From 9f3bb818deadd2a3753a5c822c1dfeb93bf288d9 Mon Sep 17 00:00:00 2001
From: Aastha Mehta <aasthakm@mpi-sws.org>
Date: Mon, 24 Jul 2017 19:18:25 +0200
Subject: [PATCH] bugfix: index overflow, handle case where producer index
wraps around and becomes smaller than consumer index
---
.../net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 52 ++++++++++++++++---
1 file changed, 44 insertions(+), 8 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index cc46b914f..6c98f6b20 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1179,6 +1179,8 @@ static int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
int rx_pkt_int = 0;
#ifdef CONFIG_XEN_SME
char dbg_buff[DBG_BUF_SIZE];
+ u16 tmp_swi_bd_prod, tmp_swi_bd_cons, tmp_swi_comp_prod, tmp_swi_comp_cons;
+ u16 tmp_hwi_bd_prod, tmp_hwi_bd_cons, tmp_hwi_comp_prod, tmp_hwi_comp_cons;
#endif
#ifdef BNX2X_STOP_ON_ERROR
@@ -1203,10 +1205,23 @@ static int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
#ifdef CONFIG_XEN_SME
if (lnk_intercept_rx_path) {
- while (fp->swi_bd_prod < fp->hwi_bd_prod
- && fp->swi_bd_cons < fp->hwi_bd_cons
- && fp->swi_comp_prod < fp->hwi_comp_prod
- && fp->swi_comp_cons < fp->hwi_comp_cons) {
+ tmp_swi_bd_prod = NEXT_RX_IDX(fp->swi_bd_prod);
+ tmp_swi_bd_cons = NEXT_RX_IDX(fp->swi_bd_cons);
+ tmp_swi_comp_prod = NEXT_RCQ_IDX(fp->swi_comp_prod);
+ tmp_swi_comp_cons = NEXT_RCQ_IDX(fp->swi_comp_cons);
+ tmp_hwi_bd_prod = fp->hwi_bd_prod;
+ tmp_hwi_bd_cons = fp->hwi_bd_cons;
+ tmp_hwi_comp_prod = fp->hwi_comp_prod;
+ tmp_hwi_comp_cons = fp->hwi_comp_cons;
+
+ //while (fp->swi_bd_prod < fp->hwi_bd_prod
+ // && fp->swi_bd_cons < fp->hwi_bd_cons
+ // && fp->swi_comp_prod < fp->hwi_comp_prod
+ // && fp->swi_comp_cons < fp->hwi_comp_cons) {
+ while(RX_BD(tmp_swi_bd_prod) <= RX_BD(tmp_hwi_bd_prod)
+ && RX_BD(tmp_swi_bd_cons) <= RX_BD(tmp_hwi_bd_cons)
+ && RCQ_BD(tmp_swi_comp_prod) <= RCQ_BD(tmp_hwi_comp_prod)
+ && RCQ_BD(tmp_swi_comp_cons) <= RCQ_BD(tmp_hwi_comp_cons)) {
memset(dbg_buff, 0, DBG_BUF_SIZE);
rx_pkt_int = __bnx2x_rx_int(fp, budget);
if (rx_pkt_int == -5) {
@@ -1224,6 +1239,16 @@ static int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
if (rx_pkt == budget)
break;
+
+ tmp_swi_bd_prod = NEXT_RX_IDX(fp->swi_bd_prod);
+ tmp_swi_bd_cons = NEXT_RX_IDX(fp->swi_bd_cons);
+ tmp_swi_comp_prod = NEXT_RCQ_IDX(fp->swi_comp_prod);
+ tmp_swi_comp_cons = NEXT_RCQ_IDX(fp->swi_comp_cons);
+ tmp_hwi_bd_prod = fp->hwi_bd_prod;
+ tmp_hwi_bd_cons = fp->hwi_bd_cons;
+ tmp_hwi_comp_prod = fp->hwi_comp_prod;
+ tmp_hwi_comp_cons = fp->hwi_comp_cons;
+
}
} else {
#endif
@@ -3622,6 +3647,8 @@ static int bnx2x_poll(struct napi_struct *napi, int budget)
union eth_rx_cqe *cqe = NULL;
struct eth_fast_path_rx_cqe *cqe_fp = NULL;
int total_work_done = 0;
+ u16 tmp_swi_bd_prod, tmp_swi_bd_cons, tmp_swi_comp_prod, tmp_swi_comp_cons;
+ u16 tmp_hwi_bd_prod, tmp_hwi_bd_cons, tmp_hwi_comp_prod, tmp_hwi_comp_cons;
#endif
#ifdef BNX2X_STOP_ON_ERROR
@@ -3678,10 +3705,19 @@ redo_poll:
napi_complete(napi);
- if ((fp->swi_bd_prod < fp->hwi_bd_prod
- && fp->swi_bd_cons < fp->hwi_bd_cons
- && fp->swi_comp_prod < fp->hwi_comp_prod
- && fp->swi_comp_cons < fp->hwi_comp_cons)
+ tmp_swi_bd_prod = NEXT_RX_IDX(fp->swi_bd_prod);
+ tmp_swi_bd_cons = NEXT_RX_IDX(fp->swi_bd_cons);
+ tmp_swi_comp_prod = NEXT_RCQ_IDX(fp->swi_comp_prod);
+ tmp_swi_comp_cons = NEXT_RCQ_IDX(fp->swi_comp_cons);
+ tmp_hwi_bd_prod = fp->hwi_bd_prod;
+ tmp_hwi_bd_cons = fp->hwi_bd_cons;
+ tmp_hwi_comp_prod = fp->hwi_comp_prod;
+ tmp_hwi_comp_cons = fp->hwi_comp_cons;
+
+ if ((RX_BD(tmp_swi_bd_prod) <= RX_BD(tmp_hwi_bd_prod)
+ && RX_BD(tmp_swi_bd_cons) <= RX_BD(tmp_hwi_bd_cons)
+ && RCQ_BD(tmp_swi_comp_prod) <= RCQ_BD(tmp_hwi_comp_prod)
+ && RCQ_BD(tmp_swi_comp_cons) <= RCQ_BD(tmp_hwi_comp_cons))
/* || BNX2X_IS_CQE_COMPLETED(cqe_fp) */) { // temporary condition for debugging
napi_schedule_irqoff(napi);
#if 0
--
GitLab