<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.E-MailFormatvorlage18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Hi Rani,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Sounds very promising to me.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Perhaps the predefined template
<b>SDDL_DEVOBJ_SYS_ALL_ADM_RWX_WORLD_R_RES_R</b> might be a good choice, as described in
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/sddl-for-device-objects">https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/sddl-for-device-objects</a>(?).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">If possible, I willingly would try some test version in advance. Or will I have to wait for an upcoming official release?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks and Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Hubert<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">BTW: Next I'm about to upgrade my system to the latest WinOF-2 2.0 + firmware 12_23_1020 to see if anything will change.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<table style="FONT-SIZE: 7pt; FONT-FAMILY: 'Segoe UI',Arial,Helvetica,sans-serif; COLOR: #000000; LINE-HEIGHT: 10pt" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td style="FONT-SIZE: 7pt; FONT-FAMILY: 'Segoe UI',Arial,Helvetica,sans-serif; COLOR: #828282; LINE-HEIGHT: 9.5pt" valign="top" align="left">
<span style="FONT-SIZE: 7pt; FONT-FAMILY: 'Segoe UI',Arial,Helvetica,sans-serif; COLOR: #828282; LINE-HEIGHT: 9.5pt"><font color="#9a9a9a">This message and attachment(s) are intended solely for use by the addressee and may contain information that is privileged,
confidential or otherwise exempt from disclosure under applicable law. If you are not the intended recipient or agent thereof responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or
copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately by telephone or with a 'reply' message and delete the message and its attachment(s), if any, from your system(s). Thank
you for your co-operation.</font></span></td>
</tr>
<tr>
<td style="FONT-SIZE: 7pt; FONT-FAMILY: 'Segoe UI',Arial,Helvetica,sans-serif; COLOR: #000000; LINE-HEIGHT: 10pt">
</td>
</tr>
</tbody>
</table>
<br>
<br>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Von:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Rani Sharoni [mailto:ranish@mellanox.com]
<br>
<b>Gesendet:</b> Donnerstag, 6. September 2018 09:05<br>
<b>An:</b> Tziporet Koren; Hefty, Sean; Schmitt, Hubert; ofw@lists.openfabrics.org; Eilon Greenstein<br>
<b>Betreff:</b> Re: [ofw] NetworkDirect API: Loading of "NDv2 Provider for Mellanox WinOF-2" requires admin privileges<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div id="divtagdefaultwrapper">
<p><span style="font-family:"Calibri","sans-serif";color:black">Hi,<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">The winof-2 CX4 driver is NDIS miniport driver hence using NdisRegisterDeviceEx to register the underlying device.<o:p></o:p></span></p>
<p><span style="font-family:"Calibri","sans-serif";color:black">We are using DefaultSDDLString == NULL which seem to restrict the device access to admin only.<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">Winof-1 CX3 has dedicated WDF filter driver that seems to to have no such restriction.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">OTOH, we have not yet got such ask hence never actually noticed it.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">I think that Linux also allow non-admin to access IB-verbs and therefore we should relax the device (maybe with configuration that allow security hardening).<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">Thanks,
<o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"Calibri","sans-serif";color:black">Rani<o:p></o:p></span></p>
<div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-family:"Calibri","sans-serif";color:black">
<hr size="2" width="98%" align="center">
</span></div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"> Tziporet Koren<br>
<b>Sent:</b> Tuesday, September 4, 2018 7:52 PM<br>
<b>To:</b> Hefty, Sean; Schmitt, Hubert; ofw@lists.openfabrics.org; Eilon Greenstein<br>
<b>Subject:</b> Re: [ofw] NetworkDirect API: Loading of "NDv2 Provider for Mellanox WinOF-2" requires admin privileges</span><span style="font-family:"Calibri","sans-serif";color:black">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">Sean<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">Thanks for answering.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">Eilon can you look into this?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div id="x_x_composer_signature">
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">Tziporet Koren
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">VP of SW<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">Mellanox Technologies Ltd.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">Mobile: +972-54-4689426<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">-------- Original message --------<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">From: "Hefty, Sean" <sean.hefty@intel.com>
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">Date: 04/09/2018 7:33 pm (GMT+02:00)
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">To: "Schmitt, Hubert" <Hubert.Schmitt@oce.com>, ofw@lists.openfabrics.org
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black">Subject: Re: [ofw] NetworkDirect API: Loading of "NDv2 Provider for Mellanox WinOF-2" requires admin privileges
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">I didn't realize this mailing list was still active. For most windows questions, you will need to contact the vendor directly. AFAIK, the Windows OFED development
hasn't been active in years, and went away once Microsoft created NetworkDirect.<br>
<br>
- Sean<br>
<br>
<br>
> Hello all,<br>
> <br>
> I have an issue in my NetworkDirect RDMA application when loading the<br>
> Mellanox NDv2 provider. It seems as the newer WinOF-2 driver for<br>
> ConnectX-4 IB HCAs (mlx5nd.dll) requires that the connecting process<br>
> has adminstrator privileges.<br>
> <br>
> Because when running my application with normal user privileges, I get<br>
> an error 0x80070005 (Access denied), whereas this has never been an<br>
> issue with the older WinOF driver for ConnectX-3 HCAs (mlx4nd.dll).<br>
> <br>
> Here the failing code sequence from my ndhelper.cpp:<br>
> <br>
> static HMODULE g_hProvider = NULL;<br>
> static IND2Provider g_pIProvider = NULL;<br>
> <br>
> static HRESULT LoadProvider( __in WSAPROTOCOL_INFOW* pProtocol ) {<br>
> WCHAR* pPath = ::GetProviderPath( pProtocol ); //<br>
> %SystemRoot%\System32\mlx5nd.dll<br>
> g_hProvider = ::LoadLibraryW( pPath );<br>
> ::HeapFree( ::GetProcessHeap(), 0, pPath );<br>
> <br>
> DLLGETCLASSOBJECT pfnDllGetClassObject =<br>
> reinterpret_cast<DLLGETCLASSOBJECT>(<br>
> ::GetProcAddress( g_hProvider, "DllGetClassObject" )<br>
> );<br>
> <br>
> DLLGETCLASSOBJECT pfnDllCanUnloadNow =<br>
> reinterpret_cast<DLLCANUNLOADNOW>(<br>
> ::GetProcAddress(g_hProvider, "DllCanUnloadNow")<br>
> );<br>
> <br>
> IClassFactory* pClassFactory;<br>
> <br>
> HRESULT hr = pfnDllGetClassObject(<br>
> pProtocol->ProviderId,<br>
> IID_IClassFactory,<br>
> reinterpret_cast<void**>(&pClassFactory)<br>
> );<br>
> <br>
> if (g_pIProvider == NULL) {<br>
> hr = pClassFactory->CreateInstance(<br>
> NULL,<br>
> IID_IND2Provider,<br>
> reinterpret_cast<void**>(&g_pIProvider)<br>
> );<br>
> if (FAILED(hr)) {<br>
> TRACE("ClassFactory->CreateInstance(IID_IND2Provider)<br>
> failed with error 0x%08X", hr); // Without having admin rights, always<br>
> ending up here!<br>
> g_pIProvider = NULL;<br>
> }<br>
> pClassFactory->Release();<br>
> }<br>
> }<br>
> <br>
> <br>
> <br>
> Unfortunately, just giving my process admin privileges is not an<br>
> option for me. So I would appreciate if someone has an idea how to<br>
> overcome this issue.<br>
> Perhaps some tuning of security configuration via dcomcnfg or the<br>
> like(?)<br>
> <br>
> BTW: The Mellanox-provided tools nd_read_bw.exe and nd_write_bw.exe<br>
> have the same behavior:<br>
> <br>
> * Those from WinOF driver 5.35 on ConnectX-3 FDR HCA can run WITH<br>
> or WITHOUT admin privileges.<br>
> * Those from WinOF-2 driver 1.80 on ConnectX-4 EDR HCA can run<br>
> only WITH admin privileges.<br>
> <br>
> My system configuration:<br>
> <br>
> * HPE DL380Gen10<br>
> * ConnectX-4 EDR Infiniband HCA (HPEIB EDR/EN 100Gb 2P 840QSFP28)<br>
> * Windows Server 2012 R2<br>
> * Mellanox WinOF-2 version 1.80<br>
> <br>
> Thanks and Regards,<br>
> Hubert<br>
> <br>
> <br>
> <br>
> This message and attachment(s) are intended solely for use by the<br>
> addressee and may contain information that is privileged, confidential<br>
> or otherwise exempt from disclosure under applicable law. If you are<br>
> not the intended recipient or agent thereof responsible for delivering<br>
> this message to the intended recipient, you are hereby notified that<br>
> any dissemination, distribution or copying of this communication is<br>
> strictly prohibited. If you have received this communication in error,<br>
> please notify the sender immediately by telephone or with a 'reply'<br>
> message and delete the message and its attachment(s), if any, from<br>
> your system(s). Thank you for your co-operation.<br>
> <br>
> <br>
<br>
_______________________________________________<br>
ofw mailing list<br>
ofw@lists.openfabrics.org<br>
<a href="https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.openfabrics.org%2Fmailman%2Flistinfo%2Fofw&data=02%7C01%7Ctziporet%40mellanox.com%7Cd3d9df97849742fb59d908d6128432d3%7Ca652971c7d2e4d9ba6a4d149256f461b%7C0%7C0%7C636716756345475338&sdata=dzz%2FfF25tifvZ2Kl02lPDMxyQvYYkn5Sj0C8A%2FAxS10%3D&reserved=0" id="LPlnk691082">https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.openfabrics.org%2Fmailman%2Flistinfo%2Fofw&data=02%7C01%7Ctziporet%40mellanox.com%7Cd3d9df97849742fb59d908d6128432d3%7Ca652971c7d2e4d9ba6a4d149256f461b%7C0%7C0%7C636716756345475338&sdata=dzz%2FfF25tifvZ2Kl02lPDMxyQvYYkn5Sj0C8A%2FAxS10%3D&reserved=0</a><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>