From 04afde45e096201f8fd74c1db848a5d85d1aa57d Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Thu, 17 Sep 2015 13:27:04 -0700 Subject: NTB: Fix issue where we may be accessing NULL ptr smatch detected an issue in the function ntb_transport_max_size() where we could be dereferencing a dma channel pointer when it is NULL. Reported-by: Dan Carpenter Signed-off-by: Dave Jiang Signed-off-by: Jon Mason --- drivers/ntb/ntb_transport.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) (limited to 'drivers') diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c index 6e3ee907d186..3903dfc39975 100644 --- a/drivers/ntb/ntb_transport.c +++ b/drivers/ntb/ntb_transport.c @@ -1996,23 +1996,24 @@ EXPORT_SYMBOL_GPL(ntb_transport_qp_num); */ unsigned int ntb_transport_max_size(struct ntb_transport_qp *qp) { - unsigned int max; + unsigned int max_size; unsigned int copy_align; + struct dma_chan *rx_chan, *tx_chan; if (!qp) return 0; - if (!qp->tx_dma_chan && !qp->rx_dma_chan) - return qp->tx_max_frame - sizeof(struct ntb_payload_header); + rx_chan = qp->rx_dma_chan; + tx_chan = qp->tx_dma_chan; - copy_align = max(qp->tx_dma_chan->device->copy_align, - qp->rx_dma_chan->device->copy_align); + copy_align = max(rx_chan ? rx_chan->device->copy_align : 0, + tx_chan ? tx_chan->device->copy_align : 0); /* If DMA engine usage is possible, try to find the max size for that */ - max = qp->tx_max_frame - sizeof(struct ntb_payload_header); - max -= max % (1 << copy_align); + max_size = qp->tx_max_frame - sizeof(struct ntb_payload_header); + max_size = round_down(max_size, 1 << copy_align); - return max; + return max_size; } EXPORT_SYMBOL_GPL(ntb_transport_max_size); -- cgit v1.2.3 From d4adee09fd1cf65189cb8901eb7506aea3e869ac Mon Sep 17 00:00:00 2001 From: Sudip Mukherjee Date: Sat, 3 Oct 2015 13:39:41 +0530 Subject: NTB: fix access of free-ed pointer We were accessing nt->mw_vec after freeing it. Fix the error path so that we free nt->mw_vec after we have finished using it. Signed-off-by: Sudip Mukherjee Signed-off-by: Jon Mason --- drivers/ntb/ntb_transport.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) (limited to 'drivers') diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c index 3903dfc39975..d09d92e05cbe 100644 --- a/drivers/ntb/ntb_transport.c +++ b/drivers/ntb/ntb_transport.c @@ -1080,7 +1080,7 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev) GFP_KERNEL, node); if (!nt->qp_vec) { rc = -ENOMEM; - goto err2; + goto err1; } if (nt_debugfs_dir) { @@ -1092,7 +1092,7 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev) for (i = 0; i < qp_count; i++) { rc = ntb_transport_init_queue(nt, i); if (rc) - goto err3; + goto err2; } INIT_DELAYED_WORK(&nt->link_work, ntb_transport_link_work); @@ -1100,12 +1100,12 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev) rc = ntb_set_ctx(ndev, nt, &ntb_transport_ops); if (rc) - goto err3; + goto err2; INIT_LIST_HEAD(&nt->client_devs); rc = ntb_bus_init(nt); if (rc) - goto err4; + goto err3; nt->link_is_up = false; ntb_link_enable(ndev, NTB_SPEED_AUTO, NTB_WIDTH_AUTO); @@ -1113,17 +1113,16 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev) return 0; -err4: - ntb_clear_ctx(ndev); err3: - kfree(nt->qp_vec); + ntb_clear_ctx(ndev); err2: - kfree(nt->mw_vec); + kfree(nt->qp_vec); err1: while (i--) { mw = &nt->mw_vec[i]; iounmap(mw->vbase); } + kfree(nt->mw_vec); err: kfree(nt); return rc; -- cgit v1.2.3 From 70d4687d60184915b6f40920041caa1df4f4d033 Mon Sep 17 00:00:00 2001 From: Sudip Mukherjee Date: Sat, 3 Oct 2015 13:39:42 +0530 Subject: NTB: remove unused variable These variables were not used anywhere. So remove them. Signed-off-by: Sudip Mukherjee Signed-off-by: Jon Mason --- drivers/ntb/ntb_transport.c | 4 ---- 1 file changed, 4 deletions(-) (limited to 'drivers') diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c index d09d92e05cbe..27b96ae8b191 100644 --- a/drivers/ntb/ntb_transport.c +++ b/drivers/ntb/ntb_transport.c @@ -928,7 +928,6 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt, unsigned int qp_num) { struct ntb_transport_qp *qp; - struct ntb_transport_mw *mw; phys_addr_t mw_base; resource_size_t mw_size; unsigned int num_qps_mw, tx_size; @@ -939,7 +938,6 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt, qp_count = nt->qp_count; mw_num = QP_TO_MW(nt, qp_num); - mw = &nt->mw_vec[mw_num]; qp = &nt->qp_vec[qp_num]; qp->qp_num = qp_num; @@ -1930,13 +1928,11 @@ EXPORT_SYMBOL_GPL(ntb_transport_link_up); */ void ntb_transport_link_down(struct ntb_transport_qp *qp) { - struct pci_dev *pdev; int val; if (!qp) return; - pdev = qp->ndev->pdev; qp->client_ready = false; val = ntb_spad_read(qp->ndev, QP_LINKS); -- cgit v1.2.3 From c92ba3c5d97de59c016d1a23ebab17293a792621 Mon Sep 17 00:00:00 2001 From: Jon Mason Date: Sun, 4 Oct 2015 22:54:22 -0400 Subject: NTB: invalid buf pointer in multi-MW setups Order of operations issue with the QP Num and MW count, which would result in the receive buffer pointer being invalid if there are more than 1 MW. Corrected with parenthesis to enforce the proper order of operations. Reported-by: John I. Kading Signed-off-by: Jon Mason --- drivers/ntb/ntb_transport.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c index 27b96ae8b191..be9389599e75 100644 --- a/drivers/ntb/ntb_transport.c +++ b/drivers/ntb/ntb_transport.c @@ -605,7 +605,7 @@ static int ntb_transport_setup_qp_mw(struct ntb_transport_ctx *nt, num_qps_mw = qp_count / mw_count; rx_size = (unsigned int)mw->xlat_size / num_qps_mw; - qp->rx_buff = mw->virt_addr + rx_size * qp_num / mw_count; + qp->rx_buff = mw->virt_addr + rx_size * (qp_num / mw_count); rx_size -= sizeof(struct ntb_rx_info); qp->remote_rx_info = qp->rx_buff + rx_size; @@ -956,7 +956,7 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt, mw_size = nt->mw_vec[mw_num].phys_size; tx_size = (unsigned int)mw_size / num_qps_mw; - qp_offset = tx_size * qp_num / mw_count; + qp_offset = tx_size * (qp_num / mw_count); qp->tx_mw = nt->mw_vec[mw_num].vbase + qp_offset; if (!qp->tx_mw) -- cgit v1.2.3 From 8b782fab4da771c97a198f6cb496d124dace36fd Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Thu, 24 Sep 2015 13:03:05 -0700 Subject: NTB: unify translation addresses There is no need for the upstream and downstream addresses to be different for the NTB configs. Go to using a single set of address. It is still possible to configure them differently using module parameter override however. Signed-off-by: Dave Jiang Acked and Tested-by: Allen Hubbe Signed-off-by: Jon Mason --- drivers/ntb/hw/intel/ntb_hw_intel.c | 16 ++++++++-------- drivers/ntb/hw/intel/ntb_hw_intel.h | 15 +++++---------- 2 files changed, 13 insertions(+), 18 deletions(-) (limited to 'drivers') diff --git a/drivers/ntb/hw/intel/ntb_hw_intel.c b/drivers/ntb/hw/intel/ntb_hw_intel.c index 865a3e3cc581..a198f8298258 100644 --- a/drivers/ntb/hw/intel/ntb_hw_intel.c +++ b/drivers/ntb/hw/intel/ntb_hw_intel.c @@ -2204,17 +2204,17 @@ static const struct intel_ntb_xlat_reg xeon_sec_xlat = { }; static struct intel_b2b_addr xeon_b2b_usd_addr = { - .bar2_addr64 = XEON_B2B_BAR2_USD_ADDR64, - .bar4_addr64 = XEON_B2B_BAR4_USD_ADDR64, - .bar4_addr32 = XEON_B2B_BAR4_USD_ADDR32, - .bar5_addr32 = XEON_B2B_BAR5_USD_ADDR32, + .bar2_addr64 = XEON_B2B_BAR2_ADDR64, + .bar4_addr64 = XEON_B2B_BAR4_ADDR64, + .bar4_addr32 = XEON_B2B_BAR4_ADDR32, + .bar5_addr32 = XEON_B2B_BAR5_ADDR32, }; static struct intel_b2b_addr xeon_b2b_dsd_addr = { - .bar2_addr64 = XEON_B2B_BAR2_DSD_ADDR64, - .bar4_addr64 = XEON_B2B_BAR4_DSD_ADDR64, - .bar4_addr32 = XEON_B2B_BAR4_DSD_ADDR32, - .bar5_addr32 = XEON_B2B_BAR5_DSD_ADDR32, + .bar2_addr64 = XEON_B2B_BAR2_ADDR64, + .bar4_addr64 = XEON_B2B_BAR4_ADDR64, + .bar4_addr32 = XEON_B2B_BAR4_ADDR32, + .bar5_addr32 = XEON_B2B_BAR5_ADDR32, }; /* operations for primary side of local ntb */ diff --git a/drivers/ntb/hw/intel/ntb_hw_intel.h b/drivers/ntb/hw/intel/ntb_hw_intel.h index ea0612f797df..2eb4addd10d0 100644 --- a/drivers/ntb/hw/intel/ntb_hw_intel.h +++ b/drivers/ntb/hw/intel/ntb_hw_intel.h @@ -227,16 +227,11 @@ /* Use the following addresses for translation between b2b ntb devices in case * the hardware default values are not reliable. */ -#define XEON_B2B_BAR0_USD_ADDR 0x1000000000000000ull -#define XEON_B2B_BAR2_USD_ADDR64 0x2000000000000000ull -#define XEON_B2B_BAR4_USD_ADDR64 0x4000000000000000ull -#define XEON_B2B_BAR4_USD_ADDR32 0x20000000u -#define XEON_B2B_BAR5_USD_ADDR32 0x40000000u -#define XEON_B2B_BAR0_DSD_ADDR 0x9000000000000000ull -#define XEON_B2B_BAR2_DSD_ADDR64 0xa000000000000000ull -#define XEON_B2B_BAR4_DSD_ADDR64 0xc000000000000000ull -#define XEON_B2B_BAR4_DSD_ADDR32 0xa0000000u -#define XEON_B2B_BAR5_DSD_ADDR32 0xc0000000u +#define XEON_B2B_BAR0_ADDR 0x1000000000000000ull +#define XEON_B2B_BAR2_ADDR64 0x2000000000000000ull +#define XEON_B2B_BAR4_ADDR64 0x4000000000000000ull +#define XEON_B2B_BAR4_ADDR32 0x20000000u +#define XEON_B2B_BAR5_ADDR32 0x40000000u /* The peer ntb secondary config space is 32KB fixed size */ #define XEON_B2B_MIN_SIZE 0x8000 -- cgit v1.2.3 From fdcb4b2e78220bde95ce4ba3213088e3a1f1cec6 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Wed, 7 Oct 2015 09:59:34 +0200 Subject: NTB: fix 32-bit compiler warning resource_size_t may be 32-bit wide on some architectures, which causes this warning when building the NTB code: drivers/ntb/ntb_transport.c: In function 'ntb_transport_link_work': drivers/ntb/ntb_transport.c:828:46: warning: right shift count >= width of type [-Wshift-count-overflow] The warning is harmless but can be avoided by using the upper_32_bits() macro. Signed-off-by: Arnd Bergmann Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers") Signed-off-by: Jon Mason --- drivers/ntb/ntb_transport.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c index be9389599e75..60654d524858 100644 --- a/drivers/ntb/ntb_transport.c +++ b/drivers/ntb/ntb_transport.c @@ -825,10 +825,10 @@ static void ntb_transport_link_work(struct work_struct *work) size = max_mw_size; spad = MW0_SZ_HIGH + (i * 2); - ntb_peer_spad_write(ndev, spad, (u32)(size >> 32)); + ntb_peer_spad_write(ndev, spad, upper_32_bits(size)); spad = MW0_SZ_LOW + (i * 2); - ntb_peer_spad_write(ndev, spad, (u32)size); + ntb_peer_spad_write(ndev, spad, lower_32_bits(size)); } ntb_peer_spad_write(ndev, NUM_MWS, nt->mw_count); -- cgit v1.2.3