1. 08 12月, 2021 1 次提交
    • M
      IB/hfi1: Fix early init panic · f6a3cfec
      Mike Marciniszyn 提交于
      The following trace can be observed with an init failure such as firmware
      load failures:
      
        BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
        PGD 0 P4D 0
        Oops: 0010 [#1] SMP PTI
        CPU: 0 PID: 537 Comm: kworker/0:3 Tainted: G           OE    --------- -  - 4.18.0-240.el8.x86_64 #1
        Workqueue: events work_for_cpu_fn
        RIP: 0010:0x0
        Code: Bad RIP value.
        RSP: 0000:ffffae5f878a3c98 EFLAGS: 00010046
        RAX: 0000000000000000 RBX: ffff95e48e025c00 RCX: 0000000000000000
        RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff95e48e025c00
        RBP: ffff95e4bf3660a4 R08: 0000000000000000 R09: ffffffff86d5e100
        R10: ffff95e49e1de600 R11: 0000000000000001 R12: ffff95e4bf366180
        R13: ffff95e48e025c00 R14: ffff95e4bf366028 R15: ffff95e4bf366000
        FS:  0000000000000000(0000) GS:ffff95e4df200000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: ffffffffffffffd6 CR3: 0000000f86a0a003 CR4: 00000000001606f0
        Call Trace:
         receive_context_interrupt+0x1f/0x40 [hfi1]
         __free_irq+0x201/0x300
         free_irq+0x2e/0x60
         pci_free_irq+0x18/0x30
         msix_free_irq.part.2+0x46/0x80 [hfi1]
         msix_clean_up_interrupts+0x2b/0x70 [hfi1]
         hfi1_init_dd+0x640/0x1a90 [hfi1]
         do_init_one.isra.19+0x34d/0x680 [hfi1]
         local_pci_probe+0x41/0x90
         work_for_cpu_fn+0x16/0x20
         process_one_work+0x1a7/0x360
         worker_thread+0x1cf/0x390
         ? create_worker+0x1a0/0x1a0
         kthread+0x112/0x130
         ? kthread_flush_work_fn+0x10/0x10
         ret_from_fork+0x35/0x40
      
      The free_irq() results in a callback to the registered interrupt handler,
      and rcd->do_interrupt is NULL because the receive context data structures
      are not fully initialized.
      
      Fix by ensuring that the do_interrupt is always assigned and adding a
      guards in the slow path handler to detect and handle a partially
      initialized receive context and noop the receive.
      
      Link: https://lore.kernel.org/r/20211129192003.101968.33612.stgit@awfm-01.cornelisnetworks.com
      Cc: stable@vger.kernel.org
      Fixes: b0ba3c18 ("IB/hfi1: Move normal functions from hfi1_devdata to const array")
      Signed-off-by: NMike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
      Signed-off-by: NDennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
      Signed-off-by: NJason Gunthorpe <jgg@nvidia.com>
      f6a3cfec
  2. 30 10月, 2021 1 次提交
  3. 26 8月, 2021 1 次提交
  4. 30 7月, 2021 2 次提交
  5. 22 6月, 2021 1 次提交
  6. 14 4月, 2021 1 次提交
  7. 22 3月, 2021 1 次提交
  8. 23 1月, 2021 1 次提交
    • L
      RDMA/hw/hfi1/chip: Fix a bunch of kernel-doc formatting and spelling issues · da0940e5
      Lee Jones 提交于
      Fixes the following W=1 kernel build warning(s):
      
       drivers/infiniband/hw/hfi1/chip.c:1335: warning: Function parameter or member 'dd' not described in 'hfi1_addr_from_offset'
       drivers/infiniband/hw/hfi1/chip.c:1335: warning: Function parameter or member 'offset' not described in 'hfi1_addr_from_offset'
       drivers/infiniband/hw/hfi1/chip.c:1350: warning: Function parameter or member 'dd' not described in 'read_csr'
       drivers/infiniband/hw/hfi1/chip.c:1350: warning: Function parameter or member 'offset' not described in 'read_csr'
       drivers/infiniband/hw/hfi1/chip.c:1363: warning: Function parameter or member 'dd' not described in 'write_csr'
       drivers/infiniband/hw/hfi1/chip.c:1363: warning: Function parameter or member 'offset' not described in 'write_csr'
       drivers/infiniband/hw/hfi1/chip.c:1363: warning: Function parameter or member 'value' not described in 'write_csr'
       drivers/infiniband/hw/hfi1/chip.c:1385: warning: Function parameter or member 'dd' not described in 'get_csr_addr'
       drivers/infiniband/hw/hfi1/chip.c:1385: warning: Function parameter or member 'offset' not described in 'get_csr_addr'
       drivers/infiniband/hw/hfi1/chip.c:8442: warning: Function parameter or member 'rcd' not described in 'receive_interrupt_common'
       drivers/infiniband/hw/hfi1/chip.c:8491: warning: Function parameter or member 'napi' not described in 'hfi1_netdev_rx_napi'
       drivers/infiniband/hw/hfi1/chip.c:8491: warning: Function parameter or member 'budget' not described in 'hfi1_netdev_rx_napi'
       drivers/infiniband/hw/hfi1/chip.c:14221: warning: Function parameter or member 'dd' not described in 'init_qpmap_table'
       drivers/infiniband/hw/hfi1/chip.c:14221: warning: Function parameter or member 'first_ctxt' not described in 'init_qpmap_table'
       drivers/infiniband/hw/hfi1/chip.c:14221: warning: Function parameter or member 'last_ctxt' not described in 'init_qpmap_table'
       drivers/infiniband/hw/hfi1/chip.c:14399: warning: Function parameter or member 'dd' not described in 'init_qos'
       drivers/infiniband/hw/hfi1/chip.c:14399: warning: Function parameter or member 'rmt' not described in 'init_qos'
       drivers/infiniband/hw/hfi1/chip.c:15032: warning: Function parameter or member 'dd' not described in 'hfi1_init_dd'
       drivers/infiniband/hw/hfi1/chip.c:15032: warning: Excess function parameter 'dev' description in 'hfi1_init_dd'
       drivers/infiniband/hw/hfi1/chip.c:15032: warning: Excess function parameter 'ent' description in 'hfi1_init_dd'
       drivers/infiniband/hw/hfi1/chip.c:15395: warning: Function parameter or member 'ppd' not described in 'create_pbc'
       drivers/infiniband/hw/hfi1/chip.c:15395: warning: Function parameter or member 'srate_mbs' not described in 'create_pbc'
       drivers/infiniband/hw/hfi1/chip.c:15395: warning: Function parameter or member 'dw_len' not described in 'create_pbc'
       drivers/infiniband/hw/hfi1/chip.c:15395: warning: Excess function parameter 'srate' description in 'create_pbc'
       drivers/infiniband/hw/hfi1/chip.c:15395: warning: Excess function parameter 'dwlen' description in 'create_pbc'
      
      Link: https://lore.kernel.org/r/20210121094519.2044049-16-lee.jones@linaro.org
      Cc: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
      Cc: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
      Cc: Doug Ledford <dledford@redhat.com>
      Cc: Jason Gunthorpe <jgg@ziepe.ca>
      Cc: linux-rdma@vger.kernel.org
      Signed-off-by: NLee Jones <lee.jones@linaro.org>
      Signed-off-by: NJason Gunthorpe <jgg@nvidia.com>
      da0940e5
  9. 14 11月, 2020 1 次提交
  10. 17 7月, 2020 1 次提交
  11. 30 5月, 2020 1 次提交
  12. 21 5月, 2020 5 次提交
  13. 10 1月, 2020 4 次提交
  14. 04 1月, 2020 1 次提交
  15. 14 9月, 2019 1 次提交
  16. 23 7月, 2019 1 次提交
  17. 12 6月, 2019 1 次提交
    • M
      IB/hfi1: Correct tid qp rcd to match verbs context · cc78076a
      Mike Marciniszyn 提交于
      The qp priv rcd pointer doesn't match the context being used for verbs
      causing issues when 9B and kdeth packets are processed by different
      receive contexts and hence different CPUs.
      
      When running on different CPUs the following panic can occur:
      
       WARNING: CPU: 3 PID: 2584 at lib/list_debug.c:59 __list_del_entry+0xa1/0xd0
       list_del corruption. prev->next should be ffff9a7ac31f7a30, but was ffff9a7c3bc89230
       CPU: 3 PID: 2584 Comm: z_wr_iss Kdump: loaded Tainted: P           OE  ------------   3.10.0-862.2.3.el7_lustre.x86_64 #1
       Call Trace:
        <IRQ>  [<ffffffffb7b0d78e>] dump_stack+0x19/0x1b
        [<ffffffffb74916d8>] __warn+0xd8/0x100
        [<ffffffffb749175f>] warn_slowpath_fmt+0x5f/0x80
        [<ffffffffb7768671>] __list_del_entry+0xa1/0xd0
        [<ffffffffc0c7a945>] process_rcv_qp_work+0xb5/0x160 [hfi1]
        [<ffffffffc0c7bc2b>] handle_receive_interrupt_nodma_rtail+0x20b/0x2b0 [hfi1]
        [<ffffffffc0c70683>] receive_context_interrupt+0x23/0x40 [hfi1]
        [<ffffffffb7540a94>] __handle_irq_event_percpu+0x44/0x1c0
        [<ffffffffb7540c42>] handle_irq_event_percpu+0x32/0x80
        [<ffffffffb7540ccc>] handle_irq_event+0x3c/0x60
        [<ffffffffb7543a1f>] handle_edge_irq+0x7f/0x150
        [<ffffffffb742d504>] handle_irq+0xe4/0x1a0
        [<ffffffffb7b23f7d>] do_IRQ+0x4d/0xf0
        [<ffffffffb7b16362>] common_interrupt+0x162/0x162
        <EOI>  [<ffffffffb775a326>] ? memcpy+0x6/0x110
        [<ffffffffc109210d>] ? abd_copy_from_buf_off_cb+0x1d/0x30 [zfs]
        [<ffffffffc10920f0>] ? abd_copy_to_buf_off_cb+0x30/0x30 [zfs]
        [<ffffffffc1093257>] abd_iterate_func+0x97/0x120 [zfs]
        [<ffffffffc10934d9>] abd_copy_from_buf_off+0x39/0x60 [zfs]
        [<ffffffffc109b828>] arc_write_ready+0x178/0x300 [zfs]
        [<ffffffffb7b11032>] ? mutex_lock+0x12/0x2f
        [<ffffffffb7b11032>] ? mutex_lock+0x12/0x2f
        [<ffffffffc1164d05>] zio_ready+0x65/0x3d0 [zfs]
        [<ffffffffc04d725e>] ? tsd_get_by_thread+0x2e/0x50 [spl]
        [<ffffffffc04d1318>] ? taskq_member+0x18/0x30 [spl]
        [<ffffffffc115ef22>] zio_execute+0xa2/0x100 [zfs]
        [<ffffffffc04d1d2c>] taskq_thread+0x2ac/0x4f0 [spl]
        [<ffffffffb74cee80>] ? wake_up_state+0x20/0x20
        [<ffffffffc115ee80>] ? zio_taskq_member.isra.7.constprop.10+0x80/0x80 [zfs]
        [<ffffffffc04d1a80>] ? taskq_thread_spawn+0x60/0x60 [spl]
        [<ffffffffb74bae31>] kthread+0xd1/0xe0
        [<ffffffffb74bad60>] ? insert_kthread_work+0x40/0x40
        [<ffffffffb7b1f5f7>] ret_from_fork_nospec_begin+0x21/0x21
        [<ffffffffb74bad60>] ? insert_kthread_work+0x40/0x40
      
      Fix by reading the map entry in the same manner as the hardware so that
      the kdeth and verbs contexts match.
      
      Cc: <stable@vger.kernel.org>
      Fixes: 5190f052 ("IB/hfi1: Allow the driver to initialize QP priv struct")
      Reviewed-by: NKaike Wan <kaike.wan@intel.com>
      Signed-off-by: NMike Marciniszyn <mike.marciniszyn@intel.com>
      Signed-off-by: NDennis Dalessandro <dennis.dalessandro@intel.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      cc78076a
  18. 29 5月, 2019 1 次提交
  19. 24 4月, 2019 1 次提交
  20. 08 4月, 2019 2 次提交
    • W
      drivers: Remove explicit invocations of mmiowb() · fb24ea52
      Will Deacon 提交于
      mmiowb() is now implied by spin_unlock() on architectures that require
      it, so there is no reason to call it from driver code. This patch was
      generated using coccinelle:
      
      	@mmiowb@
      	@@
      	- mmiowb();
      
      and invoked as:
      
      $ for d in drivers include/linux/qed sound; do \
      spatch --include-headers --sp-file mmiowb.cocci --dir $d --in-place; done
      
      NOTE: mmiowb() has only ever guaranteed ordering in conjunction with
      spin_unlock(). However, pairing each mmiowb() removal in this patch with
      the corresponding call to spin_unlock() is not at all trivial, so there
      is a small chance that this change may regress any drivers incorrectly
      relying on mmiowb() to order MMIO writes between CPUs using lock-free
      synchronisation. If you've ended up bisecting to this commit, you can
      reintroduce the mmiowb() calls using wmb() instead, which should restore
      the old behaviour on all architectures other than some esoteric ia64
      systems.
      Acked-by: NLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: NWill Deacon <will.deacon@arm.com>
      fb24ea52
    • W
      drivers: Remove useless trailing comments from mmiowb() invocations · 949b8c72
      Will Deacon 提交于
      In preparation for using coccinelle to remove all mmiowb() instances
      from drivers, remove all trailing comments since they won't be picked up
      by spatch later on and will end up being preserved in the code.
      Acked-by: NLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: NWill Deacon <will.deacon@arm.com>
      949b8c72
  21. 04 4月, 2019 1 次提交
  22. 02 4月, 2019 1 次提交
  23. 28 3月, 2019 1 次提交
    • K
      IB/hfi1: Fix the allocation of RSM table · d0294344
      Kaike Wan 提交于
      The receive side mapping (RSM) on hfi1 hardware is a special
      matching mechanism to direct an incoming packet to a given
      hardware receive context. It has 4 instances of matching capabilities
      (RSM0 - RSM3) that share the same RSM table (RMT). The RMT has a total of
      256 entries, each of which points to a receive context.
      
      Currently, three instances of RSM have been used:
      1. RSM0 by QOS;
      2. RSM1 by PSM FECN;
      3. RSM2 by VNIC.
      
      Each RSM instance should reserve enough entries in RMT to function
      properly. Since both PSM and VNIC could allocate any receive context
      between dd->first_dyn_alloc_ctxt and dd->num_rcv_contexts, PSM FECN must
      reserve enough RMT entries to cover the entire receive context index
      range (dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt) instead of only
      the user receive contexts allocated for PSM
      (dd->num_user_contexts). Consequently, the sizing of
      dd->num_user_contexts in set_up_context_variables is incorrect.
      
      Fixes: 2280740f ("IB/hfi1: Virtual Network Interface Controller (VNIC) HW support")
      Reviewed-by: NMike Marciniszyn <mike.marciniszyn@intel.com>
      Reviewed-by: NMichael J. Ruhl <michael.j.ruhl@intel.com>
      Signed-off-by: NKaike Wan <kaike.wan@intel.com>
      Signed-off-by: NDennis Dalessandro <dennis.dalessandro@intel.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      d0294344
  24. 06 2月, 2019 1 次提交
  25. 01 2月, 2019 1 次提交
  26. 07 12月, 2018 1 次提交
    • K
      IB/hfi1: Ignore LNI errors before DC8051 transitions to Polling state · c1a797c0
      Kaike Wan 提交于
      When it is requested to change its physical state back to Offline while in
      the process to go up, DC8051 will set the ERROR field in the
      DC8051_DBG_ERR_INFO_SET_BY_8051 register. This ERROR field will remain
      until the next time when DC8051 transitions from Offline to Polling.
      Subsequently, when the host requests DC8051 to change its physical state
      to Polling again, it may receive a DC8051 interrupt with the stale ERROR
      field still in DC8051_DBG_ERR_INFO_SET_BY_8051. If the host link state has
      been changed to Polling, this stale ERROR will force the host to
      transition to Offline state, resulting in a vicious cycle of Polling
      ->Offline->Polling->Offline. On the other hand, if the host link state is
      still Offline when the stale ERROR is received, the stale ERROR will be
      ignored, and the link will come up correctly.  This patch implements the
      correct behavior by changing host link state to Polling only after DC8051
      changes its physical state to Polling.
      Reviewed-by: NMike Marciniszyn <mike.marciniszyn@intel.com>
      Signed-off-by: NKrzysztof Goreczny <krzysztof.goreczny@intel.com>
      Signed-off-by: NKaike Wan <kaike.wan@intel.com>
      Signed-off-by: NDennis Dalessandro <dennis.dalessandro@intel.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      c1a797c0
  27. 04 12月, 2018 1 次提交
    • P
      IB/hfi1: Fix an out-of-bounds access in get_hw_stats · 36d84219
      Piotr Stankiewicz 提交于
      When running with KASAN, the following trace is produced:
      
      [   62.535888]
      
      ==================================================================
      [   62.544930] BUG: KASAN: slab-out-of-bounds in
      gut_hw_stats+0x122/0x230 [hfi1]
      [   62.553856] Write of size 8 at addr ffff88080e8d6330 by task
      kworker/0:1/14
      
      [   62.565333] CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted
      4.19.0-test-build-kasan+ #8
      [   62.575087] Hardware name: Intel Corporation S2600KPR/S2600KPR, BIOS
      SE5C610.86B.01.01.0019.101220160604 10/12/2016
      [   62.587951] Workqueue: events work_for_cpu_fn
      [   62.594050] Call Trace:
      [   62.598023]  dump_stack+0xc6/0x14c
      [   62.603089]  ? dump_stack_print_info.cold.1+0x2f/0x2f
      [   62.610041]  ? kmsg_dump_rewind_nolock+0x59/0x59
      [   62.616615]  ? get_hw_stats+0x122/0x230 [hfi1]
      [   62.622985]  print_address_description+0x6c/0x23c
      [   62.629744]  ? get_hw_stats+0x122/0x230 [hfi1]
      [   62.636108]  kasan_report.cold.6+0x241/0x308
      [   62.642365]  get_hw_stats+0x122/0x230 [hfi1]
      [   62.648703]  ? hfi1_alloc_rn+0x40/0x40 [hfi1]
      [   62.655088]  ? __kmalloc+0x110/0x240
      [   62.660695]  ? hfi1_alloc_rn+0x40/0x40 [hfi1]
      [   62.667142]  setup_hw_stats+0xd8/0x430 [ib_core]
      [   62.673972]  ? show_hfi+0x50/0x50 [hfi1]
      [   62.680026]  ib_device_register_sysfs+0x165/0x180 [ib_core]
      [   62.687995]  ib_register_device+0x5a2/0xa10 [ib_core]
      [   62.695340]  ? show_hfi+0x50/0x50 [hfi1]
      [   62.701421]  ? ib_unregister_device+0x2e0/0x2e0 [ib_core]
      [   62.709222]  ? __vmalloc_node_range+0x2d0/0x380
      [   62.716131]  ? rvt_driver_mr_init+0x11f/0x2d0 [rdmavt]
      [   62.723735]  ? vmalloc_node+0x5c/0x70
      [   62.729697]  ? rvt_driver_mr_init+0x11f/0x2d0 [rdmavt]
      [   62.737347]  ? rvt_driver_mr_init+0x1f5/0x2d0 [rdmavt]
      [   62.744998]  ? __rvt_alloc_mr+0x110/0x110 [rdmavt]
      [   62.752315]  ? rvt_rc_error+0x140/0x140 [rdmavt]
      [   62.759434]  ? rvt_vma_open+0x30/0x30 [rdmavt]
      [   62.766364]  ? mutex_unlock+0x1d/0x40
      [   62.772445]  ? kmem_cache_create_usercopy+0x15d/0x230
      [   62.780115]  rvt_register_device+0x1f6/0x360 [rdmavt]
      [   62.787823]  ? rvt_get_port_immutable+0x180/0x180 [rdmavt]
      [   62.796058]  ? __get_txreq+0x400/0x400 [hfi1]
      [   62.802969]  ? memcpy+0x34/0x50
      [   62.808611]  hfi1_register_ib_device+0xde6/0xeb0 [hfi1]
      [   62.816601]  ? hfi1_get_npkeys+0x10/0x10 [hfi1]
      [   62.823760]  ? hfi1_init+0x89f/0x9a0 [hfi1]
      [   62.830469]  ? hfi1_setup_eagerbufs+0xad0/0xad0 [hfi1]
      [   62.838204]  ? pcie_capability_clear_and_set_word+0xcd/0xe0
      [   62.846429]  ? pcie_capability_read_word+0xd0/0xd0
      [   62.853791]  ? hfi1_pcie_init+0x187/0x4b0 [hfi1]
      [   62.860958]  init_one+0x67f/0xae0 [hfi1]
      [   62.867301]  ? hfi1_init+0x9a0/0x9a0 [hfi1]
      [   62.873876]  ? wait_woken+0x130/0x130
      [   62.879860]  ? read_word_at_a_time+0xe/0x20
      [   62.886329]  ? strscpy+0x14b/0x280
      [   62.891998]  ? hfi1_init+0x9a0/0x9a0 [hfi1]
      [   62.898405]  local_pci_probe+0x70/0xd0
      [   62.904295]  ? pci_device_shutdown+0x90/0x90
      [   62.910833]  work_for_cpu_fn+0x29/0x40
      [   62.916750]  process_one_work+0x584/0x960
      [   62.922974]  ? rcu_work_rcufn+0x40/0x40
      [   62.928991]  ? __schedule+0x396/0xdc0
      [   62.934806]  ? __sched_text_start+0x8/0x8
      [   62.941020]  ? pick_next_task_fair+0x68b/0xc60
      [   62.947674]  ? run_rebalance_domains+0x260/0x260
      [   62.954471]  ? __list_add_valid+0x29/0xa0
      [   62.960607]  ? move_linked_works+0x1c7/0x230
      [   62.967077]  ?
      trace_event_raw_event_workqueue_execute_start+0x140/0x140
      [   62.976248]  ? mutex_lock+0xa6/0x100
      [   62.982029]  ? __mutex_lock_slowpath+0x10/0x10
      [   62.988795]  ? __switch_to+0x37a/0x710
      [   62.994731]  worker_thread+0x62e/0x9d0
      [   63.000602]  ? max_active_store+0xf0/0xf0
      [   63.006828]  ? __switch_to_asm+0x40/0x70
      [   63.012932]  ? __switch_to_asm+0x34/0x70
      [   63.019013]  ? __switch_to_asm+0x40/0x70
      [   63.025042]  ? __switch_to_asm+0x34/0x70
      [   63.031030]  ? __switch_to_asm+0x40/0x70
      [   63.037006]  ? __schedule+0x396/0xdc0
      [   63.042660]  ? kmem_cache_alloc_trace+0xf3/0x1f0
      [   63.049323]  ? kthread+0x59/0x1d0
      [   63.054594]  ? ret_from_fork+0x35/0x40
      [   63.060257]  ? __sched_text_start+0x8/0x8
      [   63.066212]  ? schedule+0xcf/0x250
      [   63.071529]  ? __wake_up_common+0x110/0x350
      [   63.077794]  ? __schedule+0xdc0/0xdc0
      [   63.083348]  ? wait_woken+0x130/0x130
      [   63.088963]  ? finish_task_switch+0x1f1/0x520
      [   63.095258]  ? kasan_unpoison_shadow+0x30/0x40
      [   63.101792]  ? __init_waitqueue_head+0xa0/0xd0
      [   63.108183]  ? replenish_dl_entity.cold.60+0x18/0x18
      [   63.115151]  ? _raw_spin_lock_irqsave+0x25/0x50
      [   63.121754]  ? max_active_store+0xf0/0xf0
      [   63.127753]  kthread+0x1ae/0x1d0
      [   63.132894]  ? kthread_bind+0x30/0x30
      [   63.138422]  ret_from_fork+0x35/0x40
      
      [   63.146973] Allocated by task 14:
      [   63.152077]  kasan_kmalloc+0xbf/0xe0
      [   63.157471]  __kmalloc+0x110/0x240
      [   63.162804]  init_cntrs+0x34d/0xdf0 [hfi1]
      [   63.168883]  hfi1_init_dd+0x29a3/0x2f90 [hfi1]
      [   63.175244]  init_one+0x551/0xae0 [hfi1]
      [   63.181065]  local_pci_probe+0x70/0xd0
      [   63.186759]  work_for_cpu_fn+0x29/0x40
      [   63.192310]  process_one_work+0x584/0x960
      [   63.198163]  worker_thread+0x62e/0x9d0
      [   63.203843]  kthread+0x1ae/0x1d0
      [   63.208874]  ret_from_fork+0x35/0x40
      
      [   63.217203] Freed by task 1:
      [   63.221844]  __kasan_slab_free+0x12e/0x180
      [   63.227844]  kfree+0x92/0x1a0
      [   63.232570]  single_release+0x3a/0x60
      [   63.238024]  __fput+0x1d9/0x480
      [   63.242911]  task_work_run+0x139/0x190
      [   63.248440]  exit_to_usermode_loop+0x191/0x1a0
      [   63.254814]  do_syscall_64+0x301/0x330
      [   63.260283]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      [   63.270199] The buggy address belongs to the object at
      ffff88080e8d5500
       which belongs to the cache kmalloc-4096 of size 4096
      [   63.287247] The buggy address is located 3632 bytes inside of
       4096-byte region [ffff88080e8d5500, ffff88080e8d6500)
      [   63.303564] The buggy address belongs to the page:
      [   63.310447] page:ffffea00203a3400 count:1 mapcount:0
      mapping:ffff88081380e840 index:0x0 compound_mapcount: 0
      [   63.323102] flags: 0x2fffff80008100(slab|head)
      [   63.329775] raw: 002fffff80008100 0000000000000000 0000000100000001
      ffff88081380e840
      [   63.340175] raw: 0000000000000000 0000000000070007 00000001ffffffff
      0000000000000000
      [   63.350564] page dumped because: kasan: bad access detected
      
      [   63.361974] Memory state around the buggy address:
      [   63.369137]  ffff88080e8d6200: 00 00 00 00 00 00 00 00 00 00 00 00 00
      00 00 00
      [   63.379082]  ffff88080e8d6280: 00 00 00 00 00 00 00 00 00 00 00 00 00
      00 00 00
      [   63.389032] >ffff88080e8d6300: 00 00 00 00 00 00 fc fc fc fc fc fc fc
      fc fc fc
      [   63.398944]                                      ^
      [   63.406141]  ffff88080e8d6380: fc fc fc fc fc fc fc fc fc fc fc fc fc
      fc fc fc
      [   63.416109]  ffff88080e8d6400: fc fc fc fc fc fc fc fc fc fc fc fc fc
      fc fc fc
      [   63.426099]
      ==================================================================
      
      The trace happens because get_hw_stats() assumes there is room in the
      memory allocated in init_cntrs() to accommodate the driver counters.
      Unfortunately, that routine only allocated space for the device
      counters.
      
      Fix by insuring the allocation has room for the additional driver
      counters.
      
      Cc: <Stable@vger.kernel.org> # v4.14+
      Fixes: b7481944 ("IB/hfi1: Show statistics counters under IB stats interface")
      Reviewed-by: NMike Marciniczyn <mike.marciniszyn@intel.com>
      Reviewed-by: NMike Ruhl <michael.j.ruhl@intel.com>
      Signed-off-by: NPiotr Stankiewicz <piotr.stankiewicz@intel.com>
      Signed-off-by: NDennis Dalessandro <dennis.dalessandro@intel.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      36d84219
  28. 01 10月, 2018 1 次提交
  29. 21 9月, 2018 1 次提交
    • M
      IB/hfi1: Fix destroy_qp hang after a link down · b4a4957d
      Michael J. Ruhl 提交于
      rvt_destroy_qp() cannot complete until all in process packets have
      been released from the underlying hardware.  If a link down event
      occurs, an application can hang with a kernel stack similar to:
      
      cat /proc/<app PID>/stack
       quiesce_qp+0x178/0x250 [hfi1]
       rvt_reset_qp+0x23d/0x400 [rdmavt]
       rvt_destroy_qp+0x69/0x210 [rdmavt]
       ib_destroy_qp+0xba/0x1c0 [ib_core]
       nvme_rdma_destroy_queue_ib+0x46/0x80 [nvme_rdma]
       nvme_rdma_free_queue+0x3c/0xd0 [nvme_rdma]
       nvme_rdma_destroy_io_queues+0x88/0xd0 [nvme_rdma]
       nvme_rdma_error_recovery_work+0x52/0xf0 [nvme_rdma]
       process_one_work+0x17a/0x440
       worker_thread+0x126/0x3c0
       kthread+0xcf/0xe0
       ret_from_fork+0x58/0x90
       0xffffffffffffffff
      
      quiesce_qp() waits until all outstanding packets have been freed.
      This wait should be momentary.  During a link down event, the cleanup
      handling does not ensure that all packets caught by the link down are
      flushed properly.
      
      This is caused by the fact that the freeze path and the link down
      event is handled the same.  This is not correct.  The freeze path
      waits until the HFI is unfrozen and then restarts PIO.  A link down
      is not a freeze event.  The link down path cannot restart the PIO
      until link is restored.  If the PIO path is restarted before the link
      comes up, the application (QP) using the PIO path will hang (until
      link is restored).
      
      Fix by separating the linkdown path from the freeze path and use the
      link down path for link down events.
      
      Close a race condition sc_disable() by acquiring both the progress
      and release locks.
      
      Close a race condition in sc_stop() by moving the setting of the flag
      bits under the alloc lock.
      
      Cc: <stable@vger.kernel.org> # 4.9.x+
      Fixes: 77241056 ("IB/hfi1: add driver files")
      Reviewed-by: NMike Marciniszyn <mike.marciniszyn@intel.com>
      Signed-off-by: NMichael J. Ruhl <michael.j.ruhl@intel.com>
      Signed-off-by: NDennis Dalessandro <dennis.dalessandro@intel.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      b4a4957d
  30. 12 9月, 2018 1 次提交
  31. 01 9月, 2018 1 次提交