From: Yanling Song <songyl@ramaxel.com> Ramaxel inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4TPKM CVE: NA ----------------------------------------------- Hardware calcaulats xor by 4B-aligned. When sending a non 4B-aligned message to firmware, the message has to be rounded up as 4B-aligned. Signed-off-by: Yanling Song <songyl@ramaxel.com> Reviewed-by: wenliang <wenliang@ramaxel.com> Acked-by: Xie XiuQi <xiexiuqi@huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com> --- drivers/net/ethernet/ramaxel/spnic/hw/sphw_mbox.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/ramaxel/spnic/hw/sphw_mbox.c b/drivers/net/ethernet/ramaxel/spnic/hw/sphw_mbox.c index 8abb47422bdd..7631b17a2944 100644 --- a/drivers/net/ethernet/ramaxel/spnic/hw/sphw_mbox.c +++ b/drivers/net/ethernet/ramaxel/spnic/hw/sphw_mbox.c @@ -860,6 +860,7 @@ static int mbox_prepare_dma_entry(struct sphw_mbox *func_to_func, struct mbox_dm struct mbox_dma_msg *dma_msg, void *msg, u16 msg_len) { u64 dma_addr, offset; + void *dma_vaddr; if (IS_MSG_QUEUE_FULL(mq)) { sdk_err(func_to_func->hwdev->dev_hdl, "Mbox sync message queue is busy, pi: %u, ci: %u\n", @@ -869,12 +870,13 @@ static int mbox_prepare_dma_entry(struct sphw_mbox *func_to_func, struct mbox_dm /* copy data to DMA buffer */ offset = mq->prod_idx * MBOX_MAX_BUF_SZ; - memcpy((u8 *)mq->dma_buff_vaddr + offset, msg, msg_len); + dma_vaddr = (u8 *)mq->dma_buff_vaddr + offset; + memcpy(dma_vaddr, msg, msg_len); dma_addr = mq->dma_buff_paddr + offset; dma_msg->dma_addr_high = upper_32_bits(dma_addr); dma_msg->dma_addr_low = lower_32_bits(dma_addr); dma_msg->msg_len = msg_len; - dma_msg->xor = mbox_dma_msg_xor(msg, msg_len); + dma_msg->xor = mbox_dma_msg_xor(dma_vaddr, ALIGN(msg_len, sizeof(u32))); mq->prod_idx++; mq->prod_idx = MQ_ID_MASK(mq, mq->prod_idx); -- 2.20.1