| Message ID | 20240819100606.15383-2-larysa.zaremba@intel.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | ice: fix synchronization between .ndo_bpf() and reset | expand |
On Mon, Aug 19, 2024 at 12:05:38PM +0200, Larysa Zaremba wrote: > Currently, netif_queue_set_napi() is called from ice_vsi_rebuild() that is > not rtnl-locked when called from the reset. This creates the need to take > the rtnl_lock just for a single function and complicates the > synchronization with .ndo_bpf. At the same time, there no actual need to > fill napi-to-queue information at this exact point. > > Fill napi-to-queue information when opening the VSI and clear it when the > VSI is being closed. Those routines are already rtnl-locked. > > Also, rewrite napi-to-queue assignment in a way that prevents inclusion of > XDP queues, as this leads to out-of-bounds writes, such as one below. > > [ +0.000004] BUG: KASAN: slab-out-of-bounds in netif_queue_set_napi+0x1c2/0x1e0 > [ +0.000012] Write of size 8 at addr ffff889881727c80 by task bash/7047 > [ +0.000006] CPU: 24 PID: 7047 Comm: bash Not tainted 6.10.0-rc2+ #2 > [ +0.000004] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021 > [ +0.000003] Call Trace: > [ +0.000003] <TASK> > [ +0.000002] dump_stack_lvl+0x60/0x80 > [ +0.000007] print_report+0xce/0x630 > [ +0.000007] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 > [ +0.000007] ? __virt_addr_valid+0x1c9/0x2c0 > [ +0.000005] ? netif_queue_set_napi+0x1c2/0x1e0 > [ +0.000003] kasan_report+0xe9/0x120 > [ +0.000004] ? netif_queue_set_napi+0x1c2/0x1e0 > [ +0.000004] netif_queue_set_napi+0x1c2/0x1e0 > [ +0.000005] ice_vsi_close+0x161/0x670 [ice] > [ +0.000114] ice_dis_vsi+0x22f/0x270 [ice] > [ +0.000095] ice_pf_dis_all_vsi.constprop.0+0xae/0x1c0 [ice] > [ +0.000086] ice_prepare_for_reset+0x299/0x750 [ice] > [ +0.000087] pci_dev_save_and_disable+0x82/0xd0 > [ +0.000006] pci_reset_function+0x12d/0x230 > [ +0.000004] reset_store+0xa0/0x100 > [ +0.000006] ? __pfx_reset_store+0x10/0x10 > [ +0.000002] ? __pfx_mutex_lock+0x10/0x10 > [ +0.000004] ? __check_object_size+0x4c1/0x640 > [ +0.000007] kernfs_fop_write_iter+0x30b/0x4a0 > [ +0.000006] vfs_write+0x5d6/0xdf0 > [ +0.000005] ? fd_install+0x180/0x350 > [ +0.000005] ? __pfx_vfs_write+0x10/0xA10 > [ +0.000004] ? do_fcntl+0x52c/0xcd0 > [ +0.000004] ? kasan_save_track+0x13/0x60 > [ +0.000003] ? kasan_save_free_info+0x37/0x60 > [ +0.000006] ksys_write+0xfa/0x1d0 > [ +0.000003] ? __pfx_ksys_write+0x10/0x10 > [ +0.000002] ? __x64_sys_fcntl+0x121/0x180 > [ +0.000004] ? _raw_spin_lock+0x87/0xe0 > [ +0.000005] do_syscall_64+0x80/0x170 > [ +0.000007] ? _raw_spin_lock+0x87/0xe0 > [ +0.000004] ? __pfx__raw_spin_lock+0x10/0x10 > [ +0.000003] ? file_close_fd_locked+0x167/0x230 > [ +0.000005] ? syscall_exit_to_user_mode+0x7d/0x220 > [ +0.000005] ? do_syscall_64+0x8c/0x170 > [ +0.000004] ? do_syscall_64+0x8c/0x170 > [ +0.000003] ? do_syscall_64+0x8c/0x170 > [ +0.000003] ? fput+0x1a/0x2c0 > [ +0.000004] ? filp_close+0x19/0x30 > [ +0.000004] ? do_dup2+0x25a/0x4c0 > [ +0.000004] ? __x64_sys_dup2+0x6e/0x2e0 > [ +0.000002] ? syscall_exit_to_user_mode+0x7d/0x220 > [ +0.000004] ? do_syscall_64+0x8c/0x170 > [ +0.000003] ? __count_memcg_events+0x113/0x380 > [ +0.000005] ? handle_mm_fault+0x136/0x820 > [ +0.000005] ? do_user_addr_fault+0x444/0xa80 > [ +0.000004] ? clear_bhb_loop+0x25/0x80 > [ +0.000004] ? clear_bhb_loop+0x25/0x80 > [ +0.000002] entry_SYSCALL_64_after_hwframe+0x76/0x7e > [ +0.000005] RIP: 0033:0x7f2033593154 > > Fixes: 080b0c8d6d26 ("ice: Fix ASSERT_RTNL() warning during certain scenarios") Shouldn't you include: Fixes: 91fdbce7e8d6 ("ice: Add support in the driver for associating queue with napi") as we were iterating over XDP rings that were attached to q_vectors from the very beginning? > Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com> > Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> > Reviewed-by: Amritha Nambiar <amritha.nambiar@intel.com> > Tested-by: Chandan Kumar Rout <chandanx.rout@intel.com> > Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> > --- > drivers/net/ethernet/intel/ice/ice_base.c | 11 +- > drivers/net/ethernet/intel/ice/ice_lib.c | 129 ++++++---------------- > drivers/net/ethernet/intel/ice/ice_lib.h | 10 +- > drivers/net/ethernet/intel/ice/ice_main.c | 17 ++- > 4 files changed, 49 insertions(+), 118 deletions(-) > > diff --git a/drivers/net/ethernet/intel/ice/ice_base.c b/drivers/net/ethernet/intel/ice/ice_base.c > index f448d3a84564..c158749a80e0 100644 > --- a/drivers/net/ethernet/intel/ice/ice_base.c > +++ b/drivers/net/ethernet/intel/ice/ice_base.c > @@ -190,16 +190,11 @@ static void ice_free_q_vector(struct ice_vsi *vsi, int v_idx) > } > q_vector = vsi->q_vectors[v_idx]; > > - ice_for_each_tx_ring(tx_ring, q_vector->tx) { > - ice_queue_set_napi(vsi, tx_ring->q_index, NETDEV_QUEUE_TYPE_TX, > - NULL); > + ice_for_each_tx_ring(tx_ring, vsi->q_vectors[v_idx]->tx) > tx_ring->q_vector = NULL; > - } > - ice_for_each_rx_ring(rx_ring, q_vector->rx) { > - ice_queue_set_napi(vsi, rx_ring->q_index, NETDEV_QUEUE_TYPE_RX, > - NULL); > + > + ice_for_each_rx_ring(rx_ring, vsi->q_vectors[v_idx]->rx) > rx_ring->q_vector = NULL; > - } > > /* only VSI with an associated netdev is set up with NAPI */ > if (vsi->netdev) > diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c > index 03c4df4ed585..5f2ddcaf7031 100644 > --- a/drivers/net/ethernet/intel/ice/ice_lib.c > +++ b/drivers/net/ethernet/intel/ice/ice_lib.c > @@ -2286,9 +2286,6 @@ static int ice_vsi_cfg_def(struct ice_vsi *vsi) > > ice_vsi_map_rings_to_vectors(vsi); > > - /* Associate q_vector rings to napi */ > - ice_vsi_set_napi_queues(vsi); > - > vsi->stat_offsets_loaded = false; > > /* ICE_VSI_CTRL does not need RSS so skip RSS processing */ > @@ -2621,6 +2618,7 @@ void ice_vsi_close(struct ice_vsi *vsi) > if (!test_and_set_bit(ICE_VSI_DOWN, vsi->state)) > ice_down(vsi); > > + ice_vsi_clear_napi_queues(vsi); > ice_vsi_free_irq(vsi); > ice_vsi_free_tx_rings(vsi); > ice_vsi_free_rx_rings(vsi); > @@ -2687,120 +2685,55 @@ void ice_dis_vsi(struct ice_vsi *vsi, bool locked) > } > > /** > - * __ice_queue_set_napi - Set the napi instance for the queue > - * @dev: device to which NAPI and queue belong > - * @queue_index: Index of queue > - * @type: queue type as RX or TX > - * @napi: NAPI context > - * @locked: is the rtnl_lock already held > - * > - * Set the napi instance for the queue. Caller indicates the lock status. > - */ > -static void > -__ice_queue_set_napi(struct net_device *dev, unsigned int queue_index, > - enum netdev_queue_type type, struct napi_struct *napi, > - bool locked) > -{ > - if (!locked) > - rtnl_lock(); > - netif_queue_set_napi(dev, queue_index, type, napi); > - if (!locked) > - rtnl_unlock(); > -} > - > -/** > - * ice_queue_set_napi - Set the napi instance for the queue > - * @vsi: VSI being configured > - * @queue_index: Index of queue > - * @type: queue type as RX or TX > - * @napi: NAPI context > + * ice_vsi_set_napi_queues > + * @vsi: VSI pointer > * > - * Set the napi instance for the queue. The rtnl lock state is derived from the > - * execution path. > + * Associate queue[s] with napi for all vectors. > + * The caller must hold rtnl_lock. > */ > -void > -ice_queue_set_napi(struct ice_vsi *vsi, unsigned int queue_index, > - enum netdev_queue_type type, struct napi_struct *napi) > +void ice_vsi_set_napi_queues(struct ice_vsi *vsi) this appears to be called only in ice_main.c. It should be moved there and made a static function instead of having it in ice_lib.c. Unless I overlooked something... > { > - struct ice_pf *pf = vsi->back; > + struct net_device *netdev = vsi->netdev; > + int q_idx, v_idx; > > - if (!vsi->netdev) > + if (!netdev) > return; > > - if (current_work() == &pf->serv_task || > - test_bit(ICE_PREPARED_FOR_RESET, pf->state) || > - test_bit(ICE_DOWN, pf->state) || > - test_bit(ICE_SUSPENDED, pf->state)) > - __ice_queue_set_napi(vsi->netdev, queue_index, type, napi, > - false); > - else > - __ice_queue_set_napi(vsi->netdev, queue_index, type, napi, > - true); > -} > + ice_for_each_rxq(vsi, q_idx) > + netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_RX, > + &vsi->rx_rings[q_idx]->q_vector->napi); > > -/** > - * __ice_q_vector_set_napi_queues - Map queue[s] associated with the napi > - * @q_vector: q_vector pointer > - * @locked: is the rtnl_lock already held > - * > - * Associate the q_vector napi with all the queue[s] on the vector. > - * Caller indicates the lock status. > - */ > -void __ice_q_vector_set_napi_queues(struct ice_q_vector *q_vector, bool locked) > -{ > - struct ice_rx_ring *rx_ring; > - struct ice_tx_ring *tx_ring; > - > - ice_for_each_rx_ring(rx_ring, q_vector->rx) > - __ice_queue_set_napi(q_vector->vsi->netdev, rx_ring->q_index, > - NETDEV_QUEUE_TYPE_RX, &q_vector->napi, > - locked); > - > - ice_for_each_tx_ring(tx_ring, q_vector->tx) > - __ice_queue_set_napi(q_vector->vsi->netdev, tx_ring->q_index, > - NETDEV_QUEUE_TYPE_TX, &q_vector->napi, > - locked); > + ice_for_each_txq(vsi, q_idx) > + netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_TX, > + &vsi->tx_rings[q_idx]->q_vector->napi); > /* Also set the interrupt number for the NAPI */ > - netif_napi_set_irq(&q_vector->napi, q_vector->irq.virq); > -} > - > -/** > - * ice_q_vector_set_napi_queues - Map queue[s] associated with the napi > - * @q_vector: q_vector pointer > - * > - * Associate the q_vector napi with all the queue[s] on the vector > - */ > -void ice_q_vector_set_napi_queues(struct ice_q_vector *q_vector) > -{ > - struct ice_rx_ring *rx_ring; > - struct ice_tx_ring *tx_ring; > - > - ice_for_each_rx_ring(rx_ring, q_vector->rx) > - ice_queue_set_napi(q_vector->vsi, rx_ring->q_index, > - NETDEV_QUEUE_TYPE_RX, &q_vector->napi); > + ice_for_each_q_vector(vsi, v_idx) { > + struct ice_q_vector *q_vector = vsi->q_vectors[v_idx]; > > - ice_for_each_tx_ring(tx_ring, q_vector->tx) > - ice_queue_set_napi(q_vector->vsi, tx_ring->q_index, > - NETDEV_QUEUE_TYPE_TX, &q_vector->napi); > - /* Also set the interrupt number for the NAPI */ > - netif_napi_set_irq(&q_vector->napi, q_vector->irq.virq); > + netif_napi_set_irq(&q_vector->napi, q_vector->irq.virq); > + } > } > > /** > - * ice_vsi_set_napi_queues > + * ice_vsi_clear_napi_queues > * @vsi: VSI pointer > * > - * Associate queue[s] with napi for all vectors > + * Clear the association between all VSI queues queue[s] and napi. > + * The caller must hold rtnl_lock. > */ > -void ice_vsi_set_napi_queues(struct ice_vsi *vsi) > +void ice_vsi_clear_napi_queues(struct ice_vsi *vsi) > { > - int i; > + struct net_device *netdev = vsi->netdev; > + int q_idx; > > - if (!vsi->netdev) > + if (!netdev) > return; > > - ice_for_each_q_vector(vsi, i) > - ice_q_vector_set_napi_queues(vsi->q_vectors[i]); > + ice_for_each_txq(vsi, q_idx) > + netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_TX, NULL); > + > + ice_for_each_rxq(vsi, q_idx) > + netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_RX, NULL); > } > > /** > diff --git a/drivers/net/ethernet/intel/ice/ice_lib.h b/drivers/net/ethernet/intel/ice/ice_lib.h > index 94ce8964dda6..36d86535695d 100644 > --- a/drivers/net/ethernet/intel/ice/ice_lib.h > +++ b/drivers/net/ethernet/intel/ice/ice_lib.h > @@ -44,16 +44,10 @@ void ice_vsi_cfg_netdev_tc(struct ice_vsi *vsi, u8 ena_tc); > struct ice_vsi * > ice_vsi_setup(struct ice_pf *pf, struct ice_vsi_cfg_params *params); > > -void > -ice_queue_set_napi(struct ice_vsi *vsi, unsigned int queue_index, > - enum netdev_queue_type type, struct napi_struct *napi); > - > -void __ice_q_vector_set_napi_queues(struct ice_q_vector *q_vector, bool locked); > - > -void ice_q_vector_set_napi_queues(struct ice_q_vector *q_vector); > - > void ice_vsi_set_napi_queues(struct ice_vsi *vsi); > > +void ice_vsi_clear_napi_queues(struct ice_vsi *vsi); > + > int ice_vsi_release(struct ice_vsi *vsi); > > void ice_vsi_close(struct ice_vsi *vsi); > diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c > index 66820ed5e969..2d286a4609a5 100644 > --- a/drivers/net/ethernet/intel/ice/ice_main.c > +++ b/drivers/net/ethernet/intel/ice/ice_main.c > @@ -3537,11 +3537,9 @@ static void ice_napi_add(struct ice_vsi *vsi) > if (!vsi->netdev) > return; > > - ice_for_each_q_vector(vsi, v_idx) { > + ice_for_each_q_vector(vsi, v_idx) > netif_napi_add(vsi->netdev, &vsi->q_vectors[v_idx]->napi, > ice_napi_poll); > - __ice_q_vector_set_napi_queues(vsi->q_vectors[v_idx], false); > - } > } > > /** > @@ -5519,7 +5517,9 @@ static int ice_reinit_interrupt_scheme(struct ice_pf *pf) > if (ret) > goto err_reinit; > ice_vsi_map_rings_to_vectors(pf->vsi[v]); > + rtnl_lock(); > ice_vsi_set_napi_queues(pf->vsi[v]); > + rtnl_unlock(); > } > > ret = ice_req_irq_msix_misc(pf); > @@ -5533,8 +5533,12 @@ static int ice_reinit_interrupt_scheme(struct ice_pf *pf) > > err_reinit: > while (v--) > - if (pf->vsi[v]) > + if (pf->vsi[v]) { > + rtnl_lock(); > + ice_vsi_clear_napi_queues(pf->vsi[v]); > + rtnl_unlock(); > ice_vsi_free_q_vectors(pf->vsi[v]); > + } > > return ret; > } > @@ -5599,6 +5603,9 @@ static int ice_suspend(struct device *dev) > ice_for_each_vsi(pf, v) { > if (!pf->vsi[v]) > continue; > + rtnl_lock(); > + ice_vsi_clear_napi_queues(pf->vsi[v]); > + rtnl_unlock(); > ice_vsi_free_q_vectors(pf->vsi[v]); > } > ice_clear_interrupt_scheme(pf); > @@ -7434,6 +7441,8 @@ int ice_vsi_open(struct ice_vsi *vsi) > err = netif_set_real_num_rx_queues(vsi->netdev, vsi->num_rxq); > if (err) > goto err_set_qs; > + > + ice_vsi_set_napi_queues(vsi); > } > > err = ice_up_complete(vsi); > -- > 2.43.0 >
On Tue, Aug 20, 2024 at 02:31:51PM +0200, Maciej Fijalkowski wrote: > On Mon, Aug 19, 2024 at 12:05:38PM +0200, Larysa Zaremba wrote: > > Currently, netif_queue_set_napi() is called from ice_vsi_rebuild() that is > > not rtnl-locked when called from the reset. This creates the need to take > > the rtnl_lock just for a single function and complicates the > > synchronization with .ndo_bpf. At the same time, there no actual need to > > fill napi-to-queue information at this exact point. > > > > Fill napi-to-queue information when opening the VSI and clear it when the > > VSI is being closed. Those routines are already rtnl-locked. > > > > Also, rewrite napi-to-queue assignment in a way that prevents inclusion of > > XDP queues, as this leads to out-of-bounds writes, such as one below. > > > > [ +0.000004] BUG: KASAN: slab-out-of-bounds in netif_queue_set_napi+0x1c2/0x1e0 > > [ +0.000012] Write of size 8 at addr ffff889881727c80 by task bash/7047 > > [ +0.000006] CPU: 24 PID: 7047 Comm: bash Not tainted 6.10.0-rc2+ #2 > > [ +0.000004] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021 > > [ +0.000003] Call Trace: > > [ +0.000003] <TASK> > > [ +0.000002] dump_stack_lvl+0x60/0x80 > > [ +0.000007] print_report+0xce/0x630 > > [ +0.000007] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 > > [ +0.000007] ? __virt_addr_valid+0x1c9/0x2c0 > > [ +0.000005] ? netif_queue_set_napi+0x1c2/0x1e0 > > [ +0.000003] kasan_report+0xe9/0x120 > > [ +0.000004] ? netif_queue_set_napi+0x1c2/0x1e0 > > [ +0.000004] netif_queue_set_napi+0x1c2/0x1e0 > > [ +0.000005] ice_vsi_close+0x161/0x670 [ice] > > [ +0.000114] ice_dis_vsi+0x22f/0x270 [ice] > > [ +0.000095] ice_pf_dis_all_vsi.constprop.0+0xae/0x1c0 [ice] > > [ +0.000086] ice_prepare_for_reset+0x299/0x750 [ice] > > [ +0.000087] pci_dev_save_and_disable+0x82/0xd0 > > [ +0.000006] pci_reset_function+0x12d/0x230 > > [ +0.000004] reset_store+0xa0/0x100 > > [ +0.000006] ? __pfx_reset_store+0x10/0x10 > > [ +0.000002] ? __pfx_mutex_lock+0x10/0x10 > > [ +0.000004] ? __check_object_size+0x4c1/0x640 > > [ +0.000007] kernfs_fop_write_iter+0x30b/0x4a0 > > [ +0.000006] vfs_write+0x5d6/0xdf0 > > [ +0.000005] ? fd_install+0x180/0x350 > > [ +0.000005] ? __pfx_vfs_write+0x10/0xA10 > > [ +0.000004] ? do_fcntl+0x52c/0xcd0 > > [ +0.000004] ? kasan_save_track+0x13/0x60 > > [ +0.000003] ? kasan_save_free_info+0x37/0x60 > > [ +0.000006] ksys_write+0xfa/0x1d0 > > [ +0.000003] ? __pfx_ksys_write+0x10/0x10 > > [ +0.000002] ? __x64_sys_fcntl+0x121/0x180 > > [ +0.000004] ? _raw_spin_lock+0x87/0xe0 > > [ +0.000005] do_syscall_64+0x80/0x170 > > [ +0.000007] ? _raw_spin_lock+0x87/0xe0 > > [ +0.000004] ? __pfx__raw_spin_lock+0x10/0x10 > > [ +0.000003] ? file_close_fd_locked+0x167/0x230 > > [ +0.000005] ? syscall_exit_to_user_mode+0x7d/0x220 > > [ +0.000005] ? do_syscall_64+0x8c/0x170 > > [ +0.000004] ? do_syscall_64+0x8c/0x170 > > [ +0.000003] ? do_syscall_64+0x8c/0x170 > > [ +0.000003] ? fput+0x1a/0x2c0 > > [ +0.000004] ? filp_close+0x19/0x30 > > [ +0.000004] ? do_dup2+0x25a/0x4c0 > > [ +0.000004] ? __x64_sys_dup2+0x6e/0x2e0 > > [ +0.000002] ? syscall_exit_to_user_mode+0x7d/0x220 > > [ +0.000004] ? do_syscall_64+0x8c/0x170 > > [ +0.000003] ? __count_memcg_events+0x113/0x380 > > [ +0.000005] ? handle_mm_fault+0x136/0x820 > > [ +0.000005] ? do_user_addr_fault+0x444/0xa80 > > [ +0.000004] ? clear_bhb_loop+0x25/0x80 > > [ +0.000004] ? clear_bhb_loop+0x25/0x80 > > [ +0.000002] entry_SYSCALL_64_after_hwframe+0x76/0x7e > > [ +0.000005] RIP: 0033:0x7f2033593154 > > > > Fixes: 080b0c8d6d26 ("ice: Fix ASSERT_RTNL() warning during certain scenarios") > > Shouldn't you include: > Fixes: 91fdbce7e8d6 ("ice: Add support in the driver for associating queue with napi") > > as we were iterating over XDP rings that were attached to q_vectors from > the very beginning? > I probably should have done this. > > Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com> > > Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> > > Reviewed-by: Amritha Nambiar <amritha.nambiar@intel.com> > > Tested-by: Chandan Kumar Rout <chandanx.rout@intel.com> > > Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> > > --- > > drivers/net/ethernet/intel/ice/ice_base.c | 11 +- > > drivers/net/ethernet/intel/ice/ice_lib.c | 129 ++++++---------------- > > drivers/net/ethernet/intel/ice/ice_lib.h | 10 +- > > drivers/net/ethernet/intel/ice/ice_main.c | 17 ++- > > 4 files changed, 49 insertions(+), 118 deletions(-) > > > > diff --git a/drivers/net/ethernet/intel/ice/ice_base.c b/drivers/net/ethernet/intel/ice/ice_base.c > > index f448d3a84564..c158749a80e0 100644 > > --- a/drivers/net/ethernet/intel/ice/ice_base.c > > +++ b/drivers/net/ethernet/intel/ice/ice_base.c > > @@ -190,16 +190,11 @@ static void ice_free_q_vector(struct ice_vsi *vsi, int v_idx) > > } > > q_vector = vsi->q_vectors[v_idx]; > > > > - ice_for_each_tx_ring(tx_ring, q_vector->tx) { > > - ice_queue_set_napi(vsi, tx_ring->q_index, NETDEV_QUEUE_TYPE_TX, > > - NULL); > > + ice_for_each_tx_ring(tx_ring, vsi->q_vectors[v_idx]->tx) > > tx_ring->q_vector = NULL; > > - } > > - ice_for_each_rx_ring(rx_ring, q_vector->rx) { > > - ice_queue_set_napi(vsi, rx_ring->q_index, NETDEV_QUEUE_TYPE_RX, > > - NULL); > > + > > + ice_for_each_rx_ring(rx_ring, vsi->q_vectors[v_idx]->rx) > > rx_ring->q_vector = NULL; > > - } > > > > /* only VSI with an associated netdev is set up with NAPI */ > > if (vsi->netdev) > > diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c > > index 03c4df4ed585..5f2ddcaf7031 100644 > > --- a/drivers/net/ethernet/intel/ice/ice_lib.c > > +++ b/drivers/net/ethernet/intel/ice/ice_lib.c > > @@ -2286,9 +2286,6 @@ static int ice_vsi_cfg_def(struct ice_vsi *vsi) > > > > ice_vsi_map_rings_to_vectors(vsi); > > > > - /* Associate q_vector rings to napi */ > > - ice_vsi_set_napi_queues(vsi); > > - > > vsi->stat_offsets_loaded = false; > > > > /* ICE_VSI_CTRL does not need RSS so skip RSS processing */ > > @@ -2621,6 +2618,7 @@ void ice_vsi_close(struct ice_vsi *vsi) > > if (!test_and_set_bit(ICE_VSI_DOWN, vsi->state)) > > ice_down(vsi); > > > > + ice_vsi_clear_napi_queues(vsi); > > ice_vsi_free_irq(vsi); > > ice_vsi_free_tx_rings(vsi); > > ice_vsi_free_rx_rings(vsi); > > @@ -2687,120 +2685,55 @@ void ice_dis_vsi(struct ice_vsi *vsi, bool locked) > > } > > > > /** > > - * __ice_queue_set_napi - Set the napi instance for the queue > > - * @dev: device to which NAPI and queue belong > > - * @queue_index: Index of queue > > - * @type: queue type as RX or TX > > - * @napi: NAPI context > > - * @locked: is the rtnl_lock already held > > - * > > - * Set the napi instance for the queue. Caller indicates the lock status. > > - */ > > -static void > > -__ice_queue_set_napi(struct net_device *dev, unsigned int queue_index, > > - enum netdev_queue_type type, struct napi_struct *napi, > > - bool locked) > > -{ > > - if (!locked) > > - rtnl_lock(); > > - netif_queue_set_napi(dev, queue_index, type, napi); > > - if (!locked) > > - rtnl_unlock(); > > -} > > - > > -/** > > - * ice_queue_set_napi - Set the napi instance for the queue > > - * @vsi: VSI being configured > > - * @queue_index: Index of queue > > - * @type: queue type as RX or TX > > - * @napi: NAPI context > > + * ice_vsi_set_napi_queues > > + * @vsi: VSI pointer > > * > > - * Set the napi instance for the queue. The rtnl lock state is derived from the > > - * execution path. > > + * Associate queue[s] with napi for all vectors. > > + * The caller must hold rtnl_lock. > > */ > > -void > > -ice_queue_set_napi(struct ice_vsi *vsi, unsigned int queue_index, > > - enum netdev_queue_type type, struct napi_struct *napi) > > +void ice_vsi_set_napi_queues(struct ice_vsi *vsi) > > this appears to be called only in ice_main.c. It should be moved there and > made a static function instead of having it in ice_lib.c. > > Unless I overlooked something... > You are not missing anything, but I think there is more value in keeping the set-clear functions together and ice_lib.c is a good place for that. > > { > > - struct ice_pf *pf = vsi->back; > > + struct net_device *netdev = vsi->netdev; > > + int q_idx, v_idx; > > > > - if (!vsi->netdev) > > + if (!netdev) > > return; > > > > - if (current_work() == &pf->serv_task || > > - test_bit(ICE_PREPARED_FOR_RESET, pf->state) || > > - test_bit(ICE_DOWN, pf->state) || > > - test_bit(ICE_SUSPENDED, pf->state)) > > - __ice_queue_set_napi(vsi->netdev, queue_index, type, napi, > > - false); > > - else > > - __ice_queue_set_napi(vsi->netdev, queue_index, type, napi, > > - true); > > -} > > + ice_for_each_rxq(vsi, q_idx) > > + netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_RX, > > + &vsi->rx_rings[q_idx]->q_vector->napi); > > > > -/** > > - * __ice_q_vector_set_napi_queues - Map queue[s] associated with the napi > > - * @q_vector: q_vector pointer > > - * @locked: is the rtnl_lock already held > > - * > > - * Associate the q_vector napi with all the queue[s] on the vector. > > - * Caller indicates the lock status. > > - */ > > -void __ice_q_vector_set_napi_queues(struct ice_q_vector *q_vector, bool locked) > > -{ > > - struct ice_rx_ring *rx_ring; > > - struct ice_tx_ring *tx_ring; > > - > > - ice_for_each_rx_ring(rx_ring, q_vector->rx) > > - __ice_queue_set_napi(q_vector->vsi->netdev, rx_ring->q_index, > > - NETDEV_QUEUE_TYPE_RX, &q_vector->napi, > > - locked); > > - > > - ice_for_each_tx_ring(tx_ring, q_vector->tx) > > - __ice_queue_set_napi(q_vector->vsi->netdev, tx_ring->q_index, > > - NETDEV_QUEUE_TYPE_TX, &q_vector->napi, > > - locked); > > + ice_for_each_txq(vsi, q_idx) > > + netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_TX, > > + &vsi->tx_rings[q_idx]->q_vector->napi); > > /* Also set the interrupt number for the NAPI */ > > - netif_napi_set_irq(&q_vector->napi, q_vector->irq.virq); > > -} > > - > > -/** > > - * ice_q_vector_set_napi_queues - Map queue[s] associated with the napi > > - * @q_vector: q_vector pointer > > - * > > - * Associate the q_vector napi with all the queue[s] on the vector > > - */ > > -void ice_q_vector_set_napi_queues(struct ice_q_vector *q_vector) > > -{ > > - struct ice_rx_ring *rx_ring; > > - struct ice_tx_ring *tx_ring; > > - > > - ice_for_each_rx_ring(rx_ring, q_vector->rx) > > - ice_queue_set_napi(q_vector->vsi, rx_ring->q_index, > > - NETDEV_QUEUE_TYPE_RX, &q_vector->napi); > > + ice_for_each_q_vector(vsi, v_idx) { > > + struct ice_q_vector *q_vector = vsi->q_vectors[v_idx]; > > > > - ice_for_each_tx_ring(tx_ring, q_vector->tx) > > - ice_queue_set_napi(q_vector->vsi, tx_ring->q_index, > > - NETDEV_QUEUE_TYPE_TX, &q_vector->napi); > > - /* Also set the interrupt number for the NAPI */ > > - netif_napi_set_irq(&q_vector->napi, q_vector->irq.virq); > > + netif_napi_set_irq(&q_vector->napi, q_vector->irq.virq); > > + } > > } > > > > /** > > - * ice_vsi_set_napi_queues > > + * ice_vsi_clear_napi_queues > > * @vsi: VSI pointer > > * > > - * Associate queue[s] with napi for all vectors > > + * Clear the association between all VSI queues queue[s] and napi. > > + * The caller must hold rtnl_lock. > > */ > > -void ice_vsi_set_napi_queues(struct ice_vsi *vsi) > > +void ice_vsi_clear_napi_queues(struct ice_vsi *vsi) > > { > > - int i; > > + struct net_device *netdev = vsi->netdev; > > + int q_idx; > > > > - if (!vsi->netdev) > > + if (!netdev) > > return; > > > > - ice_for_each_q_vector(vsi, i) > > - ice_q_vector_set_napi_queues(vsi->q_vectors[i]); > > + ice_for_each_txq(vsi, q_idx) > > + netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_TX, NULL); > > + > > + ice_for_each_rxq(vsi, q_idx) > > + netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_RX, NULL); > > } > > > > /** > > diff --git a/drivers/net/ethernet/intel/ice/ice_lib.h b/drivers/net/ethernet/intel/ice/ice_lib.h > > index 94ce8964dda6..36d86535695d 100644 > > --- a/drivers/net/ethernet/intel/ice/ice_lib.h > > +++ b/drivers/net/ethernet/intel/ice/ice_lib.h > > @@ -44,16 +44,10 @@ void ice_vsi_cfg_netdev_tc(struct ice_vsi *vsi, u8 ena_tc); > > struct ice_vsi * > > ice_vsi_setup(struct ice_pf *pf, struct ice_vsi_cfg_params *params); > > > > -void > > -ice_queue_set_napi(struct ice_vsi *vsi, unsigned int queue_index, > > - enum netdev_queue_type type, struct napi_struct *napi); > > - > > -void __ice_q_vector_set_napi_queues(struct ice_q_vector *q_vector, bool locked); > > - > > -void ice_q_vector_set_napi_queues(struct ice_q_vector *q_vector); > > - > > void ice_vsi_set_napi_queues(struct ice_vsi *vsi); > > > > +void ice_vsi_clear_napi_queues(struct ice_vsi *vsi); > > + > > int ice_vsi_release(struct ice_vsi *vsi); > > > > void ice_vsi_close(struct ice_vsi *vsi); > > diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c > > index 66820ed5e969..2d286a4609a5 100644 > > --- a/drivers/net/ethernet/intel/ice/ice_main.c > > +++ b/drivers/net/ethernet/intel/ice/ice_main.c > > @@ -3537,11 +3537,9 @@ static void ice_napi_add(struct ice_vsi *vsi) > > if (!vsi->netdev) > > return; > > > > - ice_for_each_q_vector(vsi, v_idx) { > > + ice_for_each_q_vector(vsi, v_idx) > > netif_napi_add(vsi->netdev, &vsi->q_vectors[v_idx]->napi, > > ice_napi_poll); > > - __ice_q_vector_set_napi_queues(vsi->q_vectors[v_idx], false); > > - } > > } > > > > /** > > @@ -5519,7 +5517,9 @@ static int ice_reinit_interrupt_scheme(struct ice_pf *pf) > > if (ret) > > goto err_reinit; > > ice_vsi_map_rings_to_vectors(pf->vsi[v]); > > + rtnl_lock(); > > ice_vsi_set_napi_queues(pf->vsi[v]); > > + rtnl_unlock(); > > } > > > > ret = ice_req_irq_msix_misc(pf); > > @@ -5533,8 +5533,12 @@ static int ice_reinit_interrupt_scheme(struct ice_pf *pf) > > > > err_reinit: > > while (v--) > > - if (pf->vsi[v]) > > + if (pf->vsi[v]) { > > + rtnl_lock(); > > + ice_vsi_clear_napi_queues(pf->vsi[v]); > > + rtnl_unlock(); > > ice_vsi_free_q_vectors(pf->vsi[v]); > > + } > > > > return ret; > > } > > @@ -5599,6 +5603,9 @@ static int ice_suspend(struct device *dev) > > ice_for_each_vsi(pf, v) { > > if (!pf->vsi[v]) > > continue; > > + rtnl_lock(); > > + ice_vsi_clear_napi_queues(pf->vsi[v]); > > + rtnl_unlock(); > > ice_vsi_free_q_vectors(pf->vsi[v]); > > } > > ice_clear_interrupt_scheme(pf); > > @@ -7434,6 +7441,8 @@ int ice_vsi_open(struct ice_vsi *vsi) > > err = netif_set_real_num_rx_queues(vsi->netdev, vsi->num_rxq); > > if (err) > > goto err_set_qs; > > + > > + ice_vsi_set_napi_queues(vsi); > > } > > > > err = ice_up_complete(vsi); > > -- > > 2.43.0 > >
On Tue, Aug 20, 2024 at 02:47:31PM +0200, Larysa Zaremba wrote: > On Tue, Aug 20, 2024 at 02:31:51PM +0200, Maciej Fijalkowski wrote: > > On Mon, Aug 19, 2024 at 12:05:38PM +0200, Larysa Zaremba wrote: > > > Currently, netif_queue_set_napi() is called from ice_vsi_rebuild() that is > > > not rtnl-locked when called from the reset. This creates the need to take > > > the rtnl_lock just for a single function and complicates the > > > synchronization with .ndo_bpf. At the same time, there no actual need to > > > fill napi-to-queue information at this exact point. > > > > > > Fill napi-to-queue information when opening the VSI and clear it when the > > > VSI is being closed. Those routines are already rtnl-locked. > > > > > > Also, rewrite napi-to-queue assignment in a way that prevents inclusion of > > > XDP queues, as this leads to out-of-bounds writes, such as one below. > > > > > > [ +0.000004] BUG: KASAN: slab-out-of-bounds in netif_queue_set_napi+0x1c2/0x1e0 > > > [ +0.000012] Write of size 8 at addr ffff889881727c80 by task bash/7047 > > > [ +0.000006] CPU: 24 PID: 7047 Comm: bash Not tainted 6.10.0-rc2+ #2 > > > [ +0.000004] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021 > > > [ +0.000003] Call Trace: > > > [ +0.000003] <TASK> > > > [ +0.000002] dump_stack_lvl+0x60/0x80 > > > [ +0.000007] print_report+0xce/0x630 > > > [ +0.000007] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 > > > [ +0.000007] ? __virt_addr_valid+0x1c9/0x2c0 > > > [ +0.000005] ? netif_queue_set_napi+0x1c2/0x1e0 > > > [ +0.000003] kasan_report+0xe9/0x120 > > > [ +0.000004] ? netif_queue_set_napi+0x1c2/0x1e0 > > > [ +0.000004] netif_queue_set_napi+0x1c2/0x1e0 > > > [ +0.000005] ice_vsi_close+0x161/0x670 [ice] > > > [ +0.000114] ice_dis_vsi+0x22f/0x270 [ice] > > > [ +0.000095] ice_pf_dis_all_vsi.constprop.0+0xae/0x1c0 [ice] > > > [ +0.000086] ice_prepare_for_reset+0x299/0x750 [ice] > > > [ +0.000087] pci_dev_save_and_disable+0x82/0xd0 > > > [ +0.000006] pci_reset_function+0x12d/0x230 > > > [ +0.000004] reset_store+0xa0/0x100 > > > [ +0.000006] ? __pfx_reset_store+0x10/0x10 > > > [ +0.000002] ? __pfx_mutex_lock+0x10/0x10 > > > [ +0.000004] ? __check_object_size+0x4c1/0x640 > > > [ +0.000007] kernfs_fop_write_iter+0x30b/0x4a0 > > > [ +0.000006] vfs_write+0x5d6/0xdf0 > > > [ +0.000005] ? fd_install+0x180/0x350 > > > [ +0.000005] ? __pfx_vfs_write+0x10/0xA10 > > > [ +0.000004] ? do_fcntl+0x52c/0xcd0 > > > [ +0.000004] ? kasan_save_track+0x13/0x60 > > > [ +0.000003] ? kasan_save_free_info+0x37/0x60 > > > [ +0.000006] ksys_write+0xfa/0x1d0 > > > [ +0.000003] ? __pfx_ksys_write+0x10/0x10 > > > [ +0.000002] ? __x64_sys_fcntl+0x121/0x180 > > > [ +0.000004] ? _raw_spin_lock+0x87/0xe0 > > > [ +0.000005] do_syscall_64+0x80/0x170 > > > [ +0.000007] ? _raw_spin_lock+0x87/0xe0 > > > [ +0.000004] ? __pfx__raw_spin_lock+0x10/0x10 > > > [ +0.000003] ? file_close_fd_locked+0x167/0x230 > > > [ +0.000005] ? syscall_exit_to_user_mode+0x7d/0x220 > > > [ +0.000005] ? do_syscall_64+0x8c/0x170 > > > [ +0.000004] ? do_syscall_64+0x8c/0x170 > > > [ +0.000003] ? do_syscall_64+0x8c/0x170 > > > [ +0.000003] ? fput+0x1a/0x2c0 > > > [ +0.000004] ? filp_close+0x19/0x30 > > > [ +0.000004] ? do_dup2+0x25a/0x4c0 > > > [ +0.000004] ? __x64_sys_dup2+0x6e/0x2e0 > > > [ +0.000002] ? syscall_exit_to_user_mode+0x7d/0x220 > > > [ +0.000004] ? do_syscall_64+0x8c/0x170 > > > [ +0.000003] ? __count_memcg_events+0x113/0x380 > > > [ +0.000005] ? handle_mm_fault+0x136/0x820 > > > [ +0.000005] ? do_user_addr_fault+0x444/0xa80 > > > [ +0.000004] ? clear_bhb_loop+0x25/0x80 > > > [ +0.000004] ? clear_bhb_loop+0x25/0x80 > > > [ +0.000002] entry_SYSCALL_64_after_hwframe+0x76/0x7e > > > [ +0.000005] RIP: 0033:0x7f2033593154 > > > > > > Fixes: 080b0c8d6d26 ("ice: Fix ASSERT_RTNL() warning during certain scenarios") > > > > Shouldn't you include: > > Fixes: 91fdbce7e8d6 ("ice: Add support in the driver for associating queue with napi") > > > > as we were iterating over XDP rings that were attached to q_vectors from > > the very beginning? > > > > I probably should have done this. Maybe this could be included while applying or sending the pull request by Tony. I'll go through the rest of set today to see if I have any comments, if there won't be anything outstanding then it won't make sense to send next revision just to fix the fixes tags. > > > > Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com> > > > Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> > > > Reviewed-by: Amritha Nambiar <amritha.nambiar@intel.com> > > > Tested-by: Chandan Kumar Rout <chandanx.rout@intel.com> > > > Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> > > > --- > > > drivers/net/ethernet/intel/ice/ice_base.c | 11 +- > > > drivers/net/ethernet/intel/ice/ice_lib.c | 129 ++++++---------------- > > > drivers/net/ethernet/intel/ice/ice_lib.h | 10 +- > > > drivers/net/ethernet/intel/ice/ice_main.c | 17 ++- > > > 4 files changed, 49 insertions(+), 118 deletions(-) > > > > > > diff --git a/drivers/net/ethernet/intel/ice/ice_base.c b/drivers/net/ethernet/intel/ice/ice_base.c > > > index f448d3a84564..c158749a80e0 100644 > > > --- a/drivers/net/ethernet/intel/ice/ice_base.c > > > +++ b/drivers/net/ethernet/intel/ice/ice_base.c > > > @@ -190,16 +190,11 @@ static void ice_free_q_vector(struct ice_vsi *vsi, int v_idx) > > > } > > > q_vector = vsi->q_vectors[v_idx]; > > > > > > - ice_for_each_tx_ring(tx_ring, q_vector->tx) { > > > - ice_queue_set_napi(vsi, tx_ring->q_index, NETDEV_QUEUE_TYPE_TX, > > > - NULL); > > > + ice_for_each_tx_ring(tx_ring, vsi->q_vectors[v_idx]->tx) > > > tx_ring->q_vector = NULL; > > > - } > > > - ice_for_each_rx_ring(rx_ring, q_vector->rx) { > > > - ice_queue_set_napi(vsi, rx_ring->q_index, NETDEV_QUEUE_TYPE_RX, > > > - NULL); > > > + > > > + ice_for_each_rx_ring(rx_ring, vsi->q_vectors[v_idx]->rx) > > > rx_ring->q_vector = NULL; > > > - } > > > > > > /* only VSI with an associated netdev is set up with NAPI */ > > > if (vsi->netdev) > > > diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c > > > index 03c4df4ed585..5f2ddcaf7031 100644 > > > --- a/drivers/net/ethernet/intel/ice/ice_lib.c > > > +++ b/drivers/net/ethernet/intel/ice/ice_lib.c > > > @@ -2286,9 +2286,6 @@ static int ice_vsi_cfg_def(struct ice_vsi *vsi) > > > > > > ice_vsi_map_rings_to_vectors(vsi); > > > > > > - /* Associate q_vector rings to napi */ > > > - ice_vsi_set_napi_queues(vsi); > > > - > > > vsi->stat_offsets_loaded = false; > > > > > > /* ICE_VSI_CTRL does not need RSS so skip RSS processing */ > > > @@ -2621,6 +2618,7 @@ void ice_vsi_close(struct ice_vsi *vsi) > > > if (!test_and_set_bit(ICE_VSI_DOWN, vsi->state)) > > > ice_down(vsi); > > > > > > + ice_vsi_clear_napi_queues(vsi); > > > ice_vsi_free_irq(vsi); > > > ice_vsi_free_tx_rings(vsi); > > > ice_vsi_free_rx_rings(vsi); > > > @@ -2687,120 +2685,55 @@ void ice_dis_vsi(struct ice_vsi *vsi, bool locked) > > > } > > > > > > /** > > > - * __ice_queue_set_napi - Set the napi instance for the queue > > > - * @dev: device to which NAPI and queue belong > > > - * @queue_index: Index of queue > > > - * @type: queue type as RX or TX > > > - * @napi: NAPI context > > > - * @locked: is the rtnl_lock already held > > > - * > > > - * Set the napi instance for the queue. Caller indicates the lock status. > > > - */ > > > -static void > > > -__ice_queue_set_napi(struct net_device *dev, unsigned int queue_index, > > > - enum netdev_queue_type type, struct napi_struct *napi, > > > - bool locked) > > > -{ > > > - if (!locked) > > > - rtnl_lock(); > > > - netif_queue_set_napi(dev, queue_index, type, napi); > > > - if (!locked) > > > - rtnl_unlock(); > > > -} > > > - > > > -/** > > > - * ice_queue_set_napi - Set the napi instance for the queue > > > - * @vsi: VSI being configured > > > - * @queue_index: Index of queue > > > - * @type: queue type as RX or TX > > > - * @napi: NAPI context > > > + * ice_vsi_set_napi_queues > > > + * @vsi: VSI pointer > > > * > > > - * Set the napi instance for the queue. The rtnl lock state is derived from the > > > - * execution path. > > > + * Associate queue[s] with napi for all vectors. > > > + * The caller must hold rtnl_lock. > > > */ > > > -void > > > -ice_queue_set_napi(struct ice_vsi *vsi, unsigned int queue_index, > > > - enum netdev_queue_type type, struct napi_struct *napi) > > > +void ice_vsi_set_napi_queues(struct ice_vsi *vsi) > > > > this appears to be called only in ice_main.c. It should be moved there and > > made a static function instead of having it in ice_lib.c. > > > > Unless I overlooked something... > > > > You are not missing anything, but I think there is more value in keeping the > set-clear functions together and ice_lib.c is a good place for that. Yeah I realized after sending the comment that clear func indeed has to be exported so I'd say we can live with that. > > > > { > > > - struct ice_pf *pf = vsi->back; > > > + struct net_device *netdev = vsi->netdev; > > > + int q_idx, v_idx; > > > > > > - if (!vsi->netdev) > > > + if (!netdev) > > > return; > > > > > > - if (current_work() == &pf->serv_task || > > > - test_bit(ICE_PREPARED_FOR_RESET, pf->state) || > > > - test_bit(ICE_DOWN, pf->state) || > > > - test_bit(ICE_SUSPENDED, pf->state)) > > > - __ice_queue_set_napi(vsi->netdev, queue_index, type, napi, > > > - false); > > > - else > > > - __ice_queue_set_napi(vsi->netdev, queue_index, type, napi, > > > - true); > > > -} > > > + ice_for_each_rxq(vsi, q_idx) > > > + netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_RX, > > > + &vsi->rx_rings[q_idx]->q_vector->napi); > > > > > > -/** (...)
On 8/20/2024 6:26 AM, Maciej Fijalkowski wrote: ... >>>> Fixes: 080b0c8d6d26 ("ice: Fix ASSERT_RTNL() warning during certain scenarios") >>> >>> Shouldn't you include: >>> Fixes: 91fdbce7e8d6 ("ice: Add support in the driver for associating queue with napi") >>> >>> as we were iterating over XDP rings that were attached to q_vectors from >>> the very beginning? >>> >> >> I probably should have done this. > > Maybe this could be included while applying or sending the pull request by > Tony. I'll go through the rest of set today to see if I have any comments, > if there won't be anything outstanding then it won't make sense to send > next revision just to fix the fixes tags. Yes, I can add that in. Thanks, Tony
diff --git a/drivers/net/ethernet/intel/ice/ice_base.c b/drivers/net/ethernet/intel/ice/ice_base.c index f448d3a84564..c158749a80e0 100644 --- a/drivers/net/ethernet/intel/ice/ice_base.c +++ b/drivers/net/ethernet/intel/ice/ice_base.c @@ -190,16 +190,11 @@ static void ice_free_q_vector(struct ice_vsi *vsi, int v_idx) } q_vector = vsi->q_vectors[v_idx]; - ice_for_each_tx_ring(tx_ring, q_vector->tx) { - ice_queue_set_napi(vsi, tx_ring->q_index, NETDEV_QUEUE_TYPE_TX, - NULL); + ice_for_each_tx_ring(tx_ring, vsi->q_vectors[v_idx]->tx) tx_ring->q_vector = NULL; - } - ice_for_each_rx_ring(rx_ring, q_vector->rx) { - ice_queue_set_napi(vsi, rx_ring->q_index, NETDEV_QUEUE_TYPE_RX, - NULL); + + ice_for_each_rx_ring(rx_ring, vsi->q_vectors[v_idx]->rx) rx_ring->q_vector = NULL; - } /* only VSI with an associated netdev is set up with NAPI */ if (vsi->netdev) diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c index 03c4df4ed585..5f2ddcaf7031 100644 --- a/drivers/net/ethernet/intel/ice/ice_lib.c +++ b/drivers/net/ethernet/intel/ice/ice_lib.c @@ -2286,9 +2286,6 @@ static int ice_vsi_cfg_def(struct ice_vsi *vsi) ice_vsi_map_rings_to_vectors(vsi); - /* Associate q_vector rings to napi */ - ice_vsi_set_napi_queues(vsi); - vsi->stat_offsets_loaded = false; /* ICE_VSI_CTRL does not need RSS so skip RSS processing */ @@ -2621,6 +2618,7 @@ void ice_vsi_close(struct ice_vsi *vsi) if (!test_and_set_bit(ICE_VSI_DOWN, vsi->state)) ice_down(vsi); + ice_vsi_clear_napi_queues(vsi); ice_vsi_free_irq(vsi); ice_vsi_free_tx_rings(vsi); ice_vsi_free_rx_rings(vsi); @@ -2687,120 +2685,55 @@ void ice_dis_vsi(struct ice_vsi *vsi, bool locked) } /** - * __ice_queue_set_napi - Set the napi instance for the queue - * @dev: device to which NAPI and queue belong - * @queue_index: Index of queue - * @type: queue type as RX or TX - * @napi: NAPI context - * @locked: is the rtnl_lock already held - * - * Set the napi instance for the queue. Caller indicates the lock status. - */ -static void -__ice_queue_set_napi(struct net_device *dev, unsigned int queue_index, - enum netdev_queue_type type, struct napi_struct *napi, - bool locked) -{ - if (!locked) - rtnl_lock(); - netif_queue_set_napi(dev, queue_index, type, napi); - if (!locked) - rtnl_unlock(); -} - -/** - * ice_queue_set_napi - Set the napi instance for the queue - * @vsi: VSI being configured - * @queue_index: Index of queue - * @type: queue type as RX or TX - * @napi: NAPI context + * ice_vsi_set_napi_queues + * @vsi: VSI pointer * - * Set the napi instance for the queue. The rtnl lock state is derived from the - * execution path. + * Associate queue[s] with napi for all vectors. + * The caller must hold rtnl_lock. */ -void -ice_queue_set_napi(struct ice_vsi *vsi, unsigned int queue_index, - enum netdev_queue_type type, struct napi_struct *napi) +void ice_vsi_set_napi_queues(struct ice_vsi *vsi) { - struct ice_pf *pf = vsi->back; + struct net_device *netdev = vsi->netdev; + int q_idx, v_idx; - if (!vsi->netdev) + if (!netdev) return; - if (current_work() == &pf->serv_task || - test_bit(ICE_PREPARED_FOR_RESET, pf->state) || - test_bit(ICE_DOWN, pf->state) || - test_bit(ICE_SUSPENDED, pf->state)) - __ice_queue_set_napi(vsi->netdev, queue_index, type, napi, - false); - else - __ice_queue_set_napi(vsi->netdev, queue_index, type, napi, - true); -} + ice_for_each_rxq(vsi, q_idx) + netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_RX, + &vsi->rx_rings[q_idx]->q_vector->napi); -/** - * __ice_q_vector_set_napi_queues - Map queue[s] associated with the napi - * @q_vector: q_vector pointer - * @locked: is the rtnl_lock already held - * - * Associate the q_vector napi with all the queue[s] on the vector. - * Caller indicates the lock status. - */ -void __ice_q_vector_set_napi_queues(struct ice_q_vector *q_vector, bool locked) -{ - struct ice_rx_ring *rx_ring; - struct ice_tx_ring *tx_ring; - - ice_for_each_rx_ring(rx_ring, q_vector->rx) - __ice_queue_set_napi(q_vector->vsi->netdev, rx_ring->q_index, - NETDEV_QUEUE_TYPE_RX, &q_vector->napi, - locked); - - ice_for_each_tx_ring(tx_ring, q_vector->tx) - __ice_queue_set_napi(q_vector->vsi->netdev, tx_ring->q_index, - NETDEV_QUEUE_TYPE_TX, &q_vector->napi, - locked); + ice_for_each_txq(vsi, q_idx) + netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_TX, + &vsi->tx_rings[q_idx]->q_vector->napi); /* Also set the interrupt number for the NAPI */ - netif_napi_set_irq(&q_vector->napi, q_vector->irq.virq); -} - -/** - * ice_q_vector_set_napi_queues - Map queue[s] associated with the napi - * @q_vector: q_vector pointer - * - * Associate the q_vector napi with all the queue[s] on the vector - */ -void ice_q_vector_set_napi_queues(struct ice_q_vector *q_vector) -{ - struct ice_rx_ring *rx_ring; - struct ice_tx_ring *tx_ring; - - ice_for_each_rx_ring(rx_ring, q_vector->rx) - ice_queue_set_napi(q_vector->vsi, rx_ring->q_index, - NETDEV_QUEUE_TYPE_RX, &q_vector->napi); + ice_for_each_q_vector(vsi, v_idx) { + struct ice_q_vector *q_vector = vsi->q_vectors[v_idx]; - ice_for_each_tx_ring(tx_ring, q_vector->tx) - ice_queue_set_napi(q_vector->vsi, tx_ring->q_index, - NETDEV_QUEUE_TYPE_TX, &q_vector->napi); - /* Also set the interrupt number for the NAPI */ - netif_napi_set_irq(&q_vector->napi, q_vector->irq.virq); + netif_napi_set_irq(&q_vector->napi, q_vector->irq.virq); + } } /** - * ice_vsi_set_napi_queues + * ice_vsi_clear_napi_queues * @vsi: VSI pointer * - * Associate queue[s] with napi for all vectors + * Clear the association between all VSI queues queue[s] and napi. + * The caller must hold rtnl_lock. */ -void ice_vsi_set_napi_queues(struct ice_vsi *vsi) +void ice_vsi_clear_napi_queues(struct ice_vsi *vsi) { - int i; + struct net_device *netdev = vsi->netdev; + int q_idx; - if (!vsi->netdev) + if (!netdev) return; - ice_for_each_q_vector(vsi, i) - ice_q_vector_set_napi_queues(vsi->q_vectors[i]); + ice_for_each_txq(vsi, q_idx) + netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_TX, NULL); + + ice_for_each_rxq(vsi, q_idx) + netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_RX, NULL); } /** diff --git a/drivers/net/ethernet/intel/ice/ice_lib.h b/drivers/net/ethernet/intel/ice/ice_lib.h index 94ce8964dda6..36d86535695d 100644 --- a/drivers/net/ethernet/intel/ice/ice_lib.h +++ b/drivers/net/ethernet/intel/ice/ice_lib.h @@ -44,16 +44,10 @@ void ice_vsi_cfg_netdev_tc(struct ice_vsi *vsi, u8 ena_tc); struct ice_vsi * ice_vsi_setup(struct ice_pf *pf, struct ice_vsi_cfg_params *params); -void -ice_queue_set_napi(struct ice_vsi *vsi, unsigned int queue_index, - enum netdev_queue_type type, struct napi_struct *napi); - -void __ice_q_vector_set_napi_queues(struct ice_q_vector *q_vector, bool locked); - -void ice_q_vector_set_napi_queues(struct ice_q_vector *q_vector); - void ice_vsi_set_napi_queues(struct ice_vsi *vsi); +void ice_vsi_clear_napi_queues(struct ice_vsi *vsi); + int ice_vsi_release(struct ice_vsi *vsi); void ice_vsi_close(struct ice_vsi *vsi); diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c index 66820ed5e969..2d286a4609a5 100644 --- a/drivers/net/ethernet/intel/ice/ice_main.c +++ b/drivers/net/ethernet/intel/ice/ice_main.c @@ -3537,11 +3537,9 @@ static void ice_napi_add(struct ice_vsi *vsi) if (!vsi->netdev) return; - ice_for_each_q_vector(vsi, v_idx) { + ice_for_each_q_vector(vsi, v_idx) netif_napi_add(vsi->netdev, &vsi->q_vectors[v_idx]->napi, ice_napi_poll); - __ice_q_vector_set_napi_queues(vsi->q_vectors[v_idx], false); - } } /** @@ -5519,7 +5517,9 @@ static int ice_reinit_interrupt_scheme(struct ice_pf *pf) if (ret) goto err_reinit; ice_vsi_map_rings_to_vectors(pf->vsi[v]); + rtnl_lock(); ice_vsi_set_napi_queues(pf->vsi[v]); + rtnl_unlock(); } ret = ice_req_irq_msix_misc(pf); @@ -5533,8 +5533,12 @@ static int ice_reinit_interrupt_scheme(struct ice_pf *pf) err_reinit: while (v--) - if (pf->vsi[v]) + if (pf->vsi[v]) { + rtnl_lock(); + ice_vsi_clear_napi_queues(pf->vsi[v]); + rtnl_unlock(); ice_vsi_free_q_vectors(pf->vsi[v]); + } return ret; } @@ -5599,6 +5603,9 @@ static int ice_suspend(struct device *dev) ice_for_each_vsi(pf, v) { if (!pf->vsi[v]) continue; + rtnl_lock(); + ice_vsi_clear_napi_queues(pf->vsi[v]); + rtnl_unlock(); ice_vsi_free_q_vectors(pf->vsi[v]); } ice_clear_interrupt_scheme(pf); @@ -7434,6 +7441,8 @@ int ice_vsi_open(struct ice_vsi *vsi) err = netif_set_real_num_rx_queues(vsi->netdev, vsi->num_rxq); if (err) goto err_set_qs; + + ice_vsi_set_napi_queues(vsi); } err = ice_up_complete(vsi);
Currently, netif_queue_set_napi() is called from ice_vsi_rebuild() that is not rtnl-locked when called from the reset. This creates the need to take the rtnl_lock just for a single function and complicates the synchronization with .ndo_bpf. At the same time, there no actual need to fill napi-to-queue information at this exact point. Fill napi-to-queue information when opening the VSI and clear it when the VSI is being closed. Those routines are already rtnl-locked. Also, rewrite napi-to-queue assignment in a way that prevents inclusion of XDP queues, as this leads to out-of-bounds writes, such as one below. [ +0.000004] BUG: KASAN: slab-out-of-bounds in netif_queue_set_napi+0x1c2/0x1e0 [ +0.000012] Write of size 8 at addr ffff889881727c80 by task bash/7047 [ +0.000006] CPU: 24 PID: 7047 Comm: bash Not tainted 6.10.0-rc2+ #2 [ +0.000004] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021 [ +0.000003] Call Trace: [ +0.000003] <TASK> [ +0.000002] dump_stack_lvl+0x60/0x80 [ +0.000007] print_report+0xce/0x630 [ +0.000007] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ +0.000007] ? __virt_addr_valid+0x1c9/0x2c0 [ +0.000005] ? netif_queue_set_napi+0x1c2/0x1e0 [ +0.000003] kasan_report+0xe9/0x120 [ +0.000004] ? netif_queue_set_napi+0x1c2/0x1e0 [ +0.000004] netif_queue_set_napi+0x1c2/0x1e0 [ +0.000005] ice_vsi_close+0x161/0x670 [ice] [ +0.000114] ice_dis_vsi+0x22f/0x270 [ice] [ +0.000095] ice_pf_dis_all_vsi.constprop.0+0xae/0x1c0 [ice] [ +0.000086] ice_prepare_for_reset+0x299/0x750 [ice] [ +0.000087] pci_dev_save_and_disable+0x82/0xd0 [ +0.000006] pci_reset_function+0x12d/0x230 [ +0.000004] reset_store+0xa0/0x100 [ +0.000006] ? __pfx_reset_store+0x10/0x10 [ +0.000002] ? __pfx_mutex_lock+0x10/0x10 [ +0.000004] ? __check_object_size+0x4c1/0x640 [ +0.000007] kernfs_fop_write_iter+0x30b/0x4a0 [ +0.000006] vfs_write+0x5d6/0xdf0 [ +0.000005] ? fd_install+0x180/0x350 [ +0.000005] ? __pfx_vfs_write+0x10/0xA10 [ +0.000004] ? do_fcntl+0x52c/0xcd0 [ +0.000004] ? kasan_save_track+0x13/0x60 [ +0.000003] ? kasan_save_free_info+0x37/0x60 [ +0.000006] ksys_write+0xfa/0x1d0 [ +0.000003] ? __pfx_ksys_write+0x10/0x10 [ +0.000002] ? __x64_sys_fcntl+0x121/0x180 [ +0.000004] ? _raw_spin_lock+0x87/0xe0 [ +0.000005] do_syscall_64+0x80/0x170 [ +0.000007] ? _raw_spin_lock+0x87/0xe0 [ +0.000004] ? __pfx__raw_spin_lock+0x10/0x10 [ +0.000003] ? file_close_fd_locked+0x167/0x230 [ +0.000005] ? syscall_exit_to_user_mode+0x7d/0x220 [ +0.000005] ? do_syscall_64+0x8c/0x170 [ +0.000004] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? fput+0x1a/0x2c0 [ +0.000004] ? filp_close+0x19/0x30 [ +0.000004] ? do_dup2+0x25a/0x4c0 [ +0.000004] ? __x64_sys_dup2+0x6e/0x2e0 [ +0.000002] ? syscall_exit_to_user_mode+0x7d/0x220 [ +0.000004] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? __count_memcg_events+0x113/0x380 [ +0.000005] ? handle_mm_fault+0x136/0x820 [ +0.000005] ? do_user_addr_fault+0x444/0xa80 [ +0.000004] ? clear_bhb_loop+0x25/0x80 [ +0.000004] ? clear_bhb_loop+0x25/0x80 [ +0.000002] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000005] RIP: 0033:0x7f2033593154 Fixes: 080b0c8d6d26 ("ice: Fix ASSERT_RTNL() warning during certain scenarios") Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Amritha Nambiar <amritha.nambiar@intel.com> Tested-by: Chandan Kumar Rout <chandanx.rout@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> --- drivers/net/ethernet/intel/ice/ice_base.c | 11 +- drivers/net/ethernet/intel/ice/ice_lib.c | 129 ++++++---------------- drivers/net/ethernet/intel/ice/ice_lib.h | 10 +- drivers/net/ethernet/intel/ice/ice_main.c | 17 ++- 4 files changed, 49 insertions(+), 118 deletions(-)