[PATCH] net/bnxt: fix meter stats race with stats cache thread

[Manish Kurup <manish.kurup@broadcom.com>]

From: Jay Ding <jay.ding@broadcom.com>

The background stats cache thread and the show-port-meter-stats
path both issue MPC TABLE_READ commands targeting the same ingress
(RE_CFA) completion ring. The stats cache holds fdb_lock for the
entire batch send+collect window, but the meter stats path called
tfc_act_get() with no lock, creating a race between the two threads.

Fix by acquiring fdb_lock in ulp_fc_tfc_mtr_stat_get before the
MPC call, matching the same serialization pattern used by the stats
cache thread. The flow-stat path (ulp_fc_tfc_flow_stat_get) is
not changed because its callers in ulp_fc_mgr.c already hold the
lock. Also initialize count to zero to fix a pre-existing case
where count.reserved (marked "must be zero" in rte_flow.h) was left
uninitialized; count.reset is already explicitly set on both branches
above and was never the affected field.

Fixes: 3ed6fb5edc8e ("net/bnxt/tf_ulp: add meter stats support for Thor2")
Cc: stable@dpdk.org

Signed-off-by: Jay Ding <jay.ding@broadcom.com>
Signed-off-by: Manish Kurup <manish.kurup@broadcom.com>
---
 drivers/net/bnxt/tf_ulp/ulp_fc_mgr_tfc.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bnxt/tf_ulp/ulp_fc_mgr_tfc.c b/drivers/net/bnxt/tf_ulp/ulp_fc_mgr_tfc.c
index 8e61c71f97..d25e4ac27c 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_fc_mgr_tfc.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_fc_mgr_tfc.c
@@ -160,14 +160,27 @@ ulp_fc_tfc_mtr_stat_get(struct bnxt_ulp_context *ctxt,
 			int32_t clear,
 			struct rte_mtr_stats *mtr_count)
 {
-	struct rte_flow_query_count count;
+	struct rte_flow_query_count count = { 0 };
+	int32_t rc;
 
 	if (clear)
 		count.reset = 1;
 	else
 		count.reset = 0;
 
-	return ulp_fc_tfc_stat_get(ctxt, direction, session_type, handle, &count, mtr_count);
+	/*
+	 * Acquire fdb_lock to serialize this non-batch MPC read against the
+	 * background stats cache thread, which holds the same lock for the
+	 * duration of its batch send+collect window. Without this, both paths
+	 * race on the shared RE_CFA/TE_CFA MPC completion ring, leading to
+	 * out-of-order completions and firmware ring-state corruption.
+	 */
+	if (bnxt_ulp_cntxt_acquire_fdb_lock(ctxt))
+		return -EIO;
+
+	rc = ulp_fc_tfc_stat_get(ctxt, direction, session_type, handle, &count, mtr_count);
+	bnxt_ulp_cntxt_release_fdb_lock(ctxt);
+	return rc;
 }
 
 const struct bnxt_ulp_fc_core_ops ulp_fc_tfc_core_ops = {
-- 
2.31.1