git: 6ee16b9fa6a1 - main - iw_cxgbe: Various fixes around waiting for replies to work requests

From: John Baldwin <jhb_at_FreeBSD.org>
Date: Tue, 15 Sep 2026 14:47:50 UTC
The branch main has been updated by jhb:

URL: https://cgit.FreeBSD.org/src/commit/?id=6ee16b9fa6a1fb4de778ac03dbaa281ea2e276be

commit 6ee16b9fa6a1fb4de778ac03dbaa281ea2e276be
Author:     Potnuri Bharat Teja <bharat@chelsio.com>
AuthorDate: 2018-02-15 07:32:53 +0000
Commit:     John Baldwin <jhb@FreeBSD.org>
CommitDate: 2026-09-15 14:22:39 +0000

    iw_cxgbe: Various fixes around waiting for replies to work requests
    
    Allocate wait objects dynamically and add a refcount instead of
    allocating them on the current thread's stack.  This permits
    c4iw_wait_for_reply() to safely fail with an error and mark the device
    as dead if a reply is not received after C4IW_WR_TO seconds.  Once a
    device is marked dead, future requests fail immediately.
    
    Sponsored by:   Chelsio Communications
---
 sys/dev/cxgbe/iw_cxgbe/cm.c       |  12 ++-
 sys/dev/cxgbe/iw_cxgbe/cq.c       |  65 +++++------
 sys/dev/cxgbe/iw_cxgbe/device.c   |  21 ++++
 sys/dev/cxgbe/iw_cxgbe/iw_cxgbe.h | 114 +++++++++++++-------
 sys/dev/cxgbe/iw_cxgbe/mem.c      | 220 ++++++++++++++++++++++++--------------
 sys/dev/cxgbe/iw_cxgbe/qp.c       |  66 ++++++------
 6 files changed, 313 insertions(+), 185 deletions(-)

diff --git a/sys/dev/cxgbe/iw_cxgbe/cm.c b/sys/dev/cxgbe/iw_cxgbe/cm.c
index d291eeeb4f40..b77b5a44cab1 100644
--- a/sys/dev/cxgbe/iw_cxgbe/cm.c
+++ b/sys/dev/cxgbe/iw_cxgbe/cm.c
@@ -1081,7 +1081,7 @@ c4iw_so_upcall(struct socket *so, void *arg, int waitflag)
 	 * with locks held.
 	 */
 	if (so->so_error || c4iw_stopped(&ep->com.dev->rdev))
-		c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
+		c4iw_wake_up_noref(ep->com.wr_waitp, -ECONNRESET);
 	add_ep_to_req_list(ep, C4IW_EVENT_SOCKET);
 
 	return (SU_OK);
@@ -1311,9 +1311,14 @@ alloc_ep(int size, gfp_t gfp)
 	if (epc == NULL)
 		return (NULL);
 
+	epc->wr_waitp = c4iw_alloc_wr_wait(gfp);
+	if (!epc->wr_waitp) {
+		kfree(epc);
+		return (NULL);
+	}
 	kref_init(&epc->kref);
 	mutex_init(&epc->mutex);
-	c4iw_init_wr_wait(&epc->wr_wait);
+	c4iw_init_wr_wait(epc->wr_waitp);
 
 	return (epc);
 }
@@ -1335,6 +1340,7 @@ void _c4iw_free_ep(struct kref *kref)
 		deref_qp(ep);
 	CTR4(KTR_IW_CXGBE, "%s: ep %p, history 0x%lx, flags 0x%lx",
 	    __func__, ep, epc->history, epc->flags);
+	c4iw_put_wr_wait(ep->com.wr_waitp);
 	kfree(ep);
 }
 
@@ -2978,7 +2984,7 @@ static int fw6_wr_rpl(struct adapter *sc, const __be64 *rpl)
 	wr_waitp = (struct c4iw_wr_wait *)rpl[1];
 	CTR3(KTR_IW_CXGBE, "%s wr_waitp %p ret %u", __func__, wr_waitp, ret);
 	if (wr_waitp)
-		c4iw_wake_up(wr_waitp, ret ? -ret : 0);
+		c4iw_wake_up_deref(wr_waitp, ret ? -ret : 0);
 
 	return (0);
 }
diff --git a/sys/dev/cxgbe/iw_cxgbe/cq.c b/sys/dev/cxgbe/iw_cxgbe/cq.c
index bff2c4aeca01..5c3caf9d28bc 100644
--- a/sys/dev/cxgbe/iw_cxgbe/cq.c
+++ b/sys/dev/cxgbe/iw_cxgbe/cq.c
@@ -50,14 +50,14 @@
 #include "user.h"
 
 static int destroy_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
-		      struct c4iw_dev_ucontext *uctx)
+		      struct c4iw_dev_ucontext *uctx,
+		      struct c4iw_wr_wait *wr_waitp)
 {
 	struct adapter *sc = rdev->adap;
 	struct c4iw_dev *rhp = rdev_to_c4iw_dev(rdev);
 	struct fw_ri_res_wr *res_wr;
 	struct fw_ri_res *res;
-	int wr_len;
-	struct c4iw_wr_wait wr_wait;
+	int ret, wr_len;
 	struct wrqe *wr;
 
 	wr_len = sizeof *res_wr + sizeof *res;
@@ -71,29 +71,26 @@ static int destroy_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
 			V_FW_RI_RES_WR_NRES(1) |
 			F_FW_WR_COMPL);
 	res_wr->len16_pkd = cpu_to_be32(DIV_ROUND_UP(wr_len, 16));
-	res_wr->cookie = (unsigned long) &wr_wait;
+	res_wr->cookie = (uintptr_t)wr_waitp;
 	res = res_wr->res;
 	res->u.cq.restype = FW_RI_RES_TYPE_CQ;
 	res->u.cq.op = FW_RI_RES_OP_RESET;
 	res->u.cq.iqid = cpu_to_be32(cq->cqid);
 
-	c4iw_init_wr_wait(&wr_wait);
-
-	t4_wrq_tx(sc, wr);
-
-	c4iw_wait_for_reply(rdev, &wr_wait, 0, 0, NULL, __func__);
+	c4iw_init_wr_wait(wr_waitp);
+	ret = c4iw_ref_send_wait(rdev, wr, wr_waitp, 0, 0, NULL, __func__);
 
 	kfree(cq->sw_queue);
 	dma_free_coherent(rhp->ibdev.dma_device,
 			  cq->memsize, cq->queue,
 			  dma_unmap_addr(cq, mapping));
 	c4iw_put_cqid(rdev, cq->cqid, uctx);
-	return 0;
+	return ret;
 }
 
 static int
 create_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
-    struct c4iw_dev_ucontext *uctx)
+	  struct c4iw_dev_ucontext *uctx, struct c4iw_wr_wait *wr_waitp)
 {
 	struct adapter *sc = rdev->adap;
 	struct c4iw_dev *rhp = rdev_to_c4iw_dev(rdev);
@@ -101,7 +98,6 @@ create_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
 	struct fw_ri_res *res;
 	int wr_len;
 	int user = (uctx != &rdev->uctx);
-	struct c4iw_wr_wait wr_wait;
 	int ret;
 	struct wrqe *wr;
 	u64 cq_bar2_qoffset = 0;
@@ -144,7 +140,7 @@ create_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
 			V_FW_RI_RES_WR_NRES(1) |
 			F_FW_WR_COMPL);
 	res_wr->len16_pkd = cpu_to_be32(DIV_ROUND_UP(wr_len, 16));
-	res_wr->cookie = (unsigned long) &wr_wait;
+	res_wr->cookie = (uintptr_t)wr_waitp;
 	res = res_wr->res;
 	res->u.cq.restype = FW_RI_RES_TYPE_CQ;
 	res->u.cq.op = FW_RI_RES_OP_WRITE;
@@ -163,12 +159,9 @@ create_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
 	res->u.cq.iqsize = cpu_to_be16(cq->size);
 	res->u.cq.iqaddr = cpu_to_be64(cq->dma_addr);
 
-	c4iw_init_wr_wait(&wr_wait);
-
-	t4_wrq_tx(sc, wr);
+	c4iw_init_wr_wait(wr_waitp);
 
-	CTR2(KTR_IW_CXGBE, "%s wait_event wr_wait %p", __func__, &wr_wait);
-	ret = c4iw_wait_for_reply(rdev, &wr_wait, 0, 0, NULL, __func__);
+	ret = c4iw_ref_send_wait(rdev, wr, wr_waitp, 0, 0, NULL, __func__);
 	if (ret)
 		goto err4;
 
@@ -926,7 +919,9 @@ void c4iw_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata)
 	ucontext = rdma_udata_to_drv_context(udata, struct c4iw_ucontext,
 	    ibucontext);
 	destroy_cq(&chp->rhp->rdev, &chp->cq,
-		   ucontext ? &ucontext->uctx : &chp->cq.rdev->uctx);
+		   ucontext ? &ucontext->uctx : &chp->cq.rdev->uctx,
+		   chp->wr_waitp);
+	c4iw_put_wr_wait(chp->wr_waitp);
 }
 
 int c4iw_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
@@ -949,6 +944,12 @@ int c4iw_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
 
 	rhp = to_c4iw_dev(ibdev);
 
+	chp->wr_waitp = c4iw_alloc_wr_wait(GFP_KERNEL);
+	if (!chp->wr_waitp) {
+		return -ENOMEM;
+	}
+	c4iw_init_wr_wait(chp->wr_waitp);
+
 	ucontext = rdma_udata_to_drv_context(udata, struct c4iw_ucontext,
 	    ibucontext);
 
@@ -987,9 +988,10 @@ int c4iw_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
 	chp->cq.vector = vector;
 
 	ret = create_cq(&rhp->rdev, &chp->cq,
-			ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
+			ucontext ? &ucontext->uctx : &rhp->rdev.uctx,
+			chp->wr_waitp);
 	if (ret)
-		goto err1;
+		goto err_free_wr_wait;
 
 	chp->rhp = rhp;
 	chp->cq.size--;				/* status page */
@@ -1000,16 +1002,16 @@ int c4iw_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
 	init_waitqueue_head(&chp->wait);
 	ret = insert_handle(rhp, &rhp->cqidr, chp, chp->cq.cqid);
 	if (ret)
-		goto err2;
+		goto err_destroy_cq;
 
 	if (ucontext) {
 		ret = -ENOMEM;
 		mm = kmalloc(sizeof *mm, GFP_KERNEL);
 		if (!mm)
-			goto err3;
+			goto err_remove_handle;
 		mm2 = kmalloc(sizeof *mm2, GFP_KERNEL);
 		if (!mm2)
-			goto err4;
+			goto err_free_mm;
 
 		memset(&uresp, 0, sizeof(uresp));
 		uresp.qid_mask = rhp->rdev.cqmask;
@@ -1025,7 +1027,7 @@ int c4iw_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
 		ret = ib_copy_to_udata(udata, &uresp,
 					sizeof(uresp) - sizeof(uresp.reserved));
 		if (ret)
-			goto err5;
+			goto err_free_mm2;
 
 		mm->key = uresp.key;
 		mm->addr = vtophys(chp->cq.queue);
@@ -1042,16 +1044,17 @@ int c4iw_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
 	    __func__, chp->cq.cqid, chp, chp->cq.size, chp->cq.memsize,
 	    (unsigned long long) chp->cq.dma_addr);
 	return 0;
-err5:
+err_free_mm2:
 	kfree(mm2);
-err4:
+err_free_mm:
 	kfree(mm);
-err3:
+err_remove_handle:
 	remove_handle(rhp, &rhp->cqidr, chp->cq.cqid);
-err2:
+err_destroy_cq:
 	destroy_cq(&chp->rhp->rdev, &chp->cq,
-		   ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
-err1:
+		   ucontext ? &ucontext->uctx : &rhp->rdev.uctx, chp->wr_waitp);
+err_free_wr_wait:
+	c4iw_put_wr_wait(chp->wr_waitp);
 	return ret;
 }
 
diff --git a/sys/dev/cxgbe/iw_cxgbe/device.c b/sys/dev/cxgbe/iw_cxgbe/device.c
index 9e5ac7c530d0..f28eeec9b5ff 100644
--- a/sys/dev/cxgbe/iw_cxgbe/device.c
+++ b/sys/dev/cxgbe/iw_cxgbe/device.c
@@ -263,6 +263,27 @@ static struct uld_info c4iw_uld_info = {
 	.uld_restart = c4iw_restart,
 };
 
+void _c4iw_free_wr_wait(struct kref *kref)
+{
+	struct c4iw_wr_wait *wr_waitp;
+
+	wr_waitp = container_of(kref, struct c4iw_wr_wait, kref);
+	CTR(KTR_IW_CXGBE, "Free wr_wait %p", wr_waitp);
+	kfree(wr_waitp);
+}
+
+struct c4iw_wr_wait *c4iw_alloc_wr_wait(gfp_t gfp)
+{
+	struct c4iw_wr_wait *wr_waitp;
+
+	wr_waitp = kzalloc(sizeof(*wr_waitp), gfp);
+	if (wr_waitp) {
+		kref_init(&wr_waitp->kref);
+		CTR(KTR_IW_CXGBE, "wr_wait %p", wr_waitp);
+	}
+	return wr_waitp;
+}
+
 static int
 c4iw_activate(struct adapter *sc)
 {
diff --git a/sys/dev/cxgbe/iw_cxgbe/iw_cxgbe.h b/sys/dev/cxgbe/iw_cxgbe/iw_cxgbe.h
index 5f3e54439a7f..6fb061263956 100644
--- a/sys/dev/cxgbe/iw_cxgbe/iw_cxgbe.h
+++ b/sys/dev/cxgbe/iw_cxgbe/iw_cxgbe.h
@@ -189,18 +189,50 @@ static inline int t4_max_fr_depth(struct c4iw_rdev *rdev, bool use_dsgl)
 struct c4iw_wr_wait {
 	int ret;
 	struct completion completion;
+	struct kref kref;
 };
 
+void _c4iw_free_wr_wait(struct kref *kref);
+
+static inline void c4iw_put_wr_wait(struct c4iw_wr_wait *wr_waitp)
+{
+	CTR(KTR_IW_CXGBE, "wr_wait %p ref before put %u", wr_waitp,
+		 kref_read(&wr_waitp->kref));
+	WARN_ON(kref_read(&wr_waitp->kref) == 0);
+	kref_put(&wr_waitp->kref, _c4iw_free_wr_wait);
+}
+
+static inline void c4iw_get_wr_wait(struct c4iw_wr_wait *wr_waitp)
+{
+	CTR(KTR_IW_CXGBE, "wr_wait %p ref before get %u", wr_waitp,
+		 kref_read(&wr_waitp->kref));
+	WARN_ON(kref_read(&wr_waitp->kref) == 0);
+	kref_get(&wr_waitp->kref);
+}
+
 static inline void c4iw_init_wr_wait(struct c4iw_wr_wait *wr_waitp)
 {
 	wr_waitp->ret = 0;
 	init_completion(&wr_waitp->completion);
 }
 
-static inline void c4iw_wake_up(struct c4iw_wr_wait *wr_waitp, int ret)
+static inline void _c4iw_wake_up(struct c4iw_wr_wait *wr_waitp, int ret,
+				 bool deref)
 {
 	wr_waitp->ret = ret;
 	complete(&wr_waitp->completion);
+	if (deref)
+		c4iw_put_wr_wait(wr_waitp);
+}
+
+static inline void c4iw_wake_up_noref(struct c4iw_wr_wait *wr_waitp, int ret)
+{
+	_c4iw_wake_up(wr_waitp, ret, false);
+}
+
+static inline void c4iw_wake_up_deref(struct c4iw_wr_wait *wr_waitp, int ret)
+{
+	_c4iw_wake_up(wr_waitp, ret, true);
 }
 
 static inline int
@@ -208,60 +240,57 @@ c4iw_wait_for_reply(struct c4iw_rdev *rdev, struct c4iw_wr_wait *wr_waitp,
 		u32 hwtid, u32 qpid, struct socket *so, const char *func)
 {
 	struct adapter *sc = rdev->adap;
-	unsigned to = C4IW_WR_TO;
 	int ret;
-	int timedout = 0;
-	struct timeval t1, t2;
 
 	if (c4iw_stopped(rdev)) {
 		wr_waitp->ret = -EIO;
 		goto out;
 	}
 
-	getmicrotime(&t1);
-	do {
-		/* If waiting for reply in rdma_init()/rdma_fini() threads, then
-		 * check if there are any connection errors.
-		 */
-		if (so && so->so_error) {
-			wr_waitp->ret = -ECONNRESET;
-			CTR5(KTR_IW_CXGBE, "%s - Connection ERROR %u for sock %p"
-			    "tid %u qpid %u", func,
-			    so->so_error, so, hwtid, qpid);
-			break;
-		}
-
-		ret = wait_for_completion_timeout(&wr_waitp->completion, to);
-		if (!ret) {
-			getmicrotime(&t2);
-			timevalsub(&t2, &t1);
-			printf("%s - Device %s not responding after %ld.%06ld "
-			    "seconds - tid %u qpid %u\n", func,
-			    device_get_nameunit(sc->dev), t2.tv_sec, t2.tv_usec,
-			    hwtid, qpid);
-			if (c4iw_stopped(rdev)) {
-				wr_waitp->ret = -EIO;
-				break;
-			}
-			to = to << 2;
-			timedout = 1;
-		}
-	} while (!ret);
+	/* If waiting for reply in rdma_init()/rdma_fini() threads, then
+	 * check if there are any connection errors.
+	 */
+	if (so && so->so_error) {
+		wr_waitp->ret = -ECONNRESET;
+		CTR5(KTR_IW_CXGBE, "%s - Connection ERROR %u for sock %p"
+		    "tid %u qpid %u", func,
+		    so->so_error, so, hwtid, qpid);
+		goto out;
+	}
 
-out:
-	if (timedout) {
-		getmicrotime(&t2);
-		timevalsub(&t2, &t1);
-		printf("%s - Device %s reply after %ld.%06ld seconds - "
+	ret = wait_for_completion_timeout(&wr_waitp->completion, C4IW_WR_TO);
+	if (!ret) {
+		printf("%s - Device %s not responding (disabling device) - "
 		    "tid %u qpid %u\n", func, device_get_nameunit(sc->dev),
-		    t2.tv_sec, t2.tv_usec, hwtid, qpid);
+		    hwtid, qpid);
+		rdev->flags |= T4_IW_STOPPED;
+		wr_waitp->ret = -EIO;
+		goto out;
 	}
+
 	if (wr_waitp->ret)
 		CTR4(KTR_IW_CXGBE, "%p: FW reply %d tid %u qpid %u", sc,
 		    wr_waitp->ret, hwtid, qpid);
+out:
 	return (wr_waitp->ret);
 }
 
+static inline int c4iw_ref_send_wait(struct c4iw_rdev *rdev, struct wrqe *wr,
+				     struct c4iw_wr_wait *wr_waitp,
+				     u32 hwtid, u32 qpid, struct socket *so,
+				     const char *func)
+{
+	struct adapter *sc = rdev->adap;
+
+	CTR(KTR_IW_CXGBE, "%s wr_wait %p hwtid %u qpid %u", func, wr_waitp,
+	    hwtid, qpid);
+	c4iw_get_wr_wait(wr_waitp);
+	
+	t4_wrq_tx(sc, wr);
+
+	return c4iw_wait_for_reply(rdev, wr_waitp, hwtid, qpid, so, func);
+}
+
 struct c4iw_dev {
 	struct ib_device ibdev;
 	struct pci_dev pdev;
@@ -399,6 +428,7 @@ struct c4iw_mr {
 	dma_addr_t mpl_addr;
 	u32 max_mpl_len;
 	u32 mpl_len;
+	struct c4iw_wr_wait *wr_waitp;
 };
 
 static inline struct c4iw_mr *to_c4iw_mr(struct ib_mr *ibmr)
@@ -411,6 +441,7 @@ struct c4iw_mw {
 	struct c4iw_dev *rhp;
 	u64 kva;
 	struct tpt_attributes attr;
+	struct c4iw_wr_wait *wr_waitp;
 };
 
 static inline struct c4iw_mw *to_c4iw_mw(struct ib_mw *ibmw)
@@ -426,6 +457,7 @@ struct c4iw_cq {
 	spinlock_t comp_handler_lock;
 	atomic_t refcnt;
 	wait_queue_head_t wait;
+	struct c4iw_wr_wait *wr_waitp;
 };
 
 static inline struct c4iw_cq *to_c4iw_cq(struct ib_cq *ibcq)
@@ -494,6 +526,7 @@ struct c4iw_qp {
 	int sq_sig_all;
 	struct work_struct free_work;
 	struct c4iw_ucontext *ucontext;
+	struct c4iw_wr_wait *wr_waitp;
 };
 
 static inline struct c4iw_qp *to_c4iw_qp(struct ib_qp *ibqp)
@@ -825,7 +858,7 @@ struct c4iw_ep_common {
 	struct mutex mutex;
 	struct sockaddr_storage local_addr;
 	struct sockaddr_storage remote_addr;
-	struct c4iw_wr_wait wr_wait;
+	struct c4iw_wr_wait *wr_waitp;
 	unsigned long flags;
 	unsigned long history;
         int rpl_err;
@@ -975,6 +1008,7 @@ u32 c4iw_get_qpid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx);
 void c4iw_put_qpid(struct c4iw_rdev *rdev, u32 qid,
 		struct c4iw_dev_ucontext *uctx);
 void c4iw_ev_dispatch(struct c4iw_dev *dev, struct t4_cqe *err_cqe);
+struct c4iw_wr_wait *c4iw_alloc_wr_wait(gfp_t gfp);
 void t4_dump_stag(struct adapter *sc, const u32 stag);
 void t4_dump_all_stag(struct adapter *sc);
 #endif
diff --git a/sys/dev/cxgbe/iw_cxgbe/mem.c b/sys/dev/cxgbe/iw_cxgbe/mem.c
index 0a2b5e3cb4ba..b54c74380c74 100644
--- a/sys/dev/cxgbe/iw_cxgbe/mem.c
+++ b/sys/dev/cxgbe/iw_cxgbe/mem.c
@@ -56,42 +56,45 @@ mr_exceeds_hw_limits(struct c4iw_dev *dev, u64 length)
 
 static int
 _c4iw_write_mem_dma_aligned(struct c4iw_rdev *rdev, u32 addr, u32 len,
-			    dma_addr_t data, int wait)
+			    dma_addr_t data, struct c4iw_wr_wait *wr_waitp)
 {
 	struct adapter *sc = rdev->adap;
 	u8 wr_len;
 	int ret = 0;
-	struct c4iw_wr_wait wr_wait;
 	struct wrqe *wr;
 
-	if (wait)
-		c4iw_init_wr_wait(&wr_wait);
+	if (wr_waitp)
+		c4iw_init_wr_wait(wr_waitp);
 	wr_len = T4_WRITE_MEM_DMA_LEN;
 
 	wr = alloc_wrqe(wr_len, &sc->sge.ctrlq[0]);
 	if (wr == NULL)
 		return -ENOMEM;
 	t4_write_mem_dma_wr(sc, wrtod(wr), wr_len, 0, addr, len, data,
-	    wait ? (u64)(unsigned long)&wr_wait : 0);
+	    (u64)(unsigned long)wr_waitp);
 	t4_wrq_tx(sc, wr);
 
-	if (wait)
-		ret = c4iw_wait_for_reply(rdev, &wr_wait, 0, 0, NULL, __func__);
+	if (wr_waitp)
+		c4iw_get_wr_wait(wr_waitp);
+	t4_wrq_tx(sc, wr);
+	
+	if (wr_waitp)
+		ret = c4iw_wait_for_reply(rdev, wr_waitp, 0, 0, NULL, __func__);
 	return ret;
 }
 
 
 static int
-_c4iw_write_mem_inline(struct c4iw_rdev *rdev, u32 addr, u32 len, void *data)
+_c4iw_write_mem_inline(struct c4iw_rdev *rdev, u32 addr, u32 len, void *data,
+		       struct c4iw_wr_wait *wr_waitp)
 {
 	struct adapter *sc = rdev->adap;
 	u8 wr_len, *from_dp;
 	int copy_len, num_wqe, i, ret = 0;
-	struct c4iw_wr_wait wr_wait;
 	struct wrqe *wr;
 
 	CTR3(KTR_IW_CXGBE, "%s addr 0x%x len %u", __func__, addr, len);
-	c4iw_init_wr_wait(&wr_wait);
+	c4iw_init_wr_wait(wr_waitp);
 	num_wqe = DIV_ROUND_UP(len, T4_MAX_INLINE_SIZE);
 	from_dp = data;
 	for (i = 0; i < num_wqe; i++) {
@@ -103,7 +106,9 @@ _c4iw_write_mem_inline(struct c4iw_rdev *rdev, u32 addr, u32 len, void *data)
 			return -ENOMEM;
 		t4_write_mem_inline_wr(sc, wrtod(wr), wr_len, 0, addr, copy_len,
 		    from_dp, i == (num_wqe - 1) ?
-		    (__force __be64)(unsigned long) &wr_wait : 0);
+		    (__force __be64)(unsigned long)wr_waitp : 0);
+		if (i == (num_wqe-1))
+			c4iw_get_wr_wait(wr_waitp);
 		t4_wrq_tx(sc, wr);
 
 		if (from_dp != NULL)
@@ -111,12 +116,13 @@ _c4iw_write_mem_inline(struct c4iw_rdev *rdev, u32 addr, u32 len, void *data)
 		addr += T4_MAX_INLINE_SIZE >> 5;
 		len -= T4_MAX_INLINE_SIZE;
 	}
-	ret = c4iw_wait_for_reply(rdev, &wr_wait, 0, 0, NULL, __func__);
+	ret = c4iw_wait_for_reply(rdev, wr_waitp, 0, 0, NULL, __func__);
 	return ret;
 }
 
 static int
-_c4iw_write_mem_dma(struct c4iw_rdev *rdev, u32 addr, u32 len, void *data)
+_c4iw_write_mem_dma(struct c4iw_rdev *rdev, u32 addr, u32 len, void *data,
+		    struct c4iw_wr_wait *wr_waitp)
 {
 	struct c4iw_dev *rhp = rdev_to_c4iw_dev(rdev);
 	u32 remain = len;
@@ -139,8 +145,8 @@ _c4iw_write_mem_dma(struct c4iw_rdev *rdev, u32 addr, u32 len, void *data)
 		} else
 			dmalen = T4_ULPTX_MAX_DMA;
 		remain -= dmalen;
-		ret = _c4iw_write_mem_dma_aligned(rdev, addr, dmalen,
-				daddr, !remain);
+		ret = _c4iw_write_mem_dma_aligned(rdev, addr, dmalen, daddr,
+						  remain ? NULL : wr_waitp);
 		if (ret)
 			goto out;
 		addr += dmalen >> 5;
@@ -148,7 +154,8 @@ _c4iw_write_mem_dma(struct c4iw_rdev *rdev, u32 addr, u32 len, void *data)
 		daddr = daddr + dmalen;
 	}
 	if (remain)
-		ret = _c4iw_write_mem_inline(rdev, addr, remain, data);
+		ret = _c4iw_write_mem_inline(rdev, addr, remain, data,
+					     wr_waitp);
 out:
 	dma_unmap_single(rhp->ibdev.dma_device, save, len, DMA_TO_DEVICE);
 	return ret;
@@ -160,21 +167,28 @@ out:
  */
 static int
 write_adapter_mem(struct c4iw_rdev *rdev, u32 addr, u32 len,
-			     void *data)
+		  void *data, struct c4iw_wr_wait *wr_waitp)
 {
-	if (rdev->adap->params.ulptx_memwrite_dsgl && use_dsgl) {
-		if (len > inline_threshold) {
-			if (_c4iw_write_mem_dma(rdev, addr, len, data)) {
-				log(LOG_ERR, "%s: dma map "
-				       "failure (non fatal)\n", __func__);
-				return _c4iw_write_mem_inline(rdev, addr, len,
-							      data);
-			} else
-				return 0;
-		} else
-			return _c4iw_write_mem_inline(rdev, addr, len, data);
-	} else
-		return _c4iw_write_mem_inline(rdev, addr, len, data);
+	int ret;
+
+	if (!rdev->adap->params.ulptx_memwrite_dsgl || !use_dsgl) {
+		ret = _c4iw_write_mem_inline(rdev, addr, len, data, wr_waitp);
+		goto out;
+	}
+
+	if (len <= inline_threshold) {
+		ret = _c4iw_write_mem_inline(rdev, addr, len, data, wr_waitp);
+		goto out;
+	}
+
+	ret = _c4iw_write_mem_dma(rdev, addr, len, data, wr_waitp);
+	if (ret) {
+		log(LOG_ERR, "%s: dma map failure (non fatal)\n",
+		    device_get_nameunit(rdev->adap->dev));
+		ret = _c4iw_write_mem_inline(rdev, addr, len, data, wr_waitp);
+	}
+out:
+	return ret;
 }
 
 
@@ -188,7 +202,8 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
 			   u32 *stag, u8 stag_state, u32 pdid,
 			   enum fw_ri_stag_type type, enum fw_ri_mem_perms perm,
 			   int bind_enabled, u32 zbva, u64 to,
-			   u64 len, u8 page_size, u32 pbl_size, u32 pbl_addr)
+			   u64 len, u8 page_size, u32 pbl_size, u32 pbl_addr,
+			   struct c4iw_wr_wait *wr_waitp)
 {
 	int err;
 	struct fw_ri_tpte tpt;
@@ -245,7 +260,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
 	}
 	err = write_adapter_mem(rdev, stag_idx +
 				(rdev->adap->vres.stag.start >> 5),
-				sizeof(tpt), &tpt);
+				sizeof(tpt), &tpt, wr_waitp);
 
 	if (reset_tpt_entry) {
 		t4_stag_free(rdev->adap, stag_idx, 1);
@@ -257,43 +272,47 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
 }
 
 static int write_pbl(struct c4iw_rdev *rdev, __be64 *pbl,
-		     u32 pbl_addr, u32 pbl_size)
+		     u32 pbl_addr, u32 pbl_size, struct c4iw_wr_wait *wr_waitp)
 {
 	int err;
 
 	CTR4(KTR_IW_CXGBE, "%s *pdb_addr 0x%x, pbl_base 0x%x, pbl_size %d",
 	     __func__, pbl_addr, rdev->adap->vres.pbl.start, pbl_size);
 
-	err = write_adapter_mem(rdev, pbl_addr >> 5, pbl_size << 3, pbl);
+	err = write_adapter_mem(rdev, pbl_addr >> 5, pbl_size << 3, pbl,
+				wr_waitp);
 	return err;
 }
 
 static int dereg_mem(struct c4iw_rdev *rdev, u32 stag, u32 pbl_size,
-		     u32 pbl_addr)
+		     u32 pbl_addr, struct c4iw_wr_wait *wr_waitp)
 {
 	return write_tpt_entry(rdev, 1, &stag, 0, 0, 0, 0, 0, 0, 0UL, 0, 0,
-			       pbl_size, pbl_addr);
+			       pbl_size, pbl_addr, wr_waitp);
 }
 
-static int allocate_window(struct c4iw_rdev *rdev, u32 * stag, u32 pdid)
+static int allocate_window(struct c4iw_rdev *rdev, u32 * stag, u32 pdid,
+			   struct c4iw_wr_wait *wr_waitp)
 {
 	*stag = T4_STAG_UNSET;
 	return write_tpt_entry(rdev, 0, stag, 0, pdid, FW_RI_STAG_MW, 0, 0, 0,
-			       0UL, 0, 0, 0, 0);
+			       0UL, 0, 0, 0, 0, wr_waitp);
 }
 
-static int deallocate_window(struct c4iw_rdev *rdev, u32 stag)
+static int deallocate_window(struct c4iw_rdev *rdev, u32 stag,
+			     struct c4iw_wr_wait *wr_waitp)
 {
 	return write_tpt_entry(rdev, 1, &stag, 0, 0, 0, 0, 0, 0, 0UL, 0, 0, 0,
-			       0);
+			       0, wr_waitp);
 }
 
 static int allocate_stag(struct c4iw_rdev *rdev, u32 *stag, u32 pdid,
-			 u32 pbl_size, u32 pbl_addr)
+			 u32 pbl_size, u32 pbl_addr,
+			 struct c4iw_wr_wait *wr_waitp)
 {
 	*stag = T4_STAG_UNSET;
 	return write_tpt_entry(rdev, 0, stag, 0, pdid, FW_RI_STAG_NSMR, 0, 0, 0,
-			       0UL, 0, 0, pbl_size, pbl_addr);
+			       0UL, 0, 0, pbl_size, pbl_addr, wr_waitp);
 }
 
 static int finish_mem_reg(struct c4iw_mr *mhp, u32 stag)
@@ -318,14 +337,15 @@ static int register_mem(struct c4iw_dev *rhp, struct c4iw_pd *php,
 			      FW_RI_STAG_NSMR, mhp->attr.len ? mhp->attr.perms : 0,
 			      mhp->attr.mw_bind_enable, mhp->attr.zbva,
 			      mhp->attr.va_fbo, mhp->attr.len ? mhp->attr.len : -1, shift - 12,
-			      mhp->attr.pbl_size, mhp->attr.pbl_addr);
+			      mhp->attr.pbl_size, mhp->attr.pbl_addr,
+			      mhp->wr_waitp);
 	if (ret)
 		return ret;
 
 	ret = finish_mem_reg(mhp, stag);
 	if (ret)
 		dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
-		       mhp->attr.pbl_addr);
+			  mhp->attr.pbl_addr, mhp->wr_waitp);
 	return ret;
 }
 
@@ -357,6 +377,12 @@ struct ib_mr *c4iw_get_dma_mr(struct ib_pd *pd, int acc)
 	mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
 	if (!mhp)
 		return ERR_PTR(-ENOMEM);
+	mhp->wr_waitp = c4iw_alloc_wr_wait(GFP_KERNEL);
+	if (!mhp->wr_waitp) {
+		ret = -ENOMEM;
+		goto err_free_mhp;
+	}
+	c4iw_init_wr_wait(mhp->wr_waitp);
 
 	mhp->rhp = rhp;
 	mhp->attr.pdid = php->pdid;
@@ -370,18 +396,21 @@ struct ib_mr *c4iw_get_dma_mr(struct ib_pd *pd, int acc)
 
 	ret = write_tpt_entry(&rhp->rdev, 0, &stag, 1, php->pdid,
 			      FW_RI_STAG_NSMR, mhp->attr.perms,
-			      mhp->attr.mw_bind_enable, 0, 0, ~0ULL, 0, 0, 0);
+			      mhp->attr.mw_bind_enable, 0, 0, ~0ULL, 0, 0, 0,
+			      mhp->wr_waitp);
 	if (ret)
-		goto err1;
+		goto err_free_wr_wait;
 
 	ret = finish_mem_reg(mhp, stag);
 	if (ret)
-		goto err2;
+		goto err_dereg_mem;
 	return &mhp->ibmr;
-err2:
+err_dereg_mem:
 	dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
-		  mhp->attr.pbl_addr);
-err1:
+		  mhp->attr.pbl_addr, mhp->wr_waitp);
+err_free_wr_wait:
+	c4iw_put_wr_wait(mhp->wr_waitp);
+err_free_mhp:
 	kfree(mhp);
 	return ERR_PTR(ret);
 }
@@ -392,7 +421,7 @@ struct ib_mr *c4iw_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 	__be64 *pages;
 	int shift, n, len;
 	int i, k, entry;
-	int err = 0;
+	int err = -ENOMEM;
 	struct scatterlist *sg;
 	struct c4iw_dev *rhp;
 	struct c4iw_pd *php;
@@ -415,14 +444,15 @@ struct ib_mr *c4iw_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 	mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
 	if (!mhp)
 		return ERR_PTR(-ENOMEM);
+	mhp->wr_waitp = c4iw_alloc_wr_wait(GFP_KERNEL);
+	if (!mhp->wr_waitp)
+		goto err_free_mhp;
 
 	mhp->rhp = rhp;
 
 	mhp->umem = ib_umem_get(pd->uobject->context, start, length, acc, 0);
 	if (IS_ERR(mhp->umem)) {
-		err = PTR_ERR(mhp->umem);
-		kfree(mhp);
-		return ERR_PTR(err);
+		goto err_free_wr_wait;
 	}
 
 	shift = mhp->umem->page_shift;
@@ -430,12 +460,12 @@ struct ib_mr *c4iw_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 	n = mhp->umem->nmap;
 	err = alloc_pbl(mhp, n);
 	if (err)
-		goto err;
+		goto err_umem_release;
 
 	pages = (__be64 *) __get_free_page(GFP_KERNEL);
 	if (!pages) {
 		err = -ENOMEM;
-		goto err_pbl;
+		goto err_pbl_free;
 	}
 
 	i = n = 0;
@@ -447,7 +477,8 @@ struct ib_mr *c4iw_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 			if (i == PAGE_SIZE / sizeof *pages) {
 				err = write_pbl(&mhp->rhp->rdev,
 						pages,
-						mhp->attr.pbl_addr + (n << 3), i);
+						mhp->attr.pbl_addr + (n << 3),
+						i, mhp->wr_waitp);
 				if (err)
 					goto pbl_done;
 				n += i;
@@ -459,12 +490,13 @@ struct ib_mr *c4iw_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 
 	if (i)
 		err = write_pbl(&mhp->rhp->rdev, pages,
-				     mhp->attr.pbl_addr + (n << 3), i);
+				mhp->attr.pbl_addr + (n << 3), i,
+				mhp->wr_waitp);
 
 pbl_done:
 	free_page((unsigned long) pages);
 	if (err)
-		goto err_pbl;
+		goto err_pbl_free;
 
 	mhp->attr.pdid = php->pdid;
 	mhp->attr.zbva = 0;
@@ -475,16 +507,18 @@ pbl_done:
 
 	err = register_mem(rhp, php, mhp, shift);
 	if (err)
-		goto err_pbl;
+		goto err_pbl_free;
 
 	return &mhp->ibmr;
 
-err_pbl:
+err_pbl_free:
 	c4iw_pblpool_free(&mhp->rhp->rdev, mhp->attr.pbl_addr,
 			      mhp->attr.pbl_size << 3);
-
-err:
+err_umem_release:
 	ib_umem_release(mhp->umem);
+err_free_wr_wait:
+	c4iw_put_wr_wait(mhp->wr_waitp);
+err_free_mhp:
 	kfree(mhp);
 	return ERR_PTR(err);
 }
@@ -507,10 +541,16 @@ struct ib_mw *c4iw_alloc_mw(struct ib_pd *pd, enum ib_mw_type type,
 	mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
 	if (!mhp)
 		return ERR_PTR(-ENOMEM);
-	ret = allocate_window(&rhp->rdev, &stag, php->pdid);
+
+	mhp->wr_waitp = c4iw_alloc_wr_wait(GFP_KERNEL);
+	if (!mhp->wr_waitp) {
+		ret = -ENOMEM;
+		goto free_mhp;
+	}
+
+	ret = allocate_window(&rhp->rdev, &stag, php->pdid, mhp->wr_waitp);
 	if (ret) {
-		kfree(mhp);
-		return ERR_PTR(ret);
+		goto free_wr_wait;
 	}
 	mhp->rhp = rhp;
 	mhp->attr.pdid = php->pdid;
@@ -519,13 +559,19 @@ struct ib_mw *c4iw_alloc_mw(struct ib_pd *pd, enum ib_mw_type type,
 	mmid = (stag) >> 8;
 	mhp->ibmw.rkey = stag;
 	if (insert_handle(rhp, &rhp->mmidr, mhp, mmid)) {
-		deallocate_window(&rhp->rdev, mhp->attr.stag);
-		kfree(mhp);
-		return ERR_PTR(-ENOMEM);
+		goto dealloc_win;
 	}
 	CTR4(KTR_IW_CXGBE, "%s mmid 0x%x mhp %p stag 0x%x", __func__, mmid, mhp,
 	    stag);
 	return &(mhp->ibmw);
+
+dealloc_win:
+	deallocate_window(&rhp->rdev, mhp->attr.stag, mhp->wr_waitp);
+free_wr_wait:
+	c4iw_put_wr_wait(mhp->wr_waitp);
+free_mhp:
+ 	kfree(mhp);
+ 	return ERR_PTR(ret);
 }
 
 int c4iw_dealloc_mw(struct ib_mw *mw)
@@ -538,7 +584,8 @@ int c4iw_dealloc_mw(struct ib_mw *mw)
 	rhp = mhp->rhp;
 	mmid = (mw->rkey) >> 8;
 	remove_handle(rhp, &rhp->mmidr, mmid);
-	deallocate_window(&rhp->rdev, mhp->attr.stag);
+	deallocate_window(&rhp->rdev, mhp->attr.stag, mhp->wr_waitp);
+	c4iw_put_wr_wait(mhp->wr_waitp);
 	kfree(mhp);
 	CTR4(KTR_IW_CXGBE, "%s ib_mw %p mmid 0x%x ptr %p", __func__, mw, mmid,
 	    mhp);
@@ -573,23 +620,31 @@ struct ib_mr *c4iw_alloc_mr(struct ib_pd *pd,
 		goto err;
 	}
 
+	mhp->wr_waitp = c4iw_alloc_wr_wait(GFP_KERNEL);
+	if (!mhp->wr_waitp) {
+		ret = -ENOMEM;
+		goto err_free_mhp;
+	}
+	c4iw_init_wr_wait(mhp->wr_waitp);
+
 	mhp->mpl = dma_alloc_coherent(rhp->ibdev.dma_device,
 				      length, &mhp->mpl_addr, GFP_KERNEL);
 	if (!mhp->mpl) {
 		ret = -ENOMEM;
-		goto err_mpl;
+		goto err_free_wr_wait;
 	}
 	mhp->max_mpl_len = length;
 
 	mhp->rhp = rhp;
 	ret = alloc_pbl(mhp, max_num_sg);
 	if (ret)
-		goto err1;
+		goto err_free_dma;
 	mhp->attr.pbl_size = max_num_sg;
 	ret = allocate_stag(&rhp->rdev, &stag, php->pdid,
-			    mhp->attr.pbl_size, mhp->attr.pbl_addr);
+			    mhp->attr.pbl_size, mhp->attr.pbl_addr,
+			    mhp->wr_waitp);
 	if (ret)
-		goto err2;
+		goto err_free_pbl;
 	mhp->attr.pdid = php->pdid;
 	mhp->attr.type = FW_RI_STAG_NSMR;
 	mhp->attr.stag = stag;
@@ -598,21 +653,23 @@ struct ib_mr *c4iw_alloc_mr(struct ib_pd *pd,
 	mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
 	if (insert_handle(rhp, &rhp->mmidr, mhp, mmid)) {
 		ret = -ENOMEM;
-		goto err3;
+		goto err_dereg;
 	}
 
 	PDBG("%s mmid 0x%x mhp %p stag 0x%x\n", __func__, mmid, mhp, stag);
 	return &(mhp->ibmr);
-err3:
+err_dereg:
 	dereg_mem(&rhp->rdev, stag, mhp->attr.pbl_size,
-		       mhp->attr.pbl_addr);
-err2:
+		       mhp->attr.pbl_addr, mhp->wr_waitp);
+err_free_pbl:
 	c4iw_pblpool_free(&mhp->rhp->rdev, mhp->attr.pbl_addr,
 			      mhp->attr.pbl_size << 3);
-err1:
+err_free_dma:
 	dma_free_coherent(rhp->ibdev.dma_device,
 			  mhp->max_mpl_len, mhp->mpl, mhp->mpl_addr);
-err_mpl:
+err_free_wr_wait:
+	c4iw_put_wr_wait(mhp->wr_waitp);
+err_free_mhp:
 	kfree(mhp);
 err:
 	return ERR_PTR(ret);
@@ -653,7 +710,7 @@ int c4iw_dereg_mr(struct ib_mr *ib_mr, struct ib_udata *udata)
 	mmid = mhp->attr.stag >> 8;
*** 226 LINES SKIPPED ***