Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5b1e1a9c authored by Sankar Patchineelam's avatar Sankar Patchineelam Committed by David S. Miller
Browse files

bnxt_en: Fix possible corruption in DCB parameters from firmware. 



hwrm_send_message() is replaced with _hwrm_send_message(), and
hwrm_cmd_lock mutex lock is grabbed for the whole period of
firmware call until the firmware DCB parameters have been copied.
This will prevent possible corruption of the firmware data.

Fixes: 7df4ae9f ("bnxt_en: Implement DCBNL to support host-based DCBX.")
Signed-off-by: default avatarSankar Patchineelam <sankar.patchineelam@broadcom.com>
Signed-off-by: default avatarMichael Chan <michael.chan@broadcom.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent cc72f3b1

drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c

+18 −5
Original line number Original line Diff line number Diff line
@@ -50,7 +50,9 @@ static int bnxt_hwrm_queue_pri2cos_qcfg(struct bnxt *bp, struct ieee_ets *ets) 




	bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_PRI2COS_QCFG, -1, -1);

	bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_PRI2COS_QCFG, -1, -1);

	req.flags = cpu_to_le32(QUEUE_PRI2COS_QCFG_REQ_FLAGS_IVLAN);

	req.flags = cpu_to_le32(QUEUE_PRI2COS_QCFG_REQ_FLAGS_IVLAN);

	rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);



	mutex_lock(&bp->hwrm_cmd_lock);

	rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);

	if (!rc) {

	if (!rc) {

		u8 *pri2cos = &resp->pri0_cos_queue_id;

		u8 *pri2cos = &resp->pri0_cos_queue_id;

		int i, j;

		int i, j;
@@ -66,6 +68,7 @@ static int bnxt_hwrm_queue_pri2cos_qcfg(struct bnxt *bp, struct ieee_ets *ets) 
			}

			}

		}

		}

	}

	}

	mutex_unlock(&bp->hwrm_cmd_lock);

	return rc;

	return rc;

}

}
@@ -119,9 +122,13 @@ static int bnxt_hwrm_queue_cos2bw_qcfg(struct bnxt *bp, struct ieee_ets *ets) 
	int rc, i;

	int rc, i;





	bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_COS2BW_QCFG, -1, -1);

	bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_COS2BW_QCFG, -1, -1);

	rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);



	if (rc)

	mutex_lock(&bp->hwrm_cmd_lock);

	rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);

	if (rc) {

		mutex_unlock(&bp->hwrm_cmd_lock);

		return rc;

		return rc;

	}





	data = &resp->queue_id0 + offsetof(struct bnxt_cos2bw_cfg, queue_id);

	data = &resp->queue_id0 + offsetof(struct bnxt_cos2bw_cfg, queue_id);

	for (i = 0; i < bp->max_tc; i++, data += sizeof(cos2bw) - 4) {

	for (i = 0; i < bp->max_tc; i++, data += sizeof(cos2bw) - 4) {
@@ -143,6 +150,7 @@ static int bnxt_hwrm_queue_cos2bw_qcfg(struct bnxt *bp, struct ieee_ets *ets) 
			}

			}

		}

		}

	}

	}

	mutex_unlock(&bp->hwrm_cmd_lock);

	return 0;

	return 0;

}

}
@@ -240,12 +248,17 @@ static int bnxt_hwrm_queue_pfc_qcfg(struct bnxt *bp, struct ieee_pfc *pfc) 
	int rc;

	int rc;





	bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_PFCENABLE_QCFG, -1, -1);

	bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_PFCENABLE_QCFG, -1, -1);

	rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);



	if (rc)

	mutex_lock(&bp->hwrm_cmd_lock);

	rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);

	if (rc) {

		mutex_unlock(&bp->hwrm_cmd_lock);

		return rc;

		return rc;

	}





	pri_mask = le32_to_cpu(resp->flags);

	pri_mask = le32_to_cpu(resp->flags);

	pfc->pfc_en = pri_mask;

	pfc->pfc_en = pri_mask;

	mutex_unlock(&bp->hwrm_cmd_lock);

	return 0;

	return 0;

}

}