- 15 Oct, 2017 13 commits
-
-
Bart Van Assche authored
Avoid that gcc 7 reports the following warning when building with W=1: warning: this statement may fall through [-Wimplicit-fallthrough=] Signed-off-by:
Bart Van Assche <bart.vanassche@wdc.com> Reviewed-by:
Steve Wise <swise@opengridcomputing.com> Signed-off-by:
Doug Ledford <dledford@redhat.com>
-
Bart Van Assche authored
This patch avoids that building the cxgb4 module with W=1 triggers a complaint about a local variable that has not been declared static. Signed-off-by:
-
Bart Van Assche authored
This patch avoids that smatch reports the following: drivers/infiniband/hw/cxgb4/device.c:1105: copy_gl_to_skb_pkt() warn: inconsistent indenting drivers/infiniband/hw/cxgb4/cm.c:835: send_connect() warn: inconsistent indenting drivers/infiniband/hw/cxgb4/cm.c:841: send_connect() warn: inconsistent indenting drivers/infiniband/hw/cxgb4/cm.c:888: send_connect() warn: inconsistent indenting drivers/infiniband/hw/cxgb4/cm.c:894: send_connect() warn: inconsistent indenting Signed-off-by:
-
Bart Van Assche authored
Signed-off-by:
-
Bart Van Assche authored
Annotate t3cdev.l2opt with __rcu since it is used as an RCU pointer. Signed-off-by:
-
Bart Van Assche authored
Tell sparse what the locking assumptions are for __flush_qp() such that it does not complain about the locking operations inside that function. Signed-off-by:
-
Bart Van Assche authored
Signed-off-by:
-
Bart Van Assche authored
Avoid that gcc 7 reports the following warning when building with W=1: warning: this statement may fall through [-Wimplicit-fallthrough=] Signed-off-by:
-
Bart Van Assche authored
Avoid that gcc 7 reports the following warning when building with W=1: warning: this statement may fall through [-Wimplicit-fallthrough=] Signed-off-by:
Sagi Grimberg <sagi@grimberg.me> Signed-off-by:
-
Bart Van Assche authored
Signed-off-by:
-
Bart Van Assche authored
According to the C standard the behavior of computations with integer operands is as follows: * A computation involving unsigned operands can never overflow, because a result that cannot be represented by the resulting unsigned integer type is reduced modulo the number that is one greater than the largest value that can be represented by the resulting type. * The behavior for signed integer underflow and overflow is undefined. Hence only use unsigned integers when checking for integer overflow. This patch is what I came up with after having analyzed the following smatch warnings: drivers/infiniband/core/cma.c:3448: cma_resolve_ib_udp() warn: signed overflow undefined. 'offset + conn_param->private_data_len < conn_param->private_data_len' drivers/infiniband/core/cma.c:3505: cma_connect_ib() warn: signed overflow undefined. 'offset + conn_param->private_data_len < conn_param->private_data_len' Signed-off-by:
Sean Hefty <sean.hefty@intel.com> Signed-off-by:
-
Bart Van Assche authored
Avoid that gcc 7 reports the following warning when building with W=1: warning: this statement may fall through [-Wimplicit-fallthrough=] Signed-off-by:
-
Bart Van Assche authored
Since ipv4_addr is a big endian 32-bit number, annotate it as such. Fixes: commit be1d325a ("IB/core: Set RoCEv2 MGID according to spec") Signed-off-by:
Leon Romanovsky <leonro@mellanox.com> Signed-off-by:
-
- 10 Oct, 2017 4 commits
-
-
Doug Ledford authored
Merge tag 'mlx5-updates-2017-10-06' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux into k.o/for-next Merge Mellanox shared pull request Signed-off-by:
-
Colin Ian King authored
prot_sg_cnt cannot be zero as a previous check on ret (from which prot_sg_cnt is assigned) returns -ENOMEM if is it zero. Since it cannot be zero we can simplify the code by removing the non -zero check on prot_sg_cnt and redundant else statement. Detected by CoverityScan, COD#1357188 ("Logically dead code") Signed-off-by:Colin Ian King <colin.king@canonical.com> Signed-off-by:
-
Bart Van Assche authored
Instead of making every caller convert the second argument of sa_path_set_slid() and sa_path_set_dlid() to big endian format, make these two functions accept LIDs in CPU endian format. This patch does not change any functionality. Signed-off-by:
-
Arnd Bergmann authored
The infiniband subsystem causes a link failure when the umem driver is built on MMU-less systems: mm/mmu_notifier.o: In function `do_mmu_notifier_register': mmu_notifier.c:(.text+0x32): undefined reference to `mm_take_all_locks' drivers/infiniband/core/umem.o: In function `ib_umem_get': umem.c:(.text+0x132): undefined reference to `can_do_mlock' drivers/infiniband/core/umem_odp.o: In function `ib_umem_odp_map_dma_pages': umem_odp.c:(.text+0x766): undefined reference to `get_user_pages_remote' This bug has existed for a while but only become apparent in ARM randconfig builds when the dependency on PCI was lifted, as none of the ARM-NOMMU targets support PCI at the moment. We could probably get the umem driver to build by providing an alternative implementation 'can_do_mlock()' that returns false on NOMMU-systems, but then we'd still have a problem with the mmu-notifiers required by CONFIG_INFINIBAND_ON_DEMAND_PAGING, so simply forbidding umem with NOMMU seems like the simplest workaround. Fixes: 931bc0d9 ("IB: Move PCI dependency from root KConfig to HW's KConfigs") Signed-off-by:
Arnd Bergmann <arnd@arndb.de> Signed-off-by:
-
- 09 Oct, 2017 2 commits
-
-
Doug Ledford authored
If the allocation of elem fails, it is not sufficient to simply check for NULL and return. We need to also put our reference on the pool or else we will leave the pool with a permanent ref count and we will never be able to free it. Fixes: 4831ca9e ("IB/rxe: check for allocation failure on elem") Suggested-by:
Leon Romanovsky <leon@kernel.org> Signed-off-by:
-
Colin Ian King authored
The allocation for elem may fail (especially because we're using GFP_ATOMIC) so best to check for a null return. This fixes a potential null pointer dereference when assigning elem->pool. Detected by CoverityScan CID#1357507 ("Dereference null return value") Fixes: 8700e3e7 ("Soft RoCE driver") Signed-off-by:
-
- 04 Oct, 2017 12 commits
-
-
Don Hiatt authored
On OPA devices opa_local_smp_check will receive 32Bit LIDs when the LID is Extended. In such cases, it is okay to lose the upper 16 bits of the LID as this information is obtained elsewhere. Do not issue a warning when calling ib_lid_cpu16() in this case by masking out the upper 16Bits. [75920.148985] ------------[ cut here ]------------ [75920.154651] WARNING: CPU: 0 PID: 1718 at ./include/rdma/ib_verbs.h:3788 hfi1_process_mad+0x1c1f/0x1c80 [hfi1] [75920.166192] Modules linked in: ib_ipoib hfi1(E) rdmavt(E) rdma_ucm(E) ib_ucm(E) rdma_cm(E) ib_cm(E) iw_cm(E) ib_umad(E) ib_uverbs(E) ib_core(E) libiscsi scsi_transport_iscsi dm_mirror dm_region_hash dm_log dm_mod dax x86_pkg_temp_thermal intel_powerclamp coretemp kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel mei_me ipmi_si iTCO_wdt iTCO_vendor_support crypto_simd ipmi_devintf pcspkr mei sg i2c_i801 glue_helper lpc_ich shpchp ioatdma mfd_core wmi ipmi_msghandler cryptd acpi_power_meter acpi_pad nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod mgag200 drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm igb ptp ahci libahci pps_core crc32c_intel libata dca i2c_algo_bit i2c_core [last unloaded: ib_core] [75920.246331] CPU: 0 PID: 1718 Comm: kworker/0:1H Tainted: G W I E 4.13.0-rc7+ #1 [75920.255907] Hardware name: Intel Corporation S2600WT2/S2600WT2, BIOS SE5C610.86B.01.01.0008.021120151325 02/11/2015 [75920.268158] Workqueue: ib-comp-wq ib_cq_poll_work [ib_core] [75920.274934] task: ffff88084a718000 task.stack: ffffc9000a424000 [75920.282123] RIP: 0010:hfi1_process_mad+0x1c1f/0x1c80 [hfi1] [75920.288881] RSP: 0018:ffffc9000a427c38 EFLAGS: 00010206 [75920.295265] RAX: 0000000000010001 RBX: ffff8808361420e8 RCX: ffff880837811d80 [75920.303784] RDX: 0000000000000002 RSI: 0000000000007fff RDI: ffff880837811d80 [75920.312302] RBP: ffffc9000a427d38 R08: 0000000000000000 R09: ffff8808361420e8 [75920.320819] R10: ffff88083841f0e8 R11: ffffc9000a427da8 R12: 0000000000000001 [75920.329335] R13: ffff880837810000 R14: 0000000000000000 R15: ffff88084f1a4800 [75920.337849] FS: 0000000000000000(0000) GS:ffff88085f400000(0000) knlGS:0000000000000000 [75920.347450] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [75920.354405] CR2: 00007f9e4b3d9000 CR3: 0000000001c09000 CR4: 00000000001406f0 [75920.362947] Call Trace: [75920.366257] ? ib_mad_recv_done+0x258/0x9b0 [ib_core] [75920.372457] ? ib_mad_recv_done+0x258/0x9b0 [ib_core] [75920.378652] ? __kmalloc+0x1df/0x210 [75920.383229] ib_mad_recv_done+0x305/0x9b0 [ib_core] [75920.389270] __ib_process_cq+0x5d/0xb0 [ib_core] [75920.395032] ib_cq_poll_work+0x20/0x60 [ib_core] [75920.400777] process_one_work+0x149/0x360 [75920.405836] worker_thread+0x4d/0x3c0 [75920.410505] kthread+0x109/0x140 [75920.414681] ? rescuer_thread+0x380/0x380 [75920.419731] ? kthread_park+0x60/0x60 [75920.424406] ret_from_fork+0x25/0x30 [75920.428972] Code: 4c 89 9d 58 ff ff ff 49 89 45 00 66 b8 00 02 49 89 45 08 e8 44 27 89 e0 4c 8b 9d 58 ff ff ff e9 d8 f6 ff ff 0f ff e9 55 e7 ff ff <0f> ff e9 3b e5 ff ff 0f ff 0f 1f 84 00 00 00 00 00 e9 4b e9 ff [75921.451269] ---[ end trace cf26df27c9597265 ]--- Fixes: 62ede777 ("Add OPA extended LID support") Reviewed-by:
Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by:
Don Hiatt <don.hiatt@intel.com> Signed-off-by:
Dennis Dalessandro <dennis.dalessandro@intel.com> Reviewed-by:
-
Don Hiatt authored
On OPA devices the user_mad recv_handler can receive 32Bit LIDs (e.g. OPA_PERMISSIVE_LID) and it is okay to lose the upper 16 bits of the LID as this information is obtained elsewhere. Do not issue a warning when calling ib_lid_be16() in this case by masking out the upper 16Bits. [75667.310846] ------------[ cut here ]------------ [75667.316447] WARNING: CPU: 0 PID: 1718 at ./include/rdma/ib_verbs.h:3799 recv_handler+0x15a/0x170 [ib_umad] [75667.327640] Modules linked in: ib_ipoib hfi1(E) rdmavt(E) rdma_ucm(E) ib_ucm(E) rdma_cm(E) ib_cm(E) iw_cm(E) ib_umad(E) ib_uverbs(E) ib_core(E) libiscsi scsi_transport_iscsi dm_mirror dm_region_hash dm_log dm_mod dax x86_pkg_temp_thermal intel_powerclamp coretemp kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel mei_me ipmi_si iTCO_wdt iTCO_vendor_support crypto_simd ipmi_devintf pcspkr mei sg i2c_i801 glue_helper lpc_ich shpchp ioatdma mfd_core wmi ipmi_msghandler cryptd acpi_power_meter acpi_pad nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod mgag200 drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm igb ptp ahci libahci pps_core crc32c_intel libata dca i2c_algo_bit i2c_core [last unloaded: ib_core] [75667.407704] CPU: 0 PID: 1718 Comm: kworker/0:1H Tainted: G W I E 4.13.0-rc7+ #1 [75667.417310] Hardware name: Intel Corporation S2600WT2/S2600WT2, BIOS SE5C610.86B.01.01.0008.021120151325 02/11/2015 [75667.429555] Workqueue: ib-comp-wq ib_cq_poll_work [ib_core] [75667.436360] task: ffff88084a718000 task.stack: ffffc9000a424000 [75667.443549] RIP: 0010:recv_handler+0x15a/0x170 [ib_umad] [75667.450090] RSP: 0018:ffffc9000a427ce8 EFLAGS: 00010286 [75667.456508] RAX: 00000000ffffffff RBX: ffff88085159ce80 RCX: 0000000000000000 [75667.465094] RDX: ffff88085a47b068 RSI: 0000000000000000 RDI: ffff88085159cf00 [75667.473668] RBP: ffffc9000a427d38 R08: 000000000001efc0 R09: ffff88085159ce80 [75667.482228] R10: ffff88085f007480 R11: ffff88084acf20e8 R12: ffff88085a47b020 [75667.490824] R13: ffff881056842e10 R14: ffff881056840200 R15: ffff88104c8d0800 [75667.499390] FS: 0000000000000000(0000) GS:ffff88085f400000(0000) knlGS:0000000000000000 [75667.509028] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [75667.516080] CR2: 00007f9e4b3d9000 CR3: 0000000001c09000 CR4: 00000000001406f0 [75667.524664] Call Trace: [75667.528044] ? find_mad_agent+0x7c/0x1b0 [ib_core] [75667.534031] ? ib_mark_mad_done+0x73/0xa0 [ib_core] [75667.540142] ib_mad_recv_done+0x423/0x9b0 [ib_core] [75667.546215] __ib_process_cq+0x5d/0xb0 [ib_core] [75667.552007] ib_cq_poll_work+0x20/0x60 [ib_core] [75667.557766] process_one_work+0x149/0x360 [75667.562844] worker_thread+0x4d/0x3c0 [75667.567529] kthread+0x109/0x140 [75667.571713] ? rescuer_thread+0x380/0x380 [75667.576775] ? kthread_park+0x60/0x60 [75667.581447] ret_from_fork+0x25/0x30 [75667.586014] Code: 43 4a 0f b6 45 c6 88 43 4b 48 8b 45 b0 48 89 43 4c 48 8b 45 b8 48 89 43 54 8b 45 c0 0f c8 89 43 5c e9 79 ff ff ff e8 16 4e fa e0 <0f> ff e9 42 ff ff ff 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 [75667.608323] ---[ end trace cf26df27c9597264 ]--- Fixes: 62ede777 ("Add OPA extended LID support") Reviewed-by:
-
Sebastian Sanchez authored
The s_ahgpsn was incorrectly placed in the read-mostly section of the QP and the s_curr_size and s_hdrwords are oversized. The misplaced s_ahgpsn will cause the read-mostly cachelines to thrash. Place s_ahgpsn in the send side cache lines and correctly size and s_hdrwords and s_cur_size to keep the send side cachelines at the same size. Reviewed-by:
Sebastian Sanchez <sebastian.sanchez@intel.com> Signed-off-by:
-
Don Hiatt authored
The LIDs passed to opa_extended_lid are in __be32 format, change function signature accordingly. This fixes the following sparse warnings: drivers/infiniband/core/cm.c:1181:60: warning: incorrect type in argument 1 (different ba drivers/infiniband/core/cm.c:1182:60: warning: incorrect type in argument 2 (different ba drivers/infiniband/core/cm.c:1242:68: warning: incorrect type in argument 1 (different ba drivers/infiniband/core/cm.c:1243:68: warning: incorrect type in argument 2 (different ba drivers/infiniband/core/cm.c:2922:66: warning: incorrect type in argument 1 (different ba drivers/infiniband/core/cm.c:2923:66: warning: incorrect type in argument 2 (different ba include/rdma/opa_addr.h:102:14: warning: cast to restricted __be32 Fixes: e92aa00a ("IB/CM: Add OPA Path record support to CM") Reviewed-by:
-
Sebastian Sanchez authored
When the link is disabled and re-enabled, the host version bit is not set again, so the firmware behaves as though it’s interacting with an old driver. This causes LNI to get out of sync. The host version bit needs to be set at load_8051_firmware() and _dc_start(). Currently, it's only set at load_8051_firmware(). Create a common function to set the bit with the intent to make the code more maintainable in the future, set the host version bit at _dc_start() and modify the 8051 command API to prevent a deadlock as _dc_start() is already holding the dc8051 lock. Fixes: 913cc671 ("IB/hfi1: Always perform offline transition") Reviewed-by:
-
Michael J. Ruhl authored
The addition of the VNIC contexts to num_rcv_contexts changes the meaning of the sysfs value nctxts from available user contexts, to user contexts + reserved VNIC contexts. User applications that use nctxts are now broken. Update the calculation so that VNIC contexts are used only if there are hardware contexts available, and do not silently affect nctxts. Update code to use the calculated VNIC context number. Update the sysfs value nctxts to be available user contexts only. Fixes: 2280740f ("IB/hfi1: Virtual Network Interface Controller (VNIC) HW support") Reviewed-by:
Ira Weiny <ira.weiny@intel.com> Reviewed-by:
Niranjana Vishwanathapura <Niranjana.Vishwanathapura@intel.com> Reviewed-by:
Michael J. Ruhl <michael.j.ruhl@intel.com> Signed-off-by:
-
Mike Marciniszyn authored
The 16B changes to the output side of the header trace introduced two issues: 1. An uninitialized field "l4" for 9B packets This field needs to be given a value of 0 for 9B packets to insure a correct 9B trace. The fix adds a new define to insure that there is a dummy default for 9B packets to insure the correct string is decoded. 2. Use of entry vs. __entry in field references Fixes: Commit 863cf89d ("IB/hfi1: Add 16B trace support") Reported-by:
Kaike Wan <kaike.wan@intel.com> Reviewed-by:
-
Jakub Byczkowski authored
Platform configuration format version 4, that didn't use the file size field, is not parsed by the host driver. Only version 5 is supported. Add logic in parsing procedure to determine what format is being used and allow to read data from version 4 files. Reviewed-by:
Jan Sokolowski <jan.sokolowski@intel.com> Reviewed-by:
Andrzej Kacprowski <andrzej.kacprowski@intel.com> Signed-off-by:
Jakub Byczkowski <jakub.byczkowski@intel.com> Signed-off-by:
-
Shiraz Saleem authored
A Work Request (WR) posted after QP is flushed will not get a flush completion. Correct this problem by not allowing posting of WRs after a QP is flushed. Fixes: d3749841 ("i40iw: add files for iwarp interface") Signed-off-by:
Shiraz Saleem <shiraz.saleem@intel.com> Signed-off-by:
-
Mustafa Ismail authored
If RTR WQE is posted and QP is flushed, a CQE is incorrectly generated for the RTR WQE. Add code to look for the RTR and not generate a CQE when QP is flushed. Fixes: 280cfc4b ("i40iw: user kernel shared files") Signed-off-by:
Mustafa Ismail <mustafa.ismail@intel.com> Signed-off-by:
-
Tatyana Nikolova authored
The ACK packets for an MPA request are ignored and the MPA request is retransmitted if the MPA reply is late or missing. Fix this by checking ack_rcvd variable before retransmitting a packet. Fixes: f27b4746 ("i40iw: add connection management code") Signed-off-by:
Tatyana Nikolova <tatyana.e.nikolova@intel.com> Signed-off-by:
Faisal Latif <faisal.latif@intel.com> Signed-off-by:
-
Colin Ian King authored
For the case where hr_qp->state == IB_QPS_RESET, an uninitialized value in ret is being returned by function hns_roce_v2_query_qp. Fix this by setting ret to 0 for this specific return condition. Detected by CoverityScan, CID#1457203 ("Unitialized scalar variable") Signed-off-by:Wei Hu (Xavier) <xavier.huwei@huawei.com> Signed-off-by:
-
- 29 Sep, 2017 9 commits
-
-
Lijun Ou authored
We replace usleep_range that was excessively long anyway with udelay to avoid using usleep_range function in spin_lock_bh spin region, thereby avoiding this calltrace: BUG: scheduling while atomic: insmod/1428/0x00000002 Modules linked in: hns-roce-hw-v2(+) hns_roce rdma_ucm rdma_cm iw_cm ib_uverbs ib_cm ib_core CPU: 0 PID: 1428 Comm: insmod Not tainted 4.12.0-rc1-00677-g252e8fd-dirty #43 Hardware name: (null) (DT) Call trace: [<ffff000008089d20>] dump_backtrace+0x0/0x274 [<ffff00000808a068>] show_stack+0x20/0x28 [<ffff00000844ea58>] dump_stack+0x94/0xb4 [<ffff0000080f975c>] __schedule_bug+0x68/0x84 [<ffff000008a988d4>] __schedule+0x5fc/0x70c [<ffff000008a98a24>] schedule+0x40/0xa4 [<ffff000008a9c6f0>] schedule_hrtimeout_range_clock+0x98/0xfc [<ffff000008a9c788>] schedule_hrtimeout_range+0x34/0x40 [<ffff000008a9c098>] usleep_range+0x6c/0x80 [<ffff000000b9ae68>] hns_roce_cmd_send+0xe4/0x264 [hns-roce-hw-v2] [<ffff000000b9b748>] hns_roce_cmd_query_hw_info+0x40/0x60 [hns-roce-hw-v2] [<ffff000000b9b790>] hns_roce_v2_profile+0x28/0x668 [hns-roce-hw-v2] [<ffff000000b6b1f4>] hns_roce_init+0x6c/0x948 [hns-roce-hw-v2] Signed-off-by:
Lijun Ou <oulijun@huawei.com> Signed-off-by:
Shaobo Xu <xushaobo2@huawei.com> Signed-off-by:
-
Lijun Ou authored
The driver doesn't actually register an inetaddr notifier function, so there is no need to unregister it on shutdown. Signed-off-by:
-
Wei Hu(Xavier) authored
After the loop in hns_roce_v1_mr_free_work_fn function, it is possible that all qps will have been freed (in which case ne will be 0). If that happens, then later in the function when we dereference hr_qp we will get an exception. Check ne is not 0 to make sure we actually have an hr_qp left to work on. This patch fixes the smatch error as below: drivers/infiniband/hw/hns/hns_roce_hw_v1.c:1009 hns_roce_v1_mr_free_work_fn() error: we previously assumed 'hr_qp' could be null Signed-off-by:
-
Lijun Ou authored
When querying qp, It needs to return RoCE device ah_attr type that may be specific to RoCE devices. Signed-off-by:
-
Lijun Ou authored
Only when the IB_QP_DEST_QPN flag of attr_mask is set is it valid to assign the dest_qp_num into the dest_qp field of qp context. Signed-off-by:
-
Wei Hu(Xavier) authored
When lp_qp_work is NULL, we should return ENOMEM. In order to do so, we had to make some upper layer functions return a value instead of being void type so we can propagate the error up the stack. This patch fixes the smatch error as below: drivers/infiniband/hw/hns/hns_roce_hw_v1.c:918 hns_roce_v1_recreate_lp_qp() error: potential null dereference 'lp_qp_work'. (kzalloc returns null) Signed-off-by:
-
Lijun Ou authored
Put the code for checking the send doorbell status into a separate function and call it from check_qp_db_process_status to improve indenting and readability. It fixes the warning from static checker: drivers/infiniband/hw/hns/hns_roce_hw_v1.c:3562 check_qp_db_process_status() warn: inconsistent indenting. Fixes: 5f110ac4 ("IB/hns: Fix for checkpatch.pl comment style) Signed-off-by:
-
Lijun Ou authored
The value of max_rd_atomic and max_dest_rd_atomic in query_qp are incorrect. It should be assigned by left shifting of the bit in hip06 SoC. Signed-off-by:
-
Steve Wise authored
For messages sent from the host to fw that solicit a reply from fw, the c4iw_wr_wait struct pointer is passed in the host->fw message, and included in the fw->host fw6_msg reply. This allows the sender to wait until the reply is received, and the code processing the ingress reply to wake up the sender. If c4iw_wait_for_reply() times out, however, we need to keep the c4iw_wr_wait object around in case the reply eventually does arrive. Otherwise we have touch-after-free bugs in the wake_up paths. This was hit due to a bad kernel driver that blocked ingress processing of cxgb4 for a long time, causing iw_cxgb4 timeouts, but eventually resuming ingress processing and thus hitting the touch-after-free bug. So I want to fix iw_cxgb4 such that we'll at least keep the wait object around until the reply comes. If it never comes we leak a small amount of memory, but if it does come late, we won't potentially crash the system. So add a kref struct in the c4iw_wr_wait struct, and take a reference before sending a message to FW that will generate a FW6 reply. And remove the reference (and potentially free the wait object) when the reply is processed. The ep code also uses the wr_wait for non FW6 CPL messages and doesn't embed the c4iw_wr_wait object in the message sent to firmware. So for those cases we add c4iw_wake_up_noref(). The mr/mw, cq, and qp object create/destroy paths do need this reference logic. For these paths, c4iw_ref_send_wait() is introduced to take the wr_wait reference, send the msg to fw, and then wait for the reply. So going forward, iw_cxgb4 either uses c4iw_ofld_send(), c4iw_wait_for_reply() and c4iw_wake_up_noref() like is done in the some of the endpoint logic, or c4iw_ref_send_wait() and c4iw_wake_up_deref() (formerly c4iw_wake_up()) when sending messages with the c4iw_wr_wait object pointer embedded in the message and resulting FW6 reply. Signed-off-by:
-
