Re: 回复：[v4,net-next,11/11] net/nebula-matrix: add common dev start/stop operation

[Andrew Lunn]

On Tue, Feb 10, 2026 at 10:07:01AM +0800, Illusion Wang wrote:
> Thank you for your feedback
> But
> enum nbl_msix_serv_type {
> 	/* virtio_dev has a config vector_id, and the vector_id need is 0 */
> 	NBL_MSIX_VIRTIO_TYPE = 0,
> 	NBL_MSIX_NET_TYPE,
> 	NBL_MSIX_MAILBOX_TYPE,
> 	NBL_MSIX_TYPE_MAX
> };
> NBL_MSIX_NET_TYPE equals 1，so this function has no problem？

Please don't top post.

> --illusion.wang
> 
> > +static int nbl_dev_configure_msix_map(struct nbl_dev_mgt *dev_mgt)
> > +{
> > + struct nbl_dispatch_ops *disp_ops = dev_mgt->disp_ops_tbl->ops;
> > + struct nbl_dev_common *dev_common = dev_mgt->common_dev;
> > + struct nbl_msix_info *msix_info = &dev_common->msix_info;
> > + bool mask_en = msix_info->serv_info[NBL_MSIX_NET_TYPE].hw_self_mask_en;
> > + u16 msix_net_num = msix_info->serv_info[NBL_MSIX_NET_TYPE].num;
> > + u16 msix_not_net_num = 0;
> > + int err, i;
> > +
> > + for (i = NBL_MSIX_NET_TYPE; i < NBL_MSIX_TYPE_MAX; i++)
> > +  msix_info->serv_info[i].base_vector_id =
> > +   msix_info->serv_info[i - 1].base_vector_id +
> > +   msix_info->serv_info[i - 1].num;
>              ^^^^^^
> 
> Does this loop cause an array underflow? NBL_MSIX_NET_TYPE equals 0 (from
> the enum in nbl_dev.h), so on the first iteration i=0 and the code accesses
> serv_info[-1].

> The serv_info array is declared with NBL_MSIX_TYPE_MAX (2) elements in
> struct nbl_msix_info, giving valid indices [0,1]. Accessing index -1 reads
> uninitialized memory before the array start.

It is interesting it has the enum wrong. Given what you show,
NBL_MSIX_NET_TYPE is 1, NBL_MSIX_TYPE_MAX 3. But it seems to be
missing NBL_MSIX_VIRTIO_TYPE.

The tool does go backwards and forwards with the different
patches. Does nbl_msix_serv_type always have the values you show, or
does it start with less members and more are added in later patches?
That might of confused it, or you as you broke the driver up any less
big parts.

However, this code does look error prone. What would happen if a new
value was added between _VIRTIO_TYPE an _NET_TYPE?

Safer would be:

	 for (i = NBL_MSIX_NET_TYPE; i < NBL_MSIX_TYPE_MAX; i++)
		msix_info->serv_info[i].base_vector_id =
		msix_info->serv_info[i - NBL_MSIX_NET_TYPE].base_vector_id +
		msix_info->serv_info[i - NBL_MSIX_NET_TYPE].num;

But i also wounder why your design needs to do this shuffling? It
seems like a bad design.

	Andrew