From: sashiko-bot@kernel.org
To: "Wei Fang" <wei.fang@nxp.com>
Cc: imx@lists.linux.dev, Frank.Li@kernel.org
Subject: Re: [PATCH v3 net 1/9] net: enetc: fix incorrect mailbox message status returned to VFs
Date: Sat, 30 May 2026 00:44:29 +0000 [thread overview]
Message-ID: <20260530004429.A76AB1F00899@smtp.kernel.org> (raw)
In-Reply-To: <20260520064421.91569-2-wei.fang@nxp.com>
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Pre-existing issues:
- [High] `__raw_writel` and `__raw_writew` are used for MAC address registers instead of standard I/O accessors, causing incorrect byte ordering on Big-Endian architectures.
- [High] The mailbox message structures passed over DMA use native `u16` instead of explicitly sized and endian-annotated types, causing communication failures between differing architectures.
--
commit 7c657b40dbc4f4dc4746436920b4e6e79230ff89
Author: Wei Fang <wei.fang@nxp.com>
net: enetc: fix incorrect mailbox message status returned to VFs
This commit corrects the mailbox message status returned to VFs in two
cases. It ensures that unsupported command types return a failure status
instead of retaining the default success status. It also returns a failure
when a VF attempts to override a MAC address that has already been set by
the PF.
> diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
> index a12fd54a475f6..27d4bb65e017f 100644
> --- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
> +++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
> @@ -493,11 +493,13 @@ static u16 enetc_msg_pf_set_vf_primary_mac_addr(struct enetc_pf *pf,
> return ENETC_MSG_CMD_STATUS_FAIL;
>
> addr = cmd->mac.sa_data;
> - if (vf_state->flags & ENETC_VF_FLAG_PF_SET_MAC)
> + if (vf_state->flags & ENETC_VF_FLAG_PF_SET_MAC) {
> dev_warn(dev, "Attempt to override PF set mac addr for VF%d\n",
> vf_id);
> - else
> - enetc_pf_set_primary_mac_addr(&pf->si->hw, vf_id + 1, addr);
> + return ENETC_MSG_CMD_STATUS_FAIL;
> + }
> +
> + enetc_pf_set_primary_mac_addr(&pf->si->hw, vf_id + 1, addr);
[Severity: High]
This is a pre-existing issue, but does enetc_pf_set_primary_mac_addr() handle
endianness correctly on Big-Endian architectures?
Looking at the implementation:
static void enetc_pf_set_primary_mac_addr(struct enetc_hw *hw, int si,
const u8 *addr)
{
u32 upper = get_unaligned_le32(addr);
...
__raw_writel(upper, hw->port + ENETC_PSIPMAR0(si));
...
}
Using __raw_writel() instead of writel() bypasses byte-swapping. Since
get_unaligned_le32() converts the MAC bytes into a CPU-native 32-bit integer,
writing it directly with __raw_writel() on a Big-Endian system will reverse
the bytes compared to what a Little-Endian device expects.
Could this cause the hardware to be programmed with a corrupted MAC address,
and should it use writel() or the driver's standard I/O accessors instead?
>
> return ENETC_MSG_CMD_STATUS_OK;
> }
> @@ -509,7 +511,6 @@ void enetc_msg_handle_rxmsg(struct enetc_pf *pf, int vf_id, u16 *status)
> struct enetc_msg_cmd_header *cmd_hdr;
> u16 cmd_type;
>
> - *status = ENETC_MSG_CMD_STATUS_OK;
> cmd_hdr = (struct enetc_msg_cmd_header *)msg->vaddr;
> cmd_type = cmd_hdr->type;
[Severity: High]
This is a pre-existing issue, but will reading cmd_hdr->type cause
communication failures if the VF guest and host PF have different endianness?
The mailbox message structures passed over DMA use native u16 types:
struct enetc_msg_cmd_header {
u16 type;
u16 id;
};
If a Little-Endian guest runs on a Big-Endian host, the PF will misinterpret
the command types because it reads them in its native byte order.
Do these fields need to be explicitly sized and endian-annotated (e.g., __le16)
with le16_to_cpu() conversions applied when reading them to ensure cross-endian
configurations function correctly?
[ ... ]
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260520064421.91569-1-wei.fang@nxp.com?part=1
next prev parent reply other threads:[~2026-05-30 0:44 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-20 6:44 [PATCH v3 net 0/9] net: enetc: SR-IOV robustness and security fixes Wei Fang
2026-05-20 6:44 ` [PATCH v3 net 1/9] net: enetc: fix incorrect mailbox message status returned to VFs Wei Fang
2026-05-30 0:44 ` sashiko-bot [this message]
2026-05-20 6:44 ` [PATCH v3 net 2/9] net: enetc: fix missing error code when pf->vf_state allocation fails Wei Fang
2026-05-20 6:44 ` [PATCH v3 net 3/9] net: enetc: add ratelimiting to VF mailbox error messages Wei Fang
2026-05-20 6:44 ` [PATCH v3 net 4/9] net: enetc: fix TOCTOU race and validate VF MAC address Wei Fang
2026-05-20 6:44 ` [PATCH v3 net 5/9] net: enetc: fix race condition in VF MAC address configuration Wei Fang
2026-05-30 0:44 ` sashiko-bot
2026-05-20 6:44 ` [PATCH v3 net 6/9] net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx() Wei Fang
2026-05-20 6:44 ` [PATCH v3 net 7/9] net: enetc: fix unbounded loop and interrupt handling in VF-to-PF messaging Wei Fang
2026-05-20 6:44 ` [PATCH v3 net 8/9] net: enetc: fix init and teardown order to prevent use of unsafe resources Wei Fang
2026-05-20 6:44 ` [PATCH v3 net 9/9] net: enetc: avoid VF->PF mailbox timeout during SR-IOV teardown Wei Fang
2026-05-21 16:00 ` [PATCH v3 net 0/9] net: enetc: SR-IOV robustness and security fixes patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260530004429.A76AB1F00899@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=Frank.Li@kernel.org \
--cc=imx@lists.linux.dev \
--cc=sashiko-reviews@lists.linux.dev \
--cc=wei.fang@nxp.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox