Re: [PATCH net-next v3 3/4] NTB: ntb_transport: Add per-payload client metadata

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unaligned frame sizes lead to unaligned I/O writes and memory reads of the payload header.
--

commit 91aff7efee260ec323eefdc5885fbc094f6643c8
Author: Koichiro Den <den@valinux.co.jp>

NTB: ntb_transport: Add per-payload client metadata

This commit extends ntb_transport to carry 24 bits of opaque client metadata
alongside payload bytes. The metadata is packed into the upper bits of the
payload header's flags field and exposed via the transmit and receive
interfaces. It also adapts ntb_netdev to use the new interfaces without
metadata.

> diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
> index 3f497a62673fd..197376376bff5 100644
> --- a/drivers/ntb/ntb_transport.c
> +++ b/drivers/ntb/ntb_transport.c

[ ... ]

> @@ -1656,6 +1662,7 @@ static int ntb_process_rxc(struct ntb_transport_qp *qp)
>  
>  	entry->rx_hdr = hdr;
>  	entry->rx_index = qp->rx_index;
> +	entry->flags = flags & DESC_META_MASK;

[Severity: High]
This is a pre-existing issue, but does the calculation of the frame sizes
guarantee 4-byte alignment for the payload header?

In ntb_transport_setup_qp_mw(), qp->rx_max_frame and qp->tx_max_frame are
calculated using rx_size / 2 and tx_size / 2 without forcing alignment.

This means the hdr pointer in ntb_process_rxc() can be unaligned when
reading flags:

drivers/ntb/ntb_transport.c:ntb_process_rxc() {
	...
	offset = qp->rx_buff + qp->rx_max_frame * qp->rx_index;
	hdr = offset + qp->rx_max_frame - sizeof(struct ntb_payload_header);

	flags = le32_to_cpu(READ_ONCE(hdr->flags));
	...
}

Executing READ_ONCE() on an unaligned address can trigger alignment faults
(kernel panics) depending on the architecture.

Additionally, this unaligned frame size also leads to unaligned 32-bit PCIe
I/O writes in ntb_async_tx():

drivers/ntb/ntb_transport.c:ntb_async_tx() {
	...
	iowrite32(entry->len, &hdr->len);
	...
}

Unaligned memory-mapped PCIe addresses can trigger fatal hardware errors
(Unsupported Request). Can we ensure qp->rx_max_frame and qp->tx_max_frame
are properly aligned?

>  
>  	if (len > entry->len) {
>  		dev_dbg(&qp->ndev->pdev->dev,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904052134.2970111-1-den@valinux.co.jp?part=3