public inbox for netdev@vger.kernel.org
 help / color / mirror / Atom feed
* IXGBE VF DMA error handling bug(?)
@ 2021-07-19 17:44 Jamie Iles
  0 siblings, 0 replies; only message in thread
From: Jamie Iles @ 2021-07-19 17:44 UTC (permalink / raw)
  To: jesse.brandeburg, anthony.l.nguyen; +Cc: netdev

Hi folks,

Whilst reviewing the IXGBE driver I found a potential bug for VF DMA 
error handling.

83c61fa97a7d ("ixgbe: Add protection from VF invalid target DMA") added 
a workaround for an invalid VF DMA address that would read the TLP 
header from the PCIe RP to get the requester ID and then reset the 
originating VF.  144384649dc1 ("ixgbe: Check config reads for removal") 
then added checks for removal when performing config accesses, but 
changed:

 bdev = pdev->bus->self;                                        
 while (bdev && (pci_pcie_type(bdev) != PCI_EXP_TYPE_ROOT_PORT))
         bdev = bdev->bus->self;                                

...

-       pci_read_config_dword(bdev, pos + PCI_ERR_HEADER_LOG, &dw0);      
-       pci_read_config_dword(bdev, pos + PCI_ERR_HEADER_LOG + 4, &dw1);  
-       pci_read_config_dword(bdev, pos + PCI_ERR_HEADER_LOG + 8, &dw2);  
-       pci_read_config_dword(bdev, pos + PCI_ERR_HEADER_LOG + 12, &dw3); 
+       dw0 = ixgbe_read_pci_cfg_dword(hw, pos + PCI_ERR_HEADER_LOG);     
+       dw1 = ixgbe_read_pci_cfg_dword(hw, pos + PCI_ERR_HEADER_LOG + 4); 
+       dw2 = ixgbe_read_pci_cfg_dword(hw, pos + PCI_ERR_HEADER_LOG + 8); 
+       dw3 = ixgbe_read_pci_cfg_dword(hw, pos + PCI_ERR_HEADER_LOG + 12);

so now the header is being read from NIC config space rather than the 
root port.

If correct, the fix should be as simple as reverting those accessor 
changes in ixgbe_io_error_detected.

Thanks,

Jamie

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2021-07-19 17:49 UTC | newest]

Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-07-19 17:44 IXGBE VF DMA error handling bug(?) Jamie Iles

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox