From owner-svn-src-all@freebsd.org Tue Nov 21 01:18:59 2017 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id C340CDB9F9F; Tue, 21 Nov 2017 01:18:59 +0000 (UTC) (envelope-from np@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 90298757C5; Tue, 21 Nov 2017 01:18:59 +0000 (UTC) (envelope-from np@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id vAL1IwZR072580; Tue, 21 Nov 2017 01:18:58 GMT (envelope-from np@FreeBSD.org) Received: (from np@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id vAL1IwDZ072579; Tue, 21 Nov 2017 01:18:58 GMT (envelope-from np@FreeBSD.org) Message-Id: <201711210118.vAL1IwDZ072579@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: np set sender to np@FreeBSD.org using -f From: Navdeep Parhar Date: Tue, 21 Nov 2017 01:18:58 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r326042 - head/sys/dev/cxgbe/cudbg X-SVN-Group: head X-SVN-Commit-Author: np X-SVN-Commit-Paths: head/sys/dev/cxgbe/cudbg X-SVN-Commit-Revision: 326042 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Nov 2017 01:18:59 -0000 Author: np Date: Tue Nov 21 01:18:58 2017 New Revision: 326042 URL: https://svnweb.freebsd.org/changeset/base/326042 Log: cxgbe(4): Fix unsafe mailbox access in cudbg. MFC after: 1 week Sponsored by: Chelsio Communications Modified: head/sys/dev/cxgbe/cudbg/cudbg_lib.c Modified: head/sys/dev/cxgbe/cudbg/cudbg_lib.c ============================================================================== --- head/sys/dev/cxgbe/cudbg/cudbg_lib.c Mon Nov 20 23:51:51 2017 (r326041) +++ head/sys/dev/cxgbe/cudbg/cudbg_lib.c Tue Nov 21 01:18:58 2017 (r326042) @@ -77,10 +77,17 @@ static void read_sge_ctxt(struct cudbg_init *pdbg_init struct adapter *padap = pdbg_init->adap; int rc = -1; - if (is_fw_attached(pdbg_init)) + if (is_fw_attached(pdbg_init)) { + rc = begin_synchronized_op(padap, NULL, SLEEP_OK | INTR_OK, + "t4cudf"); + if (rc != 0) + goto out; rc = t4_sge_ctxt_rd(padap, padap->mbox, cid, ctype, data); + end_synchronized_op(padap, 0); + } +out: if (rc) t4_sge_ctxt_rd_bd(padap, cid, ctype, data); } @@ -2720,7 +2727,12 @@ static void cudbg_t4_fwcache(struct cudbg_init *pdbg_i if (is_fw_attached(pdbg_init)) { /* Flush uP dcache before reading edcX/mcX */ - rc = t4_fwcache(padap, FW_PARAM_DEV_FWCACHE_FLUSH); + rc = begin_synchronized_op(padap, NULL, SLEEP_OK | INTR_OK, + "t4cudl"); + if (rc == 0) { + rc = t4_fwcache(padap, FW_PARAM_DEV_FWCACHE_FLUSH); + end_synchronized_op(padap, 0); + } if (rc) { if (pdbg_init->verbose) @@ -3331,6 +3343,9 @@ static int collect_tid(struct cudbg_init *pdbg_init, para[5] = FW_PARAM_PFVF_A(SERVER_START); para[6] = FW_PARAM_PFVF_A(SERVER_END); + rc = begin_synchronized_op(padap, NULL, SLEEP_OK | INTR_OK, "t4cudq"); + if (rc) + goto err; mbox = padap->mbox; pf = padap->pf; rc = t4_query_params(padap, mbox, pf, 0, 7, para, val); @@ -3417,6 +3432,7 @@ static int collect_tid(struct cudbg_init *pdbg_init, rc = compress_buff(&scratch_buff, dbg_buff); err1: + end_synchronized_op(padap, 0); release_scratch_buff(&scratch_buff, dbg_buff); err: return rc; @@ -3602,8 +3618,13 @@ static int collect_mps_tcam(struct cudbg_init *pdbg_in htons(V_FW_LDST_CMD_FID(FW_LDST_MPS_RPLC) | V_FW_LDST_CMD_IDX(i)); - rc = t4_wr_mbox(padap, padap->mbox, &ldst_cmd, - sizeof(ldst_cmd), &ldst_cmd); + rc = begin_synchronized_op(padap, NULL, + SLEEP_OK | INTR_OK, "t4cudm"); + if (rc == 0) { + rc = t4_wr_mbox(padap, padap->mbox, &ldst_cmd, + sizeof(ldst_cmd), &ldst_cmd); + end_synchronized_op(padap, 0); + } if (rc) mps_rpl_backdoor(padap, &mps_rplc);