ntb_hw(4): Only record the first three MSIX vectors

[cem]

Summary

Don't overrun the msix_data array by reading the (unused) link state
interrupt information.

Reported by: mav
Sponsored by: EMC / Isilon Storage Division

[mav]

The patch looks good to me, and alike change I've tried myself before fixed the kernel panic.

On the other hand all this workaround stopped any interface traffic for me (without it traffic flows, but _very_ slowly), so can not really test it. Will investigate more.

[mav]

I'm just not sure why ntb_get_msix_info() needs argument to assert its value inside. Why not just remove it, doing fixed loop same as in other places?

[cem]

In D6489#137571, @mav wrote:

The patch looks good to me, and alike change I've tried myself before fixed the kernel panic.

On the other hand all this workaround stopped any interface traffic for me (without it traffic flows, but _very_ slowly), so can not really test it. Will investigate more.

Wow, what panic did you hit? I'm surprised, I didn't run into it.

Re: if_ntb, I'm sure that code is buggy. We don't use it at Isilon so I haven't spent much effort debugging it.

In D6489#137575, @mav wrote:

I'm just not sure why ntb_get_msix_info() needs argument to assert its value inside. Why not just remove it, doing fixed loop same as in other places?

For now, that would be fine. Most of the code tries to handle the hardware-reported number of registers generally rather than hardcoding, though.

[mav]

In D6489#137595, @cem wrote:

Wow, what panic did you hit? I'm surprised, I didn't run into it.

I am surprised you could not hit it. This bug overwrites ntb->peer_lapic_bar pointer with some garbage, that caused fault inside ntb_peer_db_set(). At least it happens so on FreeBSD 10 where I am trying to run this code.

Re: if_ntb, I'm sure that code is buggy. We don't use it at Isilon so I haven't spent much effort debugging it.

That somewhat explains my thoughts about this code after day spent reading it. :(

[cem]

In D6489#137596, @mav wrote:

In D6489#137595, @cem wrote:

Wow, what panic did you hit? I'm surprised, I didn't run into it.

I am surprised you could not hit it. This bug overwrites ntb->peer_lapic_bar pointer with some garbage, that caused fault inside ntb_peer_db_set(). At least it happens so on FreeBSD 10 where I am trying to run this code.

Ah, we don't use that routine.

Re: if_ntb, I'm sure that code is buggy. We don't use it at Isilon so I haven't spent much effort debugging it.

That somewhat explains my thoughts about this code after day spent reading it. :(

:-)