Commit a029a2fe authored by Michael Chan's avatar Michael Chan Committed by Jakub Kicinski
Browse files

bnxt_en: Check TQM rings for maximum supported value. 



TQM rings are hardware resources that require host context memory
managed by the driver.  The driver supports up to 9 TQM rings and
the number of rings to use is requested by firmware during run-time.
Cap this number to the maximum supported to prevent accessing beyond
the array.  Future firmware may request more than 9 TQM rings.  Define
macros to remove the magic number 9 from the C code.

Fixes: ac3158cb ("bnxt_en: Allocate TQM ring context memory according to fw specification.")
Reviewed-by: default avatarPavan Chebbi <pavan.chebbi@broadcom.com>
Reviewed-by: default avatarVasundhara Volam <vasundhara-v.volam@broadcom.com>
Signed-off-by: default avatarMichael Chan <michael.chan@broadcom.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent fb1e6e56

drivers/net/ethernet/broadcom/bnxt/bnxt.c

+5 −2
Original line number Diff line number Diff line
@@ -6790,8 +6790,10 @@ static int bnxt_hwrm_func_backing_store_qcaps(struct bnxt *bp) 
		ctx->tqm_fp_rings_count = resp->tqm_fp_rings_count;

		if (!ctx->tqm_fp_rings_count)

			ctx->tqm_fp_rings_count = bp->max_q;

		else if (ctx->tqm_fp_rings_count > BNXT_MAX_TQM_FP_RINGS)

			ctx->tqm_fp_rings_count = BNXT_MAX_TQM_FP_RINGS;



		tqm_rings = ctx->tqm_fp_rings_count + 1;

		tqm_rings = ctx->tqm_fp_rings_count + BNXT_MAX_TQM_SP_RINGS;

		ctx_pg = kcalloc(tqm_rings, sizeof(*ctx_pg), GFP_KERNEL);

		if (!ctx_pg) {

			kfree(ctx);
@@ -6925,7 +6927,8 @@ static int bnxt_hwrm_func_backing_store_cfg(struct bnxt *bp, u32 enables) 
	     pg_attr = &req.tqm_sp_pg_size_tqm_sp_lvl,

	     pg_dir = &req.tqm_sp_page_dir,

	     ena = FUNC_BACKING_STORE_CFG_REQ_ENABLES_TQM_SP;

	     i < 9; i++, num_entries++, pg_attr++, pg_dir++, ena <<= 1) {

	     i < BNXT_MAX_TQM_RINGS;

	     i++, num_entries++, pg_attr++, pg_dir++, ena <<= 1) {

		if (!(enables & ena))

			continue;

drivers/net/ethernet/broadcom/bnxt/bnxt.h

+6 −1
Original line number Diff line number Diff line
@@ -1436,6 +1436,11 @@ struct bnxt_ctx_pg_info { 
	struct bnxt_ctx_pg_info **ctx_pg_tbl;

};



#define BNXT_MAX_TQM_SP_RINGS		1

#define BNXT_MAX_TQM_FP_RINGS		8

#define BNXT_MAX_TQM_RINGS		\

	(BNXT_MAX_TQM_SP_RINGS + BNXT_MAX_TQM_FP_RINGS)



struct bnxt_ctx_mem_info {

	u32	qp_max_entries;

	u16	qp_min_qp1_entries;
@@ -1474,7 +1479,7 @@ struct bnxt_ctx_mem_info { 
	struct bnxt_ctx_pg_info stat_mem;

	struct bnxt_ctx_pg_info mrav_mem;

	struct bnxt_ctx_pg_info tim_mem;

	struct bnxt_ctx_pg_info *tqm_mem[9];

	struct bnxt_ctx_pg_info *tqm_mem[BNXT_MAX_TQM_RINGS];

};



struct bnxt_fw_health {