]> Git Repo - linux.git/blame - net/smc/smc_cdc.c
net/smc: fix kernel panic caused by race of smc_sock
[linux.git] / net / smc / smc_cdc.c
CommitLineData
b2441318 1// SPDX-License-Identifier: GPL-2.0
5f08318f
UB
2/*
3 * Shared Memory Communications over RDMA (SMC-R) and RoCE
4 *
5 * Connection Data Control (CDC)
6 * handles flow control
7 *
8 * Copyright IBM Corp. 2016
9 *
10 * Author(s): Ursula Braun <[email protected]>
11 */
12
13#include <linux/spinlock.h>
14
15#include "smc.h"
16#include "smc_wr.h"
17#include "smc_cdc.h"
e6727f39 18#include "smc_tx.h"
952310cc 19#include "smc_rx.h"
b38d7324 20#include "smc_close.h"
5f08318f
UB
21
22/********************************** send *************************************/
23
5f08318f
UB
24/* handler for send/transmission completion of a CDC msg */
25static void smc_cdc_tx_handler(struct smc_wr_tx_pend_priv *pnd_snd,
26 struct smc_link *link,
27 enum ib_wc_status wc_status)
28{
29 struct smc_cdc_tx_pend *cdcpend = (struct smc_cdc_tx_pend *)pnd_snd;
bac6de7b 30 struct smc_connection *conn = cdcpend->conn;
5f08318f
UB
31 struct smc_sock *smc;
32 int diff;
33
bac6de7b 34 smc = container_of(conn, struct smc_sock, conn);
5f08318f
UB
35 bh_lock_sock(&smc->sk);
36 if (!wc_status) {
69cb7dc0 37 diff = smc_curs_diff(cdcpend->conn->sndbuf_desc->len,
5f08318f
UB
38 &cdcpend->conn->tx_curs_fin,
39 &cdcpend->cursor);
40 /* sndbuf_space is decreased in smc_sendmsg */
41 smp_mb__before_atomic();
42 atomic_add(diff, &cdcpend->conn->sndbuf_space);
69cb7dc0 43 /* guarantee 0 <= sndbuf_space <= sndbuf_desc->len */
5f08318f 44 smp_mb__after_atomic();
bac6de7b 45 smc_curs_copy(&conn->tx_curs_fin, &cdcpend->cursor, conn);
f0ec4f1d
KG
46 smc_curs_copy(&conn->local_tx_ctrl_fin, &cdcpend->p_cursor,
47 conn);
48 conn->tx_cdc_seq_fin = cdcpend->ctrl_seq;
5f08318f 49 }
349d4312
DL
50
51 if (atomic_dec_and_test(&conn->cdc_pend_tx_wr) &&
52 unlikely(wq_has_sleeper(&conn->cdc_pend_tx_wq)))
53 wake_up(&conn->cdc_pend_tx_wq);
54 WARN_ON(atomic_read(&conn->cdc_pend_tx_wr) < 0);
55
e6727f39 56 smc_tx_sndbuf_nonfull(smc);
5f08318f
UB
57 bh_unlock_sock(&smc->sk);
58}
59
51957bc5 60int smc_cdc_get_free_slot(struct smc_connection *conn,
c6f02ebe 61 struct smc_link *link,
5f08318f 62 struct smc_wr_buf **wr_buf,
ad6f317f 63 struct smc_rdma_wr **wr_rdma_buf,
5f08318f
UB
64 struct smc_cdc_tx_pend **pend)
65{
1a0a04c7 66 int rc;
51957bc5 67
1a0a04c7 68 rc = smc_wr_tx_get_free_slot(link, smc_cdc_tx_handler, wr_buf,
ad6f317f 69 wr_rdma_buf,
1a0a04c7 70 (struct smc_wr_tx_pend_priv **)pend);
2bced6ae 71 if (conn->killed) {
1a0a04c7 72 /* abnormal termination */
2bced6ae
KG
73 if (!rc)
74 smc_wr_tx_put_slot(link,
75 (struct smc_wr_tx_pend_priv *)pend);
1a0a04c7 76 rc = -EPIPE;
2bced6ae 77 }
1a0a04c7 78 return rc;
5f08318f
UB
79}
80
81static inline void smc_cdc_add_pending_send(struct smc_connection *conn,
82 struct smc_cdc_tx_pend *pend)
83{
84 BUILD_BUG_ON_MSG(
85 sizeof(struct smc_cdc_msg) > SMC_WR_BUF_SIZE,
86 "must increase SMC_WR_BUF_SIZE to at least sizeof(struct smc_cdc_msg)");
87 BUILD_BUG_ON_MSG(
b9a22dd9 88 offsetofend(struct smc_cdc_msg, reserved) > SMC_WR_TX_SIZE,
5f08318f
UB
89 "must adapt SMC_WR_TX_SIZE to sizeof(struct smc_cdc_msg); if not all smc_wr upper layer protocols use the same message size any more, must start to set link->wr_tx_sges[i].length on each individual smc_wr_tx_send()");
90 BUILD_BUG_ON_MSG(
91 sizeof(struct smc_cdc_tx_pend) > SMC_WR_TX_PEND_PRIV_SIZE,
92 "must increase SMC_WR_TX_PEND_PRIV_SIZE to at least sizeof(struct smc_cdc_tx_pend)");
93 pend->conn = conn;
94 pend->cursor = conn->tx_curs_sent;
95 pend->p_cursor = conn->local_tx_ctrl.prod;
96 pend->ctrl_seq = conn->tx_cdc_seq;
97}
98
99int smc_cdc_msg_send(struct smc_connection *conn,
100 struct smc_wr_buf *wr_buf,
101 struct smc_cdc_tx_pend *pend)
102{
387707fd 103 struct smc_link *link = conn->lnk;
b8649efa 104 union smc_host_cursor cfed;
5f08318f
UB
105 int rc;
106
5f08318f
UB
107 smc_cdc_add_pending_send(conn, pend);
108
109 conn->tx_cdc_seq++;
110 conn->local_tx_ctrl.seqno = conn->tx_cdc_seq;
ccc8ca9b 111 smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf, conn, &cfed);
349d4312
DL
112
113 atomic_inc(&conn->cdc_pend_tx_wr);
114 smp_mb__after_atomic(); /* Make sure cdc_pend_tx_wr added before post */
115
5f08318f 116 rc = smc_wr_tx_send(link, (struct smc_wr_tx_pend_priv *)pend);
4dff63c2 117 if (!rc) {
b8649efa 118 smc_curs_copy(&conn->rx_curs_confirmed, &cfed, conn);
4dff63c2 119 conn->local_rx_ctrl.prod_flags.cons_curs_upd_req = 0;
f0ec4f1d
KG
120 } else {
121 conn->tx_cdc_seq--;
122 conn->local_tx_ctrl.seqno = conn->tx_cdc_seq;
349d4312 123 atomic_dec(&conn->cdc_pend_tx_wr);
4dff63c2 124 }
5f08318f
UB
125
126 return rc;
127}
128
29bd73db 129/* send a validation msg indicating the move of a conn to an other QP link */
b8ded9de
KG
130int smcr_cdc_msg_send_validation(struct smc_connection *conn,
131 struct smc_cdc_tx_pend *pend,
132 struct smc_wr_buf *wr_buf)
29bd73db
KG
133{
134 struct smc_host_cdc_msg *local = &conn->local_tx_ctrl;
135 struct smc_link *link = conn->lnk;
29bd73db
KG
136 struct smc_cdc_msg *peer;
137 int rc;
138
29bd73db
KG
139 peer = (struct smc_cdc_msg *)wr_buf;
140 peer->common.type = local->common.type;
141 peer->len = local->len;
142 peer->seqno = htons(conn->tx_cdc_seq_fin); /* seqno last compl. tx */
143 peer->token = htonl(local->token);
144 peer->prod_flags.failover_validation = 1;
145
349d4312
DL
146 /* We need to set pend->conn here to make sure smc_cdc_tx_handler()
147 * can handle properly
148 */
149 smc_cdc_add_pending_send(conn, pend);
150
151 atomic_inc(&conn->cdc_pend_tx_wr);
152 smp_mb__after_atomic(); /* Make sure cdc_pend_tx_wr added before post */
153
29bd73db 154 rc = smc_wr_tx_send(link, (struct smc_wr_tx_pend_priv *)pend);
349d4312
DL
155 if (unlikely(rc))
156 atomic_dec(&conn->cdc_pend_tx_wr);
157
29bd73db
KG
158 return rc;
159}
160
be244f28 161static int smcr_cdc_get_slot_and_msg_send(struct smc_connection *conn)
5f08318f
UB
162{
163 struct smc_cdc_tx_pend *pend;
164 struct smc_wr_buf *wr_buf;
c6f02ebe
KG
165 struct smc_link *link;
166 bool again = false;
5f08318f
UB
167 int rc;
168
c6f02ebe
KG
169again:
170 link = conn->lnk;
95f7f3e7
KG
171 if (!smc_wr_tx_link_hold(link))
172 return -ENOLINK;
c6f02ebe 173 rc = smc_cdc_get_free_slot(conn, link, &wr_buf, NULL, &pend);
5f08318f 174 if (rc)
95f7f3e7 175 goto put_out;
5f08318f 176
2dee25af 177 spin_lock_bh(&conn->send_lock);
c6f02ebe
KG
178 if (link != conn->lnk) {
179 /* link of connection changed, try again one time*/
180 spin_unlock_bh(&conn->send_lock);
181 smc_wr_tx_put_slot(link,
182 (struct smc_wr_tx_pend_priv *)pend);
95f7f3e7 183 smc_wr_tx_link_put(link);
c6f02ebe
KG
184 if (again)
185 return -ENOLINK;
186 again = true;
187 goto again;
188 }
2dee25af
KG
189 rc = smc_cdc_msg_send(conn, wr_buf, pend);
190 spin_unlock_bh(&conn->send_lock);
95f7f3e7
KG
191put_out:
192 smc_wr_tx_link_put(link);
2dee25af 193 return rc;
5f08318f
UB
194}
195
be244f28
HW
196int smc_cdc_get_slot_and_msg_send(struct smc_connection *conn)
197{
198 int rc;
199
50c6b20e
UB
200 if (!conn->lgr || (conn->lgr->is_smcd && conn->lgr->peer_shutdown))
201 return -EPIPE;
202
be244f28
HW
203 if (conn->lgr->is_smcd) {
204 spin_lock_bh(&conn->send_lock);
205 rc = smcd_cdc_msg_send(conn);
206 spin_unlock_bh(&conn->send_lock);
207 } else {
208 rc = smcr_cdc_get_slot_and_msg_send(conn);
209 }
210
211 return rc;
212}
213
349d4312 214void smc_cdc_wait_pend_tx_wr(struct smc_connection *conn)
5f08318f 215{
349d4312 216 wait_event(conn->cdc_pend_tx_wq, !atomic_read(&conn->cdc_pend_tx_wr));
5f08318f
UB
217}
218
be244f28
HW
219/* Send a SMC-D CDC header.
220 * This increments the free space available in our send buffer.
221 * Also update the confirmed receive buffer with what was sent to the peer.
222 */
223int smcd_cdc_msg_send(struct smc_connection *conn)
224{
225 struct smc_sock *smc = container_of(conn, struct smc_sock, conn);
b9a22dd9 226 union smc_host_cursor curs;
be244f28
HW
227 struct smcd_cdc_msg cdc;
228 int rc, diff;
229
230 memset(&cdc, 0, sizeof(cdc));
231 cdc.common.type = SMC_CDC_MSG_TYPE;
b9a22dd9
UB
232 curs.acurs.counter = atomic64_read(&conn->local_tx_ctrl.prod.acurs);
233 cdc.prod.wrap = curs.wrap;
234 cdc.prod.count = curs.count;
235 curs.acurs.counter = atomic64_read(&conn->local_tx_ctrl.cons.acurs);
236 cdc.cons.wrap = curs.wrap;
237 cdc.cons.count = curs.count;
238 cdc.cons.prod_flags = conn->local_tx_ctrl.prod_flags;
239 cdc.cons.conn_state_flags = conn->local_tx_ctrl.conn_state_flags;
be244f28
HW
240 rc = smcd_tx_ism_write(conn, &cdc, sizeof(cdc), 0, 1);
241 if (rc)
242 return rc;
b9a22dd9 243 smc_curs_copy(&conn->rx_curs_confirmed, &curs, conn);
4dff63c2 244 conn->local_rx_ctrl.prod_flags.cons_curs_upd_req = 0;
be244f28
HW
245 /* Calculate transmitted data and increment free send buffer space */
246 diff = smc_curs_diff(conn->sndbuf_desc->len, &conn->tx_curs_fin,
247 &conn->tx_curs_sent);
248 /* increased by confirmed number of bytes */
249 smp_mb__before_atomic();
250 atomic_add(diff, &conn->sndbuf_space);
251 /* guarantee 0 <= sndbuf_space <= sndbuf_desc->len */
252 smp_mb__after_atomic();
bac6de7b 253 smc_curs_copy(&conn->tx_curs_fin, &conn->tx_curs_sent, conn);
be244f28
HW
254
255 smc_tx_sndbuf_nonfull(smc);
256 return rc;
257}
258
5f08318f
UB
259/********************************* receive ***********************************/
260
261static inline bool smc_cdc_before(u16 seq1, u16 seq2)
262{
263 return (s16)(seq1 - seq2) < 0;
264}
265
de8474eb
SR
266static void smc_cdc_handle_urg_data_arrival(struct smc_sock *smc,
267 int *diff_prod)
268{
269 struct smc_connection *conn = &smc->conn;
270 char *base;
271
272 /* new data included urgent business */
bac6de7b 273 smc_curs_copy(&conn->urg_curs, &conn->local_rx_ctrl.prod, conn);
de8474eb
SR
274 conn->urg_state = SMC_URG_VALID;
275 if (!sock_flag(&smc->sk, SOCK_URGINLINE))
276 /* we'll skip the urgent byte, so don't account for it */
277 (*diff_prod)--;
be244f28 278 base = (char *)conn->rmb_desc->cpu_addr + conn->rx_off;
de8474eb
SR
279 if (conn->urg_curs.count)
280 conn->urg_rx_byte = *(base + conn->urg_curs.count - 1);
281 else
282 conn->urg_rx_byte = *(base + conn->rmb_desc->len - 1);
283 sk_send_sigurg(&smc->sk);
284}
285
b286a065
KG
286static void smc_cdc_msg_validate(struct smc_sock *smc, struct smc_cdc_msg *cdc,
287 struct smc_link *link)
288{
289 struct smc_connection *conn = &smc->conn;
290 u16 recv_seq = ntohs(cdc->seqno);
291 s16 diff;
292
293 /* check that seqnum was seen before */
294 diff = conn->local_rx_ctrl.seqno - recv_seq;
295 if (diff < 0) { /* diff larger than 0x7fff */
296 /* drop connection */
297 conn->out_of_sync = 1; /* prevent any further receives */
298 spin_lock_bh(&conn->send_lock);
299 conn->local_tx_ctrl.conn_state_flags.peer_conn_abort = 1;
300 conn->lnk = link;
301 spin_unlock_bh(&conn->send_lock);
302 sock_hold(&smc->sk); /* sock_put in abort_work */
22ef473d 303 if (!queue_work(smc_close_wq, &conn->abort_work))
b286a065
KG
304 sock_put(&smc->sk);
305 }
306}
307
5f08318f 308static void smc_cdc_msg_recv_action(struct smc_sock *smc,
5f08318f
UB
309 struct smc_cdc_msg *cdc)
310{
311 union smc_host_cursor cons_old, prod_old;
312 struct smc_connection *conn = &smc->conn;
313 int diff_cons, diff_prod;
314
bac6de7b
SR
315 smc_curs_copy(&prod_old, &conn->local_rx_ctrl.prod, conn);
316 smc_curs_copy(&cons_old, &conn->local_rx_ctrl.cons, conn);
5f08318f
UB
317 smc_cdc_msg_to_host(&conn->local_rx_ctrl, cdc, conn);
318
319 diff_cons = smc_curs_diff(conn->peer_rmbe_size, &cons_old,
320 &conn->local_rx_ctrl.cons);
321 if (diff_cons) {
322 /* peer_rmbe_space is decreased during data transfer with RDMA
323 * write
324 */
325 smp_mb__before_atomic();
326 atomic_add(diff_cons, &conn->peer_rmbe_space);
327 /* guarantee 0 <= peer_rmbe_space <= peer_rmbe_size */
328 smp_mb__after_atomic();
329 }
330
69cb7dc0 331 diff_prod = smc_curs_diff(conn->rmb_desc->len, &prod_old,
5f08318f
UB
332 &conn->local_rx_ctrl.prod);
333 if (diff_prod) {
de8474eb
SR
334 if (conn->local_rx_ctrl.prod_flags.urg_data_present)
335 smc_cdc_handle_urg_data_arrival(smc, &diff_prod);
5f08318f
UB
336 /* bytes_to_rcv is decreased in smc_recvmsg */
337 smp_mb__before_atomic();
338 atomic_add(diff_prod, &conn->bytes_to_rcv);
69cb7dc0 339 /* guarantee 0 <= bytes_to_rcv <= rmb_desc->len */
5f08318f 340 smp_mb__after_atomic();
952310cc 341 smc->sk.sk_data_ready(&smc->sk);
de8474eb 342 } else {
cf0cfe53
KG
343 if (conn->local_rx_ctrl.prod_flags.write_blocked)
344 smc->sk.sk_data_ready(&smc->sk);
345 if (conn->local_rx_ctrl.prod_flags.urg_data_pending)
346 conn->urg_state = SMC_URG_NOTYET;
5f08318f
UB
347 }
348
51f1de79 349 /* trigger sndbuf consumer: RDMA write into peer RMBE and CDC */
cf0cfe53
KG
350 if ((diff_cons && smc_tx_prepared_sends(conn)) ||
351 conn->local_rx_ctrl.prod_flags.cons_curs_upd_req ||
352 conn->local_rx_ctrl.prod_flags.urg_data_pending)
51f1de79 353 smc_tx_sndbuf_nonempty(conn);
cf0cfe53 354
de8474eb
SR
355 if (diff_cons && conn->urg_tx_pend &&
356 atomic_read(&conn->peer_rmbe_space) == conn->peer_rmbe_size) {
357 /* urg data confirmed by peer, indicate we're ready for more */
358 conn->urg_tx_pend = false;
359 smc->sk.sk_write_space(&smc->sk);
360 }
51f1de79 361
b38d7324 362 if (conn->local_rx_ctrl.conn_state_flags.peer_conn_abort) {
5f08318f 363 smc->sk.sk_err = ECONNRESET;
b38d7324
UB
364 conn->local_tx_ctrl.conn_state_flags.peer_conn_abort = 1;
365 }
46c28dbd
UB
366 if (smc_cdc_rxed_any_close_or_senddone(conn)) {
367 smc->sk.sk_shutdown |= RCV_SHUTDOWN;
368 if (smc->clcsock && smc->clcsock->sk)
369 smc->clcsock->sk->sk_shutdown |= RCV_SHUTDOWN;
370 sock_set_flag(&smc->sk, SOCK_DONE);
51f1de79 371 sock_hold(&smc->sk); /* sock_put in close_work */
22ef473d 372 if (!queue_work(smc_close_wq, &conn->close_work))
51f1de79 373 sock_put(&smc->sk);
b38d7324 374 }
5f08318f
UB
375}
376
377/* called under tasklet context */
d7b0e37c 378static void smc_cdc_msg_recv(struct smc_sock *smc, struct smc_cdc_msg *cdc)
5f08318f 379{
5f08318f 380 sock_hold(&smc->sk);
5f08318f 381 bh_lock_sock(&smc->sk);
d7b0e37c 382 smc_cdc_msg_recv_action(smc, cdc);
5f08318f
UB
383 bh_unlock_sock(&smc->sk);
384 sock_put(&smc->sk); /* no free sk in softirq-context */
385}
386
be244f28
HW
387/* Schedule a tasklet for this connection. Triggered from the ISM device IRQ
388 * handler to indicate update in the DMBE.
389 *
390 * Context:
391 * - tasklet context
392 */
fcb8e3a3 393static void smcd_cdc_rx_tsklet(struct tasklet_struct *t)
be244f28 394{
fcb8e3a3 395 struct smc_connection *conn = from_tasklet(conn, t, rx_tsklet);
b9a22dd9 396 struct smcd_cdc_msg *data_cdc;
be244f28
HW
397 struct smcd_cdc_msg cdc;
398 struct smc_sock *smc;
399
b2900980 400 if (!conn || conn->killed)
be244f28
HW
401 return;
402
b9a22dd9
UB
403 data_cdc = (struct smcd_cdc_msg *)conn->rmb_desc->cpu_addr;
404 smcd_curs_copy(&cdc.prod, &data_cdc->prod, conn);
405 smcd_curs_copy(&cdc.cons, &data_cdc->cons, conn);
be244f28
HW
406 smc = container_of(conn, struct smc_sock, conn);
407 smc_cdc_msg_recv(smc, (struct smc_cdc_msg *)&cdc);
408}
409
410/* Initialize receive tasklet. Called from ISM device IRQ handler to start
411 * receiver side.
412 */
413void smcd_cdc_rx_init(struct smc_connection *conn)
414{
fcb8e3a3 415 tasklet_setup(&conn->rx_tsklet, smcd_cdc_rx_tsklet);
be244f28
HW
416}
417
5f08318f
UB
418/***************************** init, exit, misc ******************************/
419
420static void smc_cdc_rx_handler(struct ib_wc *wc, void *buf)
421{
422 struct smc_link *link = (struct smc_link *)wc->qp->qp_context;
423 struct smc_cdc_msg *cdc = buf;
d7b0e37c
HW
424 struct smc_connection *conn;
425 struct smc_link_group *lgr;
426 struct smc_sock *smc;
5f08318f
UB
427
428 if (wc->byte_len < offsetof(struct smc_cdc_msg, reserved))
429 return; /* short message */
cbba07a7 430 if (cdc->len != SMC_WR_TX_SIZE)
5f08318f 431 return; /* invalid message */
d7b0e37c
HW
432
433 /* lookup connection */
00e5fb26 434 lgr = smc_get_lgr(link);
d7b0e37c
HW
435 read_lock_bh(&lgr->conns_lock);
436 conn = smc_lgr_find_conn(ntohl(cdc->token), lgr);
437 read_unlock_bh(&lgr->conns_lock);
b286a065 438 if (!conn || conn->out_of_sync)
d7b0e37c
HW
439 return;
440 smc = container_of(conn, struct smc_sock, conn);
441
b286a065
KG
442 if (cdc->prod_flags.failover_validation) {
443 smc_cdc_msg_validate(smc, cdc, link);
444 return;
d7b0e37c 445 }
b286a065
KG
446 if (smc_cdc_before(ntohs(cdc->seqno),
447 conn->local_rx_ctrl.seqno))
448 /* received seqno is old */
449 return;
450
d7b0e37c 451 smc_cdc_msg_recv(smc, cdc);
5f08318f
UB
452}
453
454static struct smc_wr_rx_handler smc_cdc_rx_handlers[] = {
455 {
456 .handler = smc_cdc_rx_handler,
457 .type = SMC_CDC_MSG_TYPE
458 },
459 {
460 .handler = NULL,
461 }
462};
463
464int __init smc_cdc_init(void)
465{
466 struct smc_wr_rx_handler *handler;
467 int rc = 0;
468
469 for (handler = smc_cdc_rx_handlers; handler->handler; handler++) {
470 INIT_HLIST_NODE(&handler->list);
471 rc = smc_wr_rx_register_handler(handler);
472 if (rc)
473 break;
474 }
475 return rc;
476}
This page took 0.461766 seconds and 4 git commands to generate.