netdev - RE: [PATCH net] net: libwx: fix firmware mailbox abnormal return

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <028a01db5ce1$7f555f60$7e001e20$@trustnetic.com>
Date: Thu, 2 Jan 2025 14:42:30 +0800
From: Jiawen Wu <jiawenwu@...stnetic.com>
To: "'Jakub Kicinski'" <kuba@...nel.org>
Cc: <andrew+netdev@...n.ch>,
	<davem@...emloft.net>,
	<edumazet@...gle.com>,
	<pabeni@...hat.com>,
	<horms@...nel.org>,
	<rmk+kernel@...linux.org.uk>,
	<netdev@...r.kernel.org>,
	<mengyuanlou@...-swift.com>
Subject: RE: [PATCH net] net: libwx: fix firmware mailbox abnormal return

On Tue, Dec 31, 2024 10:12 AM, Jakub Kicinski wrote:
> On Thu, 26 Dec 2024 11:18:10 +0800 Jiawen Wu wrote:
> > Firmware writes back 'firmware ready' and 'unknown command' in the mailbox
> > message if there is an unknown command sent by driver. It tends to happen
> > with the use of custom firmware. So move the check for 'unknown command'
> > out of the poll timeout for 'firmware ready'. And adjust the debug log so
> > that mailbox messages are always printed when commands timeout.
> 
> The commit message doesn't really explain what the problem is,
> just what the code does. What is the problem you're solving
> and how does it impact the user?

The problem has not happened yet, but the code behavior is wrong. 
Follow this wrong flow, driver would never return error if there is a unknown
command. Since reading 'firmware ready' does not timeout. Thus driver would
mistakenly believe that the interaction has completed successfully.

> 
> > Fixes: 1efa9bfe58c5 ("net: libwx: Implement interaction with firmware")
> > Signed-off-by: Jiawen Wu <jiawenwu@...stnetic.com>
> > ---
> >  drivers/net/ethernet/wangxun/libwx/wx_hw.c | 22 ++++++++++------------
> >  1 file changed, 10 insertions(+), 12 deletions(-)
> >
> > diff --git a/drivers/net/ethernet/wangxun/libwx/wx_hw.c b/drivers/net/ethernet/wangxun/libwx/wx_hw.c
> > index 1bf9c38e4125..7059e0100c7c 100644
> > --- a/drivers/net/ethernet/wangxun/libwx/wx_hw.c
> > +++ b/drivers/net/ethernet/wangxun/libwx/wx_hw.c
> > @@ -334,27 +334,25 @@ int wx_host_interface_command(struct wx *wx, u32 *buffer,
> >  	status = read_poll_timeout(rd32, hicr, hicr & WX_MNG_MBOX_CTL_FWRDY, 1000,
> >  				   timeout * 1000, false, wx, WX_MNG_MBOX_CTL);
> >
> > +	buf[0] = rd32(wx, WX_MNG_MBOX);
> > +	if ((buf[0] & 0xff0000) >> 16 == 0x80) {
> > +		wx_dbg(wx, "It's unknown cmd.\n");
> > +		status = -EINVAL;
> > +		goto rel_out;
> > +	}
> 
> Why check this before the status check? If the poll timed out doesn't
> it mean the FW did not respond?

Firmware writes back 'firmware ready' and 'unknown command', so the poll
will not time out.

> 
> >  	/* Check command completion */
> >  	if (status) {
> >  		wx_dbg(wx, "Command has failed with no status valid.\n");
> > -
> > -		buf[0] = rd32(wx, WX_MNG_MBOX);
> > -		if ((buffer[0] & 0xff) != (~buf[0] >> 24)) {
> > -			status = -EINVAL;
> > -			goto rel_out;
> > -		}
> > -		if ((buf[0] & 0xff0000) >> 16 == 0x80) {
> > -			wx_dbg(wx, "It's unknown cmd.\n");
> > -			status = -EINVAL;
> > -			goto rel_out;
> > -		}
> >
> > +		wx_dbg(wx, "check: %x %x\n", buffer[0] & 0xff, ~buf[0] >> 24);
> > +		if ((buffer[0] & 0xff) != (~buf[0] >> 24))
> > +			goto rel_out;
> 
> Inverse question here, I guess. Why is it only an error for FW not
> to be ready if cmd doesn't match?

It is to check if the cmd has been processed by FW. If it matches, it means
that FW has already processed the cmd, but FWRDY timeout for some
unknown reason.