aboutsummaryrefslogtreecommitdiffstats
path: root/drivers (follow)
AgeCommit message (Collapse)AuthorFilesLines
2016-05-26IB/hfi1: Do not free hfi1 cdev parent structure earlyDennis Dalessandro5-6/+31
The deletion of a cdev is not a fence for holding off references to the structure. The driver attempts to delete the cdev and then proceeds to free the parent structure, the hfi1_devdata, or dd. This can potentially lead to a kernel panic in situations where a user has an FD for the cdev open, and the pci device gets removed. If the user then closes the FD there will be a NULL dereference when trying to do put on the cdev's kobject. Fix this by pointing the cdev's kobject.parent at a new kobject embedded in its parent structure. Also take a reference when the device is opened and put it back when it is closed. Reviewed-by: Mitko Haralanov <mitko.haralanov@intel.com> Signed-off-by: Ira Weiny <ira.weiny@intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-26IB/hfi1: Add trace message in user IOCTL handlingDennis Dalessandro3-0/+3
Add a trace message to HFI1s user IOCTL handling. This allows debugging of which IOCTLs are being handled by the driver. Reviewed-by: Ira Weiny <ira.weiny@intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-26IB/hfi1: Remove write(), use ioctl() for user cmdsDennis Dalessandro1-226/+0
Remove the write() handler for user space commands now that ioctl handling is available. User apps will need to change to use ioctl from this point forward. Reviewed-by: Mitko Haralanov <mitko.haralanov@intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-26IB/hfi1: Add ioctl() interface for user commandsDennis Dalessandro2-1/+208
IOCTL is more suited to what user space commands need to do than the write() interface. Add IOCTL definitions for all existing write commands and the handling for those. The write() interface will be removed in a follow on patch. Reviewed-by: Mitko Haralanov <mitko.haralanov@intel.com> Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Reviewed-by: Ira Weiny <ira.weiny@intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-26IB/hfi1: Remove unused user commandDennis Dalessandro1-3/+0
The HFI1_CMD_SDMA_STATUS_UPD command was never implemented it has no reason to live in the driver. Remove it. Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Mitko Haralanov <mitko.haralanov@intel.com> Reviewed-by: Ira Weiny <ira.weiny@intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-26IB/hfi1: Remove snoop/diag interfaceDennis Dalessandro3-1934/+2
The snoop/diag interface is better served by an implementation which is more general and usable by other drivers perhaps. Go ahead and remove the code now and get rid of the char dev. We can put the feature back when we have a more agreeable solution. Reviewed-by: Dean Luick <dean.luick@intel.com> Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-26IB/hfi1: Remove EPROM functionality from data deviceDennis Dalessandro2-392/+0
Remove EPROM handling from the cdev which is used for user application data traffic. Reviewed-by: Dean Luick <dean.luick@intel.com> Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-26IB/hfi1: Remove UI char deviceDennis Dalessandro1-167/+1
Remove UI char device which exposes direct access to registers for user space. This was put in to aid in debugging the hardware. We are looking into alternatives means of providing the same functionality. This removes another char device from HFI1's footprint. Reviewed-by: Dean Luick <dean.luick@intel.com> Reviewed-by: Mitko Haralanov <mitko.haralanov@intel.com> Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-26IB/hfi1: Remove multiple device cdevDennis Dalessandro1-83/+19
hfi1 current exports a cdev that can be used to target all of the hfi's in the system. However there is a problem with this approach in that the devices could be on different subnets. This is a problem that user space can figure out and explicitly tell the driver on which device to create a context. Remove the multi-purpose cdev leaving a dedicated cdev for each port. Also remove the striping capability that is dependent upon the user choosing the multi-purpose cdev. It is now up to user space to determine how to stripe contexts. Reviewed-by: Dean Luick <dean.luick@intel.com> Reviewed-by: Mitko Haralanov <mitko.haralanov@intel.com> Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Reviewed-by: Ira Weiny <ira.weiny@intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-26IB/hfi1: Remove anti-pattern in cdev initDennis Dalessandro1-7/+7
Remove the usage of an anti-pattern goto in hfi1_cdev_init to improve code readability. Suggested-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Reviewed-by: Ira Weiny <ira.weiny@intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-26IB/hfi1: Fix bug that blocks process on exit after port bounceJianxin Xiong1-1/+4
During the processing of a user SDMA request, if there was an error before the request counter was increased, the state of the packet queue could be updated incorrectly, causing the counter to underflow. As the result, the process could get stuck later since the counter could never get back to 0. This patch adds a condition to guard the packet queue update so that the counter is only decreased if it has been increased before the error happens. Reviewed-by: Mitko Haralanov <mitko.haralanov@intel.com> Signed-off-by: Jianxin Xiong <jianxin.xiong@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-26IB/qib: Remove unused qib_7322_intr_msgs[]Jubin John1-15/+0
Building the qib driver with gcc version 6.1.0 raises the following build warning: drivers/infiniband/hw/qib/qib_iba7322.c:1311:39: warning: 'qib_7322_intr_msgs' defined but not used [-Wunused-const-variable=] static const struct qib_hwerror_msgs qib_7322_intr_msgs[] = { ^~~~~~~~~~~~~~~~~~ Remove the unused qib_7322_intr_msgs[] Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by: Jubin John <jubin.john@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-26IB/hfi1: Remove unnecessary commentIra Weiny1-3/+0
This comment was old, the MTU enums have been defined. Reviewed-by: Mitko Haralanov <mitko.haralanov@intel.com> Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Ira Weiny <ira.weiny@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-26IB/hfi1: Fix sdma_event_names[] build warningJubin John1-0/+2
sdma_event_names[] is only used within CONFIG_SDMA_VERBOSITY ifdefs, so when CONFIG_SDMA_VERBOSITY is disabled, it results in the following 0-day build warning: >> drivers/infiniband/hw/hfi1/sdma.c:137:27: warning: 'sdma_event_names' >> defined but not used [-Wunused-const-variable=] static const char * const sdma_event_names[] = { ^~~~~~~~~~~~~~~~ This occurs on the following compiler: compiler: gcc-6 (Debian 6.1.1-1) 6.1.1 20160430 For more information check: https://lists.01.org/pipermail/kbuild-all/2016-May/020060.html Fix this warning by defining sdma_event_name[] only within the CONFIG_SDMA_VERBOSITY ifdefs. Reported-by: kbuild test robot <fengguang.wu@intel.com> Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Jubin John <jubin.john@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-26IB/rdmavt: Use kzalloc_nodeJubin John1-1/+3
Use kzalloc_node instead of kzalloc for rdmavt memory region segment allocation to optimize for performance on NUMA platforms. Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Jubin John <jubin.john@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-26IB/rdmavt: Insure QP vmalloc variants zero memoryMike Marciniszyn1-4/+4
The usage of the various vmalloc APIs do not consistently zero memory when allocating the swqe. Insure zeroing variants are used. Reviewed-by: Mitko Haralanov <mitko.haralanov@intel.com> Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-26IB/hfi1: Fix an interval RB node reference count leakMitko Haralanov1-7/+6
Commit e88c9271d9f8 ("IB/hfi1: Fix buffer cache corner case which may cause corruption") introduced a bug which may cause a reference count of a interval RB node to be leaked in the case where an SDMA transfer from that node completes at the same time as the node is being extended. If a node is being extended, it is first removed from the RB tree in order to be processed without the risk of an invalidation event removing the node at the same time. If a SDMA completion happens during that time, the completion handler will fail to find the node in the RB tree and, therefore, fail to correctly decrement its refcount. This leaves the node in the tree and its pages pinned for the duration of the user process. To prevent this from happening the io vector adds a reference to the RB node, which is used during the SDMA completion instead of looking up the node in the RB tree. This change adds a performance improvement as a side effect by avoiding the RB tree lookup. Fixes: e88c9271d9f8 ("IB/hfi1: Fix buffer cache corner case which may cause corruption") Reviewed-by: Dean Luick <dean.luick@intel.com> Reviewed-by: Harish Chegondi <harish.chegondi@intel.com> Signed-off-by: Mitko Haralanov <mitko.haralanov@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-13staging/rdma/hfi1: use RCU_INIT_POINTER() when NULLing.Muhammad Falak R Wani1-1/+1
It is safe to use RCU_INIT_POINTER() to NULL a pointer, instead of rcu_assign_pointer(). This results in slightly smaller/faster code. Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com> Reviewed-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-13IB/hfi1: Change hfi1_init loop to preserve error returnsAshutosh Dixit1-3/+3
If one iteration of the loop causes an error return and a later iteration doesn't, the later iteration causes the earlier error condition to be lost. This could result in driver probe succeeding when it should have failed. Therefore save off the error return in the loop itself rather than outside the loop. Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Reviewed-by: Mitko Haralanov <mitko.haralanov@intel.com> Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-13IB/hfi1: Keep SC_USER as the last send context typeJianxin Xiong1-4/+4
SC_USER needs to be the last send context type to ensure other send context types get their allocation when num_user_contexts is set to a large number. This fixes a panic when the module parameter num_user_contexts is set to 141 and larger. Reviewed-by: Dean Luick <dean.luick@intel.com> Signed-off-by: Jianxin Xiong <jianxin.xiong@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-13IB/hfi1: Immediately apply congestion setting MADDean Luick1-33/+60
The handling of the congestion setting MAD packet only saved off the values, waiting for a congestion control table packet before going active. Instead, immediately apply the values. Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Dean Luick <dean.luick@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-13IB/hfi1: Correct log message stringsJakub Pawlak4-7/+6
Remove "IB" keyword from log messages. Correct comment for thermal sensor init function. Reviewed-by: Dean Luick <dean.luick@intel.com> Signed-off-by: Jakub Pawlak <jakub.pawlak@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-13IB/rdmavt: Increase CQ callback thread priorityMike Marciniszyn1-0/+1
The priority of the send engines is higher than the CQ completion thread potentially causing completions to be starved for very fast interfaces. Change the CQ kthread to match the send engine threads to minimize this delay for ULP completion processing. Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-13IB/hfi1: Fix hfi_rcvhdr tracepointJubin John1-1/+1
The hfi_rcvhdr tracepoint has the ctxt and eflags switched in the prototype of the trace event, compared to the args and usage of the trace function. Fix this by swapping these 2 fields in the trace event prototype. Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by: Jubin John <jubin.john@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-13IB/hfi1: Remove unnecessary headerJubin John2-2/+0
While running perftests, there is a significant utilization of the random number daemon. This is due to the linux/random.h header being included in qp.c and verbs.c. However, none of the functions from this header are being used in these files, so remove the unnecessary header. Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by: Jubin John <jubin.john@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-13IB/hfi1: Improve performance of interval RB treesMitko Haralanov1-11/+11
The interval RB tree management functions use handlers to store user-specific callback for the various tree operations. These handlers are put on a doubly-linked list. When a RB tree function is called, the list is searched for the handler of the particular tree. The list which holds the handlers is modified very rarely - when a handler is created and when a handler is removed. On the other hand, it is searched very often. This a perfect usage scenario for RCU. The result is a much lower overhead of traversing the list as most of the time no locking will be required. Reviewed-by: Dean Luick <dean.luick@intel.com> Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by: Mitko Haralanov <mitko.haralanov@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-13IB/hfi1: Fix potential panic with sdma drained mechanismMike Marciniszyn1-1/+1
The guard is backwards, potentially causing the SDMA client to panic if a wait structure was not specified. psm and verbs are not exposed to the issue, but fix the code just to be correct. Fixes: a545f5308b6c ("staging/rdma/hfi: fix CQ completion order issue") Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-13IB/hfi1: Fix pio wait counter double incrementMike Marciniszyn1-1/+0
The code unconditionlly increments the pio wait counter making the counter inacurate and unusable. Fixes: 14553ca11039 ("staging/rdma/hfi1: Adaptive PIO for short messages") Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-13IB/hfi1: Remove no-op QSFP reset codeDean Luick1-3/+0
The RESET_N bit of the ASIC_QSFPn_OE register is not used by the hardware. Remove code that tries to use it - it does nothing. Reviewed-by: Easwar Hariharan <easwar.hariharan@intel.com> Signed-off-by: Dean Luick <dean.luick@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-13IB/hfi1: Correct external device configuration shiftEaswar Hariharan1-2/+2
The external device configuration was incorrectly shifted to byte 3 of the 32 bit DC_HOST_COMM_SETTINGS instead of byte 0. This patch corrects the shift and provides the cable capability information in byte 0. Reviewed-by: Dean Luick <dean.luick@intel.com> Signed-off-by: Easwar Hariharan <easwar.hariharan@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-13IB/hfi1: Wait for QSFP modules to initializeEaswar Hariharan3-7/+21
The function level reset in init_chip() and subsequent write of all 1s to the ASIC_QSFP registers effectively resets attached active and optical QSFP modules that pay attention to the RESET_N pin. We subsequently try to access the QSFP management interface to qualify and tune the channel and fabric SerDes before enough time (2 seconds per SFF 8679 spec for QSFP28 modules) has elapsed for the module to finish initialization. This fails and causes the failure of the channel tuning algorithm, preventing us from bringing the link up. This patch checks the port type prior to beginning channel and SerDes tuning, and if found to be QSFP, watches for the QSFP initialization complete interrupt, with a maximum timeout of 2 seconds, to allow the initialization to complete. Reviewed-by: Dean Luick <dean.luick@intel.com> Signed-off-by: Easwar Hariharan <easwar.hariharan@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-13IB/hfi1: Ignore non-temperature warnings on a downed linkEaswar Hariharan3-7/+13
QSFP modules can raise an interrupt to inform us of expected conditions while the link is down, such as RX power low. Actively ignore these conditions when the link is down as they only add reporting noise. Continue reporting conditions that are valid at all times, such as temperature alarms and warnings. Reviewed-by: Dean Luick <dean.luick@intel.com> Signed-off-by: Easwar Hariharan <easwar.hariharan@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-12IB/srp: Move common code into the callerBart Van Assche1-1/+0
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Sagi Grimberg <sagi@grimberg.me> Cc: Laurence Oberman <loberman@redhat.com> Reviewed-by: Sagi Grimberg <sai@grimberg.m> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-12IB/srp: Move code out of a loopBart Van Assche1-3/+3
Since all srp_map_finish_fr() callers pass a non-zero value as the fourth argument (sg_nents), the sg_nents == 0 check in that function can be removed. Add a count == 0 check in the caller of that function. Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Sagi Grimberg <sagi@grimberg.me> Cc: Laurence Oberman <loberman@redhat.com> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-12IB/srp: Avoid that mapping failure triggers an infinite loopBart Van Assche1-0/+2
The srp_queuecommand() function translates ENOMEM into QUEUE_FULL which causes the SCSI mid-layer to retry the command. All other error codes are translated into DID_ERROR which causes the SCSI command to fail. Return E2BIG if mapping will always fail to prevent that the SCSI mid-layer keeps resubmitting a command forever. Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Sagi Grimberg <sagi@grimberg.me> Cc: Laurence Oberman <loberman@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-12IB/srp: Introduce target->mr_pool_sizeBart Van Assche2-3/+4
This patch does not change any functionality. Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> Reviewed-by: Sagi Grimberg <sagig@mellanox.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Laurence Oberman <loberman@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-12IB/srp: Fix srp_map_data() error pathsBart Van Assche1-11/+13
Ensure that req->nmdesc is set correctly in srp_map_sg() if mapping fails. Avoid that mapping failure causes a memory descriptor leak. Report srp_map_sg() failure to the caller. Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Sagi Grimberg <sagi@grimberg.me> Cc: Laurence Oberman <loberman@redhat.com> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-12IB/srp: Document srp_map_data() return valueBart Van Assche1-0/+9
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> Reviewed-by: Sagi Grimberg <sagig@mellanox.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Laurence Oberman <loberman@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-12IB/srp: Fix a commentBart Van Assche1-1/+1
The free request list was removed through patch "IB/srp: Use block layer tags". Hence update a comment that refers to that free request list. Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Sagi Grimberg <sagi@grimberg.me> Cc: Laurence Oberman <loberman@redhat.com> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-12IB/srp: Fix a spelling error in a source code commentBart Van Assche1-1/+1
Change one occurrence of "boundries" into "boundaries". Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> Reviewed-by: Sagi Grimberg <sagig@mellanox.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Laurence Oberman <loberman@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-05Merge branches 'hfi1' and 'iw_cxgb4' into k.o/for-4.7Doug Ledford38-544/+1134
2016-05-05RDMA/iw_cxgb4: remove abort_connection() usage from ep_timeout()Hariprasad S1-10/+2
Use c4iw_ep_disconnect() instead. This is part of getting rid of abort_connection() altogether so we properly clean up on send_abort() failures. This is the last user of abort_connection(), so remove it too. Signed-off-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-05RDMA/iw_cxgb4: move QP -> ERROR on fatal disconnect errorsHariprasad S1-0/+13
In c4iw_ep_disconnect(), if we fail to initiate a close operation, then move the qp to ERROR to disassociate the ep from the qp. Failure to do this will leak the ep resources. Signed-off-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-05RDMA/iw_cxgb4: don't use abort_connection in process_mpa_request()Hariprasad S1-29/+35
Instead return whether the caller needs to disconnect. This is part of getting rid of abort_connection() altogether so we properly clean up on send_abort() failures. Signed-off-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-05RDMA/iw_cxgb4: remove abort_connection() usage from accept/rejectHariprasad S1-14/+15
Use c4iw_ep_disconnect() instead. This is part of getting rid of abort_connection() altogether so we properly clean up on send_abort() failures. Signed-off-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-05RDMA/iw_cxgb4: free resources when send_flowc() failsHariprasad S1-5/+18
Signed-off-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-05RDMA/iw_cxgb4: remove connection abort from process_mpa_replyHariprasad S1-2/+13
Instead, have the caller, rx_data() handle the close/abort like it does for process_mpa_request(). This is part of getting rid of abort_connection() altogether so we properly clean up on send_abort() failures. Signed-off-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-05RDMA/iw_cxgb4: ensure eps don't get freed while the mutex is heldHariprasad S1-0/+7
In rx_data(), with the ep in FPDU_MODE, refcnt=2, if we get unexpected streaming data, we call c4iw_modify_rc_qp() and move the qp from RTS -> TERMINATE. In c4iw_modify_rc_qp(), if rdma_fini() returns an error, the ep will be dereferenced (refcnt=1). Then rx_data() calls c4iw_ep_disconnect() which starts the close operation. But if send_halfclose() fails in c4iw_ep_disconnect(), we will call release_ep_resources() derefing the ep which reduces the refcnt to 0 and and frees the ep. However we still has the ep mutex at that point, so we have a touch-after-free bug. There is a similar issue where peer_close() calls c4iw_ep_disconnect(). The solution is to add a reference to the ep in c4iw_ep_disconnect() after acquiring the mutex, and release it after releasing the mutex. Signed-off-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-05RDMA/iw_cxgb4: stop ep timer on close failureHariprasad S1-1/+6
In c4iw_ep_disconnect(), if we start the ep timer to begin a close, but send_halfclose() fails, we need to stop the timer and send a CLOSE event up to the IWCM before releasing the resources. Otherwise, we can crash when the ep timer fires if the ep is referencing a previous instance of the device. This can happen as part of adapter reset/recovery, for instance. Signed-off-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-05-05RDMA/iw_cxgb4: release ep resources on accept arp failureHariprasad S1-16/+66
If ARP fails before the CPL_PASS_ACCEPT_RPL is seen by hardware, the tid will be stuck in SYN_PEND and never released. So create an arp failure handler specifically for this message to release the endpoint resources. In pass_accept_rpl_arp_failure(), put the parent endpoint so it will be freed when destroyed. Also we don't need to call release_tid() here because _c4iw_free_ep() calls cxgb4_remove_tid() which releases the hwtid. If we get an ABORT_REQ_RSS instead of a PASS_ESTABLISH (because the peer's ACK to our SYN is never received), then put the parent as well in peer_abort(). Treat accept_cr() failures just like arp failures: put the parent ep and release the ep resources destroying the tid The ARP failure handlers are called in an atomic context, so we need to schedule some of the processing which might block. Namely _c4iw_free_ep() which needs a mutex. So create a "special" CPL opcode and handler and schedule it via sched() to be run by process_work() in a blockable context. Also rework the active open arp failure handler to make use of release_ep_resources(). This allows both the active and passive arp failure handlers to use the same deferred cleanup function. Signed-off-by: Steve Wise <swise@opengridcomputing.com> Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: Doug Ledford <dledford@redhat.com>