From: Jay Ding <[email protected]>
The background stats cache thread and the show-port-meter-stats
path both issue MPC TABLE_READ commands targeting the same ingress
(RE_CFA) completion ring. The stats cache holds fdb_lock for the
entire batch send+collect window, but the meter stats path called
tfc_act_get() with no lock, creating a race between the two threads.
Fix by acquiring fdb_lock in ulp_fc_tfc_mtr_stat_get before the
MPC call, matching the same serialization pattern used by the stats
cache thread. The flow-stat path (ulp_fc_tfc_flow_stat_get) is
not changed because its callers in ulp_fc_mgr.c already hold the
lock. Also initialize count to zero to fix a pre-existing case
where count.reserved (marked "must be zero" in rte_flow.h) was left
uninitialized; count.reset is already explicitly set on both branches
above and was never the affected field.
Fixes: 3ed6fb5edc8e ("net/bnxt/tf_ulp: add meter stats support for Thor2")
Cc: [email protected]
Signed-off-by: Jay Ding <[email protected]>
Signed-off-by: Manish Kurup <[email protected]>
---
drivers/net/bnxt/tf_ulp/ulp_fc_mgr_tfc.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/drivers/net/bnxt/tf_ulp/ulp_fc_mgr_tfc.c
b/drivers/net/bnxt/tf_ulp/ulp_fc_mgr_tfc.c
index 8e61c71f97..d25e4ac27c 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_fc_mgr_tfc.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_fc_mgr_tfc.c
@@ -160,14 +160,27 @@ ulp_fc_tfc_mtr_stat_get(struct bnxt_ulp_context *ctxt,
int32_t clear,
struct rte_mtr_stats *mtr_count)
{
- struct rte_flow_query_count count;
+ struct rte_flow_query_count count = { 0 };
+ int32_t rc;
if (clear)
count.reset = 1;
else
count.reset = 0;
- return ulp_fc_tfc_stat_get(ctxt, direction, session_type, handle,
&count, mtr_count);
+ /*
+ * Acquire fdb_lock to serialize this non-batch MPC read against the
+ * background stats cache thread, which holds the same lock for the
+ * duration of its batch send+collect window. Without this, both paths
+ * race on the shared RE_CFA/TE_CFA MPC completion ring, leading to
+ * out-of-order completions and firmware ring-state corruption.
+ */
+ if (bnxt_ulp_cntxt_acquire_fdb_lock(ctxt))
+ return -EIO;
+
+ rc = ulp_fc_tfc_stat_get(ctxt, direction, session_type, handle, &count,
mtr_count);
+ bnxt_ulp_cntxt_release_fdb_lock(ctxt);
+ return rc;
}
const struct bnxt_ulp_fc_core_ops ulp_fc_tfc_core_ops = {
--
2.31.1
