The idev mcs_list is walked from the mailbox interrupt thread via
roc_idev_mcs_get() and dereferenced in mcs_event_cb_process(), while
the control thread can concurrently free the mcs in roc_mcs_dev_fini().
With no lock on the list, an MCS interrupt during teardown could read
freed memory or corrupt the TAILQ mid-splice.
Add a dedicated idev mcs_lock, held across the lookup+callback in the
interrupt handler, the list insert in roc_mcs_dev_init(), and the
TAILQ_REMOVE in roc_mcs_dev_fini() (which drains any in-flight
interrupt before mcs and sa_port_map are freed). List helpers stay
lock-free to avoid recursive locking.
Fixes: f752780f30dc ("common/cnxk: add ROC MACsec initialization")
Cc: [email protected]
Signed-off-by: Aarnav JP <[email protected]>
---
drivers/common/cnxk/roc_dev.c | 11 +++++++++--
drivers/common/cnxk/roc_idev.c | 1 +
drivers/common/cnxk/roc_idev_priv.h | 1 +
drivers/common/cnxk/roc_mcs.c | 30 +++++++++++++++++++++--------
4 files changed, 33 insertions(+), 10 deletions(-)
diff --git a/drivers/common/cnxk/roc_dev.c b/drivers/common/cnxk/roc_dev.c
index a432fb8710..6d918bf17b 100644
--- a/drivers/common/cnxk/roc_dev.c
+++ b/drivers/common/cnxk/roc_dev.c
@@ -669,15 +669,20 @@ static int
mbox_up_handler_mcs_intr_notify(struct dev *dev, struct mcs_intr_info *info,
struct msg_rsp *rsp)
{
struct roc_mcs_event_desc desc = {0};
+ struct idev_cfg *idev = idev_get_cfg();
struct roc_mcs *mcs;
plt_base_dbg("pf:%d/vf:%d msg id 0x%x (%s) from: pf:%d/vf:%d",
dev_get_pf(dev->pf_func),
dev_get_vf(dev->pf_func), info->hdr.id,
mbox_id2name(info->hdr.id),
dev_get_pf(info->hdr.pcifunc),
dev_get_vf(info->hdr.pcifunc));
+ if (idev == NULL)
+ goto exit;
+
+ plt_spinlock_lock(&idev->mcs_lock);
mcs = roc_idev_mcs_get(info->mcs_id);
if (!mcs)
- goto exit;
+ goto unlock;
if (info->intr_mask) {
switch (info->intr_mask) {
@@ -739,12 +744,14 @@ mbox_up_handler_mcs_intr_notify(struct dev *dev, struct
mcs_intr_info *info, str
desc.metadata.lmac_id = info->lmac_id;
break;
default:
- goto exit;
+ goto unlock;
}
mcs_event_cb_process(mcs, &desc);
}
+unlock:
+ plt_spinlock_unlock(&idev->mcs_lock);
exit:
rsp->hdr.rc = 0;
return 0;
diff --git a/drivers/common/cnxk/roc_idev.c b/drivers/common/cnxk/roc_idev.c
index 6aa5b10ee9..17b99682fd 100644
--- a/drivers/common/cnxk/roc_idev.c
+++ b/drivers/common/cnxk/roc_idev.c
@@ -45,6 +45,7 @@ idev_set_defaults(struct idev_cfg *idev)
TAILQ_INIT(&idev->roc_nix_list);
plt_spinlock_init(&idev->nix_inl_dev_lock);
plt_spinlock_init(&idev->npa_dev_lock);
+ plt_spinlock_init(&idev->mcs_lock);
__atomic_store_n(&idev->npa_refcnt, 0, __ATOMIC_RELEASE);
}
diff --git a/drivers/common/cnxk/roc_idev_priv.h
b/drivers/common/cnxk/roc_idev_priv.h
index dde555535b..ca47f6948e 100644
--- a/drivers/common/cnxk/roc_idev_priv.h
+++ b/drivers/common/cnxk/roc_idev_priv.h
@@ -45,6 +45,7 @@ struct idev_cfg {
struct idev_nix_inl_rx_inj_cfg inl_rx_inj_cfg;
plt_spinlock_t nix_inl_dev_lock;
plt_spinlock_t npa_dev_lock;
+ plt_spinlock_t mcs_lock;
uint8_t dma_cs_offset;
};
diff --git a/drivers/common/cnxk/roc_mcs.c b/drivers/common/cnxk/roc_mcs.c
index 0ae5618c09..1b45f5dad9 100644
--- a/drivers/common/cnxk/roc_mcs.c
+++ b/drivers/common/cnxk/roc_mcs.c
@@ -839,17 +839,24 @@ struct roc_mcs *
roc_mcs_dev_init(uint8_t mcs_idx)
{
struct mcs_event_cb_list *cb_list;
+ struct idev_cfg *idev;
struct roc_mcs *mcs;
struct npa_lf *npa;
if (!(roc_feature_bphy_has_macsec() || roc_feature_nix_has_macsec()))
return NULL;
- mcs = roc_idev_mcs_get(mcs_idx);
- if (mcs) {
- plt_info("Skipping device, mcs device already probed");
- mcs->refcount++;
- return mcs;
+ idev = idev_get_cfg();
+ if (idev) {
+ plt_spinlock_lock(&idev->mcs_lock);
+ mcs = roc_idev_mcs_get(mcs_idx);
+ if (mcs) {
+ plt_info("Skipping device, mcs device already probed");
+ mcs->refcount++;
+ plt_spinlock_unlock(&idev->mcs_lock);
+ return mcs;
+ }
+ plt_spinlock_unlock(&idev->mcs_lock);
}
mcs = plt_zmalloc(sizeof(struct roc_mcs), PLT_CACHE_LINE_SIZE);
@@ -870,8 +877,11 @@ roc_mcs_dev_init(uint8_t mcs_idx)
cb_list = (struct mcs_event_cb_list *)roc_mcs_to_mcs_cb_list(mcs);
TAILQ_INIT(cb_list);
+ idev = idev_get_cfg();
+ plt_spinlock_lock(&idev->mcs_lock);
roc_idev_mcs_set(mcs);
mcs->refcount++;
+ plt_spinlock_unlock(&idev->mcs_lock);
return mcs;
exit:
@@ -882,12 +892,18 @@ roc_mcs_dev_init(uint8_t mcs_idx)
void
roc_mcs_dev_fini(struct roc_mcs *mcs)
{
+ struct idev_cfg *idev = idev_get_cfg();
struct mcs_priv *priv;
int i;
+ plt_spinlock_lock(&idev->mcs_lock);
mcs->refcount--;
- if (mcs->refcount > 0)
+ if (mcs->refcount > 0) {
+ plt_spinlock_unlock(&idev->mcs_lock);
return;
+ }
+ roc_idev_mcs_free(mcs);
+ plt_spinlock_unlock(&idev->mcs_lock);
priv = roc_mcs_to_mcs_priv(mcs);
@@ -902,7 +918,5 @@ roc_mcs_dev_fini(struct roc_mcs *mcs)
plt_free(mcs->sa_port_map);
- roc_idev_mcs_free(mcs);
-
plt_free(mcs);
}
--
2.43.0
