forked from Minki/linux
f2334964e9
Occasionally ib_write_bw crash is seen due to access of a pd object in
i40iw_sc_qp_destroy after it is freed. Destroy qp is not synchronous in
i40iw and thus the iwqp object could be referencing a pd object that is
freed by ib core as a result of successful return from i40iw_destroy_qp.
Wait in i40iw_destroy_qp till all QP references are released and destroy
the QP and its associated resources before returning. Switch to use the
refcount API vs atomic API for lifetime management of the qp.
RIP: 0010:i40iw_sc_qp_destroy+0x4b/0x120 [i40iw]
[...]
RSP: 0018:ffffb4a7042e3ba8 EFLAGS: 00010002
RAX: 0000000000000000 RBX: 0000000000000001 RCX: dead000000000122
RDX: ffffb4a7042e3bac RSI: ffff8b7ef9b1e940 RDI: ffff8b7efbf09080
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 8080808080808080 R11: 0000000000000010 R12: ffff8b7efbf08050
R13: 0000000000000001 R14: ffff8b7f15042928 R15: ffff8b7ef9b1e940
FS: 0000000000000000(0000) GS:ffff8b7f2fa00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000400 CR3: 000000020d60a006 CR4: 00000000001606e0
Call Trace:
i40iw_exec_cqp_cmd+0x4d3/0x5c0 [i40iw]
? try_to_wake_up+0x1ea/0x5d0
? __switch_to_asm+0x40/0x70
i40iw_process_cqp_cmd+0x95/0xa0 [i40iw]
i40iw_handle_cqp_op+0x42/0x1a0 [i40iw]
? cm_event_handler+0x13c/0x1f0 [iw_cm]
i40iw_rem_ref+0xa0/0xf0 [i40iw]
cm_work_handler+0x99c/0xd10 [iw_cm]
process_one_work+0x1a1/0x360
worker_thread+0x30/0x380
? process_one_work+0x360/0x360
kthread+0x10c/0x130
? kthread_park+0x80/0x80
ret_from_fork+0x35/0x40
Fixes: d374984179
("i40iw: add files for iwarp interface")
Link: https://lore.kernel.org/r/20200916131811.2077-1-shiraz.saleem@intel.com
Reported-by: Kamal Heib <kheib@redhat.com>
Signed-off-by: Sindhu, Devale <sindhu.devale@intel.com>
Signed-off-by: Shiraz, Saleem <shiraz.saleem@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
180 lines
4.3 KiB
C
180 lines
4.3 KiB
C
/*******************************************************************************
|
|
*
|
|
* Copyright (c) 2015-2016 Intel Corporation. All rights reserved.
|
|
*
|
|
* This software is available to you under a choice of one of two
|
|
* licenses. You may choose to be licensed under the terms of the GNU
|
|
* General Public License (GPL) Version 2, available from the file
|
|
* COPYING in the main directory of this source tree, or the
|
|
* OpenFabrics.org BSD license below:
|
|
*
|
|
* Redistribution and use in source and binary forms, with or
|
|
* without modification, are permitted provided that the following
|
|
* conditions are met:
|
|
*
|
|
* - Redistributions of source code must retain the above
|
|
* copyright notice, this list of conditions and the following
|
|
* disclaimer.
|
|
*
|
|
* - Redistributions in binary form must reproduce the above
|
|
* copyright notice, this list of conditions and the following
|
|
* disclaimer in the documentation and/or other materials
|
|
* provided with the distribution.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
|
|
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
|
|
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
|
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
* SOFTWARE.
|
|
*
|
|
*******************************************************************************/
|
|
|
|
#ifndef I40IW_VERBS_H
|
|
#define I40IW_VERBS_H
|
|
|
|
struct i40iw_ucontext {
|
|
struct ib_ucontext ibucontext;
|
|
struct i40iw_device *iwdev;
|
|
struct list_head cq_reg_mem_list;
|
|
spinlock_t cq_reg_mem_list_lock; /* memory list for cq's */
|
|
struct list_head qp_reg_mem_list;
|
|
spinlock_t qp_reg_mem_list_lock; /* memory list for qp's */
|
|
int abi_ver;
|
|
};
|
|
|
|
struct i40iw_pd {
|
|
struct ib_pd ibpd;
|
|
struct i40iw_sc_pd sc_pd;
|
|
atomic_t usecount;
|
|
};
|
|
|
|
struct i40iw_hmc_pble {
|
|
union {
|
|
u32 idx;
|
|
dma_addr_t addr;
|
|
};
|
|
};
|
|
|
|
struct i40iw_cq_mr {
|
|
struct i40iw_hmc_pble cq_pbl;
|
|
dma_addr_t shadow;
|
|
};
|
|
|
|
struct i40iw_qp_mr {
|
|
struct i40iw_hmc_pble sq_pbl;
|
|
struct i40iw_hmc_pble rq_pbl;
|
|
dma_addr_t shadow;
|
|
struct page *sq_page;
|
|
};
|
|
|
|
struct i40iw_pbl {
|
|
struct list_head list;
|
|
union {
|
|
struct i40iw_qp_mr qp_mr;
|
|
struct i40iw_cq_mr cq_mr;
|
|
};
|
|
|
|
bool pbl_allocated;
|
|
bool on_list;
|
|
u64 user_base;
|
|
struct i40iw_pble_alloc pble_alloc;
|
|
struct i40iw_mr *iwmr;
|
|
};
|
|
|
|
#define MAX_SAVE_PAGE_ADDRS 4
|
|
struct i40iw_mr {
|
|
union {
|
|
struct ib_mr ibmr;
|
|
struct ib_mw ibmw;
|
|
};
|
|
struct ib_umem *region;
|
|
u16 type;
|
|
u32 page_cnt;
|
|
u64 page_size;
|
|
u32 npages;
|
|
u32 stag;
|
|
u64 length;
|
|
u64 pgaddrmem[MAX_SAVE_PAGE_ADDRS];
|
|
struct i40iw_pbl iwpbl;
|
|
};
|
|
|
|
struct i40iw_cq {
|
|
struct ib_cq ibcq;
|
|
struct i40iw_sc_cq sc_cq;
|
|
u16 cq_head;
|
|
u16 cq_size;
|
|
u16 cq_number;
|
|
bool user_mode;
|
|
u32 polled_completions;
|
|
u32 cq_mem_size;
|
|
struct i40iw_dma_mem kmem;
|
|
spinlock_t lock; /* for poll cq */
|
|
struct i40iw_pbl *iwpbl;
|
|
};
|
|
|
|
struct disconn_work {
|
|
struct work_struct work;
|
|
struct i40iw_qp *iwqp;
|
|
};
|
|
|
|
struct iw_cm_id;
|
|
struct ietf_mpa_frame;
|
|
struct i40iw_ud_file;
|
|
|
|
struct i40iw_qp_kmode {
|
|
struct i40iw_dma_mem dma_mem;
|
|
u64 *wrid_mem;
|
|
};
|
|
|
|
struct i40iw_qp {
|
|
struct ib_qp ibqp;
|
|
struct i40iw_sc_qp sc_qp;
|
|
struct i40iw_device *iwdev;
|
|
struct i40iw_cq *iwscq;
|
|
struct i40iw_cq *iwrcq;
|
|
struct i40iw_pd *iwpd;
|
|
struct i40iw_qp_host_ctx_info ctx_info;
|
|
struct i40iwarp_offload_info iwarp_info;
|
|
void *allocated_buffer;
|
|
refcount_t refcount;
|
|
struct iw_cm_id *cm_id;
|
|
void *cm_node;
|
|
struct ib_mr *lsmm_mr;
|
|
struct work_struct work;
|
|
enum ib_qp_state ibqp_state;
|
|
u32 iwarp_state;
|
|
u32 qp_mem_size;
|
|
u32 last_aeq;
|
|
atomic_t close_timer_started;
|
|
spinlock_t lock; /* for post work requests */
|
|
struct i40iw_qp_context *iwqp_context;
|
|
void *pbl_vbase;
|
|
dma_addr_t pbl_pbase;
|
|
struct page *page;
|
|
u8 active_conn:1;
|
|
u8 user_mode:1;
|
|
u8 hte_added:1;
|
|
u8 flush_issued:1;
|
|
u8 destroyed:1;
|
|
u8 sig_all:1;
|
|
u8 pau_mode:1;
|
|
u8 rsvd:1;
|
|
u16 term_sq_flush_code;
|
|
u16 term_rq_flush_code;
|
|
u8 hw_iwarp_state;
|
|
u8 hw_tcp_state;
|
|
struct i40iw_qp_kmode kqp;
|
|
struct i40iw_dma_mem host_ctx;
|
|
struct timer_list terminate_timer;
|
|
struct i40iw_pbl iwpbl;
|
|
struct i40iw_dma_mem q2_ctx_mem;
|
|
struct i40iw_dma_mem ietf_mem;
|
|
struct completion sq_drained;
|
|
struct completion rq_drained;
|
|
struct completion free_qp;
|
|
};
|
|
#endif
|