mirror of
https://github.com/torvalds/linux.git
synced 2024-12-12 14:12:51 +00:00
1e75550648
Below 2 commits will be reverted: commit8ff5f5d9d8
("RDMA/rxe: Prevent double freeing rxe_map_set()") commit647bf13ce9
("RDMA/rxe: Create duplicate mapping tables for FMRs") The community has a few bug reports which pointed this commit at last. Some proposals are raised up in the meantime but all of them have no follow-up operation. The previous commit led the map_set of FMR to be not available any more if the MR is registered again after invalidating. Although the mentioned patch try to fix a potential race in building/accessing the same table for fast memory regions, it broke rtrs etc ULPs. Since the latter could be worse, revert this patch. With previous commit, it's observed that a same MR in rnbd server will trigger below code path: -> rxe_mr_init_fast() |-> alloc map_set() # map_set is uninitialized |...-> rxe_map_mr_sg() # build the map_set |-> rxe_mr_set_page() |...-> rxe_reg_fast_mr() # mr->state change to VALID from FREE that means # we can access host memory(such rxe_mr_copy) |...-> rxe_invalidate_mr() # mr->state change to FREE from VALID |...-> rxe_reg_fast_mr() # mr->state change to VALID from FREE, # but map_set was not built again |...-> rxe_mr_copy() # kernel crash due to access wild addresses # that lookup from the map_set The backtraces are not always identical. [1st]---------- RIP: 0010:lookup_iova+0x66/0xa0 [rdma_rxe] Code: 00 00 00 48 d3 ee 89 32 c3 4c 8b 18 49 8b 3b 48 8b 47 08 48 39 c6 72 38 48 29 c6 45 31 d2 b8 01 00 00 00 48 63 c8 48 c1 e1 04 <48> 8b 4c 0f 08 48 39 f1 77 21 83 c0 01 48 29 ce 3d 00 01 00 00 75 RSP: 0018:ffffb7ff80063bf0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff9b9949d86800 RCX: 0000000000000000 RDX: ffffb7ff80063c00 RSI: 0000000049f6b378 RDI: 002818da00000004 RBP: 0000000000000120 R08: ffffb7ff80063c08 R09: ffffb7ff80063c04 R10: 0000000000000002 R11: ffff9b9916f7eef8 R12: ffff9b99488a0038 R13: ffff9b99488a0038 R14: ffff9b9914fb346a R15: ffff9b990ab27000 FS: 0000000000000000(0000) GS:ffff9b997dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007efc33a98ed0 CR3: 0000000014f32004 CR4: 00000000001706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> rxe_mr_copy.part.0+0x6f/0x140 [rdma_rxe] rxe_responder+0x12ee/0x1b60 [rdma_rxe] ? rxe_icrc_check+0x7e/0x100 [rdma_rxe] ? rxe_rcv+0x1d0/0x780 [rdma_rxe] ? rxe_icrc_hdr.isra.0+0xf6/0x160 [rdma_rxe] rxe_do_task+0x67/0xb0 [rdma_rxe] rxe_xmit_packet+0xc7/0x210 [rdma_rxe] rxe_requester+0x680/0xee0 [rdma_rxe] ? update_load_avg+0x5f/0x690 ? update_load_avg+0x5f/0x690 ? rtrs_clt_recv_done+0x1b/0x30 [rtrs_client] [2nd]---------- RIP: 0010:rxe_mr_copy.part.0+0xa8/0x140 [rdma_rxe] Code: 00 00 49 c1 e7 04 48 8b 00 4c 8d 2c d0 48 8b 44 24 10 4d 03 7d 00 85 ed 7f 10 eb 6c 89 54 24 0c 49 83 c7 10 31 c0 85 ed 7e 5e <49> 8b 3f 8b 14 24 4c 89 f6 48 01 c7 85 d2 74 06 48 89 fe 4c 89 f7 RSP: 0018:ffffae3580063bf8 EFLAGS: 00010202 RAX: 0000000000018978 RBX: ffff9d7ef7a03600 RCX: 0000000000000008 RDX: 000000000000007c RSI: 000000000000007c RDI: ffff9d7ef7a03600 RBP: 0000000000000120 R08: ffffae3580063c08 R09: ffffae3580063c04 R10: ffff9d7efece0038 R11: ffff9d7ec4b1db00 R12: ffff9d7efece0038 R13: ffff9d7ef4098260 R14: ffff9d7f11e23c6a R15: 4c79500065708144 FS: 0000000000000000(0000) GS:ffff9d7f3dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fce47276c60 CR3: 0000000003f66004 CR4: 00000000001706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> rxe_responder+0x12ee/0x1b60 [rdma_rxe] ? rxe_icrc_check+0x7e/0x100 [rdma_rxe] ? rxe_rcv+0x1d0/0x780 [rdma_rxe] ? rxe_icrc_hdr.isra.0+0xf6/0x160 [rdma_rxe] rxe_do_task+0x67/0xb0 [rdma_rxe] rxe_xmit_packet+0xc7/0x210 [rdma_rxe] rxe_requester+0x680/0xee0 [rdma_rxe] ? update_load_avg+0x5f/0x690 ? update_load_avg+0x5f/0x690 ? rtrs_clt_recv_done+0x1b/0x30 [rtrs_client] rxe_do_task+0x67/0xb0 [rdma_rxe] tasklet_action_common.constprop.0+0x92/0xc0 __do_softirq+0xe1/0x2d8 run_ksoftirqd+0x21/0x30 smpboot_thread_fn+0x183/0x220 ? sort_range+0x20/0x20 kthread+0xe2/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 Link: https://lore.kernel.org/r/1658805386-2-1-git-send-email-lizhijian@fujitsu.com Link: https://lore.kernel.org/all/20220210073655.42281-1-guoqing.jiang@linux.dev/T/ Link: https://www.spinics.net/lists/linux-rdma/msg110836.html Link: https://lore.kernel.org/lkml/94a5ea93-b8bb-3a01-9497-e2021f29598a@linux.dev/t/ Tested-by: Md Haris Iqbal <haris.iqbal@ionos.com> Reviewed-by: Bob Pearson <rpearsonhpe@gmail.com> Signed-off-by: Li Zhijian <lizhijian@fujitsu.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
333 lines
6.8 KiB
C
333 lines
6.8 KiB
C
// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB
|
|
/*
|
|
* Copyright (c) 2020 Hewlett Packard Enterprise, Inc. All rights reserved.
|
|
*/
|
|
|
|
/*
|
|
* The rdma_rxe driver supports type 1 or type 2B memory windows.
|
|
* Type 1 MWs are created by ibv_alloc_mw() verbs calls and bound by
|
|
* ibv_bind_mw() calls. Type 2 MWs are also created by ibv_alloc_mw()
|
|
* but bound by bind_mw work requests. The ibv_bind_mw() call is converted
|
|
* by libibverbs to a bind_mw work request.
|
|
*/
|
|
|
|
#include "rxe.h"
|
|
|
|
int rxe_alloc_mw(struct ib_mw *ibmw, struct ib_udata *udata)
|
|
{
|
|
struct rxe_mw *mw = to_rmw(ibmw);
|
|
struct rxe_pd *pd = to_rpd(ibmw->pd);
|
|
struct rxe_dev *rxe = to_rdev(ibmw->device);
|
|
int ret;
|
|
|
|
rxe_get(pd);
|
|
|
|
ret = rxe_add_to_pool(&rxe->mw_pool, mw);
|
|
if (ret) {
|
|
rxe_put(pd);
|
|
return ret;
|
|
}
|
|
|
|
mw->rkey = ibmw->rkey = (mw->elem.index << 8) | rxe_get_next_key(-1);
|
|
mw->state = (mw->ibmw.type == IB_MW_TYPE_2) ?
|
|
RXE_MW_STATE_FREE : RXE_MW_STATE_VALID;
|
|
spin_lock_init(&mw->lock);
|
|
|
|
rxe_finalize(mw);
|
|
|
|
return 0;
|
|
}
|
|
|
|
int rxe_dealloc_mw(struct ib_mw *ibmw)
|
|
{
|
|
struct rxe_mw *mw = to_rmw(ibmw);
|
|
|
|
rxe_cleanup(mw);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
|
|
struct rxe_mw *mw, struct rxe_mr *mr)
|
|
{
|
|
if (mw->ibmw.type == IB_MW_TYPE_1) {
|
|
if (unlikely(mw->state != RXE_MW_STATE_VALID)) {
|
|
pr_err_once(
|
|
"attempt to bind a type 1 MW not in the valid state\n");
|
|
return -EINVAL;
|
|
}
|
|
|
|
/* o10-36.2.2 */
|
|
if (unlikely((mw->access & IB_ZERO_BASED))) {
|
|
pr_err_once("attempt to bind a zero based type 1 MW\n");
|
|
return -EINVAL;
|
|
}
|
|
}
|
|
|
|
if (mw->ibmw.type == IB_MW_TYPE_2) {
|
|
/* o10-37.2.30 */
|
|
if (unlikely(mw->state != RXE_MW_STATE_FREE)) {
|
|
pr_err_once(
|
|
"attempt to bind a type 2 MW not in the free state\n");
|
|
return -EINVAL;
|
|
}
|
|
|
|
/* C10-72 */
|
|
if (unlikely(qp->pd != to_rpd(mw->ibmw.pd))) {
|
|
pr_err_once(
|
|
"attempt to bind type 2 MW with qp with different PD\n");
|
|
return -EINVAL;
|
|
}
|
|
|
|
/* o10-37.2.40 */
|
|
if (unlikely(!mr || wqe->wr.wr.mw.length == 0)) {
|
|
pr_err_once(
|
|
"attempt to invalidate type 2 MW by binding with NULL or zero length MR\n");
|
|
return -EINVAL;
|
|
}
|
|
}
|
|
|
|
/* remaining checks only apply to a nonzero MR */
|
|
if (!mr)
|
|
return 0;
|
|
|
|
if (unlikely(mr->access & IB_ZERO_BASED)) {
|
|
pr_err_once("attempt to bind MW to zero based MR\n");
|
|
return -EINVAL;
|
|
}
|
|
|
|
/* C10-73 */
|
|
if (unlikely(!(mr->access & IB_ACCESS_MW_BIND))) {
|
|
pr_err_once(
|
|
"attempt to bind an MW to an MR without bind access\n");
|
|
return -EINVAL;
|
|
}
|
|
|
|
/* C10-74 */
|
|
if (unlikely((mw->access &
|
|
(IB_ACCESS_REMOTE_WRITE | IB_ACCESS_REMOTE_ATOMIC)) &&
|
|
!(mr->access & IB_ACCESS_LOCAL_WRITE))) {
|
|
pr_err_once(
|
|
"attempt to bind an Writable MW to an MR without local write access\n");
|
|
return -EINVAL;
|
|
}
|
|
|
|
/* C10-75 */
|
|
if (mw->access & IB_ZERO_BASED) {
|
|
if (unlikely(wqe->wr.wr.mw.length > mr->length)) {
|
|
pr_err_once(
|
|
"attempt to bind a ZB MW outside of the MR\n");
|
|
return -EINVAL;
|
|
}
|
|
} else {
|
|
if (unlikely((wqe->wr.wr.mw.addr < mr->iova) ||
|
|
((wqe->wr.wr.mw.addr + wqe->wr.wr.mw.length) >
|
|
(mr->iova + mr->length)))) {
|
|
pr_err_once(
|
|
"attempt to bind a VA MW outside of the MR\n");
|
|
return -EINVAL;
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void rxe_do_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
|
|
struct rxe_mw *mw, struct rxe_mr *mr)
|
|
{
|
|
u32 key = wqe->wr.wr.mw.rkey & 0xff;
|
|
|
|
mw->rkey = (mw->rkey & ~0xff) | key;
|
|
mw->access = wqe->wr.wr.mw.access;
|
|
mw->state = RXE_MW_STATE_VALID;
|
|
mw->addr = wqe->wr.wr.mw.addr;
|
|
mw->length = wqe->wr.wr.mw.length;
|
|
|
|
if (mw->mr) {
|
|
rxe_put(mw->mr);
|
|
atomic_dec(&mw->mr->num_mw);
|
|
mw->mr = NULL;
|
|
}
|
|
|
|
if (mw->length) {
|
|
mw->mr = mr;
|
|
atomic_inc(&mr->num_mw);
|
|
rxe_get(mr);
|
|
}
|
|
|
|
if (mw->ibmw.type == IB_MW_TYPE_2) {
|
|
rxe_get(qp);
|
|
mw->qp = qp;
|
|
}
|
|
}
|
|
|
|
int rxe_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe)
|
|
{
|
|
int ret;
|
|
struct rxe_mw *mw;
|
|
struct rxe_mr *mr;
|
|
struct rxe_dev *rxe = to_rdev(qp->ibqp.device);
|
|
u32 mw_rkey = wqe->wr.wr.mw.mw_rkey;
|
|
u32 mr_lkey = wqe->wr.wr.mw.mr_lkey;
|
|
|
|
mw = rxe_pool_get_index(&rxe->mw_pool, mw_rkey >> 8);
|
|
if (unlikely(!mw)) {
|
|
ret = -EINVAL;
|
|
goto err;
|
|
}
|
|
|
|
if (unlikely(mw->rkey != mw_rkey)) {
|
|
ret = -EINVAL;
|
|
goto err_drop_mw;
|
|
}
|
|
|
|
if (likely(wqe->wr.wr.mw.length)) {
|
|
mr = rxe_pool_get_index(&rxe->mr_pool, mr_lkey >> 8);
|
|
if (unlikely(!mr)) {
|
|
ret = -EINVAL;
|
|
goto err_drop_mw;
|
|
}
|
|
|
|
if (unlikely(mr->lkey != mr_lkey)) {
|
|
ret = -EINVAL;
|
|
goto err_drop_mr;
|
|
}
|
|
} else {
|
|
mr = NULL;
|
|
}
|
|
|
|
spin_lock_bh(&mw->lock);
|
|
|
|
ret = rxe_check_bind_mw(qp, wqe, mw, mr);
|
|
if (ret)
|
|
goto err_unlock;
|
|
|
|
rxe_do_bind_mw(qp, wqe, mw, mr);
|
|
err_unlock:
|
|
spin_unlock_bh(&mw->lock);
|
|
err_drop_mr:
|
|
if (mr)
|
|
rxe_put(mr);
|
|
err_drop_mw:
|
|
rxe_put(mw);
|
|
err:
|
|
return ret;
|
|
}
|
|
|
|
static int rxe_check_invalidate_mw(struct rxe_qp *qp, struct rxe_mw *mw)
|
|
{
|
|
if (unlikely(mw->state == RXE_MW_STATE_INVALID))
|
|
return -EINVAL;
|
|
|
|
/* o10-37.2.26 */
|
|
if (unlikely(mw->ibmw.type == IB_MW_TYPE_1))
|
|
return -EINVAL;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void rxe_do_invalidate_mw(struct rxe_mw *mw)
|
|
{
|
|
struct rxe_qp *qp;
|
|
struct rxe_mr *mr;
|
|
|
|
/* valid type 2 MW will always have a QP pointer */
|
|
qp = mw->qp;
|
|
mw->qp = NULL;
|
|
rxe_put(qp);
|
|
|
|
/* valid type 2 MW will always have an MR pointer */
|
|
mr = mw->mr;
|
|
mw->mr = NULL;
|
|
atomic_dec(&mr->num_mw);
|
|
rxe_put(mr);
|
|
|
|
mw->access = 0;
|
|
mw->addr = 0;
|
|
mw->length = 0;
|
|
mw->state = RXE_MW_STATE_FREE;
|
|
}
|
|
|
|
int rxe_invalidate_mw(struct rxe_qp *qp, u32 rkey)
|
|
{
|
|
struct rxe_dev *rxe = to_rdev(qp->ibqp.device);
|
|
struct rxe_mw *mw;
|
|
int ret;
|
|
|
|
mw = rxe_pool_get_index(&rxe->mw_pool, rkey >> 8);
|
|
if (!mw) {
|
|
ret = -EINVAL;
|
|
goto err;
|
|
}
|
|
|
|
if (rkey != mw->rkey) {
|
|
ret = -EINVAL;
|
|
goto err_drop_ref;
|
|
}
|
|
|
|
spin_lock_bh(&mw->lock);
|
|
|
|
ret = rxe_check_invalidate_mw(qp, mw);
|
|
if (ret)
|
|
goto err_unlock;
|
|
|
|
rxe_do_invalidate_mw(mw);
|
|
err_unlock:
|
|
spin_unlock_bh(&mw->lock);
|
|
err_drop_ref:
|
|
rxe_put(mw);
|
|
err:
|
|
return ret;
|
|
}
|
|
|
|
struct rxe_mw *rxe_lookup_mw(struct rxe_qp *qp, int access, u32 rkey)
|
|
{
|
|
struct rxe_dev *rxe = to_rdev(qp->ibqp.device);
|
|
struct rxe_pd *pd = to_rpd(qp->ibqp.pd);
|
|
struct rxe_mw *mw;
|
|
int index = rkey >> 8;
|
|
|
|
mw = rxe_pool_get_index(&rxe->mw_pool, index);
|
|
if (!mw)
|
|
return NULL;
|
|
|
|
if (unlikely((mw->rkey != rkey) || rxe_mw_pd(mw) != pd ||
|
|
(mw->ibmw.type == IB_MW_TYPE_2 && mw->qp != qp) ||
|
|
(mw->length == 0) ||
|
|
(access && !(access & mw->access)) ||
|
|
mw->state != RXE_MW_STATE_VALID)) {
|
|
rxe_put(mw);
|
|
return NULL;
|
|
}
|
|
|
|
return mw;
|
|
}
|
|
|
|
void rxe_mw_cleanup(struct rxe_pool_elem *elem)
|
|
{
|
|
struct rxe_mw *mw = container_of(elem, typeof(*mw), elem);
|
|
struct rxe_pd *pd = to_rpd(mw->ibmw.pd);
|
|
|
|
rxe_put(pd);
|
|
|
|
if (mw->mr) {
|
|
struct rxe_mr *mr = mw->mr;
|
|
|
|
mw->mr = NULL;
|
|
atomic_dec(&mr->num_mw);
|
|
rxe_put(mr);
|
|
}
|
|
|
|
if (mw->qp) {
|
|
struct rxe_qp *qp = mw->qp;
|
|
|
|
mw->qp = NULL;
|
|
rxe_put(qp);
|
|
}
|
|
|
|
mw->access = 0;
|
|
mw->addr = 0;
|
|
mw->length = 0;
|
|
mw->state = RXE_MW_STATE_INVALID;
|
|
}
|