提交 3c968887 编写于 作者: B Bart Van Assche 提交者: Linus Torvalds

Revert "ib_srpt: Convert to percpu_ida tag allocation"

This reverts commit 0fd10721.

That patch causes the ib_srpt driver to crash as soon as the first SCSI
command is received:

  kernel BUG at drivers/infiniband/ulp/srpt/ib_srpt.c:1439!
  invalid opcode: 0000 [#1] SMP
  Workqueue: target_completion target_complete_ok_work [target_core_mod]
  RIP: srpt_queue_response+0x437/0x4a0 [ib_srpt]
  Call Trace:
    srpt_queue_data_in+0x9/0x10 [ib_srpt]
    target_complete_ok_work+0x152/0x2b0 [target_core_mod]
    process_one_work+0x197/0x480
    worker_thread+0x49/0x490
    kthread+0xea/0x100
    ret_from_fork+0x22/0x40

Aside from the crash, the shortcomings of that patch are as follows:

 - It makes the ib_srpt driver use I/O contexts allocated by
   transport_alloc_session_tags() but it does not initialize these I/O
   contexts properly.  All the initializations performed by
   srpt_alloc_ioctx() are skipped.

 - It swaps the order of the send ioctx allocation and the transition to
   RTR mode which is wrong.

 - The amount of memory that is needed for I/O contexts is doubled.

 - srpt_rdma_ch.free_list is no longer used but is not removed.
Signed-off-by: NBart Van Assche <bart.vanassche@sandisk.com>
Cc: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
上级 93061f39
...@@ -1264,26 +1264,40 @@ static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch, ...@@ -1264,26 +1264,40 @@ static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch,
*/ */
static struct srpt_send_ioctx *srpt_get_send_ioctx(struct srpt_rdma_ch *ch) static struct srpt_send_ioctx *srpt_get_send_ioctx(struct srpt_rdma_ch *ch)
{ {
struct se_session *se_sess;
struct srpt_send_ioctx *ioctx; struct srpt_send_ioctx *ioctx;
int tag; unsigned long flags;
BUG_ON(!ch); BUG_ON(!ch);
se_sess = ch->sess;
tag = percpu_ida_alloc(&se_sess->sess_tag_pool, TASK_RUNNING); ioctx = NULL;
if (tag < 0) { spin_lock_irqsave(&ch->spinlock, flags);
pr_err("Unable to obtain tag for srpt_send_ioctx\n"); if (!list_empty(&ch->free_list)) {
return NULL; ioctx = list_first_entry(&ch->free_list,
struct srpt_send_ioctx, free_list);
list_del(&ioctx->free_list);
} }
ioctx = &((struct srpt_send_ioctx *)se_sess->sess_cmd_map)[tag]; spin_unlock_irqrestore(&ch->spinlock, flags);
memset(ioctx, 0, sizeof(struct srpt_send_ioctx));
ioctx->ch = ch; if (!ioctx)
return ioctx;
BUG_ON(ioctx->ch != ch);
spin_lock_init(&ioctx->spinlock); spin_lock_init(&ioctx->spinlock);
ioctx->state = SRPT_STATE_NEW; ioctx->state = SRPT_STATE_NEW;
ioctx->n_rbuf = 0;
ioctx->rbufs = NULL;
ioctx->n_rdma = 0;
ioctx->n_rdma_wrs = 0;
ioctx->rdma_wrs = NULL;
ioctx->mapped_sg_count = 0;
init_completion(&ioctx->tx_done); init_completion(&ioctx->tx_done);
ioctx->queue_status_only = false;
ioctx->cmd.map_tag = tag; /*
* transport_init_se_cmd() does not initialize all fields, so do it
* here.
*/
memset(&ioctx->cmd, 0, sizeof(ioctx->cmd));
memset(&ioctx->sense_data, 0, sizeof(ioctx->sense_data));
return ioctx; return ioctx;
} }
...@@ -2021,7 +2035,7 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id, ...@@ -2021,7 +2035,7 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
struct ib_cm_rep_param *rep_param; struct ib_cm_rep_param *rep_param;
struct srpt_rdma_ch *ch, *tmp_ch; struct srpt_rdma_ch *ch, *tmp_ch;
u32 it_iu_len; u32 it_iu_len;
int ret = 0; int i, ret = 0;
unsigned char *p; unsigned char *p;
WARN_ON_ONCE(irqs_disabled()); WARN_ON_ONCE(irqs_disabled());
...@@ -2143,6 +2157,12 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id, ...@@ -2143,6 +2157,12 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
if (!ch->ioctx_ring) if (!ch->ioctx_ring)
goto free_ch; goto free_ch;
INIT_LIST_HEAD(&ch->free_list);
for (i = 0; i < ch->rq_size; i++) {
ch->ioctx_ring[i]->ch = ch;
list_add_tail(&ch->ioctx_ring[i]->free_list, &ch->free_list);
}
ret = srpt_create_ch_ib(ch); ret = srpt_create_ch_ib(ch);
if (ret) { if (ret) {
rej->reason = cpu_to_be32( rej->reason = cpu_to_be32(
...@@ -2173,8 +2193,7 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id, ...@@ -2173,8 +2193,7 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
p = &ch->sess_name[0]; p = &ch->sess_name[0];
try_again: try_again:
ch->sess = target_alloc_session(&sport->port_tpg_1, ch->rq_size, ch->sess = target_alloc_session(&sport->port_tpg_1, 0, 0,
sizeof(struct srpt_send_ioctx),
TARGET_PROT_NORMAL, p, ch, NULL); TARGET_PROT_NORMAL, p, ch, NULL);
if (IS_ERR(ch->sess)) { if (IS_ERR(ch->sess)) {
pr_info("Rejected login because no ACL has been" pr_info("Rejected login because no ACL has been"
...@@ -2881,7 +2900,7 @@ static void srpt_release_cmd(struct se_cmd *se_cmd) ...@@ -2881,7 +2900,7 @@ static void srpt_release_cmd(struct se_cmd *se_cmd)
struct srpt_send_ioctx *ioctx = container_of(se_cmd, struct srpt_send_ioctx *ioctx = container_of(se_cmd,
struct srpt_send_ioctx, cmd); struct srpt_send_ioctx, cmd);
struct srpt_rdma_ch *ch = ioctx->ch; struct srpt_rdma_ch *ch = ioctx->ch;
struct se_session *se_sess = ch->sess; unsigned long flags;
WARN_ON(ioctx->state != SRPT_STATE_DONE); WARN_ON(ioctx->state != SRPT_STATE_DONE);
WARN_ON(ioctx->mapped_sg_count != 0); WARN_ON(ioctx->mapped_sg_count != 0);
...@@ -2892,7 +2911,9 @@ static void srpt_release_cmd(struct se_cmd *se_cmd) ...@@ -2892,7 +2911,9 @@ static void srpt_release_cmd(struct se_cmd *se_cmd)
ioctx->n_rbuf = 0; ioctx->n_rbuf = 0;
} }
percpu_ida_free(&se_sess->sess_tag_pool, se_cmd->map_tag); spin_lock_irqsave(&ch->spinlock, flags);
list_add(&ioctx->free_list, &ch->free_list);
spin_unlock_irqrestore(&ch->spinlock, flags);
} }
/** /**
......
...@@ -179,6 +179,7 @@ struct srpt_recv_ioctx { ...@@ -179,6 +179,7 @@ struct srpt_recv_ioctx {
* struct srpt_send_ioctx - SRPT send I/O context. * struct srpt_send_ioctx - SRPT send I/O context.
* @ioctx: See above. * @ioctx: See above.
* @ch: Channel pointer. * @ch: Channel pointer.
* @free_list: Node in srpt_rdma_ch.free_list.
* @n_rbuf: Number of data buffers in the received SRP command. * @n_rbuf: Number of data buffers in the received SRP command.
* @rbufs: Pointer to SRP data buffer array. * @rbufs: Pointer to SRP data buffer array.
* @single_rbuf: SRP data buffer if the command has only a single buffer. * @single_rbuf: SRP data buffer if the command has only a single buffer.
...@@ -201,6 +202,7 @@ struct srpt_send_ioctx { ...@@ -201,6 +202,7 @@ struct srpt_send_ioctx {
struct srp_direct_buf *rbufs; struct srp_direct_buf *rbufs;
struct srp_direct_buf single_rbuf; struct srp_direct_buf single_rbuf;
struct scatterlist *sg; struct scatterlist *sg;
struct list_head free_list;
spinlock_t spinlock; spinlock_t spinlock;
enum srpt_command_state state; enum srpt_command_state state;
struct se_cmd cmd; struct se_cmd cmd;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册