net: ena: Add validation for completion descriptors consistency

Validate that `first` flag is set only for the first
descriptor in multi-buffer packets.
In case of an invalid descriptor, a reset will occur.
A new reset reason for RX data corruption has been added.

Signed-off-by: Shahar Itzko <itzko@amazon.com>
Signed-off-by: David Arinzon <darinzon@amazon.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240512134637.25299-4-darinzon@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/amazon/ena/ena_eth_com.c b/drivers/net/ethernet/amazon/ena/ena_eth_com.c
index 933e619..4c6e07a 100644 (file)
--- a/drivers/net/ethernet/amazon/ena/ena_eth_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_eth_com.c
@@ -229,30 +229,43 @@ static struct ena_eth_io_rx_cdesc_base *
                idx * io_cq->cdesc_entry_size_in_bytes);
 }
 
-static u16 ena_com_cdesc_rx_pkt_get(struct ena_com_io_cq *io_cq,
-                                          u16 *first_cdesc_idx)
+static int ena_com_cdesc_rx_pkt_get(struct ena_com_io_cq *io_cq,
+                                   u16 *first_cdesc_idx,
+                                   u16 *num_descs)
 {
+       u16 count = io_cq->cur_rx_pkt_cdesc_count, head_masked;
        struct ena_eth_io_rx_cdesc_base *cdesc;
-       u16 count = 0, head_masked;
        u32 last = 0;
 
        do {
+               u32 status;
+
                cdesc = ena_com_get_next_rx_cdesc(io_cq);
                if (!cdesc)
                        break;
+               status = READ_ONCE(cdesc->status);
 
                ena_com_cq_inc_head(io_cq);
+               if (unlikely((status & ENA_ETH_IO_RX_CDESC_BASE_FIRST_MASK) >>
+                   ENA_ETH_IO_RX_CDESC_BASE_FIRST_SHIFT && count != 0)) {
+                       struct ena_com_dev *dev = ena_com_io_cq_to_ena_dev(io_cq);
+
+                       netdev_err(dev->net_device,
+                                  "First bit is on in descriptor #%d on q_id: %d, req_id: %u\n",
+                                  count, io_cq->qid, cdesc->req_id);
+                       return -EFAULT;
+               }
                count++;
-               last = (READ_ONCE(cdesc->status) & ENA_ETH_IO_RX_CDESC_BASE_LAST_MASK) >>
-                      ENA_ETH_IO_RX_CDESC_BASE_LAST_SHIFT;
+               last = (status & ENA_ETH_IO_RX_CDESC_BASE_LAST_MASK) >>
+                       ENA_ETH_IO_RX_CDESC_BASE_LAST_SHIFT;
        } while (!last);
 
        if (last) {
                *first_cdesc_idx = io_cq->cur_rx_pkt_cdesc_start_idx;
-               count += io_cq->cur_rx_pkt_cdesc_count;
 
                head_masked = io_cq->head & (io_cq->q_depth - 1);
 
+               *num_descs = count;
                io_cq->cur_rx_pkt_cdesc_count = 0;
                io_cq->cur_rx_pkt_cdesc_start_idx = head_masked;
 
@@ -260,11 +273,11 @@ static u16 ena_com_cdesc_rx_pkt_get(struct ena_com_io_cq *io_cq,
                           "ENA q_id: %d packets were completed. first desc idx %u descs# %d\n",
                           io_cq->qid, *first_cdesc_idx, count);
        } else {
-               io_cq->cur_rx_pkt_cdesc_count += count;
-               count = 0;
+               io_cq->cur_rx_pkt_cdesc_count = count;
+               *num_descs = 0;
        }
 
-       return count;
+       return 0;
 }
 
 static int ena_com_create_meta(struct ena_com_io_sq *io_sq,
@@ -539,10 +552,14 @@ int ena_com_rx_pkt(struct ena_com_io_cq *io_cq,
        u16 cdesc_idx = 0;
        u16 nb_hw_desc;
        u16 i = 0;
+       int rc;
 
        WARN(io_cq->direction != ENA_COM_IO_QUEUE_DIRECTION_RX, "wrong Q type");
 
-       nb_hw_desc = ena_com_cdesc_rx_pkt_get(io_cq, &cdesc_idx);
+       rc = ena_com_cdesc_rx_pkt_get(io_cq, &cdesc_idx, &nb_hw_desc);
+       if (unlikely(rc != 0))
+               return -EFAULT;
+
        if (nb_hw_desc == 0) {
                ena_rx_ctx->descs = nb_hw_desc;
                return 0;

diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index 6a9d1b6..7398bc6 100644 (file)
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -1347,6 +1347,8 @@ error:
        if (rc == -ENOSPC) {
                ena_increase_stat(&rx_ring->rx_stats.bad_desc_num, 1, &rx_ring->syncp);
                ena_reset_device(adapter, ENA_REGS_RESET_TOO_MANY_RX_DESCS);
+       } else if (rc == -EFAULT) {
+               ena_reset_device(adapter, ENA_REGS_RESET_RX_DESCRIPTOR_MALFORMED);
        } else {
                ena_increase_stat(&rx_ring->rx_stats.bad_req_id, 1,
                                  &rx_ring->syncp);

diff --git a/drivers/net/ethernet/amazon/ena/ena_regs_defs.h b/drivers/net/ethernet/amazon/ena/ena_regs_defs.h
index 2c3d6a7..a2efeba 100644 (file)
--- a/drivers/net/ethernet/amazon/ena/ena_regs_defs.h
+++ b/drivers/net/ethernet/amazon/ena/ena_regs_defs.h
@@ -22,6 +22,7 @@ enum ena_regs_reset_reason_types {
        ENA_REGS_RESET_GENERIC                      = 13,
        ENA_REGS_RESET_MISS_INTERRUPT               = 14,
        ENA_REGS_RESET_SUSPECTED_POLL_STARVATION    = 15,
+       ENA_REGS_RESET_RX_DESCRIPTOR_MALFORMED      = 16,
 };
 
 /* ena_registers offsets */