Commit 7c4bfcb0 authored by Xi Wang's avatar Xi Wang Committed by David S. Miller

net: hns3: Fix for PF mailbox receving unknown message

Before the firmware updates the crq's tail pointer, if the PF driver
reads the data in the crq, the data may be incomplete at this time,
which will lead to the driver read an unknown message.

This patch fixes it by checking if crq is not empty before reading the
message.

Fixes: c1a81619 ("net: hns3: Add mailbox interrupt handling to PF driver")
Signed-off-by: default avatarXi Wang <wangxi11@huawei.com>
Signed-off-by: default avatarPeng Li <lipeng321@huawei.com>
Signed-off-by: default avatarSalil Mehta <salil.mehta@huawei.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 96c0e861
...@@ -382,6 +382,13 @@ static void hclge_reset_vf(struct hclge_vport *vport, ...@@ -382,6 +382,13 @@ static void hclge_reset_vf(struct hclge_vport *vport,
hclge_func_reset_cmd(hdev, mbx_req->mbx_src_vfid); hclge_func_reset_cmd(hdev, mbx_req->mbx_src_vfid);
} }
static bool hclge_cmd_crq_empty(struct hclge_hw *hw)
{
u32 tail = hclge_read_dev(hw, HCLGE_NIC_CRQ_TAIL_REG);
return tail == hw->cmq.crq.next_to_use;
}
void hclge_mbx_handler(struct hclge_dev *hdev) void hclge_mbx_handler(struct hclge_dev *hdev)
{ {
struct hclge_cmq_ring *crq = &hdev->hw.cmq.crq; struct hclge_cmq_ring *crq = &hdev->hw.cmq.crq;
...@@ -390,12 +397,23 @@ void hclge_mbx_handler(struct hclge_dev *hdev) ...@@ -390,12 +397,23 @@ void hclge_mbx_handler(struct hclge_dev *hdev)
struct hclge_desc *desc; struct hclge_desc *desc;
int ret, flag; int ret, flag;
flag = le16_to_cpu(crq->desc[crq->next_to_use].flag);
/* handle all the mailbox requests in the queue */ /* handle all the mailbox requests in the queue */
while (hnae_get_bit(flag, HCLGE_CMDQ_RX_OUTVLD_B)) { while (!hclge_cmd_crq_empty(&hdev->hw)) {
desc = &crq->desc[crq->next_to_use]; desc = &crq->desc[crq->next_to_use];
req = (struct hclge_mbx_vf_to_pf_cmd *)desc->data; req = (struct hclge_mbx_vf_to_pf_cmd *)desc->data;
flag = le16_to_cpu(crq->desc[crq->next_to_use].flag);
if (unlikely(!hnae_get_bit(flag, HCLGE_CMDQ_RX_OUTVLD_B))) {
dev_warn(&hdev->pdev->dev,
"dropped invalid mailbox message, code = %d\n",
req->msg[0]);
/* dropping/not processing this invalid message */
crq->desc[crq->next_to_use].flag = 0;
hclge_mbx_ring_ptr_move_crq(crq);
continue;
}
vport = &hdev->vport[req->mbx_src_vfid]; vport = &hdev->vport[req->mbx_src_vfid];
switch (req->msg[0]) { switch (req->msg[0]) {
...@@ -470,7 +488,6 @@ void hclge_mbx_handler(struct hclge_dev *hdev) ...@@ -470,7 +488,6 @@ void hclge_mbx_handler(struct hclge_dev *hdev)
} }
crq->desc[crq->next_to_use].flag = 0; crq->desc[crq->next_to_use].flag = 0;
hclge_mbx_ring_ptr_move_crq(crq); hclge_mbx_ring_ptr_move_crq(crq);
flag = le16_to_cpu(crq->desc[crq->next_to_use].flag);
} }
/* Write back CMDQ_RQ header pointer, M7 need this pointer */ /* Write back CMDQ_RQ header pointer, M7 need this pointer */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment