linux-kernel - Re: [PATCH V1] accel/amdxdna: Fix tail-pointer polling in mailbox_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <bc2f1460-24db-67bd-af93-078bbf0b393d@amd.com>
Date: Mon, 8 Dec 2025 08:34:20 -0800
From: Lizhi Hou <lizhi.hou@....com>
To: "Falkowski, Maciej" <maciej.falkowski@...ux.intel.com>,
	<ogabbay@...nel.org>, <quic_jhugo@...cinc.com>,
	<dri-devel@...ts.freedesktop.org>
CC: <linux-kernel@...r.kernel.org>, <max.zhen@....com>,
	<sonal.santan@....com>, <mario.limonciello@....com>
Subject: Re: [PATCH V1] accel/amdxdna: Fix tail-pointer polling in
 mailbox_get_msg()

Applied to drm-misc-next

On 12/5/25 08:41, Falkowski, Maciej wrote:
> Reviewed-by: Maciej Falkowski <maciej.falkowski@...ux.intel.com>
>
> On 12/4/2025 7:16 PM, Lizhi Hou wrote:
>> In mailbox_get_msg(), mailbox_reg_read_non_zero() is called to poll 
>> for a
>> non-zero tail pointer. This assumed that a zero value indicates an 
>> error.
>> However, certain corner cases legitimately produce a zero tail pointer.
>> To handle these cases, remove mailbox_reg_read_non_zero(). The zero tail
>> pointer will be treated as a valid rewind event.
>>
>> Signed-off-by: Lizhi Hou <lizhi.hou@....com>
>> ---
>>   drivers/accel/amdxdna/amdxdna_mailbox.c | 19 +------------------
>>   1 file changed, 1 insertion(+), 18 deletions(-)
>>
>> diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c 
>> b/drivers/accel/amdxdna/amdxdna_mailbox.c
>> index 858df97cd3fb..a60a85ce564c 100644
>> --- a/drivers/accel/amdxdna/amdxdna_mailbox.c
>> +++ b/drivers/accel/amdxdna/amdxdna_mailbox.c
>> @@ -112,22 +112,6 @@ static u32 mailbox_reg_read(struct 
>> mailbox_channel *mb_chann, u32 mbox_reg)
>>       return readl(ringbuf_addr);
>>   }
>>   -static int mailbox_reg_read_non_zero(struct mailbox_channel 
>> *mb_chann, u32 mbox_reg, u32 *val)
>> -{
>> -    struct xdna_mailbox_res *mb_res = &mb_chann->mb->res;
>> -    void __iomem *ringbuf_addr = mb_res->mbox_base + mbox_reg;
>> -    int ret, value;
>> -
>> -    /* Poll till value is not zero */
>> -    ret = readx_poll_timeout(readl, ringbuf_addr, value,
>> -                 value, 1 /* us */, 100);
>> -    if (ret < 0)
>> -        return ret;
>> -
>> -    *val = value;
>> -    return 0;
>> -}
>> -
>>   static inline void
>>   mailbox_set_headptr(struct mailbox_channel *mb_chann, u32 headptr_val)
>>   {
>> @@ -286,8 +270,7 @@ static int mailbox_get_msg(struct mailbox_channel 
>> *mb_chann)
>>       u32 start_addr;
>>       int ret;
>>   -    if (mailbox_reg_read_non_zero(mb_chann, 
>> mb_chann->res[CHAN_RES_I2X].mb_tail_ptr_reg, &tail))
>> -        return -EINVAL;
>> +    tail = mailbox_get_tailptr(mb_chann, CHAN_RES_I2X);
>>       head = mb_chann->i2x_head;
>>       ringbuf_size = mailbox_get_ringbuf_size(mb_chann, CHAN_RES_I2X);
>>       start_addr = mb_chann->res[CHAN_RES_I2X].rb_start_addr;