From: Joseph Wong <[email protected]>
When parsing max_ring_grps and max_l2_ctx values from firmware, clamp
values if they exceed a 16-bit value. max_hw_ring_grps is received as
32-bit in __bnxt_hwrm_func_qcaps() (the func_qcaps response) but cast
to 16-bit when used; add the clamp there and, as defense-in-depth,
also in bnxt_hwrm_func_resc_qcaps() in case that response's field ever
widens. max_l2_ctx is 16-bit in both responses, but its post-read
addition with max_rx_em_flows can overflow a 16-bit sum; widen the
addition to 32-bit and clamp the result.
Fixes: 2691827e82c0 ("net/bnxt: add HWRM VNIC alloc")
Fixes: 80bf6811fa0f ("net/bnxt: fix L2 context calculation for Thor")
Cc: [email protected]
Signed-off-by: Joseph Wong <[email protected]>
Signed-off-by: Mohammad Shuab Siddique <[email protected]>
---
drivers/net/bnxt/bnxt.h | 3 +++
drivers/net/bnxt/bnxt_hwrm.c | 16 ++++++++++++----
2 files changed, 15 insertions(+), 4 deletions(-)
diff --git a/drivers/net/bnxt/bnxt.h b/drivers/net/bnxt/bnxt.h
index 336de75da0..69455af31f 100644
--- a/drivers/net/bnxt/bnxt.h
+++ b/drivers/net/bnxt/bnxt.h
@@ -863,6 +863,9 @@ struct bnxt {
#define BNXT_P7_MAX_NQ_RING_CNT 512
#define BNXT_P7_CQ_MAX_L2_ENT 8192
+#define BNXT_MAX_RING_GRPS 65535U
+#define BNXT_MAX_L2_CTX 65535U
+
uint32_t flags2;
#define BNXT_FLAGS2_PTP_TIMESYNC_ENABLED BIT(0)
#define BNXT_FLAGS2_PTP_ALARM_SCHEDULED BIT(1)
diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index aa8152eaa0..765aa7c452 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -1125,6 +1125,8 @@ static int __bnxt_hwrm_func_qcaps(struct bnxt *bp)
HWRM_CHECK_RESULT();
bp->max_ring_grps = rte_le_to_cpu_32(resp->max_hw_ring_grps);
+ if (bp->max_ring_grps > BNXT_MAX_RING_GRPS)
+ bp->max_ring_grps = BNXT_MAX_RING_GRPS;
flags = rte_le_to_cpu_32(resp->flags);
flags_ext2 = rte_le_to_cpu_32(resp->flags_ext2);
flags_ext3 = rte_le_to_cpu_32(resp->flags_ext3);
@@ -1155,8 +1157,10 @@ static int __bnxt_hwrm_func_qcaps(struct bnxt *bp)
bp->first_vf_id = rte_le_to_cpu_16(resp->first_vf_id);
bp->max_rx_em_flows = rte_le_to_cpu_16(resp->max_rx_em_flows);
bp->max_l2_ctx = rte_le_to_cpu_16(resp->max_l2_ctxs);
- if (!BNXT_CHIP_P5_P7(bp) && !bp->pdev->max_vfs)
- bp->max_l2_ctx += bp->max_rx_em_flows;
+ if (!BNXT_CHIP_P5_P7(bp) && !bp->pdev->max_vfs) {
+ uint32_t l2_ctx = bp->max_l2_ctx + bp->max_rx_em_flows;
+ bp->max_l2_ctx = (uint16_t)RTE_MIN(l2_ctx,
(uint32_t)BNXT_MAX_L2_CTX);
+ }
if (bp->vnic_cap_flags & BNXT_VNIC_CAP_COS_CLASSIFY)
bp->max_vnics = rte_le_to_cpu_16(BNXT_MAX_VNICS_COS_CLASSIFY);
else
@@ -1556,12 +1560,16 @@ int bnxt_hwrm_func_resc_qcaps(struct bnxt *bp)
bp->max_tx_rings = rte_le_to_cpu_16(resp->max_tx_rings);
bp->max_rx_rings = rte_le_to_cpu_16(resp->max_rx_rings);
bp->max_ring_grps = rte_le_to_cpu_32(resp->max_hw_ring_grps);
+ if (bp->max_ring_grps > BNXT_MAX_RING_GRPS)
+ bp->max_ring_grps = BNXT_MAX_RING_GRPS;
/* func_resource_qcaps does not return max_rx_em_flows.
* So use the value provided by func_qcaps.
*/
bp->max_l2_ctx = rte_le_to_cpu_16(resp->max_l2_ctxs);
- if (!BNXT_CHIP_P5_P7(bp) && !bp->pdev->max_vfs)
- bp->max_l2_ctx += bp->max_rx_em_flows;
+ if (!BNXT_CHIP_P5_P7(bp) && !bp->pdev->max_vfs) {
+ uint32_t l2_ctx = bp->max_l2_ctx + bp->max_rx_em_flows;
+ bp->max_l2_ctx = (uint16_t)RTE_MIN(l2_ctx,
(uint32_t)BNXT_MAX_L2_CTX);
+ }
if (bp->vnic_cap_flags & BNXT_VNIC_CAP_COS_CLASSIFY)
bp->max_vnics = rte_le_to_cpu_16(BNXT_MAX_VNICS_COS_CLASSIFY);
else
--
2.47.3
