Linux kernel and device drivers for NXP i.MX platforms
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: "Wei Fang" <wei.fang@nxp.com>
Cc: imx@lists.linux.dev, Frank.Li@kernel.org
Subject: Re: [PATCH v3 net 1/9] net: enetc: fix incorrect mailbox message status returned to VFs
Date: Sat, 30 May 2026 00:44:29 +0000	[thread overview]
Message-ID: <20260530004429.A76AB1F00899@smtp.kernel.org> (raw)
In-Reply-To: <20260520064421.91569-2-wei.fang@nxp.com>

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] `__raw_writel` and `__raw_writew` are used for MAC address registers instead of standard I/O accessors, causing incorrect byte ordering on Big-Endian architectures.
- [High] The mailbox message structures passed over DMA use native `u16` instead of explicitly sized and endian-annotated types, causing communication failures between differing architectures.
--

commit 7c657b40dbc4f4dc4746436920b4e6e79230ff89
Author: Wei Fang <wei.fang@nxp.com>

net: enetc: fix incorrect mailbox message status returned to VFs

This commit corrects the mailbox message status returned to VFs in two
cases. It ensures that unsupported command types return a failure status
instead of retaining the default success status. It also returns a failure
when a VF attempts to override a MAC address that has already been set by
the PF.

> diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
> index a12fd54a475f6..27d4bb65e017f 100644
> --- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
> +++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
> @@ -493,11 +493,13 @@ static u16 enetc_msg_pf_set_vf_primary_mac_addr(struct enetc_pf *pf,
>  		return ENETC_MSG_CMD_STATUS_FAIL;
>  
>  	addr = cmd->mac.sa_data;
> -	if (vf_state->flags & ENETC_VF_FLAG_PF_SET_MAC)
> +	if (vf_state->flags & ENETC_VF_FLAG_PF_SET_MAC) {
>  		dev_warn(dev, "Attempt to override PF set mac addr for VF%d\n",
>  			 vf_id);
> -	else
> -		enetc_pf_set_primary_mac_addr(&pf->si->hw, vf_id + 1, addr);
> +		return ENETC_MSG_CMD_STATUS_FAIL;
> +	}
> +
> +	enetc_pf_set_primary_mac_addr(&pf->si->hw, vf_id + 1, addr);

[Severity: High]
This is a pre-existing issue, but does enetc_pf_set_primary_mac_addr() handle
endianness correctly on Big-Endian architectures?

Looking at the implementation:

static void enetc_pf_set_primary_mac_addr(struct enetc_hw *hw, int si,
					  const u8 *addr)
{
	u32 upper = get_unaligned_le32(addr);
	...
	__raw_writel(upper, hw->port + ENETC_PSIPMAR0(si));
	...
}

Using __raw_writel() instead of writel() bypasses byte-swapping. Since
get_unaligned_le32() converts the MAC bytes into a CPU-native 32-bit integer,
writing it directly with __raw_writel() on a Big-Endian system will reverse
the bytes compared to what a Little-Endian device expects.

Could this cause the hardware to be programmed with a corrupted MAC address,
and should it use writel() or the driver's standard I/O accessors instead?

>  
>  	return ENETC_MSG_CMD_STATUS_OK;
>  }
> @@ -509,7 +511,6 @@ void enetc_msg_handle_rxmsg(struct enetc_pf *pf, int vf_id, u16 *status)
>  	struct enetc_msg_cmd_header *cmd_hdr;
>  	u16 cmd_type;
>  
> -	*status = ENETC_MSG_CMD_STATUS_OK;
>  	cmd_hdr = (struct enetc_msg_cmd_header *)msg->vaddr;
>  	cmd_type = cmd_hdr->type;

[Severity: High]
This is a pre-existing issue, but will reading cmd_hdr->type cause
communication failures if the VF guest and host PF have different endianness?

The mailbox message structures passed over DMA use native u16 types:

struct enetc_msg_cmd_header {
	u16 type;
	u16 id;
};

If a Little-Endian guest runs on a Big-Endian host, the PF will misinterpret
the command types because it reads them in its native byte order.

Do these fields need to be explicitly sized and endian-annotated (e.g., __le16)
with le16_to_cpu() conversions applied when reading them to ensure cross-endian
configurations function correctly?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260520064421.91569-1-wei.fang@nxp.com?part=1

  reply	other threads:[~2026-05-30  0:44 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-05-20  6:44 [PATCH v3 net 0/9] net: enetc: SR-IOV robustness and security fixes Wei Fang
2026-05-20  6:44 ` [PATCH v3 net 1/9] net: enetc: fix incorrect mailbox message status returned to VFs Wei Fang
2026-05-30  0:44   ` sashiko-bot [this message]
2026-05-20  6:44 ` [PATCH v3 net 2/9] net: enetc: fix missing error code when pf->vf_state allocation fails Wei Fang
2026-05-20  6:44 ` [PATCH v3 net 3/9] net: enetc: add ratelimiting to VF mailbox error messages Wei Fang
2026-05-20  6:44 ` [PATCH v3 net 4/9] net: enetc: fix TOCTOU race and validate VF MAC address Wei Fang
2026-05-20  6:44 ` [PATCH v3 net 5/9] net: enetc: fix race condition in VF MAC address configuration Wei Fang
2026-05-30  0:44   ` sashiko-bot
2026-05-20  6:44 ` [PATCH v3 net 6/9] net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx() Wei Fang
2026-05-20  6:44 ` [PATCH v3 net 7/9] net: enetc: fix unbounded loop and interrupt handling in VF-to-PF messaging Wei Fang
2026-05-20  6:44 ` [PATCH v3 net 8/9] net: enetc: fix init and teardown order to prevent use of unsafe resources Wei Fang
2026-05-20  6:44 ` [PATCH v3 net 9/9] net: enetc: avoid VF->PF mailbox timeout during SR-IOV teardown Wei Fang
2026-05-21 16:00 ` [PATCH v3 net 0/9] net: enetc: SR-IOV robustness and security fixes patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260530004429.A76AB1F00899@smtp.kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=Frank.Li@kernel.org \
    --cc=imx@lists.linux.dev \
    --cc=sashiko-reviews@lists.linux.dev \
    --cc=wei.fang@nxp.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox