summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-01-15drm/nouveau/pmu: initialise SW state for falcon from constructorBen Skeggs
This will allow us to register the falcon with ACR, and further customise its behaviour by providing the nvkm_falcon_func structure directly. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/pmu: select implementation based on available firmwareBen Skeggs
This will allow for further customisation of the subdev depending on what firmware is available. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/pmu/gp10b: split from gm20b implementationBen Skeggs
ACR LS FW loading is moving out of SECBOOT and into their specific subdevs, and the available GM20B/GP10B FWs have interface differences. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/gsp: initialise SW state for falcon from constructorBen Skeggs
This will allow us to register the falcon with ACR, and further customise its behaviour by providing the nvkm_falcon_func structure directly. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/gsp: select implementation based on available firmwareBen Skeggs
This will allow for further customisation of the subdev depending on what firmware is available. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/acr: add loaders for currently available LS firmware imagesBen Skeggs
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/acr: add stub implementation for all GPUs currently supported by ↵Ben Skeggs
SECBOOT PMU, SEC2 and GR will be modified to register their falcons with ACR before the main commit switching everything over. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/core: define ACR subdevBen Skeggs
This will replace the current SECBOOT subdev for handling firmware on secure falcons. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/core: add representation of generic binary objectsBen Skeggs
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/core: add a macro to better handle multiple firmware versionsBen Skeggs
Will be used in upcoming commits to allow subdevs to better customise themselves based on which (if any) firmware is available. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/core: output fw size in debug messagesBen Skeggs
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/flcn: export existing funcsBen Skeggs
These will be used in upcoming commits which will provide more customisation. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/flcn: fetch PRI address from TOP if not provided by constructorBen Skeggs
Shortcut to avoid each subdev having to do this itself. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/flcn: move fetching of configuration until first useBen Skeggs
We want to be able to register falcons with ACR during the constructor for the subdev it belongs to, however, we may not have access to the falcon's registers prior to DEVINIT. Delay touching registers until the first time the falcon is acquired. This may temporarily break secboot on non-production boards due to not being able to determine whether the falcon is in debug or production mode, the new ACR subdev will not have this issue, and it's not a use-case that's terribly important for bisectability. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/fault/gv100-: fix memory leak on module unloadBen Skeggs
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/disp/dp: fix typo when determining failsafe link configurationBen Skeggs
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/drm/ttm: Remove set but not used variable 'mem'YueHaibing
drivers/gpu/drm/nouveau/nouveau_ttm.c: In function nouveau_vram_manager_new: drivers/gpu/drm/nouveau/nouveau_ttm.c:66:22: warning: variable mem set but not used [-Wunused-but-set-variable] drivers/gpu/drm/nouveau/nouveau_ttm.c: In function nouveau_gart_manager_new: drivers/gpu/drm/nouveau/nouveau_ttm.c:106:22: warning: variable mem set but not used [-Wunused-but-set-variable] They are not used any more, so remove it. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau: Fix copy-paste error in nouveau_fence_wait_uevent_handlerYueHaibing
Like other cases, it should use rcu protected 'chan' rather than 'fence->channel' in nouveau_fence_wait_uevent_handler. Fixes: 0ec5f02f0e2c ("drm/nouveau: prevent stale fence->channel pointers, and protect with rcu") Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/gr/gv100-: modify gr init to match newer version of RMBen Skeggs
Will be used as a basis for implementing changes needed for Turing. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/gr/gk20a,gm200-: add terminators to method lists read from fwBen Skeggs
Method init is typically ordered by class in the FW image as ThreeD, TwoD, Compute. Due to a bug in parsing the FW into our internal format, we've been accidentally sending Twod + Compute methods to the ThreeD class, as well as Compute methods to the TwoD class - oops. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/gr/gf100-: remove dtorBen Skeggs
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/fault/tu102: define nvkm_fault_func.pinBen Skeggs
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/core: fix missing newline in fw loader error messageBen Skeggs
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/secboot/gm20b: initialize pointer in gm20b_secboot_new()Dan Carpenter
We accidentally set "psb" which is a no-op instead of "*psb" so it generates a static checker warning. We should probably set it before the first error return so that it's always initialized. Fixes: 923f1bd27bf1 ("drm/nouveau/secboot/gm20b: add secure boot support") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/mmu: Add correct turing page kindsJames Jones
Turing introduced a new simplified page kind scheme, reducing the number of possible page kinds from 256 to 16. It also is the first NVIDIA GPU in which the highest possible page kind value is not reserved as an "invalid" page kind. To address this, the invalid page kind is made an explicit property of the MMU HAL, and a new table of page kinds is added to the tu102 MMU HAL. One hardware change not addressed here is that 0x00 is technically no longer a supported page kind, and pitch surfaces are instead intended to share the block-linear generic page kind 0x06. However, because that will be a rather invasive change to nouveau and 0x00 still works fine in practice on Turing hardware, addressing this new behavior is deferred. Signed-off-by: James Jones <jajones@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau: Fix ttm move init with multiple GPUsJames Jones
The pointer used to walk the table of move ops and pick the right one for the current GPU was declared static, meaning its state was carried over between invocations of the function, and also made the function non-rentrant and thread-unsafe. Since the table is ordered such that newer GPU methods are listed first, the result of this was that initializing newer GPUs after older GPUs would result in no suitable ttm move acceleration operations being found, and ttm would fall back to CPU blits on the older GPUs. This change declares the walking pointer separately from the table and makes it non-static to fix the logic. Signed-off-by: James Jones <jajones@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau: use NULL for pointer assignment.Wambui Karuga
Replace the use of 0 in the pointer assignment with NULL to address the following sparse warning: drivers/gpu/drm/nouveau/nouveau_hwmon.c:744:29: warning: Using plain integer as NULL pointer Signed-off-by: Wambui Karuga <wambui.karugax@gmail.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/kms/nv04: remove set but unused variable.Wambui Karuga
The local variable `pclks` is defined and set but not used and can therefore be removed. Issue found by coccinelle. Signed-off-by: Wambui Karuga <wambui.karugax@gmail.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/fb/gf100-: declare constants as unsigned long long.Wambui Karuga
Explicitly declare constants as unsigned long long to address the following sparse warnings: warning: constant is so big it is long v2: convert to unsigned long long for compatibility with 32-bit architectures. Signed-off-by: Wambui Karuga <wambui.karugax@gmail.com> Suggested by: lia Mirkin <imirkin@alum.mit.edu> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/kms/nv04-nv4x: Use match_string() helper to simplify the codeYueHaibing
match_string() returns the array index of a matching string. Use it instead of the open-coded implementation. Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/ce/gp10b: Use correct copy engineThierry Reding
gp10b uses the new engine enumeration mechanism introduced in the Pascal architecture. As a result, the copy engine, which used to be at index 2 for prior Tegra GPU instantiations, has now moved to index 0. Fix up the index and also use the gp100 variant of the copy engine class because on gp10b the PASCAL_DMA_COPY_B class is not supported. Signed-off-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/ltc/gp10b: Add custom L2 cache implementationThierry Reding
There are extra registers that need to be programmed to make the level 2 cache work on GP10B, such as the stream ID register that is used when an SMMU is used to translate memory addresses. Signed-off-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/secboot/gm20b,gp10b: Read WPR configuration from GPU registersThierry Reding
The GPUs found on Tegra SoCs have registers that can be used to read the WPR configuration. Use these registers instead of reaching into the memory controller's register space to read the same information. Signed-off-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/tegra: Set clock rate if not setThierry Reding
If the GPU clock has not had a rate set, initialize it to the maximum clock rate to make sure it does run. Signed-off-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/tegra: Avoid pulsing reset twiceThierry Reding
When the GPU powergate is controlled by a generic power domain provider, the reset will automatically be asserted and deasserted as part of the power-ungating procedure. On some Jetson TX2 boards, doing an additional assert and deassert of the GPU outside of the power-ungate procedure can cause the GPU to go into a bad state where the memory interface can no longer access system memory. Signed-off-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau: Do not try to disable PCI device on TegraThierry Reding
When Nouveau is instantiated on top of a platform device, the dev->pdev field will be NULL and calling pci_disable_device() will crash. Move the PCI disabling code to the PCI specific driver removal code. Signed-off-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/fault: Add support for GP10BThierry Reding
There is no BAR2 on GP10B and there is no need to map through BAR2 because all memory is shared between the GPU and the CPU. Add a custom implementation of the fault sub-device that uses nvkm_memory_addr() instead of nvkm_memory_bar2() to return the address of a pinned fault buffer. Signed-off-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/nouveau: fix incorrect sizeof on args.src an args.dstColin Ian King
The sizeof is currently on args.src and args.dst and should be on *args.src and *args.dst. Fortunately these sizes just so happen to be the same size so it worked, however, this should be fixed and it also cleans up static analysis warnings Addresses-Coverity: ("sizeof not portable") Fixes: f268307ec7c7 ("nouveau: simplify nouveau_dmem_migrate_vma") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/kms/nv50-: Report possible_crtcs incorrectly on mstos, for nowLyude Paul
This commit is seperate from the previous one to make it easier to revert in the future. Basically, while working on making MSTOs per-head as opposed to per-head-per-connector I discovered these lovely issues: https://gitlab.freedesktop.org/xorg/xserver/merge_requests/277 https://gitlab.gnome.org/GNOME/mutter/issues/759 Note as well that Intel already has a temporary workaround for this in their kernel driver. So, unfortunately we need to follow suit to avoid causing a regression in userspace. Once these issues get fixed, this commit should be reverted. Signed-off-by: Lyude Paul <lyude@redhat.com> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/kms/nv50-: Use less encoders by making mstos per-headLyude Paul
Currently, for every single MST capable DRM connector we create a set of fake encoders, one for each possible head. Unfortunately this ends up being a huge waste of encoders. While this currently isn't causing us any problems, it's extremely close to doing so. The ThinkPad P71 is a good example of this. Originally when trying to figure out why nouveau was failing to load on this laptop, I discovered it was because nouveau was creating too many encoders. This ended up being because we were mistakenly creating MST encoders for the eDP port, however we are still extremely close to hitting the encoder limit on this machine as it exposes 1 eDP port and 5 DP ports, resulting in 31 encoders. So while this fix didn't end up being necessary to fix the P71, we still need to implement this so that we avoid hitting the encoder limit for valid display configurations in the event that some machine with more connectors then this becomes available. Plus, we don't want to let good code go to waste :) So, use less encoders by only creating one MSTO per head. Then, attach each new MSTC to each MSTO which corresponds to a head that it's parent DP port is capable of using. This brings the number of encoders we register on the ThinkPad P71 from 31, down to just 15. Yay! Signed-off-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/kms/nv50-: Remove nv50_mstc_best_encoder()Lyude Paul
When drm_connector_helper_funcs->atomic_best_encoder is defined, ->best_encoder is ignored by the atomic modesetting helpers. That being said, this hook is completely broken anyway - it always returns the first msto for a given mstc, despite the fact it might already be in use. So, just get rid of it. We'll need this in a moment anyway, when we make mstos per-head as opposed to per-connector. Changes since v1: * Fix typo in documentation - imirkin Signed-off-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/kms/gf119-: allow both 256- and 1024-sized LUTs to be usedIlia Mirkin
The hardware supports either size. Also add checks to ensure that only these two sizes may be used for supplying a LUT. Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-15drm/nouveau/gr/gk208-gm10x: regenerate built-in firmwareBen Skeggs
Commit 5fde30a2684041f9820aa9dc4fbd0009a45076a9 in envytools modified some of the Falcon V5 encodings, regenerate the relevant FW with this. Also modify build rules to include SPDX header in generated files. Tested on GM107, with no issues noted. Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2020-01-14Merge tag 'nfs-for-5.5-2' of git://git.linux-nfs.org/projects/anna/linux-nfsLinus Torvalds
Pull NFS client bugfixes from Anna Schumaker: "Three NFS over RDMA fixes for bugs Chuck found that can be hit during device removal: - Fix create_qp crash on device unload - Fix completion wait during device removal - Fix oops in receive handler after device removal" * tag 'nfs-for-5.5-2' of git://git.linux-nfs.org/projects/anna/linux-nfs: xprtrdma: Fix oops in Receive handler after device removal xprtrdma: Fix completion wait during device removal xprtrdma: Fix create_qp crash on device unload
2020-01-14block: fix get_max_segment_size() overflow on 32bit archMing Lei
Commit 429120f3df2d starts to take account of segment's start dma address when computing max segment size, and data type of 'unsigned long' is used to do that. However, the segment mask may be 0xffffffff, so the figured out segment size may be overflowed in case of zero physical address on 32bit arch. Fix the issue by returning queue_max_segment_size() directly when that happens. Fixes: 429120f3df2d ("block: fix splitting segments on boundary masks") Reported-by: Guenter Roeck <linux@roeck-us.net> Tested-by: Guenter Roeck <linux@roeck-us.net> Cc: Christoph Hellwig <hch@lst.de> Tested-by: Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-01-14hv_sock: Remove the accept port restrictionSunil Muthuswamy
Currently, hv_sock restricts the port the guest socket can accept connections on. hv_sock divides the socket port namespace into two parts for server side (listening socket), 0-0x7FFFFFFF & 0x80000000-0xFFFFFFFF (there are no restrictions on client port namespace). The first part (0-0x7FFFFFFF) is reserved for sockets where connections can be accepted. The second part (0x80000000-0xFFFFFFFF) is reserved for allocating ports for the peer (host) socket, once a connection is accepted. This reservation of the port namespace is specific to hv_sock and not known by the generic vsock library (ex: af_vsock). This is problematic because auto-binds/ephemeral ports are handled by the generic vsock library and it has no knowledge of this port reservation and could allocate a port that is not compatible with hv_sock (and legitimately so). The issue hasn't surfaced so far because the auto-bind code of vsock (__vsock_bind_stream) prior to the change 'VSOCK: bind to random port for VMADDR_PORT_ANY' would start walking up from LAST_RESERVED_PORT (1023) and start assigning ports. That will take a large number of iterations to hit 0x7FFFFFFF. But, after the above change to randomize port selection, the issue has started coming up more frequently. There has really been no good reason to have this port reservation logic in hv_sock from the get go. Reserving a local port for peer ports is not how things are handled generally. Peer ports should reflect the peer port. This fixes the issue by lifting the port reservation, and also returns the right peer port. Since the code converts the GUID to the peer port (by using the first 4 bytes), there is a possibility of conflicts, but that seems like a reasonable risk to take, given this is limited to vsock and that only applies to all local sockets. Signed-off-by: Sunil Muthuswamy <sunilmut@microsoft.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-14net: usb: lan78xx: limit size of local TSO packetsEric Dumazet
lan78xx_tx_bh() makes sure to not exceed MAX_SINGLE_PACKET_SIZE bytes in the aggregated packets it builds, but does nothing to prevent large GSO packets being submitted. Pierre-Francois reported various hangs when/if TSO is enabled. For localy generated packets, we can use netif_set_gso_max_size() to limit the size of TSO packets. Note that forwarded packets could still hit the issue, so a complete fix might require implementing .ndo_features_check for this driver, forcing a software segmentation if the size of the TSO packet exceeds MAX_SINGLE_PACKET_SIZE. Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: RENARD Pierre-Francois <pfrenard@gmail.com> Tested-by: RENARD Pierre-Francois <pfrenard@gmail.com> Cc: Stefan Wahren <stefan.wahren@i2se.com> Cc: Woojung Huh <woojung.huh@microchip.com> Cc: Microchip Linux Driver Support <UNGLinuxDriver@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-14ptp: free ptp device pin descriptors properlyVladis Dronov
There is a bug in ptp_clock_unregister(), where ptp_cleanup_pin_groups() first frees ptp->pin_{,dev_}attr, but then posix_clock_unregister() needs them to destroy a related sysfs device. These functions can not be just swapped, as posix_clock_unregister() frees ptp which is needed in the ptp_cleanup_pin_groups(). Fix this by calling ptp_cleanup_pin_groups() in ptp_clock_release(), right before ptp is freed. This makes this patch fix an UAF bug in a patch which fixes an UAF bug. Reported-by: Antti Laakso <antti.laakso@intel.com> Fixes: a33121e5487b ("ptp: fix the race between the release of ptp_clock and cdev") Link: https://lore.kernel.org/netdev/3d2bd09735dbdaf003585ca376b7c1e5b69a19bd.camel@intel.com/ Signed-off-by: Vladis Dronov <vdronov@redhat.com> Acked-by: Richard Cochran <richardcochran@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-14drm/dp_mst: clear time slots for ports invalidWayne Lin
[Why] When change the connection status in a MST topology, mst device which detect the event will send out CONNECTION_STATUS_NOTIFY messgae. e.g. src-mst-mst-sst => src-mst (unplug) mst-sst Currently, under the above case of unplugging device, ports which have been allocated payloads and are no longer in the topology still occupy time slots and recorded in proposed_vcpi[] of topology manager. If we don't clean up the proposed_vcpi[], when code flow goes to try to update payload table by calling drm_dp_update_payload_part1(), we will fail at checking port validation due to there are ports with proposed time slots but no longer in the mst topology. As the result of that, we will also stop updating the DPCD payload table of down stream port. [How] While handling the CONNECTION_STATUS_NOTIFY message, add a detection to see if the event indicates that a device is unplugged to an output port. If the detection is true, then iterrate over all proposed_vcpi[] to see whether a port of the proposed_vcpi[] is still in the topology or not. If the port is invalid, set its num_slots to 0. Thereafter, when try to update payload table by calling drm_dp_update_payload_part1(), we can successfully update the DPCD payload table of down stream port and clear the proposed_vcpi[] to NULL. Changes since v1:(https://patchwork.kernel.org/patch/11275801/) * Invert the conditional to reduce the indenting Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Wayne Lin <Wayne.Lin@amd.com> Signed-off-by: Lyude Paul <lyude@redhat.com> [removed cc for stable - there's too many patches this depends on for this to backport cleanly] Link: https://patchwork.freedesktop.org/patch/msgid/20200106102158.28261-1-Wayne.Lin@amd.com
2020-01-14xprtrdma: Fix oops in Receive handler after device removalChuck Lever
Since v5.4, a device removal occasionally triggered this oops: Dec 2 17:13:53 manet kernel: BUG: unable to handle page fault for address: 0000000c00000219 Dec 2 17:13:53 manet kernel: #PF: supervisor read access in kernel mode Dec 2 17:13:53 manet kernel: #PF: error_code(0x0000) - not-present page Dec 2 17:13:53 manet kernel: PGD 0 P4D 0 Dec 2 17:13:53 manet kernel: Oops: 0000 [#1] SMP Dec 2 17:13:53 manet kernel: CPU: 2 PID: 468 Comm: kworker/2:1H Tainted: G W 5.4.0-00050-g53717e43af61 #883 Dec 2 17:13:53 manet kernel: Hardware name: Supermicro SYS-6028R-T/X10DRi, BIOS 1.1a 10/16/2015 Dec 2 17:13:53 manet kernel: Workqueue: ib-comp-wq ib_cq_poll_work [ib_core] Dec 2 17:13:53 manet kernel: RIP: 0010:rpcrdma_wc_receive+0x7c/0xf6 [rpcrdma] Dec 2 17:13:53 manet kernel: Code: 6d 8b 43 14 89 c1 89 45 78 48 89 4d 40 8b 43 2c 89 45 14 8b 43 20 89 45 18 48 8b 45 20 8b 53 14 48 8b 30 48 8b 40 10 48 8b 38 <48> 8b 87 18 02 00 00 48 85 c0 75 18 48 8b 05 1e 24 c4 e1 48 85 c0 Dec 2 17:13:53 manet kernel: RSP: 0018:ffffc900035dfe00 EFLAGS: 00010246 Dec 2 17:13:53 manet kernel: RAX: ffff888467290000 RBX: ffff88846c638400 RCX: 0000000000000048 Dec 2 17:13:53 manet kernel: RDX: 0000000000000048 RSI: 00000000f942e000 RDI: 0000000c00000001 Dec 2 17:13:53 manet kernel: RBP: ffff888467611b00 R08: ffff888464e4a3c4 R09: 0000000000000000 Dec 2 17:13:53 manet kernel: R10: ffffc900035dfc88 R11: fefefefefefefeff R12: ffff888865af4428 Dec 2 17:13:53 manet kernel: R13: ffff888466023000 R14: ffff88846c63f000 R15: 0000000000000010 Dec 2 17:13:53 manet kernel: FS: 0000000000000000(0000) GS:ffff88846fa80000(0000) knlGS:0000000000000000 Dec 2 17:13:53 manet kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Dec 2 17:13:53 manet kernel: CR2: 0000000c00000219 CR3: 0000000002009002 CR4: 00000000001606e0 Dec 2 17:13:53 manet kernel: Call Trace: Dec 2 17:13:53 manet kernel: __ib_process_cq+0x5c/0x14e [ib_core] Dec 2 17:13:53 manet kernel: ib_cq_poll_work+0x26/0x70 [ib_core] Dec 2 17:13:53 manet kernel: process_one_work+0x19d/0x2cd Dec 2 17:13:53 manet kernel: ? cancel_delayed_work_sync+0xf/0xf Dec 2 17:13:53 manet kernel: worker_thread+0x1a6/0x25a Dec 2 17:13:53 manet kernel: ? cancel_delayed_work_sync+0xf/0xf Dec 2 17:13:53 manet kernel: kthread+0xf4/0xf9 Dec 2 17:13:53 manet kernel: ? kthread_queue_delayed_work+0x74/0x74 Dec 2 17:13:53 manet kernel: ret_from_fork+0x24/0x30 The proximal cause is that this rpcrdma_rep has a rr_rdmabuf that is still pointing to the old ib_device, which has been freed. The only way that is possible is if this rpcrdma_rep was not destroyed by rpcrdma_ia_remove. Debugging showed that was indeed the case: this rpcrdma_rep was still in use by a completing RPC at the time of the device removal, and thus wasn't on the rep free list. So, it was not found by rpcrdma_reps_destroy(). The fix is to introduce a list of all rpcrdma_reps so that they all can be found when a device is removed. That list is used to perform only regbuf DMA unmapping, replacing that call to rpcrdma_reps_destroy(). Meanwhile, to prevent corruption of this list, I've moved the destruction of temp rpcrdma_rep objects to rpcrdma_post_recvs(). rpcrdma_xprt_drain() ensures that post_recvs (and thus rep_destroy) is not invoked while rpcrdma_reps_unmap is walking rb_all_reps, thus protecting the rb_all_reps list. Fixes: b0b227f071a0 ("xprtrdma: Use an llist to manage free rpcrdma_reps") Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>