Skip to content

Commit

Permalink
qed: sanitize PBL chains allocation
Browse files Browse the repository at this point in the history 
PBL chain elements are actually DMA addresses stored in __le64, but
currently their size is hardcoded to 8, and DMA addresses are assigned
via cast to variable-sized dma_addr_t without any bitwise conversions.
Change the type of pbl_virt array to match the actual one, add a new
field to store the size of allocated DMA memory and sanitize elements
assignment.

Misc: give more logic names to the members of qed_chain::pbl_sp embedded
struct.

Signed-off-by: Alexander Lobakin <[email protected]>
Signed-off-by: Igor Russkikh <[email protected]>
Signed-off-by: Michal Kalderon <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
  • Loading branch information
@solbjorn @davem330
solbjorn authored and davem330 committed Jul 23, 2020
1 parent 96ca4c5 commit 9b6ee3c
Show file tree
Hide file tree
Showing 3 changed files with 20 additions and 21 deletions.
21 changes: 10 additions & 11 deletions drivers/net/ethernet/qlogic/qed/qed_chain.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ static void qed_chain_free_pbl(struct qed_dev *cdev, struct qed_chain *chain)
{
struct device *dev = &cdev->pdev->dev;
struct addr_tbl_entry *entry;
u32 pbl_size, i;
u32 i;

if (!chain->pbl.pp_addr_tbl)
return;
Expand All @@ -63,11 +63,10 @@ static void qed_chain_free_pbl(struct qed_dev *cdev, struct qed_chain *chain)
entry->dma_map);
}

pbl_size = chain->page_cnt * QED_CHAIN_PBL_ENTRY_SIZE;

if (!chain->b_external_pbl)
dma_free_coherent(dev, pbl_size, chain->pbl_sp.p_virt_table,
chain->pbl_sp.p_phys_table);
dma_free_coherent(dev, chain->pbl_sp.table_size,
chain->pbl_sp.table_virt,
chain->pbl_sp.table_phys);

vfree(chain->pbl.pp_addr_tbl);
chain->pbl.pp_addr_tbl = NULL;
Expand Down Expand Up @@ -190,7 +189,7 @@ static int qed_chain_alloc_pbl(struct qed_dev *cdev, struct qed_chain *chain,
struct device *dev = &cdev->pdev->dev;
struct addr_tbl_entry *addr_tbl;
dma_addr_t phys, pbl_phys;
void *pbl_virt;
__le64 *pbl_virt;
u32 page_cnt, i;
size_t size;
void *virt;
Expand All @@ -214,7 +213,7 @@ static int qed_chain_alloc_pbl(struct qed_dev *cdev, struct qed_chain *chain,

chain->b_external_pbl = true;
} else {
size = array_size(page_cnt, QED_CHAIN_PBL_ENTRY_SIZE);
size = array_size(page_cnt, sizeof(*pbl_virt));
if (unlikely(size == SIZE_MAX))
return -EOVERFLOW;

Expand All @@ -225,8 +224,9 @@ static int qed_chain_alloc_pbl(struct qed_dev *cdev, struct qed_chain *chain,
if (!pbl_virt)
return -ENOMEM;

chain->pbl_sp.p_virt_table = pbl_virt;
chain->pbl_sp.p_phys_table = pbl_phys;
chain->pbl_sp.table_virt = pbl_virt;
chain->pbl_sp.table_phys = pbl_phys;
chain->pbl_sp.table_size = size;

for (i = 0; i < page_cnt; i++) {
virt = dma_alloc_coherent(dev, QED_CHAIN_PAGE_SIZE, &phys,
Expand All @@ -240,8 +240,7 @@ static int qed_chain_alloc_pbl(struct qed_dev *cdev, struct qed_chain *chain,
}

/* Fill the PBL table with the physical address of the page */
*(dma_addr_t *)pbl_virt = phys;
pbl_virt += QED_CHAIN_PBL_ENTRY_SIZE;
pbl_virt[i] = cpu_to_le64(phys);

/* Keep the virtual address of the page */
addr_tbl[i].virt_addr = virt;
Expand Down
4 changes: 2 additions & 2 deletions drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -366,11 +366,11 @@ int qed_sp_pf_start(struct qed_hwfn *p_hwfn,

/* Place EQ address in RAMROD */
DMA_REGPAIR_LE(p_ramrod->event_ring_pbl_addr,
p_hwfn->p_eq->chain.pbl_sp.p_phys_table);
qed_chain_get_pbl_phys(&p_hwfn->p_eq->chain));
page_cnt = (u8)qed_chain_get_page_cnt(&p_hwfn->p_eq->chain);
p_ramrod->event_ring_num_pages = page_cnt;
DMA_REGPAIR_LE(p_ramrod->consolid_q_pbl_addr,
p_hwfn->p_consq->chain.pbl_sp.p_phys_table);
qed_chain_get_pbl_phys(&p_hwfn->p_consq->chain));

qed_tunn_set_pf_start_params(p_hwfn, p_tunn, &p_ramrod->tunnel_config);

Expand Down
16 changes: 8 additions & 8 deletions include/linux/qed/qed_chain.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -127,8 +127,9 @@ struct qed_chain {

/* Base address of a pre-allocated buffer for pbl */
struct {
dma_addr_t p_phys_table;
void *p_virt_table;
__le64 *table_virt;
dma_addr_t table_phys;
size_t table_size;
} pbl_sp;

/* Address of first page of the chain - the address is required
Expand All @@ -146,7 +147,6 @@ struct qed_chain {
bool b_external_pbl;
};

#define QED_CHAIN_PBL_ENTRY_SIZE 8
#define QED_CHAIN_PAGE_SIZE 0x1000

#define ELEMS_PER_PAGE(elem_size) \
Expand Down Expand Up @@ -236,7 +236,7 @@ static inline u32 qed_chain_get_page_cnt(struct qed_chain *p_chain)

static inline dma_addr_t qed_chain_get_pbl_phys(struct qed_chain *p_chain)
{
return p_chain->pbl_sp.p_phys_table;
return p_chain->pbl_sp.table_phys;
}

/**
Expand Down Expand Up @@ -527,8 +527,8 @@ static inline void qed_chain_init_params(struct qed_chain *p_chain,
p_chain->capacity = p_chain->usable_per_page * page_cnt;
p_chain->size = p_chain->elem_per_page * page_cnt;

p_chain->pbl_sp.p_phys_table = 0;
p_chain->pbl_sp.p_virt_table = NULL;
p_chain->pbl_sp.table_phys = 0;
p_chain->pbl_sp.table_virt = NULL;
p_chain->pbl.pp_addr_tbl = NULL;
}

Expand Down Expand Up @@ -569,8 +569,8 @@ static inline void qed_chain_init_pbl_mem(struct qed_chain *p_chain,
dma_addr_t p_phys_pbl,
struct addr_tbl_entry *pp_addr_tbl)
{
p_chain->pbl_sp.p_phys_table = p_phys_pbl;
p_chain->pbl_sp.p_virt_table = p_virt_pbl;
p_chain->pbl_sp.table_phys = p_phys_pbl;
p_chain->pbl_sp.table_virt = p_virt_pbl;
p_chain->pbl.pp_addr_tbl = pp_addr_tbl;
}

Expand Down

0 comments on commit 9b6ee3c

Please sign in to comment.