From patchwork Wed Sep 28 20:25:47 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Parav Pandit X-Patchwork-Id: 9354863 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 4825A6077B for ; Wed, 28 Sep 2016 20:25:54 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 36AC2289AF for ; Wed, 28 Sep 2016 20:25:54 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 27B5529758; Wed, 28 Sep 2016 20:25:54 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 62EFD289AF for ; Wed, 28 Sep 2016 20:25:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753963AbcI1UZw (ORCPT ); Wed, 28 Sep 2016 16:25:52 -0400 Received: from mail-pa0-f67.google.com ([209.85.220.67]:34811 "EHLO mail-pa0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752880AbcI1UZv (ORCPT ); Wed, 28 Sep 2016 16:25:51 -0400 Received: by mail-pa0-f67.google.com with SMTP id r9so1798840paz.1 for ; Wed, 28 Sep 2016 13:25:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=v/Vz++pZo1ravgg66Au5gb2pNsxLNUlI3zlx0V3hBxo=; b=BFbHVE1KpGj8UMCrVr3oukfbcjDKwevs4Je3qYqWt/1D2Eo6plOYve42uQ6M54RWLA KWZLWudzYHfHYA0TtuLzf3ggUT6mP8WRSdy0XQp0GlwkWO6jwUXtSHp+ZdwWHqbO6bjx 0v6ctj078zhhwDNARIEceWAVz2m+ITFi3GSfjU9B2flA1SmC56GTFP4SR4pbSUDznyWU tHXJh9twP9YX064Tf68LWt/eD9EVV/d/nWWq7GgM+1B75WJRa6Olb3tLQ4W++7ymqdgY HWJq+f24SZ1vV/nqC3aRWE1fg7CZFslnOxOpgkYFPzKVhYQ+hbgHtIMFxl4Qj7ap7i1l NS/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=v/Vz++pZo1ravgg66Au5gb2pNsxLNUlI3zlx0V3hBxo=; b=fkwvX35NGPNuSfgHx4xw5BCjc4GLyREdsaiMlljbP6W3ApUg5+hgz/C1AaoR98JssH B+qnK0/i1mIMeNA3I7RMoR6XUwzy31UPOURy3f3i4+HYOaR+VNtpHwfNkNXiSGf2+v9W /HldZxUmqARvDiQLXTwbm6I1dil5v8UB19FJ1pAOGQZvq5UTwji839FDphsAYOKxANE+ q1b2jxy8cif7PrcFOOy//i3wH8oxqSpFrsTtvZ8nLiDu/TgITi5x6IwTl+aTFzTVGmoJ uKp9hiX6i9lf5C4JSDUcwGpvoGltR+v2f/PYK9oLUCVTEOVJWMJBzB2YvtvuaZvV2bvX GxOQ== X-Gm-Message-State: AE9vXwOFaT7iweMcQt5nGuYAsIzPQFHPfdVodR6HWMJqdPOBt41kMUKOb6PNN4vHDZRRdA== X-Received: by 10.66.164.227 with SMTP id yt3mr60937830pab.117.1475094350457; Wed, 28 Sep 2016 13:25:50 -0700 (PDT) Received: from ip-172-31-4-47.us-west-2.compute.internal (ec2-52-43-58-33.us-west-2.compute.amazonaws.com. [52.43.58.33]) by smtp.gmail.com with ESMTPSA id x190sm14565613pfx.21.2016.09.28.13.25.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 28 Sep 2016 13:25:49 -0700 (PDT) From: Parav Pandit To: dennis.dalessandro@intel.com, monis@mellanox.com, linux-rdma@vger.kernel.org, dledford@redhat.com Cc: pandit.parav@gmail.com Subject: [PATCH] IB/rxe: IB/core: IB/rdmavt: Fix kernel crash for reg MR Date: Wed, 28 Sep 2016 20:25:47 +0000 Message-Id: <1475094347-18402-1-git-send-email-pandit.parav@gmail.com> X-Mailer: git-send-email 2.7.4 Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This patch fixes below kernel crash on memory registration for rxe and other transport drivers which has dma_ops extension. IB/core invokes ib_map_sg_attrs() in generic manner with dma attributes which is used by mlx5 and mthca adapters. However in doing so it ignored honoring dma_ops extension of software based transports for sg map/unmap operation. This results into calling dma_map_sg_attrs of hardware virtual device resulting in crash for null reference. Fix: It extends core to support sg_map/unmap_attrs and transport drivers to implement those dma_ops callback functions. Verified usign perftest applications. Sep 27 06:54:44 kernel: [53869.549130] BUG: unable to handle kernel NULL pointer dereference at (null) Sep 27 06:54:44 kernel: [53869.553005] IP: [] check_addr+0x35/0x60 Sep 27 06:54:44 kernel: [53869.553005] PGD 3cad8067 PUD 3ce05067 PMD 0 Sep 27 06:54:44 kernel: [53869.553005] Oops: 0000 [#1] SMP Sep 27 06:54:44 kernel: [53869.553005] Modules linked in: rdma_rxe rdma_ucm ib_umad rdma_cm configfs iw_cm ib_cm ib_uverbs udp_tunnel ib_core binfmt_misc dm_mirror dm_region_hash dm_log dm_mod mousedev evdev psmouse acpi_cpufreq pcspkr button ext4(E) crc16(E) jbd2(E) mbcache(E) ata_piix(E) libata(E) scsi_mod(E) [last unloaded: rdma_rxe] Sep 27 06:54:44 kernel: [53869.553005] CPU: 0 PID: 32639 Comm: ib_send_bw Tainted: G E 4.8.0-rc6+ #12 Sep 27 06:54:44 kernel: [53869.553005] Hardware name: Xen HVM domU, BIOS 4.2.amazon 05/12/2016 Sep 27 06:54:44 kernel: [53869.553005] task: ffff88003ca45880 task.stack: ffff88003ce88000 Sep 27 06:54:44 kernel: [53869.553005] RIP: 0010:[] [] check_addr+0x35/0x60 Sep 27 06:54:44 kernel: [53869.553005] RSP: 0018:ffff88003ce8bb90 EFLAGS: 00010246 Sep 27 06:54:44 kernel: [53869.553005] RAX: 0000000000000000 RBX: ffff88003d4e1440 RCX: 0000000000001000 Sep 27 06:54:44 kernel: [53869.553005] RDX: 000000002cf3c000 RSI: ffff88003d012840 RDI: ffffffff81789d7e Sep 27 06:54:44 kernel: [53869.553005] RBP: ffff88003ce8bbc0 R08: 0000000000000000 R09: ffff88003ce05048 Sep 27 06:54:44 kernel: [53869.553005] R10: 00000000013f4000 R11: 0000000000000002 R12: 0000000000000000 Sep 27 06:54:44 kernel: [53869.553005] R13: 0000000000000002 R14: ffff88003d012840 R15: 0000160000000000 Sep 27 06:54:44 kernel: [53869.553005] FS: 00007f19c7803740(0000) GS:ffff88003e200000(0000) knlGS:0000000000000000 Sep 27 06:54:44 kernel: [53869.553005] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Sep 27 06:54:44 kernel: [53869.553005] CR2: 0000000000000000 CR3: 0000000037cb1000 CR4: 00000000001406f0 Sep 27 06:54:44 kernel: [53869.553005] Stack: Sep 27 06:54:44 kernel: [53869.553005] ffffffff81032b39 ffff880037a98c40 0000000000000000 ffff88003becf280 Sep 27 06:54:44 kernel: [53869.553005] ffff88003bf33000 0000000000000000 ffff88003ce8bc38 ffffffffa02b31c6 Sep 27 06:54:44 kernel: [53869.553005] ffff880037a98c40 ffff88003d012840 0000000000000002 0000000000000000 Sep 27 06:54:44 kernel: [53869.553005] Call Trace: Sep 27 06:54:44 kernel: [53869.553005] [] ? nommu_map_sg+0x99/0xd0 Sep 27 06:54:44 kernel: [53869.553005] [] ib_umem_get+0x3d6/0x470 [ib_core] Sep 27 06:54:44 kernel: [53869.553005] [] rxe_mem_init_user+0x49/0x270 [rdma_rxe] Sep 27 06:54:44 kernel: [53869.553005] [] ? rxe_add_index+0xca/0x100 [rdma_rxe] Sep 27 06:54:44 kernel: [53869.553005] [] rxe_reg_user_mr+0x9f/0x130 [rdma_rxe] Sep 27 06:54:44 kernel: [53869.553005] [] ib_uverbs_reg_mr+0x14e/0x2c0 [ib_uverbs] Sep 27 06:54:44 kernel: [53869.553005] [] ib_uverbs_write+0x15b/0x3b0 [ib_uverbs] Sep 27 06:54:44 kernel: [53869.553005] [] ? mem_cgroup_commit_charge+0x76/0xe0 Sep 27 06:54:44 kernel: [53869.553005] [] ? page_add_new_anon_rmap+0x89/0xc0 Sep 27 06:54:44 kernel: [53869.553005] [] ? lru_cache_add_active_or_unevictable+0x39/0xc0 Sep 27 06:54:44 kernel: [53869.553005] [] __vfs_write+0x28/0x120 Sep 27 06:54:44 kernel: [53869.553005] [] ? rw_verify_area+0x49/0xb0 Sep 27 06:54:44 kernel: [53869.553005] [] vfs_write+0xb2/0x1b0 Sep 27 06:54:44 kernel: [53869.553005] [] SyS_write+0x46/0xa0 Sep 27 06:54:44 kernel: [53869.553005] [] entry_SYSCALL_64_fastpath+0x1a/0xa4 Signed-off-by: Parav Pandit --- drivers/infiniband/sw/rdmavt/dma.c | 17 +++++++++++++++++ drivers/infiniband/sw/rxe/rxe_dma.c | 17 +++++++++++++++++ include/rdma/ib_verbs.h | 23 ++++++++++++++++++++--- 3 files changed, 54 insertions(+), 3 deletions(-) diff --git a/drivers/infiniband/sw/rdmavt/dma.c b/drivers/infiniband/sw/rdmavt/dma.c index 33076a5..01f71ca 100644 --- a/drivers/infiniband/sw/rdmavt/dma.c +++ b/drivers/infiniband/sw/rdmavt/dma.c @@ -138,6 +138,21 @@ static void rvt_unmap_sg(struct ib_device *dev, /* This is a stub, nothing to be done here */ } +static int rvt_map_sg_attrs(struct ib_device *dev, struct scatterlist *sgl, + int nents, enum dma_data_direction direction, + unsigned long attrs) +{ + return rvt_map_sg(dev, sgl, nents, direction); +} + +static void rvt_unmap_sg_attrs(struct ib_device *dev, + struct scatterlist *sg, int nents, + enum dma_data_direction direction, + unsigned long attrs) +{ + return rvt_unmap_sg(dev, sg, nents, direction); +} + static void rvt_sync_single_for_cpu(struct ib_device *dev, u64 addr, size_t size, enum dma_data_direction dir) { @@ -177,6 +192,8 @@ struct ib_dma_mapping_ops rvt_default_dma_mapping_ops = { .unmap_page = rvt_dma_unmap_page, .map_sg = rvt_map_sg, .unmap_sg = rvt_unmap_sg, + .map_sg_attrs = rvt_map_sg_attrs, + .unmap_sg_attrs = rvt_unmap_sg_attrs, .sync_single_for_cpu = rvt_sync_single_for_cpu, .sync_single_for_device = rvt_sync_single_for_device, .alloc_coherent = rvt_dma_alloc_coherent, diff --git a/drivers/infiniband/sw/rxe/rxe_dma.c b/drivers/infiniband/sw/rxe/rxe_dma.c index 7634c1a..a0f8af5 100644 --- a/drivers/infiniband/sw/rxe/rxe_dma.c +++ b/drivers/infiniband/sw/rxe/rxe_dma.c @@ -117,6 +117,21 @@ static void rxe_unmap_sg(struct ib_device *dev, WARN_ON(!valid_dma_direction(direction)); } +static int rxe_map_sg_attrs(struct ib_device *dev, struct scatterlist *sgl, + int nents, enum dma_data_direction direction, + unsigned long attrs) +{ + return rxe_map_sg(dev, sgl, nents, direction); +} + +static void rxe_unmap_sg_attrs(struct ib_device *dev, + struct scatterlist *sg, int nents, + enum dma_data_direction direction, + unsigned long attrs) +{ + rxe_unmap_sg(dev, sg, nents, direction); +} + static void rxe_sync_single_for_cpu(struct ib_device *dev, u64 addr, size_t size, enum dma_data_direction dir) @@ -159,6 +174,8 @@ struct ib_dma_mapping_ops rxe_dma_mapping_ops = { .unmap_page = rxe_dma_unmap_page, .map_sg = rxe_map_sg, .unmap_sg = rxe_unmap_sg, + .map_sg_attrs = rxe_map_sg_attrs, + .unmap_sg_attrs = rxe_unmap_sg_attrs, .sync_single_for_cpu = rxe_sync_single_for_cpu, .sync_single_for_device = rxe_sync_single_for_device, .alloc_coherent = rxe_dma_alloc_coherent, diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h index e1f9673..9e93565 100644 --- a/include/rdma/ib_verbs.h +++ b/include/rdma/ib_verbs.h @@ -1739,6 +1739,14 @@ struct ib_dma_mapping_ops { void (*unmap_sg)(struct ib_device *dev, struct scatterlist *sg, int nents, enum dma_data_direction direction); + int (*map_sg_attrs)(struct ib_device *dev, + struct scatterlist *sg, int nents, + enum dma_data_direction direction, + unsigned long attrs); + void (*unmap_sg_attrs)(struct ib_device *dev, + struct scatterlist *sg, int nents, + enum dma_data_direction direction, + unsigned long attrs); void (*sync_single_for_cpu)(struct ib_device *dev, u64 dma_handle, size_t size, @@ -3000,8 +3008,12 @@ static inline int ib_dma_map_sg_attrs(struct ib_device *dev, enum dma_data_direction direction, unsigned long dma_attrs) { - return dma_map_sg_attrs(dev->dma_device, sg, nents, direction, - dma_attrs); + if (dev->dma_ops) + return dev->dma_ops->map_sg_attrs(dev, sg, nents, direction, + dma_attrs); + else + return dma_map_sg_attrs(dev->dma_device, sg, nents, direction, + dma_attrs); } static inline void ib_dma_unmap_sg_attrs(struct ib_device *dev, @@ -3009,7 +3021,12 @@ static inline void ib_dma_unmap_sg_attrs(struct ib_device *dev, enum dma_data_direction direction, unsigned long dma_attrs) { - dma_unmap_sg_attrs(dev->dma_device, sg, nents, direction, dma_attrs); + if (dev->dma_ops) + return dev->dma_ops->unmap_sg_attrs(dev, sg, nents, direction, + dma_attrs); + else + dma_unmap_sg_attrs(dev->dma_device, sg, nents, direction, + dma_attrs); } /** * ib_sg_dma_address - Return the DMA address from a scatter/gather entry