1e75550648
Below 2 commits will be reverted:
commit 8ff5f5d9d8cf ("RDMA/rxe: Prevent double freeing rxe_map_set()")
commit 647bf13ce944 ("RDMA/rxe: Create duplicate mapping tables for FMRs")
The community has a few bug reports which pointed this commit at last.
Some proposals are raised up in the meantime but all of them have no
follow-up operation.
The previous commit led the map_set of FMR to be not available any more if
the MR is registered again after invalidating. Although the mentioned
patch try to fix a potential race in building/accessing the same table
for fast memory regions, it broke rtrs etc ULPs. Since the latter could
be worse, revert this patch.
With previous commit, it's observed that a same MR in rnbd server will
trigger below code path:
-> rxe_mr_init_fast()
|-> alloc map_set() # map_set is uninitialized
|...-> rxe_map_mr_sg() # build the map_set
|-> rxe_mr_set_page()
|...-> rxe_reg_fast_mr() # mr->state change to VALID from FREE that means
# we can access host memory(such rxe_mr_copy)
|...-> rxe_invalidate_mr() # mr->state change to FREE from VALID
|...-> rxe_reg_fast_mr() # mr->state change to VALID from FREE,
# but map_set was not built again
|...-> rxe_mr_copy() # kernel crash due to access wild addresses
# that lookup from the map_set
The backtraces are not always identical.
[1st]----------
RIP: 0010:lookup_iova+0x66/0xa0 [rdma_rxe]
Code: 00 00 00 48 d3 ee 89 32 c3 4c 8b 18 49 8b 3b 48 8b 47 08 48 39 c6 72 38 48 29 c6 45 31 d2 b8 01 00 00 00 48 63 c8 48 c1 e1 04 <48> 8b 4c 0f 08 48 39 f1 77 21 83 c0 01 48 29 ce 3d 00 01 00 00 75
RSP: 0018:ffffb7ff80063bf0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff9b9949d86800 RCX: 0000000000000000
RDX: ffffb7ff80063c00 RSI: 0000000049f6b378 RDI: 002818da00000004
RBP: 0000000000000120 R08: ffffb7ff80063c08 R09: ffffb7ff80063c04
R10: 0000000000000002 R11: ffff9b9916f7eef8 R12: ffff9b99488a0038
R13: ffff9b99488a0038 R14: ffff9b9914fb346a R15: ffff9b990ab27000
FS: 0000000000000000(0000) GS:ffff9b997dc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efc33a98ed0 CR3: 0000000014f32004 CR4: 00000000001706f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
rxe_mr_copy.part.0+0x6f/0x140 [rdma_rxe]
rxe_responder+0x12ee/0x1b60 [rdma_rxe]
? rxe_icrc_check+0x7e/0x100 [rdma_rxe]
? rxe_rcv+0x1d0/0x780 [rdma_rxe]
? rxe_icrc_hdr.isra.0+0xf6/0x160 [rdma_rxe]
rxe_do_task+0x67/0xb0 [rdma_rxe]
rxe_xmit_packet+0xc7/0x210 [rdma_rxe]
rxe_requester+0x680/0xee0 [rdma_rxe]
? update_load_avg+0x5f/0x690
? update_load_avg+0x5f/0x690
? rtrs_clt_recv_done+0x1b/0x30 [rtrs_client]
[2nd]----------
RIP: 0010:rxe_mr_copy.part.0+0xa8/0x140 [rdma_rxe]
Code: 00 00 49 c1 e7 04 48 8b 00 4c 8d 2c d0 48 8b 44 24 10 4d 03 7d 00 85 ed 7f 10 eb 6c 89 54 24 0c 49 83 c7 10 31 c0 85 ed 7e 5e <49> 8b 3f 8b 14 24 4c 89 f6 48 01 c7 85 d2 74 06 48 89 fe 4c 89 f7
RSP: 0018:ffffae3580063bf8 EFLAGS: 00010202
RAX: 0000000000018978 RBX: ffff9d7ef7a03600 RCX: 0000000000000008
RDX: 000000000000007c RSI: 000000000000007c RDI: ffff9d7ef7a03600
RBP: 0000000000000120 R08: ffffae3580063c08 R09: ffffae3580063c04
R10: ffff9d7efece0038 R11: ffff9d7ec4b1db00 R12: ffff9d7efece0038
R13: ffff9d7ef4098260 R14: ffff9d7f11e23c6a R15: 4c79500065708144
FS: 0000000000000000(0000) GS:ffff9d7f3dc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fce47276c60 CR3: 0000000003f66004 CR4: 00000000001706f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
rxe_responder+0x12ee/0x1b60 [rdma_rxe]
? rxe_icrc_check+0x7e/0x100 [rdma_rxe]
? rxe_rcv+0x1d0/0x780 [rdma_rxe]
? rxe_icrc_hdr.isra.0+0xf6/0x160 [rdma_rxe]
rxe_do_task+0x67/0xb0 [rdma_rxe]
rxe_xmit_packet+0xc7/0x210 [rdma_rxe]
rxe_requester+0x680/0xee0 [rdma_rxe]
? update_load_avg+0x5f/0x690
? update_load_avg+0x5f/0x690
? rtrs_clt_recv_done+0x1b/0x30 [rtrs_client]
rxe_do_task+0x67/0xb0 [rdma_rxe]
tasklet_action_common.constprop.0+0x92/0xc0
__do_softirq+0xe1/0x2d8
run_ksoftirqd+0x21/0x30
smpboot_thread_fn+0x183/0x220
? sort_range+0x20/0x20
kthread+0xe2/0x110
? kthread_complete_and_exit+0x20/0x20
ret_from_fork+0x22/0x30
Link: https://lore.kernel.org/r/1658805386-2-1-git-send-email-lizhijian@fujitsu.com
Link: https://lore.kernel.org/all/20220210073655.42281-1-guoqing.jiang@linux.dev/T/
Link: https://www.spinics.net/lists/linux-rdma/msg110836.html
Link: https://lore.kernel.org/lkml/94a5ea93-b8bb-3a01-9497-e2021f29598a@linux.dev/t/
Tested-by: Md Haris Iqbal <haris.iqbal@ionos.com>
Reviewed-by: Bob Pearson <rpearsonhpe@gmail.com>
Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
192 lines
6.5 KiB
C
192 lines
6.5 KiB
C
/* SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB */
|
|
/*
|
|
* Copyright (c) 2016 Mellanox Technologies Ltd. All rights reserved.
|
|
* Copyright (c) 2015 System Fabric Works, Inc. All rights reserved.
|
|
*/
|
|
|
|
#ifndef RXE_LOC_H
|
|
#define RXE_LOC_H
|
|
|
|
/* rxe_av.c */
|
|
void rxe_init_av(struct rdma_ah_attr *attr, struct rxe_av *av);
|
|
|
|
int rxe_av_chk_attr(struct rxe_dev *rxe, struct rdma_ah_attr *attr);
|
|
|
|
void rxe_av_from_attr(u8 port_num, struct rxe_av *av,
|
|
struct rdma_ah_attr *attr);
|
|
|
|
void rxe_av_to_attr(struct rxe_av *av, struct rdma_ah_attr *attr);
|
|
|
|
void rxe_av_fill_ip_info(struct rxe_av *av, struct rdma_ah_attr *attr);
|
|
|
|
struct rxe_av *rxe_get_av(struct rxe_pkt_info *pkt, struct rxe_ah **ahp);
|
|
|
|
/* rxe_cq.c */
|
|
int rxe_cq_chk_attr(struct rxe_dev *rxe, struct rxe_cq *cq,
|
|
int cqe, int comp_vector);
|
|
|
|
int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
|
|
int comp_vector, struct ib_udata *udata,
|
|
struct rxe_create_cq_resp __user *uresp);
|
|
|
|
int rxe_cq_resize_queue(struct rxe_cq *cq, int new_cqe,
|
|
struct rxe_resize_cq_resp __user *uresp,
|
|
struct ib_udata *udata);
|
|
|
|
int rxe_cq_post(struct rxe_cq *cq, struct rxe_cqe *cqe, int solicited);
|
|
|
|
void rxe_cq_disable(struct rxe_cq *cq);
|
|
|
|
void rxe_cq_cleanup(struct rxe_pool_elem *elem);
|
|
|
|
/* rxe_mcast.c */
|
|
struct rxe_mcg *rxe_lookup_mcg(struct rxe_dev *rxe, union ib_gid *mgid);
|
|
int rxe_attach_mcast(struct ib_qp *ibqp, union ib_gid *mgid, u16 mlid);
|
|
int rxe_detach_mcast(struct ib_qp *ibqp, union ib_gid *mgid, u16 mlid);
|
|
void rxe_cleanup_mcg(struct kref *kref);
|
|
|
|
/* rxe_mmap.c */
|
|
struct rxe_mmap_info {
|
|
struct list_head pending_mmaps;
|
|
struct ib_ucontext *context;
|
|
struct kref ref;
|
|
void *obj;
|
|
|
|
struct mminfo info;
|
|
};
|
|
|
|
void rxe_mmap_release(struct kref *ref);
|
|
|
|
struct rxe_mmap_info *rxe_create_mmap_info(struct rxe_dev *dev, u32 size,
|
|
struct ib_udata *udata, void *obj);
|
|
|
|
int rxe_mmap(struct ib_ucontext *context, struct vm_area_struct *vma);
|
|
|
|
/* rxe_mr.c */
|
|
u8 rxe_get_next_key(u32 last_key);
|
|
void rxe_mr_init_dma(struct rxe_pd *pd, int access, struct rxe_mr *mr);
|
|
int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova,
|
|
int access, struct rxe_mr *mr);
|
|
int rxe_mr_init_fast(struct rxe_pd *pd, int max_pages, struct rxe_mr *mr);
|
|
int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, int length,
|
|
enum rxe_mr_copy_dir dir);
|
|
int copy_data(struct rxe_pd *pd, int access, struct rxe_dma_info *dma,
|
|
void *addr, int length, enum rxe_mr_copy_dir dir);
|
|
void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length);
|
|
struct rxe_mr *lookup_mr(struct rxe_pd *pd, int access, u32 key,
|
|
enum rxe_mr_lookup_type type);
|
|
int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length);
|
|
int advance_dma_data(struct rxe_dma_info *dma, unsigned int length);
|
|
int rxe_invalidate_mr(struct rxe_qp *qp, u32 key);
|
|
int rxe_reg_fast_mr(struct rxe_qp *qp, struct rxe_send_wqe *wqe);
|
|
int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata);
|
|
void rxe_mr_cleanup(struct rxe_pool_elem *elem);
|
|
|
|
/* rxe_mw.c */
|
|
int rxe_alloc_mw(struct ib_mw *ibmw, struct ib_udata *udata);
|
|
int rxe_dealloc_mw(struct ib_mw *ibmw);
|
|
int rxe_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe);
|
|
int rxe_invalidate_mw(struct rxe_qp *qp, u32 rkey);
|
|
struct rxe_mw *rxe_lookup_mw(struct rxe_qp *qp, int access, u32 rkey);
|
|
void rxe_mw_cleanup(struct rxe_pool_elem *elem);
|
|
|
|
/* rxe_net.c */
|
|
struct sk_buff *rxe_init_packet(struct rxe_dev *rxe, struct rxe_av *av,
|
|
int paylen, struct rxe_pkt_info *pkt);
|
|
int rxe_prepare(struct rxe_av *av, struct rxe_pkt_info *pkt,
|
|
struct sk_buff *skb);
|
|
int rxe_xmit_packet(struct rxe_qp *qp, struct rxe_pkt_info *pkt,
|
|
struct sk_buff *skb);
|
|
const char *rxe_parent_name(struct rxe_dev *rxe, unsigned int port_num);
|
|
|
|
/* rxe_qp.c */
|
|
int rxe_qp_chk_init(struct rxe_dev *rxe, struct ib_qp_init_attr *init);
|
|
int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp, struct rxe_pd *pd,
|
|
struct ib_qp_init_attr *init,
|
|
struct rxe_create_qp_resp __user *uresp,
|
|
struct ib_pd *ibpd, struct ib_udata *udata);
|
|
int rxe_qp_to_init(struct rxe_qp *qp, struct ib_qp_init_attr *init);
|
|
int rxe_qp_chk_attr(struct rxe_dev *rxe, struct rxe_qp *qp,
|
|
struct ib_qp_attr *attr, int mask);
|
|
int rxe_qp_from_attr(struct rxe_qp *qp, struct ib_qp_attr *attr,
|
|
int mask, struct ib_udata *udata);
|
|
int rxe_qp_to_attr(struct rxe_qp *qp, struct ib_qp_attr *attr, int mask);
|
|
void rxe_qp_error(struct rxe_qp *qp);
|
|
int rxe_qp_chk_destroy(struct rxe_qp *qp);
|
|
void rxe_qp_cleanup(struct rxe_pool_elem *elem);
|
|
|
|
static inline int qp_num(struct rxe_qp *qp)
|
|
{
|
|
return qp->ibqp.qp_num;
|
|
}
|
|
|
|
static inline enum ib_qp_type qp_type(struct rxe_qp *qp)
|
|
{
|
|
return qp->ibqp.qp_type;
|
|
}
|
|
|
|
static inline enum ib_qp_state qp_state(struct rxe_qp *qp)
|
|
{
|
|
return qp->attr.qp_state;
|
|
}
|
|
|
|
static inline int qp_mtu(struct rxe_qp *qp)
|
|
{
|
|
if (qp->ibqp.qp_type == IB_QPT_RC || qp->ibqp.qp_type == IB_QPT_UC)
|
|
return qp->attr.path_mtu;
|
|
else
|
|
return IB_MTU_4096;
|
|
}
|
|
|
|
static inline int rcv_wqe_size(int max_sge)
|
|
{
|
|
return sizeof(struct rxe_recv_wqe) +
|
|
max_sge * sizeof(struct ib_sge);
|
|
}
|
|
|
|
void free_rd_atomic_resource(struct resp_res *res);
|
|
|
|
static inline void rxe_advance_resp_resource(struct rxe_qp *qp)
|
|
{
|
|
qp->resp.res_head++;
|
|
if (unlikely(qp->resp.res_head == qp->attr.max_dest_rd_atomic))
|
|
qp->resp.res_head = 0;
|
|
}
|
|
|
|
void retransmit_timer(struct timer_list *t);
|
|
void rnr_nak_timer(struct timer_list *t);
|
|
|
|
/* rxe_srq.c */
|
|
int rxe_srq_chk_init(struct rxe_dev *rxe, struct ib_srq_init_attr *init);
|
|
int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq,
|
|
struct ib_srq_init_attr *init, struct ib_udata *udata,
|
|
struct rxe_create_srq_resp __user *uresp);
|
|
int rxe_srq_chk_attr(struct rxe_dev *rxe, struct rxe_srq *srq,
|
|
struct ib_srq_attr *attr, enum ib_srq_attr_mask mask);
|
|
int rxe_srq_from_attr(struct rxe_dev *rxe, struct rxe_srq *srq,
|
|
struct ib_srq_attr *attr, enum ib_srq_attr_mask mask,
|
|
struct rxe_modify_srq_cmd *ucmd, struct ib_udata *udata);
|
|
void rxe_srq_cleanup(struct rxe_pool_elem *elem);
|
|
|
|
void rxe_dealloc(struct ib_device *ib_dev);
|
|
|
|
int rxe_completer(void *arg);
|
|
int rxe_requester(void *arg);
|
|
int rxe_responder(void *arg);
|
|
|
|
/* rxe_icrc.c */
|
|
int rxe_icrc_init(struct rxe_dev *rxe);
|
|
int rxe_icrc_check(struct sk_buff *skb, struct rxe_pkt_info *pkt);
|
|
void rxe_icrc_generate(struct sk_buff *skb, struct rxe_pkt_info *pkt);
|
|
|
|
void rxe_resp_queue_pkt(struct rxe_qp *qp, struct sk_buff *skb);
|
|
|
|
void rxe_comp_queue_pkt(struct rxe_qp *qp, struct sk_buff *skb);
|
|
|
|
static inline unsigned int wr_opcode_mask(int opcode, struct rxe_qp *qp)
|
|
{
|
|
return rxe_wr_opcode_info[opcode].mask[qp->ibqp.qp_type];
|
|
}
|
|
|
|
#endif /* RXE_LOC_H */
|