[PATCH V2 net 0/2] hibmcge: fix RX packet corruption issue

[PATCH V2 net 0/2] hibmcge: fix RX packet corruption issue

[Jijie Shao]

This series fixes an RX packet corruption issue observed when SMMU is
disabled on the hibmcge driver. The fixes include disabling PCI Relaxed
Ordering and correcting the order of DMA barrier operations in the RX
data sync path.

---
ChangeLog:
v1 -> v2:
  - Split original single patch into two independent patches,
    suggested Jakub
  - Remove MODULE_VERSION change, pointed out by Jakub
  v1: https://lore.kernel.org/all/20260512123456.3786635-1-shaojijie@huawei.com/
---

Jijie Shao (2):
  net: hibmcge: disable Relaxed Ordering to fix RX packet corruption
  net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX
    path

 drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c | 2 ++
 drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c | 6 +++---
 2 files changed, 5 insertions(+), 3 deletions(-)

--
2.33.0

[PATCH V2 net 1/2] net: hibmcge: disable Relaxed Ordering to fix RX packet corruption

[Jijie Shao]

When SMMU is disabled, the hibmcge driver may receive corrupted packets.
The hardware writes packet data and descriptors to the same page, but
with Relaxed Ordering enabled, PCI write transactions may not be
strictly ordered. This can cause the driver to observe a valid
descriptor before the corresponding packet data is fully written.

Fix this by clearing PCI_EXP_DEVCTL_RELAX_EN in the PCI bridge control
register to ensure strict write ordering between packet data and
descriptors.

Fixes: f72e25594061 ("net: hibmcge: Implement rx_poll function to receive packets")
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
---
 drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c b/drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c
index 068da2fd1fea..319551caf047 100644
--- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c
+++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c
@@ -420,6 +420,8 @@ static int hbg_pci_init(struct pci_dev *pdev)
 		return -ENOMEM;
 
 	pci_set_master(pdev);
+	pcie_capability_clear_word(pdev, PCI_EXP_DEVCTL,
+				   PCI_EXP_DEVCTL_RELAX_EN);
 	return 0;
 }
 
-- 
2.33.0

[PATCH V2 net 2/2] net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path

[Jijie Shao]

The dma_rmb() barrier was placed before dma_sync_single_for_cpu(), which
is incorrect. DMA sync must complete first to make the buffer accessible
to the CPU, then the rmb barrier ensures subsequent descriptor reads
observe the latest data written by the hardware.

Reorder the operations so dma_sync_single_for_cpu() is called before
dma_rmb() to guarantee the driver reads consistent data from the DMA
buffer.

Fixes: f72e25594061 ("net: hibmcge: Implement rx_poll function to receive packets")
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
---
 drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c b/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c
index a4ea92c31c2f..0ae314994676 100644
--- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c
+++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_txrx.c
@@ -452,12 +452,12 @@ static bool hbg_sync_data_from_hw(struct hbg_priv *priv,
 {
 	struct hbg_rx_desc *rx_desc;
 
-	/* make sure HW write desc complete */
-	dma_rmb();
-
 	dma_sync_single_for_cpu(&priv->pdev->dev, buffer->page_dma,
 				buffer->page_size, DMA_FROM_DEVICE);
 
+	/* make sure HW write desc complete */
+	dma_rmb();
+
 	rx_desc = (struct hbg_rx_desc *)buffer->page_addr;
 	return FIELD_GET(HBG_RX_DESC_W2_PKT_LEN_M, rx_desc->word2) != 0;
 }
-- 
2.33.0

Re: [PATCH V2 net 1/2] net: hibmcge: disable Relaxed Ordering to fix RX packet corruption

[Paolo Abeni]

On 5/18/26 4:42 PM, Jijie Shao wrote:
> When SMMU is disabled, the hibmcge driver may receive corrupted packets.
> The hardware writes packet data and descriptors to the same page, but
> with Relaxed Ordering enabled, PCI write transactions may not be
> strictly ordered. This can cause the driver to observe a valid
> descriptor before the corresponding packet data is fully written.
> 
> Fix this by clearing PCI_EXP_DEVCTL_RELAX_EN in the PCI bridge control
> register to ensure strict write ordering between packet data and
> descriptors.
> 
> Fixes: f72e25594061 ("net: hibmcge: Implement rx_poll function to receive packets")
> Signed-off-by: Jijie Shao <shaojijie@huawei.com>
> ---
>  drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c b/drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c
> index 068da2fd1fea..319551caf047 100644
> --- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c
> +++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c
> @@ -420,6 +420,8 @@ static int hbg_pci_init(struct pci_dev *pdev)
>  		return -ENOMEM;
>  
>  	pci_set_master(pdev);
> +	pcie_capability_clear_word(pdev, PCI_EXP_DEVCTL,
> +				   PCI_EXP_DEVCTL_RELAX_EN);

Sashiko noted this will not survive a device reset - that performs
pci_restore_state - and you should likelly call pci_save_state(pdev)
afterwards.

/P

Re: [PATCH V2 net 1/2] net: hibmcge: disable Relaxed Ordering to fix RX packet corruption

[Jijie Shao]

on 2026/5/21 21:54, Paolo Abeni wrote:
> On 5/18/26 4:42 PM, Jijie Shao wrote:
>> When SMMU is disabled, the hibmcge driver may receive corrupted packets.
>> The hardware writes packet data and descriptors to the same page, but
>> with Relaxed Ordering enabled, PCI write transactions may not be
>> strictly ordered. This can cause the driver to observe a valid
>> descriptor before the corresponding packet data is fully written.
>>
>> Fix this by clearing PCI_EXP_DEVCTL_RELAX_EN in the PCI bridge control
>> register to ensure strict write ordering between packet data and
>> descriptors.
>>
>> Fixes: f72e25594061 ("net: hibmcge: Implement rx_poll function to receive packets")
>> Signed-off-by: Jijie Shao <shaojijie@huawei.com>
>> ---
>>   drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c | 2 ++
>>   1 file changed, 2 insertions(+)
>>
>> diff --git a/drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c b/drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c
>> index 068da2fd1fea..319551caf047 100644
>> --- a/drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c
>> +++ b/drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c
>> @@ -420,6 +420,8 @@ static int hbg_pci_init(struct pci_dev *pdev)
>>   		return -ENOMEM;
>>   
>>   	pci_set_master(pdev);
>> +	pcie_capability_clear_word(pdev, PCI_EXP_DEVCTL,
>> +				   PCI_EXP_DEVCTL_RELAX_EN);
> Sashiko noted this will not survive a device reset - that performs
> pci_restore_state - and you should likelly call pci_save_state(pdev)
> afterwards.

Yes, thank you. I will fix it in v3.
Jijie Shao