linux-kernel - Re: [PATCH V1] accel/amdxdna: Fix tail-pointer polling in mailbox_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <c16fb0e0-1f30-422e-9785-78ac0b8c4783@linux.intel.com>
Date: Fri, 5 Dec 2025 17:41:30 +0100
From: "Falkowski, Maciej" <maciej.falkowski@...ux.intel.com>
To: Lizhi Hou <lizhi.hou@....com>, ogabbay@...nel.org,
 quic_jhugo@...cinc.com, dri-devel@...ts.freedesktop.org
Cc: linux-kernel@...r.kernel.org, max.zhen@....com, sonal.santan@....com,
 mario.limonciello@....com
Subject: Re: [PATCH V1] accel/amdxdna: Fix tail-pointer polling in
 mailbox_get_msg()

Reviewed-by: Maciej Falkowski <maciej.falkowski@...ux.intel.com>

On 12/4/2025 7:16 PM, Lizhi Hou wrote:
> In mailbox_get_msg(), mailbox_reg_read_non_zero() is called to poll for a
> non-zero tail pointer. This assumed that a zero value indicates an error.
> However, certain corner cases legitimately produce a zero tail pointer.
> To handle these cases, remove mailbox_reg_read_non_zero(). The zero tail
> pointer will be treated as a valid rewind event.
>
> Signed-off-by: Lizhi Hou <lizhi.hou@....com>
> ---
>   drivers/accel/amdxdna/amdxdna_mailbox.c | 19 +------------------
>   1 file changed, 1 insertion(+), 18 deletions(-)
>
> diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c
> index 858df97cd3fb..a60a85ce564c 100644
> --- a/drivers/accel/amdxdna/amdxdna_mailbox.c
> +++ b/drivers/accel/amdxdna/amdxdna_mailbox.c
> @@ -112,22 +112,6 @@ static u32 mailbox_reg_read(struct mailbox_channel *mb_chann, u32 mbox_reg)
>   	return readl(ringbuf_addr);
>   }
>   
> -static int mailbox_reg_read_non_zero(struct mailbox_channel *mb_chann, u32 mbox_reg, u32 *val)
> -{
> -	struct xdna_mailbox_res *mb_res = &mb_chann->mb->res;
> -	void __iomem *ringbuf_addr = mb_res->mbox_base + mbox_reg;
> -	int ret, value;
> -
> -	/* Poll till value is not zero */
> -	ret = readx_poll_timeout(readl, ringbuf_addr, value,
> -				 value, 1 /* us */, 100);
> -	if (ret < 0)
> -		return ret;
> -
> -	*val = value;
> -	return 0;
> -}
> -
>   static inline void
>   mailbox_set_headptr(struct mailbox_channel *mb_chann, u32 headptr_val)
>   {
> @@ -286,8 +270,7 @@ static int mailbox_get_msg(struct mailbox_channel *mb_chann)
>   	u32 start_addr;
>   	int ret;
>   
> -	if (mailbox_reg_read_non_zero(mb_chann, mb_chann->res[CHAN_RES_I2X].mb_tail_ptr_reg, &tail))
> -		return -EINVAL;
> +	tail = mailbox_get_tailptr(mb_chann, CHAN_RES_I2X);
>   	head = mb_chann->i2x_head;
>   	ringbuf_size = mailbox_get_ringbuf_size(mb_chann, CHAN_RES_I2X);
>   	start_addr = mb_chann->res[CHAN_RES_I2X].rb_start_addr;