/0x50
      el0_svc_handler+0xbc/0x210
      el0_svc+0x8/0xc
      
      Allocated by task 256:
      __kasan_kmalloc.isra.0+0xd0/0x180
      kasan_kmalloc+0xc/0x18
      __kmalloc+0x16c/0x328
      hns_roce_v2_init_eq_table+0x764/0x1948 [hns_roce_hw_v2]
      hns_roce_init+0xf8/0xfe0 [hns_roce]
      __hns_roce_hw_v2_init_instance+0x284/0x330 [hns_roce_hw_v2]
      hns_roce_hw_v2_init_instance+0xd0/0x1b8 [hns_roce_hw_v2]
      hclge_init_roce_client_instance+0x180/0x310 [hclge]
      hclge_init_client_instance+0xcc/0x508 [hclge]
      hnae3_init_client_instance.part.3+0x3c/0x80 [hnae3]
      hnae3_register_client+0x134/0x1a8 [hnae3]
      hns_roce_hw_v2_init+0x14/0x10000 [hns_roce_hw_v2]
      do_one_initcall+0x9c/0x3e0
      do_init_module+0xd4/0x2d8
      load_module+0x3284/0x3690
      __se_sys_init_module+0x274/0x308
      __arm64_sys_init_module+0x40/0x50
      el0_svc_handler+0xbc/0x210
      el0_svc+0x8/0xc
      
      Freed by task 0:
      (stack is not available)
      
      The buggy address belongs to the object at ffff8020e7a10600
      which belongs to the cache kmalloc-128 of size 128
      The buggy address is located 8 bytes inside of
      128-byte region [ffff8020e7a10600, ffff8020e7a10680)
      The buggy address belongs to the page:
      page:ffff7fe00839e840 refcount:1 mapcount:0 mapping:ffff802340020200 index:0x0
      flags: 0x5fffe00000000200(slab)
      raw: 5fffe00000000200 dead000000000100 dead000000000200 ffff802340020200
      raw: 0000000000000000 0000000081000100 00000001ffffffff 0000000000000000
      page dumped because: kasan: bad access detected
      
      Memory state around the buggy address:
      ffff8020e7a10500: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
      ffff8020e7a10580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      >ffff8020e7a10600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      ^
      ffff8020e7a10680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      ffff8020e7a10700: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      ==================================================================
      Disabling lock debugging due to kernel taint
      
      Fixes: a5073d60 ("RDMA/hns: Add eq support of hip08")
      Signed-off-by: NXi Wang <wangxi11@huawei.com>
      Link: https://lore.kernel.org/r/1565343666-73193-7-git-send-email-oulijun@huawei.comSigned-off-by: NDoug Ledford <dledford@redhat.com>
      bf8c02f9
    • Y
      RDMA/hns: Modify pi vlaue when cq overflows · d7e5ca88
      Yangyang Li 提交于
      When exiting "for loop", the actual value of pi will be
      increased by 1, which is compatible with the next calculation.
      But when pi is equal to "ci + hr_cq-> ib_cq.cqe", the "break"
      was called and the pi is actual value, it will lead one cqe
      still existing, so the "==" should be modify to ">".
      Signed-off-by: NYangyang Li <liyangyang20@huawei.com>
      Link: https://lore.kernel.org/r/1565343666-73193-5-git-send-email-oulijun@huawei.comSigned-off-by: NDoug Ledford <dledford@redhat.com>
      d7e5ca88
    • W
      RDMA/hns: Logic optimization of wc_flags · 0e1aa6f0
      Weihang Li 提交于
      We should set IB_WC_WITH_VLAN only when VLAN is enabled.
      In addition, move setting of IB_WC_WITH_SMAC below
      setting of wc->smac.
      Signed-off-by: NWeihang Li <liweihang@hisilicon.com>
      Link: https://lore.kernel.org/r/1565343666-73193-2-git-send-email-oulijun@huawei.comSigned-off-by: NDoug Ledford <dledford@redhat.com>
      0e1aa6f0
  4. 12 8月, 2019 11 次提交
  5. 01 8月, 2019 1 次提交
  6. 25 7月, 2019 3 次提交
  7. 07 7月, 2019 1 次提交
  8. 05 7月, 2019 3 次提交
  9. 04 7月, 2019 2 次提交
  10. 25 6月, 2019 1 次提交
  11. 21 6月, 2019 3 次提交
    • L
      RDMA: Check umem pointer validity prior to release · 836a0fbb
      Leon Romanovsky 提交于
      Update ib_umem_release() to behave similarly to kfree() and allow
      submitting NULL pointer as safe input to this function.
      
      Fixes: a52c8e24 ("RDMA: Clean destroy CQ in drivers do not return errors")
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      836a0fbb
    • L
      RDMA/hns: reset function when removing module · 89a6da3c
      Lang Cheng 提交于
      During removing the driver, we needs to notify the roce engine to
      stop working immediately,and symmetrically recycle the hardware
      resources requested during initialization.
      
      The hardware provides a command called function clear that can package
      these operations,so that the driver can only focus on releasing
      resources that applied from the operating system.
      This patch implements the call of this command.
      Signed-off-by: NLang Cheng <chenglang@huawei.com>
      Signed-off-by: NLijun Ou <oulijun@huawei.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      89a6da3c
    • L
      RDMA/hns: Fix bug when wqe num is larger than 16K · 8d18ad83
      Lijun Ou 提交于
      hip08 can support up to 32768 wqes in one qp. currently if the wqe num
      is larger than 16384, the driver will lead a calltrace as follows.
      
      [21361.393725] Call trace:
      [21361.398605]  hns_roce_v2_modify_qp+0xbcc/0x1360 [hns_roce_hw_v2]
      [21361.410627]  hns_roce_modify_qp+0x1d8/0x2f8 [hns_roce]
      [21361.420906]  _ib_modify_qp+0x70/0x118
      [21361.428222]  ib_modify_qp+0x14/0x1c
      [21361.435193]  rt_ktest_modify_qp+0xb8/0x650 [rdma_test]
      [21361.445472]  exec_modify_qp_cmd+0x110/0x4d8 [rdma_test]
      [21361.455924]  rt_ktest_dispatch_cmd_3+0xa94/0x2edc [rdma_test]
      [21361.467422]  rt_ktest_dispatch_cmd_2+0x9c/0x108 [rdma_test]
      [21361.478570]  rt_ktest_dispatch_cmd+0x138/0x904 [rdma_test]
      [21361.489545]  rt_ktest_dev_write+0x328/0x4b0 [rdma_test]
      [21361.499998]  __vfs_write+0x38/0x15c
      [21361.506966]  vfs_write+0xa8/0x1a0
      [21361.513586]  ksys_write+0x50/0xb0
      [21361.520206]  sys_write+0xc/0x14
      [21361.526479]  el0_svc_naked+0x30/0x34
      [21361.533622] Code: 1ac10841 d37d7c22 0b000021 d37df021 (f86268c0)
      [21361.545815] ---[ end trace e2a1feb2c3d7f13c ]---
      
      When the wqe num is larger than 16384, hns_roce_table_find will return an
      invalid mtt, this will lead an kernel paging requet error if the driver try
      to access it. It's the mtt design defect which can't support up to the max
      wqe num of hip08.
      
      This patch fixs it by replacing mtt with mtr for wqe.
      
      Fixes: 926a01dc ("RDMA/hns: Add QP operations support for hip08 SoC")
      Signed-off-by: NXi Wang <wangxi11@huawei.com>
      Signed-off-by: NLijun Ou <oulijun@huawei.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      8d18ad83
  12. 08 6月, 2019 1 次提交
    • L
      RDMA/hns: Bugfix for filling the sge of srq · 4f18904c
      Lijun Ou 提交于
      When user post recv a srq with multiple sges, the hardware will get the
      last correct sge and count the sge numbers according to the specific
      identifier with lkey. For example, when the driver fills the sges with
      every wr less than the max sge that the user configured when creating srq,
      the hardware will stop getting the sge according to the specific lkey in
      the sge. However, it will always end with the first sge in the current
      post srq recv interface implementation.
      
      Fixes: c7bcb134 ("RDMA/hns: Add SRQ support for hip08 kernel mode")
      Signed-off-by: NLijun Ou <oulijun@huawei.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      4f18904c
  13. 01 6月, 2019 1 次提交
  14. 28 5月, 2019 2 次提交
  15. 03 5月, 2019 1 次提交