linux-toradex.git/drivers/infiniband, branch v2.6.27.50

IPoIB: Fix world-writable child interface control sysfs attributes

2010-08-02T17:18:51+00:00

commit 7a52b34b07122ff5f45258d47f260f8a525518f0 upstream.

Sumeet Lahorani  reported that the IPoIB
child entries are world-writable; however we don't want ordinary users
to be able to create and destroy child interfaces, so fix them to be
writable only by root.

Signed-off-by: Or Gerlitz 
Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman

IB/mlx4: Add strong ordering to local inval and fast reg work requests

2009-07-02T23:31:47+00:00

commit 2ac6bf4ddc87c3b6b609f8fa82f6ebbffeac12f4 upstream.

The ConnectX Programmer's Reference Manual states that the "SO" bit
must be set when posting Fast Register and Local Invalidate send work
requests.  When this bit is set, the work request will be executed
only after all previous work requests on the send queue have been
executed.  (If the bit is not set, Fast Register and Local Invalidate
WQEs may begin execution too early, which violates the defined
semantics for these operations)

This fixes the issue with NFS/RDMA reported in


Signed-off-by: Jack Morgenstein 
Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman

RDMA/nes: Don't allow userspace QPs to use STag zero

2009-03-17T00:52:57+00:00

commit c12e56ef6951f4fce1afe9ef6aab9243ea9a9b04 upstream.

STag zero is a special STag that allows consumers to access any bus
address without registering memory.  The nes driver unfortunately
allows STag zero to be used even with QPs created by unprivileged
userspace consumers, which means that any process with direct verbs
access to the nes device can read and write any memory accessible to
the underlying PCI device (usually any memory in the system).  Such
access is usually given for cluster software such as MPI to use, so
this is a local privilege escalation bug on most systems running this
driver.

The driver was using STag zero to receive the last streaming mode
data; to allow STag zero to be disabled for unprivileged QPs, the
driver now registers a special MR for this data.

Signed-off-by: Faisal Latif 
Signed-off-by: Roland Dreier 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

IB/mlx4: Fix MTT leakage in resize CQ

2008-12-05T18:55:25+00:00

commit 42ab01c31526ac1d06d193f81a498bf3cf2acfe4 upstream.

When resizing a CQ, MTTs associated with the old CQE buffer were not
freed.  As a result, if any app used resize CQ repeatedly, all MTTs
were eventually exhausted, which led to all memory registration
operations failing until the driver is reloaded.

Once the RESIZE_CQ command returns successfully from FW, FW no longer
accesses the old CQ buffer, so it is safe to deallocate the MTT
entries used by the old CQ buffer.

Finally, if the RESIZE_CQ command fails, the MTTs allocated for the
new CQEs buffer also need to be de-allocated.

This fixes .

Signed-off-by: Jack Morgenstein 
Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman

IPoIB: Fix crash when path record fails after path flush

2008-09-25T23:37:03+00:00

Commit ee1e2c82 ("IPoIB: Refresh paths instead of flushing them on SM
change events") changed how paths are flushed on an SM event.  This
change introduces a problem if the path record query triggered by
fails, causing path->ah to become NULL.  A later successful path query
will then trigger WARN_ON() in path_rec_completion(), and crash
because path->ah has already been freed, so the ipoib_put_ah() inside
the lock in path_rec_completion() may actually drop the last reference
(contrary to the comment that claims this is safe).

Fix this by updating path->ah and freeing old_ah only when the path
record query is successful.  This prevents the neighbour AH and that
path AH from getting out of sync.

This fixes 

Reported-by: Rabah Salem 
Debugged-by: Eli Cohen 
Signed-off-by: Roland Dreier 
Signed-off-by: Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband

2008-09-19T23:18:21+00:00

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  IPoIB: Fix deadlock on RTNL between bcast join comp and ipoib_stop()
  RDMA/nes: Fix client side QP destroy
  IB/mlx4: Fix up fast register page list format
  mlx4_core: Set RAE and init mtt_sz field in FRMR MPT entries

Merge branches 'ipoib', 'mlx4' and 'nes' into for-linus

2008-09-16T18:57:52+00:00

IPoIB: Fix deadlock on RTNL between bcast join comp and ipoib_stop()

2008-09-16T18:57:45+00:00

Taking rtnl_lock in ipoib_mcast_join_complete() causes a deadlock with
ipoib_stop().  We avoid it by scheduling the piece of code that takes
the lock on ipoib_workqueue instead of executing it directly.  This
works because we only flush the ipoib_workqueue with the RTNL not held.

The deadlock happens because ipoib_stop() calls ipoib_ib_dev_down()
which calls ipoib_mcast_dev_flush(), which calls ipoib_mcast_free(),
which calls ipoib_mcast_leave(). The latter calls
ib_sa_free_multicast(), and this waits until the multicast completion
handler finishes.  This handler is ipoib_mcast_join_complete(), which
waits for the rtnl_lock(), which was already taken by ipoib_stop().

This bug was introduced in commit a77a57a1 ("IPoIB: Fix deadlock on
RTNL in ipoib_stop()").

Signed-off-by: Yossi Etigin 
Signed-off-by: Roland Dreier

RDMA/nes: Fix client side QP destroy

2008-09-16T18:56:26+00:00

Fix QP not being destroyed properly on the client, which leads to
userspace programs hanging on exit.  This is a missing chunk from the
connection management rewrite in commit 6492cdf3 ("RDMA/nes: CM
connection setup/teardown rework").

Signed-off-by: Faisal Latif 
Signed-off-by: Roland Dreier

IB/mlx4: Fix up fast register page list format

2008-09-15T21:25:23+00:00

Byte swap the addresses in the page list for fast register work requests
to big endian to match what the HCA expectx.  Also, the addresses must
have the "present" bit set so that the HCA knows it can access them.
Otherwise the HCA will fault the first time it accesses the memory
region.

Signed-off-by: Vladimir Sokolovsky 
Signed-off-by: Roland Dreier