License cleanup: add SPDX GPL-2.0 license identifier to files with no license
Many source files in the tree are missing licensing information, which
makes it harder for compliance tools to determine the correct license.
By default all files without license information are under the default
license of the kernel, which is GPL version 2.
Update the files which contain no license information with the 'GPL-2.0'
SPDX license identifier. The SPDX identifier is a legally binding
shorthand, which can be used instead of the full boiler plate text.
This patch is based on work done by Thomas Gleixner and Kate Stewart and
Philippe Ombredanne.
How this work was done:
Patches were generated and checked against linux-4.14-rc6 for a subset of
the use cases:
- file had no licensing information it it.
- file was a */uapi/* one with no licensing information in it,
- file was a */uapi/* one with existing licensing information,
Further patches will be generated in subsequent months to fix up cases
where non-standard license headers were used, and references to license
had to be inferred by heuristics based on keywords.
The analysis to determine which SPDX License Identifier to be applied to
a file was done in a spreadsheet of side by side results from of the
output of two independent scanners (ScanCode & Windriver) producing SPDX
tag:value files created by Philippe Ombredanne. Philippe prepared the
base worksheet, and did an initial spot review of a few 1000 files.
The 4.13 kernel was the starting point of the analysis with 60,537 files
assessed. Kate Stewart did a file by file comparison of the scanner
results in the spreadsheet to determine which SPDX license identifier(s)
to be applied to the file. She confirmed any determination that was not
immediately clear with lawyers working with the Linux Foundation.
Criteria used to select files for SPDX license identifier tagging was:
- Files considered eligible had to be source code files.
- Make and config files were included as candidates if they contained >5
lines of source
- File already had some variant of a license header in it (even if <5
lines).
All documentation files were explicitly excluded.
The following heuristics were used to determine which SPDX license
identifiers to apply.
- when both scanners couldn't find any license traces, file was
considered to have no license information in it, and the top level
COPYING file license applied.
For non */uapi/* files that summary was:
SPDX license identifier # files
---------------------------------------------------|-------
GPL-2.0 11139
and resulted in the first patch in this series.
If that file was a */uapi/* path one, it was "GPL-2.0 WITH
Linux-syscall-note" otherwise it was "GPL-2.0". Results of that was:
SPDX license identifier # files
---------------------------------------------------|-------
GPL-2.0 WITH Linux-syscall-note 930
and resulted in the second patch in this series.
- if a file had some form of licensing information in it, and was one
of the */uapi/* ones, it was denoted with the Linux-syscall-note if
any GPL family license was found in the file or had no licensing in
it (per prior point). Results summary:
SPDX license identifier # files
---------------------------------------------------|------
GPL-2.0 WITH Linux-syscall-note 270
GPL-2.0+ WITH Linux-syscall-note 169
((GPL-2.0 WITH Linux-syscall-note) OR BSD-2-Clause) 21
((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) 17
LGPL-2.1+ WITH Linux-syscall-note 15
GPL-1.0+ WITH Linux-syscall-note 14
((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) 5
LGPL-2.0+ WITH Linux-syscall-note 4
LGPL-2.1 WITH Linux-syscall-note 3
((GPL-2.0 WITH Linux-syscall-note) OR MIT) 3
((GPL-2.0 WITH Linux-syscall-note) AND MIT) 1
and that resulted in the third patch in this series.
- when the two scanners agreed on the detected license(s), that became
the concluded license(s).
- when there was disagreement between the two scanners (one detected a
license but the other didn't, or they both detected different
licenses) a manual inspection of the file occurred.
- In most cases a manual inspection of the information in the file
resulted in a clear resolution of the license that should apply (and
which scanner probably needed to revisit its heuristics).
- When it was not immediately clear, the license identifier was
confirmed with lawyers working with the Linux Foundation.
- If there was any question as to the appropriate license identifier,
the file was flagged for further research and to be revisited later
in time.
In total, over 70 hours of logged manual review was done on the
spreadsheet to determine the SPDX license identifiers to apply to the
source files by Kate, Philippe, Thomas and, in some cases, confirmation
by lawyers working with the Linux Foundation.
Kate also obtained a third independent scan of the 4.13 code base from
FOSSology, and compared selected files where the other two scanners
disagreed against that SPDX file, to see if there was new insights. The
Windriver scanner is based on an older version of FOSSology in part, so
they are related.
Thomas did random spot checks in about 500 files from the spreadsheets
for the uapi headers and agreed with SPDX license identifier in the
files he inspected. For the non-uapi files Thomas did random spot checks
in about 15000 files.
In initial set of patches against 4.14-rc6, 3 files were found to have
copy/paste license identifier errors, and have been fixed to reflect the
correct identifier.
Additionally Philippe spent 10 hours this week doing a detailed manual
inspection and review of the 12,461 patched files from the initial patch
version early this week with:
- a full scancode scan run, collecting the matched texts, detected
license ids and scores
- reviewing anything where there was a license detected (about 500+
files) to ensure that the applied SPDX license was correct
- reviewing anything where there was no detection but the patch license
was not GPL-2.0 WITH Linux-syscall-note to ensure that the applied
SPDX license was correct
This produced a worksheet with 20 files needing minor correction. This
worksheet was then exported into 3 different .csv files for the
different types of files to be modified.
These .csv files were then reviewed by Greg. Thomas wrote a script to
parse the csv files and add the proper SPDX tag to the file, in the
format that the file expected. This script was further refined by Greg
based on the output to detect more types of files automatically and to
distinguish between header and source .c files (which need different
comment types.) Finally Greg ran the script using the .csv files to
generate the patches.
Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org>
Reviewed-by: Philippe Ombredanne <pombredanne@nexb.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-01 14:07:57 +00:00
// SPDX-License-Identifier: GPL-2.0
2017-01-09 15:55:22 +00:00
/*
* Shared Memory Communications over RDMA ( SMC - R ) and RoCE
*
* Connection Data Control ( CDC )
* handles flow control
*
* Copyright IBM Corp . 2016
*
* Author ( s ) : Ursula Braun < ubraun @ linux . vnet . ibm . com >
*/
# include <linux/spinlock.h>
# include "smc.h"
# include "smc_wr.h"
# include "smc_cdc.h"
2017-01-09 15:55:23 +00:00
# include "smc_tx.h"
2017-01-09 15:55:24 +00:00
# include "smc_rx.h"
2017-01-09 15:55:25 +00:00
# include "smc_close.h"
2017-01-09 15:55:22 +00:00
/********************************** send *************************************/
/* handler for send/transmission completion of a CDC msg */
static void smc_cdc_tx_handler ( struct smc_wr_tx_pend_priv * pnd_snd ,
struct smc_link * link ,
enum ib_wc_status wc_status )
{
struct smc_cdc_tx_pend * cdcpend = ( struct smc_cdc_tx_pend * ) pnd_snd ;
2018-07-23 11:53:09 +00:00
struct smc_connection * conn = cdcpend - > conn ;
2017-01-09 15:55:22 +00:00
struct smc_sock * smc ;
int diff ;
2018-07-23 11:53:09 +00:00
smc = container_of ( conn , struct smc_sock , conn ) ;
2017-01-09 15:55:22 +00:00
bh_lock_sock ( & smc - > sk ) ;
if ( ! wc_status ) {
2018-05-18 07:34:10 +00:00
diff = smc_curs_diff ( cdcpend - > conn - > sndbuf_desc - > len ,
2017-01-09 15:55:22 +00:00
& cdcpend - > conn - > tx_curs_fin ,
& cdcpend - > cursor ) ;
/* sndbuf_space is decreased in smc_sendmsg */
smp_mb__before_atomic ( ) ;
atomic_add ( diff , & cdcpend - > conn - > sndbuf_space ) ;
2018-05-18 07:34:10 +00:00
/* guarantee 0 <= sndbuf_space <= sndbuf_desc->len */
2017-01-09 15:55:22 +00:00
smp_mb__after_atomic ( ) ;
2018-07-23 11:53:09 +00:00
smc_curs_copy ( & conn - > tx_curs_fin , & cdcpend - > cursor , conn ) ;
2020-05-04 12:18:37 +00:00
smc_curs_copy ( & conn - > local_tx_ctrl_fin , & cdcpend - > p_cursor ,
conn ) ;
conn - > tx_cdc_seq_fin = cdcpend - > ctrl_seq ;
2017-01-09 15:55:22 +00:00
}
net/smc: fix kernel panic caused by race of smc_sock
A crash occurs when smc_cdc_tx_handler() tries to access smc_sock
but smc_release() has already freed it.
[ 4570.695099] BUG: unable to handle page fault for address: 000000002eae9e88
[ 4570.696048] #PF: supervisor write access in kernel mode
[ 4570.696728] #PF: error_code(0x0002) - not-present page
[ 4570.697401] PGD 0 P4D 0
[ 4570.697716] Oops: 0002 [#1] PREEMPT SMP NOPTI
[ 4570.698228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-rc4+ #111
[ 4570.699013] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8c24b4c 04/0
[ 4570.699933] RIP: 0010:_raw_spin_lock+0x1a/0x30
<...>
[ 4570.711446] Call Trace:
[ 4570.711746] <IRQ>
[ 4570.711992] smc_cdc_tx_handler+0x41/0xc0
[ 4570.712470] smc_wr_tx_tasklet_fn+0x213/0x560
[ 4570.712981] ? smc_cdc_tx_dismisser+0x10/0x10
[ 4570.713489] tasklet_action_common.isra.17+0x66/0x140
[ 4570.714083] __do_softirq+0x123/0x2f4
[ 4570.714521] irq_exit_rcu+0xc4/0xf0
[ 4570.714934] common_interrupt+0xba/0xe0
Though smc_cdc_tx_handler() checked the existence of smc connection,
smc_release() may have already dismissed and released the smc socket
before smc_cdc_tx_handler() further visits it.
smc_cdc_tx_handler() |smc_release()
if (!conn) |
|
|smc_cdc_tx_dismiss_slots()
| smc_cdc_tx_dismisser()
|
|sock_put(&smc->sk) <- last sock_put,
| smc_sock freed
bh_lock_sock(&smc->sk) (panic) |
To make sure we won't receive any CDC messages after we free the
smc_sock, add a refcount on the smc_connection for inflight CDC
message(posted to the QP but haven't received related CQE), and
don't release the smc_connection until all the inflight CDC messages
haven been done, for both success or failed ones.
Using refcount on CDC messages brings another problem: when the link
is going to be destroyed, smcr_link_clear() will reset the QP, which
then remove all the pending CQEs related to the QP in the CQ. To make
sure all the CQEs will always come back so the refcount on the
smc_connection can always reach 0, smc_ib_modify_qp_reset() was replaced
by smc_ib_modify_qp_error().
And remove the timeout in smc_wr_tx_wait_no_pending_sends() since we
need to wait for all pending WQEs done, or we may encounter use-after-
free when handling CQEs.
For IB device removal routine, we need to wait for all the QPs on that
device been destroyed before we can destroy CQs on the device, or
the refcount on smc_connection won't reach 0 and smc_sock cannot be
released.
Fixes: 5f08318f617b ("smc: connection data control (CDC)")
Reported-by: Wen Gu <guwen@linux.alibaba.com>
Signed-off-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-12-28 09:03:25 +00:00
2022-03-01 09:43:57 +00:00
if ( atomic_dec_and_test ( & conn - > cdc_pend_tx_wr ) ) {
2022-03-01 09:44:02 +00:00
/* If user owns the sock_lock, mark the connection need sending.
* User context will later try to send when it release sock_lock
* in smc_release_cb ( )
2022-03-01 09:43:57 +00:00
*/
2022-03-01 09:44:02 +00:00
if ( sock_owned_by_user ( & smc - > sk ) )
conn - > tx_in_release_sock = true ;
else
smc_tx_pending ( conn ) ;
2022-03-01 09:43:57 +00:00
if ( unlikely ( wq_has_sleeper ( & conn - > cdc_pend_tx_wq ) ) )
wake_up ( & conn - > cdc_pend_tx_wq ) ;
}
net/smc: fix kernel panic caused by race of smc_sock
A crash occurs when smc_cdc_tx_handler() tries to access smc_sock
but smc_release() has already freed it.
[ 4570.695099] BUG: unable to handle page fault for address: 000000002eae9e88
[ 4570.696048] #PF: supervisor write access in kernel mode
[ 4570.696728] #PF: error_code(0x0002) - not-present page
[ 4570.697401] PGD 0 P4D 0
[ 4570.697716] Oops: 0002 [#1] PREEMPT SMP NOPTI
[ 4570.698228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-rc4+ #111
[ 4570.699013] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8c24b4c 04/0
[ 4570.699933] RIP: 0010:_raw_spin_lock+0x1a/0x30
<...>
[ 4570.711446] Call Trace:
[ 4570.711746] <IRQ>
[ 4570.711992] smc_cdc_tx_handler+0x41/0xc0
[ 4570.712470] smc_wr_tx_tasklet_fn+0x213/0x560
[ 4570.712981] ? smc_cdc_tx_dismisser+0x10/0x10
[ 4570.713489] tasklet_action_common.isra.17+0x66/0x140
[ 4570.714083] __do_softirq+0x123/0x2f4
[ 4570.714521] irq_exit_rcu+0xc4/0xf0
[ 4570.714934] common_interrupt+0xba/0xe0
Though smc_cdc_tx_handler() checked the existence of smc connection,
smc_release() may have already dismissed and released the smc socket
before smc_cdc_tx_handler() further visits it.
smc_cdc_tx_handler() |smc_release()
if (!conn) |
|
|smc_cdc_tx_dismiss_slots()
| smc_cdc_tx_dismisser()
|
|sock_put(&smc->sk) <- last sock_put,
| smc_sock freed
bh_lock_sock(&smc->sk) (panic) |
To make sure we won't receive any CDC messages after we free the
smc_sock, add a refcount on the smc_connection for inflight CDC
message(posted to the QP but haven't received related CQE), and
don't release the smc_connection until all the inflight CDC messages
haven been done, for both success or failed ones.
Using refcount on CDC messages brings another problem: when the link
is going to be destroyed, smcr_link_clear() will reset the QP, which
then remove all the pending CQEs related to the QP in the CQ. To make
sure all the CQEs will always come back so the refcount on the
smc_connection can always reach 0, smc_ib_modify_qp_reset() was replaced
by smc_ib_modify_qp_error().
And remove the timeout in smc_wr_tx_wait_no_pending_sends() since we
need to wait for all pending WQEs done, or we may encounter use-after-
free when handling CQEs.
For IB device removal routine, we need to wait for all the QPs on that
device been destroyed before we can destroy CQs on the device, or
the refcount on smc_connection won't reach 0 and smc_sock cannot be
released.
Fixes: 5f08318f617b ("smc: connection data control (CDC)")
Reported-by: Wen Gu <guwen@linux.alibaba.com>
Signed-off-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-12-28 09:03:25 +00:00
WARN_ON ( atomic_read ( & conn - > cdc_pend_tx_wr ) < 0 ) ;
2017-01-09 15:55:23 +00:00
smc_tx_sndbuf_nonfull ( smc ) ;
2017-01-09 15:55:22 +00:00
bh_unlock_sock ( & smc - > sk ) ;
}
2017-09-21 07:17:34 +00:00
int smc_cdc_get_free_slot ( struct smc_connection * conn ,
2020-05-04 12:18:38 +00:00
struct smc_link * link ,
2017-01-09 15:55:22 +00:00
struct smc_wr_buf * * wr_buf ,
2019-02-04 12:44:44 +00:00
struct smc_rdma_wr * * wr_rdma_buf ,
2017-01-09 15:55:22 +00:00
struct smc_cdc_tx_pend * * pend )
{
2018-01-25 10:15:36 +00:00
int rc ;
2017-09-21 07:17:34 +00:00
2018-01-25 10:15:36 +00:00
rc = smc_wr_tx_get_free_slot ( link , smc_cdc_tx_handler , wr_buf ,
2019-02-04 12:44:44 +00:00
wr_rdma_buf ,
2018-01-25 10:15:36 +00:00
( struct smc_wr_tx_pend_priv * * ) pend ) ;
2020-07-20 14:24:28 +00:00
if ( conn - > killed ) {
2018-01-25 10:15:36 +00:00
/* abnormal termination */
2020-07-20 14:24:28 +00:00
if ( ! rc )
smc_wr_tx_put_slot ( link ,
2022-05-28 06:54:57 +00:00
( struct smc_wr_tx_pend_priv * ) ( * pend ) ) ;
2018-01-25 10:15:36 +00:00
rc = - EPIPE ;
2020-07-20 14:24:28 +00:00
}
2018-01-25 10:15:36 +00:00
return rc ;
2017-01-09 15:55:22 +00:00
}
static inline void smc_cdc_add_pending_send ( struct smc_connection * conn ,
struct smc_cdc_tx_pend * pend )
{
BUILD_BUG_ON_MSG (
sizeof ( struct smc_cdc_msg ) > SMC_WR_BUF_SIZE ,
" must increase SMC_WR_BUF_SIZE to at least sizeof(struct smc_cdc_msg) " ) ;
BUILD_BUG_ON_MSG (
2018-11-20 15:46:42 +00:00
offsetofend ( struct smc_cdc_msg , reserved ) > SMC_WR_TX_SIZE ,
2017-01-09 15:55:22 +00:00
" must adapt SMC_WR_TX_SIZE to sizeof(struct smc_cdc_msg); if not all smc_wr upper layer protocols use the same message size any more, must start to set link->wr_tx_sges[i].length on each individual smc_wr_tx_send() " ) ;
BUILD_BUG_ON_MSG (
sizeof ( struct smc_cdc_tx_pend ) > SMC_WR_TX_PEND_PRIV_SIZE ,
" must increase SMC_WR_TX_PEND_PRIV_SIZE to at least sizeof(struct smc_cdc_tx_pend) " ) ;
pend - > conn = conn ;
pend - > cursor = conn - > tx_curs_sent ;
pend - > p_cursor = conn - > local_tx_ctrl . prod ;
pend - > ctrl_seq = conn - > tx_cdc_seq ;
}
int smc_cdc_msg_send ( struct smc_connection * conn ,
struct smc_wr_buf * wr_buf ,
struct smc_cdc_tx_pend * pend )
{
2020-04-29 15:10:40 +00:00
struct smc_link * link = conn - > lnk ;
2019-02-04 12:44:45 +00:00
union smc_host_cursor cfed ;
2017-01-09 15:55:22 +00:00
int rc ;
smc_cdc_add_pending_send ( conn , pend ) ;
conn - > tx_cdc_seq + + ;
conn - > local_tx_ctrl . seqno = conn - > tx_cdc_seq ;
2019-02-07 13:52:54 +00:00
smc_host_msg_to_cdc ( ( struct smc_cdc_msg * ) wr_buf , conn , & cfed ) ;
net/smc: fix kernel panic caused by race of smc_sock
A crash occurs when smc_cdc_tx_handler() tries to access smc_sock
but smc_release() has already freed it.
[ 4570.695099] BUG: unable to handle page fault for address: 000000002eae9e88
[ 4570.696048] #PF: supervisor write access in kernel mode
[ 4570.696728] #PF: error_code(0x0002) - not-present page
[ 4570.697401] PGD 0 P4D 0
[ 4570.697716] Oops: 0002 [#1] PREEMPT SMP NOPTI
[ 4570.698228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-rc4+ #111
[ 4570.699013] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8c24b4c 04/0
[ 4570.699933] RIP: 0010:_raw_spin_lock+0x1a/0x30
<...>
[ 4570.711446] Call Trace:
[ 4570.711746] <IRQ>
[ 4570.711992] smc_cdc_tx_handler+0x41/0xc0
[ 4570.712470] smc_wr_tx_tasklet_fn+0x213/0x560
[ 4570.712981] ? smc_cdc_tx_dismisser+0x10/0x10
[ 4570.713489] tasklet_action_common.isra.17+0x66/0x140
[ 4570.714083] __do_softirq+0x123/0x2f4
[ 4570.714521] irq_exit_rcu+0xc4/0xf0
[ 4570.714934] common_interrupt+0xba/0xe0
Though smc_cdc_tx_handler() checked the existence of smc connection,
smc_release() may have already dismissed and released the smc socket
before smc_cdc_tx_handler() further visits it.
smc_cdc_tx_handler() |smc_release()
if (!conn) |
|
|smc_cdc_tx_dismiss_slots()
| smc_cdc_tx_dismisser()
|
|sock_put(&smc->sk) <- last sock_put,
| smc_sock freed
bh_lock_sock(&smc->sk) (panic) |
To make sure we won't receive any CDC messages after we free the
smc_sock, add a refcount on the smc_connection for inflight CDC
message(posted to the QP but haven't received related CQE), and
don't release the smc_connection until all the inflight CDC messages
haven been done, for both success or failed ones.
Using refcount on CDC messages brings another problem: when the link
is going to be destroyed, smcr_link_clear() will reset the QP, which
then remove all the pending CQEs related to the QP in the CQ. To make
sure all the CQEs will always come back so the refcount on the
smc_connection can always reach 0, smc_ib_modify_qp_reset() was replaced
by smc_ib_modify_qp_error().
And remove the timeout in smc_wr_tx_wait_no_pending_sends() since we
need to wait for all pending WQEs done, or we may encounter use-after-
free when handling CQEs.
For IB device removal routine, we need to wait for all the QPs on that
device been destroyed before we can destroy CQs on the device, or
the refcount on smc_connection won't reach 0 and smc_sock cannot be
released.
Fixes: 5f08318f617b ("smc: connection data control (CDC)")
Reported-by: Wen Gu <guwen@linux.alibaba.com>
Signed-off-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-12-28 09:03:25 +00:00
atomic_inc ( & conn - > cdc_pend_tx_wr ) ;
smp_mb__after_atomic ( ) ; /* Make sure cdc_pend_tx_wr added before post */
2017-01-09 15:55:22 +00:00
rc = smc_wr_tx_send ( link , ( struct smc_wr_tx_pend_priv * ) pend ) ;
2019-02-12 15:29:50 +00:00
if ( ! rc ) {
2019-02-04 12:44:45 +00:00
smc_curs_copy ( & conn - > rx_curs_confirmed , & cfed , conn ) ;
2019-02-12 15:29:50 +00:00
conn - > local_rx_ctrl . prod_flags . cons_curs_upd_req = 0 ;
2020-05-04 12:18:37 +00:00
} else {
conn - > tx_cdc_seq - - ;
conn - > local_tx_ctrl . seqno = conn - > tx_cdc_seq ;
net/smc: fix kernel panic caused by race of smc_sock
A crash occurs when smc_cdc_tx_handler() tries to access smc_sock
but smc_release() has already freed it.
[ 4570.695099] BUG: unable to handle page fault for address: 000000002eae9e88
[ 4570.696048] #PF: supervisor write access in kernel mode
[ 4570.696728] #PF: error_code(0x0002) - not-present page
[ 4570.697401] PGD 0 P4D 0
[ 4570.697716] Oops: 0002 [#1] PREEMPT SMP NOPTI
[ 4570.698228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-rc4+ #111
[ 4570.699013] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8c24b4c 04/0
[ 4570.699933] RIP: 0010:_raw_spin_lock+0x1a/0x30
<...>
[ 4570.711446] Call Trace:
[ 4570.711746] <IRQ>
[ 4570.711992] smc_cdc_tx_handler+0x41/0xc0
[ 4570.712470] smc_wr_tx_tasklet_fn+0x213/0x560
[ 4570.712981] ? smc_cdc_tx_dismisser+0x10/0x10
[ 4570.713489] tasklet_action_common.isra.17+0x66/0x140
[ 4570.714083] __do_softirq+0x123/0x2f4
[ 4570.714521] irq_exit_rcu+0xc4/0xf0
[ 4570.714934] common_interrupt+0xba/0xe0
Though smc_cdc_tx_handler() checked the existence of smc connection,
smc_release() may have already dismissed and released the smc socket
before smc_cdc_tx_handler() further visits it.
smc_cdc_tx_handler() |smc_release()
if (!conn) |
|
|smc_cdc_tx_dismiss_slots()
| smc_cdc_tx_dismisser()
|
|sock_put(&smc->sk) <- last sock_put,
| smc_sock freed
bh_lock_sock(&smc->sk) (panic) |
To make sure we won't receive any CDC messages after we free the
smc_sock, add a refcount on the smc_connection for inflight CDC
message(posted to the QP but haven't received related CQE), and
don't release the smc_connection until all the inflight CDC messages
haven been done, for both success or failed ones.
Using refcount on CDC messages brings another problem: when the link
is going to be destroyed, smcr_link_clear() will reset the QP, which
then remove all the pending CQEs related to the QP in the CQ. To make
sure all the CQEs will always come back so the refcount on the
smc_connection can always reach 0, smc_ib_modify_qp_reset() was replaced
by smc_ib_modify_qp_error().
And remove the timeout in smc_wr_tx_wait_no_pending_sends() since we
need to wait for all pending WQEs done, or we may encounter use-after-
free when handling CQEs.
For IB device removal routine, we need to wait for all the QPs on that
device been destroyed before we can destroy CQs on the device, or
the refcount on smc_connection won't reach 0 and smc_sock cannot be
released.
Fixes: 5f08318f617b ("smc: connection data control (CDC)")
Reported-by: Wen Gu <guwen@linux.alibaba.com>
Signed-off-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-12-28 09:03:25 +00:00
atomic_dec ( & conn - > cdc_pend_tx_wr ) ;
2019-02-12 15:29:50 +00:00
}
2017-01-09 15:55:22 +00:00
return rc ;
}
2020-05-04 12:18:39 +00:00
/* send a validation msg indicating the move of a conn to an other QP link */
2020-05-30 14:42:37 +00:00
int smcr_cdc_msg_send_validation ( struct smc_connection * conn ,
struct smc_cdc_tx_pend * pend ,
struct smc_wr_buf * wr_buf )
2020-05-04 12:18:39 +00:00
{
struct smc_host_cdc_msg * local = & conn - > local_tx_ctrl ;
struct smc_link * link = conn - > lnk ;
struct smc_cdc_msg * peer ;
int rc ;
peer = ( struct smc_cdc_msg * ) wr_buf ;
peer - > common . type = local - > common . type ;
peer - > len = local - > len ;
peer - > seqno = htons ( conn - > tx_cdc_seq_fin ) ; /* seqno last compl. tx */
peer - > token = htonl ( local - > token ) ;
peer - > prod_flags . failover_validation = 1 ;
net/smc: fix kernel panic caused by race of smc_sock
A crash occurs when smc_cdc_tx_handler() tries to access smc_sock
but smc_release() has already freed it.
[ 4570.695099] BUG: unable to handle page fault for address: 000000002eae9e88
[ 4570.696048] #PF: supervisor write access in kernel mode
[ 4570.696728] #PF: error_code(0x0002) - not-present page
[ 4570.697401] PGD 0 P4D 0
[ 4570.697716] Oops: 0002 [#1] PREEMPT SMP NOPTI
[ 4570.698228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-rc4+ #111
[ 4570.699013] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8c24b4c 04/0
[ 4570.699933] RIP: 0010:_raw_spin_lock+0x1a/0x30
<...>
[ 4570.711446] Call Trace:
[ 4570.711746] <IRQ>
[ 4570.711992] smc_cdc_tx_handler+0x41/0xc0
[ 4570.712470] smc_wr_tx_tasklet_fn+0x213/0x560
[ 4570.712981] ? smc_cdc_tx_dismisser+0x10/0x10
[ 4570.713489] tasklet_action_common.isra.17+0x66/0x140
[ 4570.714083] __do_softirq+0x123/0x2f4
[ 4570.714521] irq_exit_rcu+0xc4/0xf0
[ 4570.714934] common_interrupt+0xba/0xe0
Though smc_cdc_tx_handler() checked the existence of smc connection,
smc_release() may have already dismissed and released the smc socket
before smc_cdc_tx_handler() further visits it.
smc_cdc_tx_handler() |smc_release()
if (!conn) |
|
|smc_cdc_tx_dismiss_slots()
| smc_cdc_tx_dismisser()
|
|sock_put(&smc->sk) <- last sock_put,
| smc_sock freed
bh_lock_sock(&smc->sk) (panic) |
To make sure we won't receive any CDC messages after we free the
smc_sock, add a refcount on the smc_connection for inflight CDC
message(posted to the QP but haven't received related CQE), and
don't release the smc_connection until all the inflight CDC messages
haven been done, for both success or failed ones.
Using refcount on CDC messages brings another problem: when the link
is going to be destroyed, smcr_link_clear() will reset the QP, which
then remove all the pending CQEs related to the QP in the CQ. To make
sure all the CQEs will always come back so the refcount on the
smc_connection can always reach 0, smc_ib_modify_qp_reset() was replaced
by smc_ib_modify_qp_error().
And remove the timeout in smc_wr_tx_wait_no_pending_sends() since we
need to wait for all pending WQEs done, or we may encounter use-after-
free when handling CQEs.
For IB device removal routine, we need to wait for all the QPs on that
device been destroyed before we can destroy CQs on the device, or
the refcount on smc_connection won't reach 0 and smc_sock cannot be
released.
Fixes: 5f08318f617b ("smc: connection data control (CDC)")
Reported-by: Wen Gu <guwen@linux.alibaba.com>
Signed-off-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-12-28 09:03:25 +00:00
/* We need to set pend->conn here to make sure smc_cdc_tx_handler()
* can handle properly
*/
smc_cdc_add_pending_send ( conn , pend ) ;
atomic_inc ( & conn - > cdc_pend_tx_wr ) ;
smp_mb__after_atomic ( ) ; /* Make sure cdc_pend_tx_wr added before post */
2020-05-04 12:18:39 +00:00
rc = smc_wr_tx_send ( link , ( struct smc_wr_tx_pend_priv * ) pend ) ;
net/smc: fix kernel panic caused by race of smc_sock
A crash occurs when smc_cdc_tx_handler() tries to access smc_sock
but smc_release() has already freed it.
[ 4570.695099] BUG: unable to handle page fault for address: 000000002eae9e88
[ 4570.696048] #PF: supervisor write access in kernel mode
[ 4570.696728] #PF: error_code(0x0002) - not-present page
[ 4570.697401] PGD 0 P4D 0
[ 4570.697716] Oops: 0002 [#1] PREEMPT SMP NOPTI
[ 4570.698228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-rc4+ #111
[ 4570.699013] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8c24b4c 04/0
[ 4570.699933] RIP: 0010:_raw_spin_lock+0x1a/0x30
<...>
[ 4570.711446] Call Trace:
[ 4570.711746] <IRQ>
[ 4570.711992] smc_cdc_tx_handler+0x41/0xc0
[ 4570.712470] smc_wr_tx_tasklet_fn+0x213/0x560
[ 4570.712981] ? smc_cdc_tx_dismisser+0x10/0x10
[ 4570.713489] tasklet_action_common.isra.17+0x66/0x140
[ 4570.714083] __do_softirq+0x123/0x2f4
[ 4570.714521] irq_exit_rcu+0xc4/0xf0
[ 4570.714934] common_interrupt+0xba/0xe0
Though smc_cdc_tx_handler() checked the existence of smc connection,
smc_release() may have already dismissed and released the smc socket
before smc_cdc_tx_handler() further visits it.
smc_cdc_tx_handler() |smc_release()
if (!conn) |
|
|smc_cdc_tx_dismiss_slots()
| smc_cdc_tx_dismisser()
|
|sock_put(&smc->sk) <- last sock_put,
| smc_sock freed
bh_lock_sock(&smc->sk) (panic) |
To make sure we won't receive any CDC messages after we free the
smc_sock, add a refcount on the smc_connection for inflight CDC
message(posted to the QP but haven't received related CQE), and
don't release the smc_connection until all the inflight CDC messages
haven been done, for both success or failed ones.
Using refcount on CDC messages brings another problem: when the link
is going to be destroyed, smcr_link_clear() will reset the QP, which
then remove all the pending CQEs related to the QP in the CQ. To make
sure all the CQEs will always come back so the refcount on the
smc_connection can always reach 0, smc_ib_modify_qp_reset() was replaced
by smc_ib_modify_qp_error().
And remove the timeout in smc_wr_tx_wait_no_pending_sends() since we
need to wait for all pending WQEs done, or we may encounter use-after-
free when handling CQEs.
For IB device removal routine, we need to wait for all the QPs on that
device been destroyed before we can destroy CQs on the device, or
the refcount on smc_connection won't reach 0 and smc_sock cannot be
released.
Fixes: 5f08318f617b ("smc: connection data control (CDC)")
Reported-by: Wen Gu <guwen@linux.alibaba.com>
Signed-off-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-12-28 09:03:25 +00:00
if ( unlikely ( rc ) )
atomic_dec ( & conn - > cdc_pend_tx_wr ) ;
2020-05-04 12:18:39 +00:00
return rc ;
}
2018-06-28 17:05:10 +00:00
static int smcr_cdc_get_slot_and_msg_send ( struct smc_connection * conn )
2017-01-09 15:55:22 +00:00
{
struct smc_cdc_tx_pend * pend ;
struct smc_wr_buf * wr_buf ;
2020-05-04 12:18:38 +00:00
struct smc_link * link ;
bool again = false ;
2017-01-09 15:55:22 +00:00
int rc ;
2020-05-04 12:18:38 +00:00
again :
link = conn - > lnk ;
2021-10-07 14:14:40 +00:00
if ( ! smc_wr_tx_link_hold ( link ) )
return - ENOLINK ;
2020-05-04 12:18:38 +00:00
rc = smc_cdc_get_free_slot ( conn , link , & wr_buf , NULL , & pend ) ;
2017-01-09 15:55:22 +00:00
if ( rc )
2021-10-07 14:14:40 +00:00
goto put_out ;
2017-01-09 15:55:22 +00:00
2019-01-30 17:51:06 +00:00
spin_lock_bh ( & conn - > send_lock ) ;
2020-05-04 12:18:38 +00:00
if ( link ! = conn - > lnk ) {
/* link of connection changed, try again one time*/
spin_unlock_bh ( & conn - > send_lock ) ;
smc_wr_tx_put_slot ( link ,
( struct smc_wr_tx_pend_priv * ) pend ) ;
2021-10-07 14:14:40 +00:00
smc_wr_tx_link_put ( link ) ;
2020-05-04 12:18:38 +00:00
if ( again )
return - ENOLINK ;
again = true ;
goto again ;
}
2019-01-30 17:51:06 +00:00
rc = smc_cdc_msg_send ( conn , wr_buf , pend ) ;
spin_unlock_bh ( & conn - > send_lock ) ;
2021-10-07 14:14:40 +00:00
put_out :
smc_wr_tx_link_put ( link ) ;
2019-01-30 17:51:06 +00:00
return rc ;
2017-01-09 15:55:22 +00:00
}
2018-06-28 17:05:10 +00:00
int smc_cdc_get_slot_and_msg_send ( struct smc_connection * conn )
{
int rc ;
2022-01-13 08:36:41 +00:00
if ( ! smc_conn_lgr_valid ( conn ) | |
( conn - > lgr - > is_smcd & & conn - > lgr - > peer_shutdown ) )
2019-11-14 12:02:40 +00:00
return - EPIPE ;
2018-06-28 17:05:10 +00:00
if ( conn - > lgr - > is_smcd ) {
spin_lock_bh ( & conn - > send_lock ) ;
rc = smcd_cdc_msg_send ( conn ) ;
spin_unlock_bh ( & conn - > send_lock ) ;
} else {
rc = smcr_cdc_get_slot_and_msg_send ( conn ) ;
}
return rc ;
}
net/smc: fix kernel panic caused by race of smc_sock
A crash occurs when smc_cdc_tx_handler() tries to access smc_sock
but smc_release() has already freed it.
[ 4570.695099] BUG: unable to handle page fault for address: 000000002eae9e88
[ 4570.696048] #PF: supervisor write access in kernel mode
[ 4570.696728] #PF: error_code(0x0002) - not-present page
[ 4570.697401] PGD 0 P4D 0
[ 4570.697716] Oops: 0002 [#1] PREEMPT SMP NOPTI
[ 4570.698228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-rc4+ #111
[ 4570.699013] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8c24b4c 04/0
[ 4570.699933] RIP: 0010:_raw_spin_lock+0x1a/0x30
<...>
[ 4570.711446] Call Trace:
[ 4570.711746] <IRQ>
[ 4570.711992] smc_cdc_tx_handler+0x41/0xc0
[ 4570.712470] smc_wr_tx_tasklet_fn+0x213/0x560
[ 4570.712981] ? smc_cdc_tx_dismisser+0x10/0x10
[ 4570.713489] tasklet_action_common.isra.17+0x66/0x140
[ 4570.714083] __do_softirq+0x123/0x2f4
[ 4570.714521] irq_exit_rcu+0xc4/0xf0
[ 4570.714934] common_interrupt+0xba/0xe0
Though smc_cdc_tx_handler() checked the existence of smc connection,
smc_release() may have already dismissed and released the smc socket
before smc_cdc_tx_handler() further visits it.
smc_cdc_tx_handler() |smc_release()
if (!conn) |
|
|smc_cdc_tx_dismiss_slots()
| smc_cdc_tx_dismisser()
|
|sock_put(&smc->sk) <- last sock_put,
| smc_sock freed
bh_lock_sock(&smc->sk) (panic) |
To make sure we won't receive any CDC messages after we free the
smc_sock, add a refcount on the smc_connection for inflight CDC
message(posted to the QP but haven't received related CQE), and
don't release the smc_connection until all the inflight CDC messages
haven been done, for both success or failed ones.
Using refcount on CDC messages brings another problem: when the link
is going to be destroyed, smcr_link_clear() will reset the QP, which
then remove all the pending CQEs related to the QP in the CQ. To make
sure all the CQEs will always come back so the refcount on the
smc_connection can always reach 0, smc_ib_modify_qp_reset() was replaced
by smc_ib_modify_qp_error().
And remove the timeout in smc_wr_tx_wait_no_pending_sends() since we
need to wait for all pending WQEs done, or we may encounter use-after-
free when handling CQEs.
For IB device removal routine, we need to wait for all the QPs on that
device been destroyed before we can destroy CQs on the device, or
the refcount on smc_connection won't reach 0 and smc_sock cannot be
released.
Fixes: 5f08318f617b ("smc: connection data control (CDC)")
Reported-by: Wen Gu <guwen@linux.alibaba.com>
Signed-off-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-12-28 09:03:25 +00:00
void smc_cdc_wait_pend_tx_wr ( struct smc_connection * conn )
2017-01-09 15:55:22 +00:00
{
net/smc: fix kernel panic caused by race of smc_sock
A crash occurs when smc_cdc_tx_handler() tries to access smc_sock
but smc_release() has already freed it.
[ 4570.695099] BUG: unable to handle page fault for address: 000000002eae9e88
[ 4570.696048] #PF: supervisor write access in kernel mode
[ 4570.696728] #PF: error_code(0x0002) - not-present page
[ 4570.697401] PGD 0 P4D 0
[ 4570.697716] Oops: 0002 [#1] PREEMPT SMP NOPTI
[ 4570.698228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-rc4+ #111
[ 4570.699013] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8c24b4c 04/0
[ 4570.699933] RIP: 0010:_raw_spin_lock+0x1a/0x30
<...>
[ 4570.711446] Call Trace:
[ 4570.711746] <IRQ>
[ 4570.711992] smc_cdc_tx_handler+0x41/0xc0
[ 4570.712470] smc_wr_tx_tasklet_fn+0x213/0x560
[ 4570.712981] ? smc_cdc_tx_dismisser+0x10/0x10
[ 4570.713489] tasklet_action_common.isra.17+0x66/0x140
[ 4570.714083] __do_softirq+0x123/0x2f4
[ 4570.714521] irq_exit_rcu+0xc4/0xf0
[ 4570.714934] common_interrupt+0xba/0xe0
Though smc_cdc_tx_handler() checked the existence of smc connection,
smc_release() may have already dismissed and released the smc socket
before smc_cdc_tx_handler() further visits it.
smc_cdc_tx_handler() |smc_release()
if (!conn) |
|
|smc_cdc_tx_dismiss_slots()
| smc_cdc_tx_dismisser()
|
|sock_put(&smc->sk) <- last sock_put,
| smc_sock freed
bh_lock_sock(&smc->sk) (panic) |
To make sure we won't receive any CDC messages after we free the
smc_sock, add a refcount on the smc_connection for inflight CDC
message(posted to the QP but haven't received related CQE), and
don't release the smc_connection until all the inflight CDC messages
haven been done, for both success or failed ones.
Using refcount on CDC messages brings another problem: when the link
is going to be destroyed, smcr_link_clear() will reset the QP, which
then remove all the pending CQEs related to the QP in the CQ. To make
sure all the CQEs will always come back so the refcount on the
smc_connection can always reach 0, smc_ib_modify_qp_reset() was replaced
by smc_ib_modify_qp_error().
And remove the timeout in smc_wr_tx_wait_no_pending_sends() since we
need to wait for all pending WQEs done, or we may encounter use-after-
free when handling CQEs.
For IB device removal routine, we need to wait for all the QPs on that
device been destroyed before we can destroy CQs on the device, or
the refcount on smc_connection won't reach 0 and smc_sock cannot be
released.
Fixes: 5f08318f617b ("smc: connection data control (CDC)")
Reported-by: Wen Gu <guwen@linux.alibaba.com>
Signed-off-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-12-28 09:03:25 +00:00
wait_event ( conn - > cdc_pend_tx_wq , ! atomic_read ( & conn - > cdc_pend_tx_wr ) ) ;
2017-01-09 15:55:22 +00:00
}
2018-06-28 17:05:10 +00:00
/* Send a SMC-D CDC header.
* This increments the free space available in our send buffer .
* Also update the confirmed receive buffer with what was sent to the peer .
*/
int smcd_cdc_msg_send ( struct smc_connection * conn )
{
struct smc_sock * smc = container_of ( conn , struct smc_sock , conn ) ;
2018-11-20 15:46:42 +00:00
union smc_host_cursor curs ;
2018-06-28 17:05:10 +00:00
struct smcd_cdc_msg cdc ;
int rc , diff ;
memset ( & cdc , 0 , sizeof ( cdc ) ) ;
cdc . common . type = SMC_CDC_MSG_TYPE ;
2018-11-20 15:46:42 +00:00
curs . acurs . counter = atomic64_read ( & conn - > local_tx_ctrl . prod . acurs ) ;
cdc . prod . wrap = curs . wrap ;
cdc . prod . count = curs . count ;
curs . acurs . counter = atomic64_read ( & conn - > local_tx_ctrl . cons . acurs ) ;
cdc . cons . wrap = curs . wrap ;
cdc . cons . count = curs . count ;
cdc . cons . prod_flags = conn - > local_tx_ctrl . prod_flags ;
cdc . cons . conn_state_flags = conn - > local_tx_ctrl . conn_state_flags ;
2018-06-28 17:05:10 +00:00
rc = smcd_tx_ism_write ( conn , & cdc , sizeof ( cdc ) , 0 , 1 ) ;
if ( rc )
return rc ;
2018-11-20 15:46:42 +00:00
smc_curs_copy ( & conn - > rx_curs_confirmed , & curs , conn ) ;
2019-02-12 15:29:50 +00:00
conn - > local_rx_ctrl . prod_flags . cons_curs_upd_req = 0 ;
2018-06-28 17:05:10 +00:00
/* Calculate transmitted data and increment free send buffer space */
diff = smc_curs_diff ( conn - > sndbuf_desc - > len , & conn - > tx_curs_fin ,
& conn - > tx_curs_sent ) ;
/* increased by confirmed number of bytes */
smp_mb__before_atomic ( ) ;
atomic_add ( diff , & conn - > sndbuf_space ) ;
/* guarantee 0 <= sndbuf_space <= sndbuf_desc->len */
smp_mb__after_atomic ( ) ;
2018-07-23 11:53:09 +00:00
smc_curs_copy ( & conn - > tx_curs_fin , & conn - > tx_curs_sent , conn ) ;
2018-06-28 17:05:10 +00:00
smc_tx_sndbuf_nonfull ( smc ) ;
return rc ;
}
2017-01-09 15:55:22 +00:00
/********************************* receive ***********************************/
static inline bool smc_cdc_before ( u16 seq1 , u16 seq2 )
{
return ( s16 ) ( seq1 - seq2 ) < 0 ;
}
2018-05-23 14:38:11 +00:00
static void smc_cdc_handle_urg_data_arrival ( struct smc_sock * smc ,
int * diff_prod )
{
struct smc_connection * conn = & smc - > conn ;
char * base ;
/* new data included urgent business */
2018-07-23 11:53:09 +00:00
smc_curs_copy ( & conn - > urg_curs , & conn - > local_rx_ctrl . prod , conn ) ;
2018-05-23 14:38:11 +00:00
conn - > urg_state = SMC_URG_VALID ;
if ( ! sock_flag ( & smc - > sk , SOCK_URGINLINE ) )
/* we'll skip the urgent byte, so don't account for it */
( * diff_prod ) - - ;
2018-06-28 17:05:10 +00:00
base = ( char * ) conn - > rmb_desc - > cpu_addr + conn - > rx_off ;
2018-05-23 14:38:11 +00:00
if ( conn - > urg_curs . count )
conn - > urg_rx_byte = * ( base + conn - > urg_curs . count - 1 ) ;
else
conn - > urg_rx_byte = * ( base + conn - > rmb_desc - > len - 1 ) ;
sk_send_sigurg ( & smc - > sk ) ;
}
2020-05-04 12:18:40 +00:00
static void smc_cdc_msg_validate ( struct smc_sock * smc , struct smc_cdc_msg * cdc ,
struct smc_link * link )
{
struct smc_connection * conn = & smc - > conn ;
u16 recv_seq = ntohs ( cdc - > seqno ) ;
s16 diff ;
/* check that seqnum was seen before */
diff = conn - > local_rx_ctrl . seqno - recv_seq ;
if ( diff < 0 ) { /* diff larger than 0x7fff */
/* drop connection */
conn - > out_of_sync = 1 ; /* prevent any further receives */
spin_lock_bh ( & conn - > send_lock ) ;
conn - > local_tx_ctrl . conn_state_flags . peer_conn_abort = 1 ;
conn - > lnk = link ;
spin_unlock_bh ( & conn - > send_lock ) ;
sock_hold ( & smc - > sk ) ; /* sock_put in abort_work */
2020-09-10 16:48:29 +00:00
if ( ! queue_work ( smc_close_wq , & conn - > abort_work ) )
2020-05-04 12:18:40 +00:00
sock_put ( & smc - > sk ) ;
}
}
2017-01-09 15:55:22 +00:00
static void smc_cdc_msg_recv_action ( struct smc_sock * smc ,
struct smc_cdc_msg * cdc )
{
union smc_host_cursor cons_old , prod_old ;
struct smc_connection * conn = & smc - > conn ;
int diff_cons , diff_prod ;
2018-07-23 11:53:09 +00:00
smc_curs_copy ( & prod_old , & conn - > local_rx_ctrl . prod , conn ) ;
smc_curs_copy ( & cons_old , & conn - > local_rx_ctrl . cons , conn ) ;
2017-01-09 15:55:22 +00:00
smc_cdc_msg_to_host ( & conn - > local_rx_ctrl , cdc , conn ) ;
diff_cons = smc_curs_diff ( conn - > peer_rmbe_size , & cons_old ,
& conn - > local_rx_ctrl . cons ) ;
if ( diff_cons ) {
/* peer_rmbe_space is decreased during data transfer with RDMA
* write
*/
smp_mb__before_atomic ( ) ;
atomic_add ( diff_cons , & conn - > peer_rmbe_space ) ;
/* guarantee 0 <= peer_rmbe_space <= peer_rmbe_size */
smp_mb__after_atomic ( ) ;
}
2018-05-18 07:34:10 +00:00
diff_prod = smc_curs_diff ( conn - > rmb_desc - > len , & prod_old ,
2017-01-09 15:55:22 +00:00
& conn - > local_rx_ctrl . prod ) ;
if ( diff_prod ) {
2018-05-23 14:38:11 +00:00
if ( conn - > local_rx_ctrl . prod_flags . urg_data_present )
smc_cdc_handle_urg_data_arrival ( smc , & diff_prod ) ;
2017-01-09 15:55:22 +00:00
/* bytes_to_rcv is decreased in smc_recvmsg */
smp_mb__before_atomic ( ) ;
atomic_add ( diff_prod , & conn - > bytes_to_rcv ) ;
2018-05-18 07:34:10 +00:00
/* guarantee 0 <= bytes_to_rcv <= rmb_desc->len */
2017-01-09 15:55:22 +00:00
smp_mb__after_atomic ( ) ;
2017-01-09 15:55:24 +00:00
smc - > sk . sk_data_ready ( & smc - > sk ) ;
2018-05-23 14:38:11 +00:00
} else {
2019-02-12 15:29:53 +00:00
if ( conn - > local_rx_ctrl . prod_flags . write_blocked )
smc - > sk . sk_data_ready ( & smc - > sk ) ;
if ( conn - > local_rx_ctrl . prod_flags . urg_data_pending )
conn - > urg_state = SMC_URG_NOTYET ;
2017-01-09 15:55:22 +00:00
}
2018-01-26 08:28:48 +00:00
/* trigger sndbuf consumer: RDMA write into peer RMBE and CDC */
2019-02-12 15:29:53 +00:00
if ( ( diff_cons & & smc_tx_prepared_sends ( conn ) ) | |
conn - > local_rx_ctrl . prod_flags . cons_curs_upd_req | |
2022-03-01 09:44:02 +00:00
conn - > local_rx_ctrl . prod_flags . urg_data_pending ) {
if ( ! sock_owned_by_user ( & smc - > sk ) )
smc_tx_pending ( conn ) ;
else
conn - > tx_in_release_sock = true ;
}
2019-02-12 15:29:53 +00:00
2018-05-23 14:38:11 +00:00
if ( diff_cons & & conn - > urg_tx_pend & &
atomic_read ( & conn - > peer_rmbe_space ) = = conn - > peer_rmbe_size ) {
/* urg data confirmed by peer, indicate we're ready for more */
conn - > urg_tx_pend = false ;
smc - > sk . sk_write_space ( & smc - > sk ) ;
}
2018-01-26 08:28:48 +00:00
2017-01-09 15:55:25 +00:00
if ( conn - > local_rx_ctrl . conn_state_flags . peer_conn_abort ) {
2017-01-09 15:55:22 +00:00
smc - > sk . sk_err = ECONNRESET ;
2017-01-09 15:55:25 +00:00
conn - > local_tx_ctrl . conn_state_flags . peer_conn_abort = 1 ;
}
2017-04-10 12:58:01 +00:00
if ( smc_cdc_rxed_any_close_or_senddone ( conn ) ) {
smc - > sk . sk_shutdown | = RCV_SHUTDOWN ;
if ( smc - > clcsock & & smc - > clcsock - > sk )
smc - > clcsock - > sk - > sk_shutdown | = RCV_SHUTDOWN ;
sock_set_flag ( & smc - > sk , SOCK_DONE ) ;
2018-01-26 08:28:48 +00:00
sock_hold ( & smc - > sk ) ; /* sock_put in close_work */
2020-09-10 16:48:29 +00:00
if ( ! queue_work ( smc_close_wq , & conn - > close_work ) )
2018-01-26 08:28:48 +00:00
sock_put ( & smc - > sk ) ;
2017-01-09 15:55:25 +00:00
}
2017-01-09 15:55:22 +00:00
}
/* called under tasklet context */
2018-05-18 07:34:15 +00:00
static void smc_cdc_msg_recv ( struct smc_sock * smc , struct smc_cdc_msg * cdc )
2017-01-09 15:55:22 +00:00
{
sock_hold ( & smc - > sk ) ;
bh_lock_sock ( & smc - > sk ) ;
2018-05-18 07:34:15 +00:00
smc_cdc_msg_recv_action ( smc , cdc ) ;
2017-01-09 15:55:22 +00:00
bh_unlock_sock ( & smc - > sk ) ;
sock_put ( & smc - > sk ) ; /* no free sk in softirq-context */
}
2018-06-28 17:05:10 +00:00
/* Schedule a tasklet for this connection. Triggered from the ISM device IRQ
* handler to indicate update in the DMBE .
*
* Context :
* - tasklet context
*/
2020-11-03 09:18:22 +00:00
static void smcd_cdc_rx_tsklet ( struct tasklet_struct * t )
2018-06-28 17:05:10 +00:00
{
2020-11-03 09:18:22 +00:00
struct smc_connection * conn = from_tasklet ( conn , t , rx_tsklet ) ;
2018-11-20 15:46:42 +00:00
struct smcd_cdc_msg * data_cdc ;
2018-06-28 17:05:10 +00:00
struct smcd_cdc_msg cdc ;
struct smc_sock * smc ;
2019-10-21 14:13:08 +00:00
if ( ! conn | | conn - > killed )
2018-06-28 17:05:10 +00:00
return ;
2018-11-20 15:46:42 +00:00
data_cdc = ( struct smcd_cdc_msg * ) conn - > rmb_desc - > cpu_addr ;
smcd_curs_copy ( & cdc . prod , & data_cdc - > prod , conn ) ;
smcd_curs_copy ( & cdc . cons , & data_cdc - > cons , conn ) ;
2018-06-28 17:05:10 +00:00
smc = container_of ( conn , struct smc_sock , conn ) ;
smc_cdc_msg_recv ( smc , ( struct smc_cdc_msg * ) & cdc ) ;
}
/* Initialize receive tasklet. Called from ISM device IRQ handler to start
* receiver side .
*/
void smcd_cdc_rx_init ( struct smc_connection * conn )
{
2020-11-03 09:18:22 +00:00
tasklet_setup ( & conn - > rx_tsklet , smcd_cdc_rx_tsklet ) ;
2018-06-28 17:05:10 +00:00
}
2017-01-09 15:55:22 +00:00
/***************************** init, exit, misc ******************************/
static void smc_cdc_rx_handler ( struct ib_wc * wc , void * buf )
{
struct smc_link * link = ( struct smc_link * ) wc - > qp - > qp_context ;
struct smc_cdc_msg * cdc = buf ;
2018-05-18 07:34:15 +00:00
struct smc_connection * conn ;
struct smc_link_group * lgr ;
struct smc_sock * smc ;
2017-01-09 15:55:22 +00:00
if ( wc - > byte_len < offsetof ( struct smc_cdc_msg , reserved ) )
return ; /* short message */
2018-02-28 11:44:07 +00:00
if ( cdc - > len ! = SMC_WR_TX_SIZE )
2017-01-09 15:55:22 +00:00
return ; /* invalid message */
2018-05-18 07:34:15 +00:00
/* lookup connection */
2018-07-23 11:53:10 +00:00
lgr = smc_get_lgr ( link ) ;
2018-05-18 07:34:15 +00:00
read_lock_bh ( & lgr - > conns_lock ) ;
conn = smc_lgr_find_conn ( ntohl ( cdc - > token ) , lgr ) ;
read_unlock_bh ( & lgr - > conns_lock ) ;
2020-05-04 12:18:40 +00:00
if ( ! conn | | conn - > out_of_sync )
2018-05-18 07:34:15 +00:00
return ;
smc = container_of ( conn , struct smc_sock , conn ) ;
2020-05-04 12:18:40 +00:00
if ( cdc - > prod_flags . failover_validation ) {
smc_cdc_msg_validate ( smc , cdc , link ) ;
return ;
2018-05-18 07:34:15 +00:00
}
2020-05-04 12:18:40 +00:00
if ( smc_cdc_before ( ntohs ( cdc - > seqno ) ,
conn - > local_rx_ctrl . seqno ) )
/* received seqno is old */
return ;
2018-05-18 07:34:15 +00:00
smc_cdc_msg_recv ( smc , cdc ) ;
2017-01-09 15:55:22 +00:00
}
static struct smc_wr_rx_handler smc_cdc_rx_handlers [ ] = {
{
. handler = smc_cdc_rx_handler ,
. type = SMC_CDC_MSG_TYPE
} ,
{
. handler = NULL ,
}
} ;
int __init smc_cdc_init ( void )
{
struct smc_wr_rx_handler * handler ;
int rc = 0 ;
for ( handler = smc_cdc_rx_handlers ; handler - > handler ; handler + + ) {
INIT_HLIST_NODE ( & handler - > list ) ;
rc = smc_wr_rx_register_handler ( handler ) ;
if ( rc )
break ;
}
return rc ;
}