From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by dpdk.org (Postfix) with ESMTP id 51B7B1B108 for ; Wed, 21 Nov 2018 17:06:04 +0100 (CET) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id B1A733082E70; Wed, 21 Nov 2018 16:06:03 +0000 (UTC) Received: from ktraynor.remote.csb (unknown [10.36.118.7]) by smtp.corp.redhat.com (Postfix) with ESMTP id 6414360A9C; Wed, 21 Nov 2018 16:06:01 +0000 (UTC) From: Kevin Traynor To: Gautam Dawar Cc: Andrew Rybchenko , dpdk stable Date: Wed, 21 Nov 2018 16:04:02 +0000 Message-Id: <20181121160440.9014-12-ktraynor@redhat.com> In-Reply-To: <20181121160440.9014-1-ktraynor@redhat.com> References: <20181121160440.9014-1-ktraynor@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.46]); Wed, 21 Nov 2018 16:06:03 +0000 (UTC) Subject: [dpdk-stable] patch 'net/sfc/base: fix out of bounds read when dereferencing sdup' has been queued to stable release 18.08.1 X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Nov 2018 16:06:05 -0000 Hi, FYI, your patch has been queued to stable release 18.08.1 Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet. It will be pushed if I get no objections before 11/26/18. So please shout if anyone has objections. Also note that after the patch there's a diff of the upstream commit vs the patch applied to the branch. If the code is different (ie: not only metadata diffs), due for example to a change in context or macro names, please double check it. Thanks. Kevin Traynor --- >>From 6c703736316d161efea833e2be9400f392d08acd Mon Sep 17 00:00:00 2001 From: Gautam Dawar Date: Mon, 10 Sep 2018 10:33:22 +0100 Subject: [PATCH] net/sfc/base: fix out of bounds read when dereferencing sdup [ upstream commit ed42d18458cbdceb28f006fda9967141a7e79b92 ] Introduce and use macro to make sure that MCDI buffers allocated on stack are rounded up properly. Fixes: 6f619653b9b1 ("net/sfc/base: import MCDI implementation") Fixes: f7dc06bf35f2 ("net/sfc/base: import 5xxx/6xxx family support") Fixes: e7cd430c864f ("net/sfc/base: import SFN7xxx family support") Fixes: 1dae25112a54 ("net/sfc/base: import built-in selftest") Fixes: 0a7864349106 ("net/sfc/base: import PHY statistics") Fixes: 8c7c723dfe7c ("net/sfc/base: import MAC statistics") Fixes: 5935cd8c47d3 ("net/sfc/base: import RSS support") Fixes: 9ee64bd404fc ("net/sfc/base: import loopback control") Fixes: dfb3b1ce15f6 ("net/sfc/base: import monitors access via MCDI") Fixes: d96a34d165b1 ("net/sfc/base: import NVRAM support") Fixes: 05fce2ce8451 ("net/sfc/base: import libefx licensing") Fixes: ba6afee9a81e ("net/sfc/base: add advanced function to extract FW version") Fixes: c7815c1d1f20 ("net/sfc/base: use proper MCDI command for encap filters") Fixes: 17551f6dffcc ("net/sfc/base: add API to control UDP tunnel ports") Fixes: eff9b666eae5 ("net/sfc/base: move RxDP config get to EF10 NIC code") Fixes: 4aab7f07a645 ("net/sfc/base: refactor EF10 get datapath capabilities") Fixes: 480a13044b8b ("net/sfc/base: support FW subvariant choice") Fixes: 6f60cc4a78b6 ("net/sfc/base: support equal stride super-buffer Rx mode") Fixes: 9a733758c046 ("net/sfc/base: support MARK and FLAG actions in filters") Signed-off-by: Gautam Dawar Signed-off-by: Andrew Rybchenko --- drivers/net/sfc/base/ef10_ev.c | 28 ++++----- drivers/net/sfc/base/ef10_filter.c | 15 ++--- drivers/net/sfc/base/ef10_intr.c | 5 +- drivers/net/sfc/base/ef10_mac.c | 20 +++---- drivers/net/sfc/base/ef10_nic.c | 93 ++++++++++++------------------ drivers/net/sfc/base/ef10_phy.c | 19 +++--- drivers/net/sfc/base/ef10_rx.c | 35 +++++------ drivers/net/sfc/base/ef10_tx.c | 10 ++-- drivers/net/sfc/base/efx_lic.c | 39 +++++-------- drivers/net/sfc/base/efx_mcdi.c | 82 +++++++++++--------------- drivers/net/sfc/base/efx_mcdi.h | 11 ++++ drivers/net/sfc/base/efx_nic.c | 5 +- drivers/net/sfc/base/efx_nvram.c | 40 +++++-------- drivers/net/sfc/base/efx_tunnel.c | 6 +- drivers/net/sfc/base/mcdi_mon.c | 12 ++-- drivers/net/sfc/base/siena_mac.c | 9 ++- drivers/net/sfc/base/siena_nic.c | 5 +- drivers/net/sfc/base/siena_nvram.c | 5 +- drivers/net/sfc/base/siena_phy.c | 28 ++++----- 19 files changed, 197 insertions(+), 270 deletions(-) diff --git a/drivers/net/sfc/base/ef10_ev.c b/drivers/net/sfc/base/ef10_ev.c index 7f89a7bf0..287550605 100644 --- a/drivers/net/sfc/base/ef10_ev.c +++ b/drivers/net/sfc/base/ef10_ev.c @@ -74,9 +74,8 @@ efx_mcdi_set_evq_tmr( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_SET_EVQ_TMR_IN_LEN, - MC_CMD_SET_EVQ_TMR_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_SET_EVQ_TMR_IN_LEN, + MC_CMD_SET_EVQ_TMR_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_SET_EVQ_TMR; req.emr_in_buf = payload; @@ -124,7 +123,7 @@ efx_mcdi_init_evq( { efx_mcdi_req_t req; - uint8_t payload[ - MAX(MC_CMD_INIT_EVQ_IN_LEN(EFX_EVQ_NBUFS(EFX_EVQ_MAXNEVS)), - MC_CMD_INIT_EVQ_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, + MC_CMD_INIT_EVQ_IN_LEN(EFX_EVQ_NBUFS(EFX_EVQ_MAXNEVS)), + MC_CMD_INIT_EVQ_OUT_LEN); efx_qword_t *dma_addr; uint64_t addr; @@ -141,5 +140,4 @@ efx_mcdi_init_evq( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_INIT_EVQ; req.emr_in_buf = payload; @@ -261,7 +259,7 @@ efx_mcdi_init_evq_v2( { efx_mcdi_req_t req; - uint8_t payload[ - MAX(MC_CMD_INIT_EVQ_V2_IN_LEN(EFX_EVQ_NBUFS(EFX_EVQ_MAXNEVS)), - MC_CMD_INIT_EVQ_V2_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, + MC_CMD_INIT_EVQ_V2_IN_LEN(EFX_EVQ_NBUFS(EFX_EVQ_MAXNEVS)), + MC_CMD_INIT_EVQ_V2_OUT_LEN); boolean_t interrupting; unsigned int evq_type; @@ -278,5 +276,4 @@ efx_mcdi_init_evq_v2( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_INIT_EVQ; req.emr_in_buf = payload; @@ -385,9 +382,8 @@ efx_mcdi_fini_evq( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_FINI_EVQ_IN_LEN, - MC_CMD_FINI_EVQ_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_FINI_EVQ_IN_LEN, + MC_CMD_FINI_EVQ_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_FINI_EVQ; req.emr_in_buf = payload; @@ -604,6 +600,6 @@ efx_mcdi_driver_event( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_DRIVER_EVENT_IN_LEN, - MC_CMD_DRIVER_EVENT_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_DRIVER_EVENT_IN_LEN, + MC_CMD_DRIVER_EVENT_OUT_LEN); efx_rc_t rc; diff --git a/drivers/net/sfc/base/ef10_filter.c b/drivers/net/sfc/base/ef10_filter.c index a4d97f99c..30a4892df 100644 --- a/drivers/net/sfc/base/ef10_filter.c +++ b/drivers/net/sfc/base/ef10_filter.c @@ -173,10 +173,9 @@ efx_mcdi_filter_op_add( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_FILTER_OP_V3_IN_LEN, - MC_CMD_FILTER_OP_EXT_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_FILTER_OP_V3_IN_LEN, + MC_CMD_FILTER_OP_EXT_OUT_LEN); efx_filter_match_flags_t match_flags; efx_rc_t rc; - memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_FILTER_OP; req.emr_in_buf = payload; @@ -377,9 +376,8 @@ efx_mcdi_filter_op_delete( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_FILTER_OP_EXT_IN_LEN, - MC_CMD_FILTER_OP_EXT_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_FILTER_OP_EXT_IN_LEN, + MC_CMD_FILTER_OP_EXT_OUT_LEN); efx_rc_t rc; - memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_FILTER_OP; req.emr_in_buf = payload; @@ -951,11 +949,10 @@ efx_mcdi_get_parser_disp_info( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_PARSER_DISP_INFO_IN_LEN, - MC_CMD_GET_PARSER_DISP_INFO_OUT_LENMAX)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_PARSER_DISP_INFO_IN_LEN, + MC_CMD_GET_PARSER_DISP_INFO_OUT_LENMAX); size_t matches_count; size_t list_size; efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_PARSER_DISP_INFO; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/ef10_intr.c b/drivers/net/sfc/base/ef10_intr.c index 1ffe266b1..efa157125 100644 --- a/drivers/net/sfc/base/ef10_intr.c +++ b/drivers/net/sfc/base/ef10_intr.c @@ -52,6 +52,6 @@ efx_mcdi_trigger_interrupt( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_TRIGGER_INTERRUPT_IN_LEN, - MC_CMD_TRIGGER_INTERRUPT_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_TRIGGER_INTERRUPT_IN_LEN, + MC_CMD_TRIGGER_INTERRUPT_OUT_LEN); efx_rc_t rc; @@ -65,5 +65,4 @@ efx_mcdi_trigger_interrupt( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_TRIGGER_INTERRUPT; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/ef10_mac.c b/drivers/net/sfc/base/ef10_mac.c index c14010732..a4a6d9ec8 100644 --- a/drivers/net/sfc/base/ef10_mac.c +++ b/drivers/net/sfc/base/ef10_mac.c @@ -76,9 +76,8 @@ efx_mcdi_vadapter_set_mac( efx_port_t *epp = &(enp->en_port); efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_VADAPTOR_SET_MAC_IN_LEN, - MC_CMD_VADAPTOR_SET_MAC_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_VADAPTOR_SET_MAC_IN_LEN, + MC_CMD_VADAPTOR_SET_MAC_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_VADAPTOR_SET_MAC; req.emr_in_buf = payload; @@ -142,9 +141,8 @@ efx_mcdi_mtu_set( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_SET_MAC_EXT_IN_LEN, - MC_CMD_SET_MAC_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_SET_MAC_EXT_IN_LEN, + MC_CMD_SET_MAC_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_SET_MAC; req.emr_in_buf = payload; @@ -179,9 +177,8 @@ efx_mcdi_mtu_get( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_SET_MAC_EXT_IN_LEN, - MC_CMD_SET_MAC_V2_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_SET_MAC_EXT_IN_LEN, + MC_CMD_SET_MAC_V2_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_SET_MAC; req.emr_in_buf = payload; @@ -275,9 +272,8 @@ ef10_mac_reconfigure( efx_port_t *epp = &(enp->en_port); efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_SET_MAC_IN_LEN, - MC_CMD_SET_MAC_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_SET_MAC_IN_LEN, + MC_CMD_SET_MAC_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_SET_MAC; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/ef10_nic.c b/drivers/net/sfc/base/ef10_nic.c index d1985b3c5..0dd00e192 100644 --- a/drivers/net/sfc/base/ef10_nic.c +++ b/drivers/net/sfc/base/ef10_nic.c @@ -21,6 +21,6 @@ efx_mcdi_get_port_assignment( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_PORT_ASSIGNMENT_IN_LEN, - MC_CMD_GET_PORT_ASSIGNMENT_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_PORT_ASSIGNMENT_IN_LEN, + MC_CMD_GET_PORT_ASSIGNMENT_OUT_LEN); efx_rc_t rc; @@ -29,5 +29,4 @@ efx_mcdi_get_port_assignment( enp->en_family == EFX_FAMILY_MEDFORD2); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_PORT_ASSIGNMENT; req.emr_in_buf = payload; @@ -67,6 +66,6 @@ efx_mcdi_get_port_modes( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_PORT_MODES_IN_LEN, - MC_CMD_GET_PORT_MODES_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_PORT_MODES_IN_LEN, + MC_CMD_GET_PORT_MODES_OUT_LEN); efx_rc_t rc; @@ -75,5 +74,4 @@ efx_mcdi_get_port_modes( enp->en_family == EFX_FAMILY_MEDFORD2); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_PORT_MODES; req.emr_in_buf = payload; @@ -175,11 +173,10 @@ efx_mcdi_vadaptor_alloc( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_VADAPTOR_ALLOC_IN_LEN, - MC_CMD_VADAPTOR_ALLOC_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_VADAPTOR_ALLOC_IN_LEN, + MC_CMD_VADAPTOR_ALLOC_OUT_LEN); efx_rc_t rc; EFSYS_ASSERT3U(enp->en_vport_id, ==, EVB_PORT_ID_NULL); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_VADAPTOR_ALLOC; req.emr_in_buf = payload; @@ -214,9 +211,8 @@ efx_mcdi_vadaptor_free( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_VADAPTOR_FREE_IN_LEN, - MC_CMD_VADAPTOR_FREE_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_VADAPTOR_FREE_IN_LEN, + MC_CMD_VADAPTOR_FREE_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_VADAPTOR_FREE; req.emr_in_buf = payload; @@ -248,6 +244,6 @@ efx_mcdi_get_mac_address_pf( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_MAC_ADDRESSES_IN_LEN, - MC_CMD_GET_MAC_ADDRESSES_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_MAC_ADDRESSES_IN_LEN, + MC_CMD_GET_MAC_ADDRESSES_OUT_LEN); efx_rc_t rc; @@ -256,5 +252,4 @@ efx_mcdi_get_mac_address_pf( enp->en_family == EFX_FAMILY_MEDFORD2); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_MAC_ADDRESSES; req.emr_in_buf = payload; @@ -307,6 +302,6 @@ efx_mcdi_get_mac_address_vf( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_VPORT_GET_MAC_ADDRESSES_IN_LEN, - MC_CMD_VPORT_GET_MAC_ADDRESSES_OUT_LENMAX)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_VPORT_GET_MAC_ADDRESSES_IN_LEN, + MC_CMD_VPORT_GET_MAC_ADDRESSES_OUT_LENMAX); efx_rc_t rc; @@ -315,5 +310,4 @@ efx_mcdi_get_mac_address_vf( enp->en_family == EFX_FAMILY_MEDFORD2); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_VPORT_GET_MAC_ADDRESSES; req.emr_in_buf = payload; @@ -372,6 +366,6 @@ efx_mcdi_get_clock( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_CLOCK_IN_LEN, - MC_CMD_GET_CLOCK_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_CLOCK_IN_LEN, + MC_CMD_GET_CLOCK_OUT_LEN); efx_rc_t rc; @@ -380,5 +374,4 @@ efx_mcdi_get_clock( enp->en_family == EFX_FAMILY_MEDFORD2); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_CLOCK; req.emr_in_buf = payload; @@ -430,10 +423,9 @@ efx_mcdi_get_rxdp_config( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_RXDP_CONFIG_IN_LEN, - MC_CMD_GET_RXDP_CONFIG_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_RXDP_CONFIG_IN_LEN, + MC_CMD_GET_RXDP_CONFIG_OUT_LEN); uint32_t end_padding; efx_rc_t rc; - memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_RXDP_CONFIG; req.emr_in_buf = payload; @@ -490,9 +482,8 @@ efx_mcdi_get_vector_cfg( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_VECTOR_CFG_IN_LEN, - MC_CMD_GET_VECTOR_CFG_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_VECTOR_CFG_IN_LEN, + MC_CMD_GET_VECTOR_CFG_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_VECTOR_CFG; req.emr_in_buf = payload; @@ -540,6 +531,6 @@ efx_mcdi_alloc_vis( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_ALLOC_VIS_IN_LEN, - MC_CMD_ALLOC_VIS_EXT_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_ALLOC_VIS_IN_LEN, + MC_CMD_ALLOC_VIS_EXT_OUT_LEN); efx_rc_t rc; @@ -549,5 +540,4 @@ efx_mcdi_alloc_vis( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_ALLOC_VIS; req.emr_in_buf = payload; @@ -632,6 +622,6 @@ efx_mcdi_alloc_piobuf( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_ALLOC_PIOBUF_IN_LEN, - MC_CMD_ALLOC_PIOBUF_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_ALLOC_PIOBUF_IN_LEN, + MC_CMD_ALLOC_PIOBUF_OUT_LEN); efx_rc_t rc; @@ -641,5 +631,4 @@ efx_mcdi_alloc_piobuf( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_ALLOC_PIOBUF; req.emr_in_buf = payload; @@ -680,9 +669,8 @@ efx_mcdi_free_piobuf( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_FREE_PIOBUF_IN_LEN, - MC_CMD_FREE_PIOBUF_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_FREE_PIOBUF_IN_LEN, + MC_CMD_FREE_PIOBUF_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_FREE_PIOBUF; req.emr_in_buf = payload; @@ -715,9 +703,8 @@ efx_mcdi_link_piobuf( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_LINK_PIOBUF_IN_LEN, - MC_CMD_LINK_PIOBUF_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_LINK_PIOBUF_IN_LEN, + MC_CMD_LINK_PIOBUF_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_LINK_PIOBUF; req.emr_in_buf = payload; @@ -750,9 +737,8 @@ efx_mcdi_unlink_piobuf( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_UNLINK_PIOBUF_IN_LEN, - MC_CMD_UNLINK_PIOBUF_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_UNLINK_PIOBUF_IN_LEN, + MC_CMD_UNLINK_PIOBUF_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_UNLINK_PIOBUF; req.emr_in_buf = payload; @@ -952,9 +938,8 @@ ef10_mcdi_get_pf_count( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_PF_COUNT_IN_LEN, - MC_CMD_GET_PF_COUNT_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_PF_COUNT_IN_LEN, + MC_CMD_GET_PF_COUNT_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_PF_COUNT; req.emr_in_buf = payload; @@ -996,6 +981,6 @@ ef10_get_datapath_caps( efx_nic_cfg_t *encp = &(enp->en_nic_cfg); efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_CAPABILITIES_IN_LEN, - MC_CMD_GET_CAPABILITIES_V5_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_CAPABILITIES_IN_LEN, + MC_CMD_GET_CAPABILITIES_V5_OUT_LEN); efx_rc_t rc; @@ -1004,5 +989,4 @@ ef10_get_datapath_caps( - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_CAPABILITIES; req.emr_in_buf = payload; @@ -2040,6 +2024,6 @@ ef10_nic_reset( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_ENTITY_RESET_IN_LEN, - MC_CMD_ENTITY_RESET_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_ENTITY_RESET_IN_LEN, + MC_CMD_ENTITY_RESET_OUT_LEN); efx_rc_t rc; @@ -2050,5 +2034,4 @@ ef10_nic_reset( goto fail2; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_ENTITY_RESET; req.emr_in_buf = payload; @@ -2387,9 +2370,8 @@ efx_mcdi_get_nic_global( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_NIC_GLOBAL_IN_LEN, - MC_CMD_GET_NIC_GLOBAL_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_NIC_GLOBAL_IN_LEN, + MC_CMD_GET_NIC_GLOBAL_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_NIC_GLOBAL; req.emr_in_buf = payload; @@ -2431,8 +2413,7 @@ efx_mcdi_set_nic_global( { efx_mcdi_req_t req; - uint8_t payload[MC_CMD_SET_NIC_GLOBAL_IN_LEN]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_SET_NIC_GLOBAL_IN_LEN, 0); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_SET_NIC_GLOBAL; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/ef10_phy.c b/drivers/net/sfc/base/ef10_phy.c index e9c7b40e4..a1f59ff1c 100644 --- a/drivers/net/sfc/base/ef10_phy.c +++ b/drivers/net/sfc/base/ef10_phy.c @@ -243,9 +243,8 @@ ef10_phy_get_link( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_LINK_IN_LEN, - MC_CMD_GET_LINK_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_LINK_IN_LEN, + MC_CMD_GET_LINK_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_LINK; req.emr_in_buf = payload; @@ -302,6 +301,6 @@ ef10_phy_reconfigure( efx_port_t *epp = &(enp->en_port); efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_SET_LINK_IN_LEN, - MC_CMD_SET_LINK_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_SET_LINK_IN_LEN, + MC_CMD_SET_LINK_OUT_LEN); uint32_t cap_mask; #if EFSYS_OPT_PHY_LED_CONTROL @@ -317,5 +316,4 @@ ef10_phy_reconfigure( goto out; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_SET_LINK; req.emr_in_buf = payload; @@ -465,10 +463,9 @@ ef10_phy_verify( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_PHY_STATE_IN_LEN, - MC_CMD_GET_PHY_STATE_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_PHY_STATE_IN_LEN, + MC_CMD_GET_PHY_STATE_OUT_LEN); uint32_t state; efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_PHY_STATE; req.emr_in_buf = payload; @@ -588,5 +585,6 @@ ef10_bist_poll( * whilst not wasting stack. */ - uint8_t payload[MAX(MC_CMD_POLL_BIST_IN_LEN, MCDI_CTL_SDU_LEN_MAX_V1)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_POLL_BIST_IN_LEN, + MCDI_CTL_SDU_LEN_MAX_V1); efx_nic_cfg_t *encp = &(enp->en_nic_cfg); efx_mcdi_req_t req; @@ -606,5 +604,4 @@ ef10_bist_poll( _NOTE(ARGUNUSED(type)) - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_POLL_BIST; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/ef10_rx.c b/drivers/net/sfc/base/ef10_rx.c index 313a36918..17678b517 100644 --- a/drivers/net/sfc/base/ef10_rx.c +++ b/drivers/net/sfc/base/ef10_rx.c @@ -30,6 +30,6 @@ efx_mcdi_init_rxq( efx_nic_cfg_t *encp = &(enp->en_nic_cfg); efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_INIT_RXQ_V3_IN_LEN, - MC_CMD_INIT_RXQ_V3_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_INIT_RXQ_V3_IN_LEN, + MC_CMD_INIT_RXQ_V3_OUT_LEN); int npages = EFX_RXQ_NBUFS(ndescs); int i; @@ -74,5 +74,4 @@ efx_mcdi_init_rxq( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_INIT_RXQ; req.emr_in_buf = payload; @@ -147,9 +146,8 @@ efx_mcdi_fini_rxq( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_FINI_RXQ_IN_LEN, - MC_CMD_FINI_RXQ_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_FINI_RXQ_IN_LEN, + MC_CMD_FINI_RXQ_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_FINI_RXQ; req.emr_in_buf = payload; @@ -189,6 +187,6 @@ efx_mcdi_rss_context_alloc( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_RSS_CONTEXT_ALLOC_IN_LEN, - MC_CMD_RSS_CONTEXT_ALLOC_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_RSS_CONTEXT_ALLOC_IN_LEN, + MC_CMD_RSS_CONTEXT_ALLOC_OUT_LEN); uint32_t rss_context; uint32_t context_type; @@ -212,5 +210,4 @@ efx_mcdi_rss_context_alloc( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_RSS_CONTEXT_ALLOC; req.emr_in_buf = payload; @@ -275,6 +272,6 @@ efx_mcdi_rss_context_free( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_RSS_CONTEXT_FREE_IN_LEN, - MC_CMD_RSS_CONTEXT_FREE_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_RSS_CONTEXT_FREE_IN_LEN, + MC_CMD_RSS_CONTEXT_FREE_OUT_LEN); efx_rc_t rc; @@ -284,5 +281,4 @@ efx_mcdi_rss_context_free( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_RSS_CONTEXT_FREE; req.emr_in_buf = payload; @@ -325,6 +321,6 @@ efx_mcdi_rss_context_set_flags( efx_rx_hash_type_t modes; efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_RSS_CONTEXT_SET_FLAGS_IN_LEN, - MC_CMD_RSS_CONTEXT_SET_FLAGS_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_RSS_CONTEXT_SET_FLAGS_IN_LEN, + MC_CMD_RSS_CONTEXT_SET_FLAGS_OUT_LEN); efx_rc_t rc; @@ -351,5 +347,4 @@ efx_mcdi_rss_context_set_flags( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_RSS_CONTEXT_SET_FLAGS; req.emr_in_buf = payload; @@ -440,6 +435,6 @@ efx_mcdi_rss_context_set_key( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_RSS_CONTEXT_SET_KEY_IN_LEN, - MC_CMD_RSS_CONTEXT_SET_KEY_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_RSS_CONTEXT_SET_KEY_IN_LEN, + MC_CMD_RSS_CONTEXT_SET_KEY_OUT_LEN); efx_rc_t rc; @@ -449,5 +444,4 @@ efx_mcdi_rss_context_set_key( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_RSS_CONTEXT_SET_KEY; req.emr_in_buf = payload; @@ -497,6 +491,6 @@ efx_mcdi_rss_context_set_table( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_RSS_CONTEXT_SET_TABLE_IN_LEN, - MC_CMD_RSS_CONTEXT_SET_TABLE_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_RSS_CONTEXT_SET_TABLE_IN_LEN, + MC_CMD_RSS_CONTEXT_SET_TABLE_OUT_LEN); uint8_t *req_table; int i, rc; @@ -507,5 +501,4 @@ efx_mcdi_rss_context_set_table( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_RSS_CONTEXT_SET_TABLE; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/ef10_tx.c b/drivers/net/sfc/base/ef10_tx.c index e74d39540..20816f2fc 100644 --- a/drivers/net/sfc/base/ef10_tx.c +++ b/drivers/net/sfc/base/ef10_tx.c @@ -32,6 +32,6 @@ efx_mcdi_init_txq( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_INIT_TXQ_IN_LEN(EFX_TXQ_MAX_BUFS), - MC_CMD_INIT_TXQ_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_INIT_TXQ_IN_LEN(EFX_TXQ_MAX_BUFS), + MC_CMD_INIT_TXQ_OUT_LEN); efx_qword_t *dma_addr; uint64_t addr; @@ -54,5 +54,4 @@ efx_mcdi_init_txq( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_INIT_TXQ; req.emr_in_buf = payload; @@ -121,9 +120,8 @@ efx_mcdi_fini_txq( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_FINI_TXQ_IN_LEN, - MC_CMD_FINI_TXQ_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_FINI_TXQ_IN_LEN, + MC_CMD_FINI_TXQ_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_FINI_TXQ; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/efx_lic.c b/drivers/net/sfc/base/efx_lic.c index 49c00347f..1ca1bf477 100644 --- a/drivers/net/sfc/base/efx_lic.c +++ b/drivers/net/sfc/base/efx_lic.c @@ -302,10 +302,9 @@ efx_mcdi_fc_license_update_license( { efx_mcdi_req_t req; - uint8_t payload[MC_CMD_FC_IN_LICENSE_LEN]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_FC_IN_LICENSE_LEN, 0); efx_rc_t rc; EFSYS_ASSERT(enp->en_family == EFX_FAMILY_SIENA); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_FC; req.emr_in_buf = payload; @@ -348,11 +347,10 @@ efx_mcdi_fc_license_get_key_stats( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_FC_IN_LICENSE_LEN, - MC_CMD_FC_OUT_LICENSE_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_FC_IN_LICENSE_LEN, + MC_CMD_FC_OUT_LICENSE_LEN); efx_rc_t rc; EFSYS_ASSERT(enp->en_family == EFX_FAMILY_SIENA); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_FC; req.emr_in_buf = payload; @@ -664,6 +662,6 @@ efx_mcdi_licensed_app_state( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_LICENSED_APP_STATE_IN_LEN, - MC_CMD_GET_LICENSED_APP_STATE_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_LICENSED_APP_STATE_IN_LEN, + MC_CMD_GET_LICENSED_APP_STATE_OUT_LEN); uint32_t app_state; efx_rc_t rc; @@ -677,5 +675,4 @@ efx_mcdi_licensed_app_state( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_LICENSED_APP_STATE; req.emr_in_buf = payload; @@ -723,10 +720,9 @@ efx_mcdi_licensing_update_licenses( { efx_mcdi_req_t req; - uint8_t payload[MC_CMD_LICENSING_IN_LEN]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_LICENSING_IN_LEN, 0); efx_rc_t rc; EFSYS_ASSERT(enp->en_family == EFX_FAMILY_HUNTINGTON); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_LICENSING; req.emr_in_buf = payload; @@ -766,11 +762,10 @@ efx_mcdi_licensing_get_key_stats( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_LICENSING_IN_LEN, - MC_CMD_LICENSING_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_LICENSING_IN_LEN, + MC_CMD_LICENSING_OUT_LEN); efx_rc_t rc; EFSYS_ASSERT(enp->en_family == EFX_FAMILY_HUNTINGTON); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_LICENSING; req.emr_in_buf = payload; @@ -830,5 +825,5 @@ efx_mcdi_licensing_v3_update_licenses( { efx_mcdi_req_t req; - uint8_t payload[MC_CMD_LICENSING_V3_IN_LEN]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_LICENSING_V3_IN_LEN, 0); efx_rc_t rc; @@ -836,5 +831,4 @@ efx_mcdi_licensing_v3_update_licenses( (enp->en_family == EFX_FAMILY_MEDFORD2)); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_LICENSING_V3; req.emr_in_buf = payload; @@ -867,6 +861,6 @@ efx_mcdi_licensing_v3_report_license( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_LICENSING_V3_IN_LEN, - MC_CMD_LICENSING_V3_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_LICENSING_V3_IN_LEN, + MC_CMD_LICENSING_V3_OUT_LEN); efx_rc_t rc; @@ -874,5 +868,4 @@ efx_mcdi_licensing_v3_report_license( (enp->en_family == EFX_FAMILY_MEDFORD2)); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_LICENSING_V3; req.emr_in_buf = payload; @@ -931,6 +924,6 @@ efx_mcdi_licensing_v3_app_state( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_LICENSED_V3_APP_STATE_IN_LEN, - MC_CMD_GET_LICENSED_V3_APP_STATE_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_LICENSED_V3_APP_STATE_IN_LEN, + MC_CMD_GET_LICENSED_V3_APP_STATE_OUT_LEN); uint32_t app_state; efx_rc_t rc; @@ -939,5 +932,4 @@ efx_mcdi_licensing_v3_app_state( (enp->en_family == EFX_FAMILY_MEDFORD2)); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_LICENSED_V3_APP_STATE; req.emr_in_buf = payload; @@ -991,6 +983,6 @@ efx_mcdi_licensing_v3_get_id( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_LICENSING_GET_ID_V3_IN_LEN, - MC_CMD_LICENSING_GET_ID_V3_OUT_LENMIN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_LICENSING_GET_ID_V3_IN_LEN, + MC_CMD_LICENSING_GET_ID_V3_OUT_LENMIN); efx_rc_t rc; @@ -1003,5 +995,4 @@ efx_mcdi_licensing_v3_get_id( req.emr_out_buf = bufferp; req.emr_out_length = MC_CMD_LICENSING_GET_ID_V3_OUT_LENMIN; - (void) memset(payload, 0, sizeof (payload)); } else { /* Request full buffer */ diff --git a/drivers/net/sfc/base/efx_mcdi.c b/drivers/net/sfc/base/efx_mcdi.c index d4ebcf265..84d8452e4 100644 --- a/drivers/net/sfc/base/efx_mcdi.c +++ b/drivers/net/sfc/base/efx_mcdi.c @@ -901,8 +901,8 @@ efx_mcdi_version( { efx_mcdi_req_t req; - uint8_t payload[MAX(MAX(MC_CMD_GET_VERSION_IN_LEN, - MC_CMD_GET_VERSION_OUT_LEN), - MAX(MC_CMD_GET_BOOT_STATUS_IN_LEN, - MC_CMD_GET_BOOT_STATUS_OUT_LEN))]; + EFX_MCDI_DECLARE_BUF(payload, + MAX(MC_CMD_GET_VERSION_IN_LEN, MC_CMD_GET_BOOT_STATUS_IN_LEN), + MAX(MC_CMD_GET_VERSION_OUT_LEN, + MC_CMD_GET_BOOT_STATUS_OUT_LEN)); efx_word_t *ver_words; uint16_t version[4]; @@ -913,5 +913,4 @@ efx_mcdi_version( EFSYS_ASSERT3U(enp->en_features, &, EFX_FEATURE_MCDI); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_VERSION; req.emr_in_buf = payload; @@ -1019,10 +1018,9 @@ efx_mcdi_get_capabilities( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_CAPABILITIES_IN_LEN, - MC_CMD_GET_CAPABILITIES_V2_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_CAPABILITIES_IN_LEN, + MC_CMD_GET_CAPABILITIES_V2_OUT_LEN); boolean_t v2_capable; efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_CAPABILITIES; req.emr_in_buf = payload; @@ -1087,5 +1085,6 @@ efx_mcdi_do_reboot( __in boolean_t after_assertion) { - uint8_t payload[MAX(MC_CMD_REBOOT_IN_LEN, MC_CMD_REBOOT_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_REBOOT_IN_LEN, + MC_CMD_REBOOT_OUT_LEN); efx_mcdi_req_t req; efx_rc_t rc; @@ -1100,5 +1099,4 @@ efx_mcdi_do_reboot( EFSYS_ASSERT3U(enp->en_magic, ==, EFX_NIC_MAGIC); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_REBOOT; req.emr_in_buf = payload; @@ -1151,6 +1149,6 @@ efx_mcdi_read_assertion( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_ASSERTS_IN_LEN, - MC_CMD_GET_ASSERTS_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_ASSERTS_IN_LEN, + MC_CMD_GET_ASSERTS_OUT_LEN); const char *reason; unsigned int flags; @@ -1253,9 +1251,8 @@ efx_mcdi_drv_attach( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_DRV_ATTACH_IN_LEN, - MC_CMD_DRV_ATTACH_EXT_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_DRV_ATTACH_IN_LEN, + MC_CMD_DRV_ATTACH_EXT_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_DRV_ATTACH; req.emr_in_buf = payload; @@ -1312,9 +1309,8 @@ efx_mcdi_get_board_cfg( efx_mcdi_iface_t *emip = &(enp->en_mcdi.em_emip); efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_BOARD_CFG_IN_LEN, - MC_CMD_GET_BOARD_CFG_OUT_LENMIN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_BOARD_CFG_IN_LEN, + MC_CMD_GET_BOARD_CFG_OUT_LENMIN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_BOARD_CFG; req.emr_in_buf = payload; @@ -1392,9 +1388,8 @@ efx_mcdi_get_resource_limits( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_RESOURCE_LIMITS_IN_LEN, - MC_CMD_GET_RESOURCE_LIMITS_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_RESOURCE_LIMITS_IN_LEN, + MC_CMD_GET_RESOURCE_LIMITS_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_RESOURCE_LIMITS; req.emr_in_buf = payload; @@ -1439,6 +1434,6 @@ efx_mcdi_get_phy_cfg( efx_nic_cfg_t *encp = &(enp->en_nic_cfg); efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_PHY_CFG_IN_LEN, - MC_CMD_GET_PHY_CFG_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_PHY_CFG_IN_LEN, + MC_CMD_GET_PHY_CFG_OUT_LEN); #if EFSYS_OPT_NAMES const char *namep; @@ -1448,5 +1443,4 @@ efx_mcdi_get_phy_cfg( efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_PHY_CFG; req.emr_in_buf = payload; @@ -1687,9 +1681,8 @@ efx_mcdi_bist_start( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_START_BIST_IN_LEN, - MC_CMD_START_BIST_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_START_BIST_IN_LEN, + MC_CMD_START_BIST_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_START_BIST; req.emr_in_buf = payload; @@ -1750,9 +1743,8 @@ efx_mcdi_log_ctrl( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_LOG_CTRL_IN_LEN, - MC_CMD_LOG_CTRL_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_LOG_CTRL_IN_LEN, + MC_CMD_LOG_CTRL_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_LOG_CTRL; req.emr_in_buf = payload; @@ -1799,6 +1791,6 @@ efx_mcdi_mac_stats( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_MAC_STATS_IN_LEN, - MC_CMD_MAC_STATS_V2_OUT_DMA_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_MAC_STATS_IN_LEN, + MC_CMD_MAC_STATS_V2_OUT_DMA_LEN); int clear = (action == EFX_STATS_CLEAR); int upload = (action == EFX_STATS_UPLOAD); @@ -1808,5 +1800,4 @@ efx_mcdi_mac_stats( efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_MAC_STATS; req.emr_in_buf = payload; @@ -1980,9 +1971,8 @@ efx_mcdi_get_function_info( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_FUNCTION_INFO_IN_LEN, - MC_CMD_GET_FUNCTION_INFO_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_FUNCTION_INFO_IN_LEN, + MC_CMD_GET_FUNCTION_INFO_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_FUNCTION_INFO; req.emr_in_buf = payload; @@ -2025,9 +2015,8 @@ efx_mcdi_privilege_mask( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_PRIVILEGE_MASK_IN_LEN, - MC_CMD_PRIVILEGE_MASK_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_PRIVILEGE_MASK_IN_LEN, + MC_CMD_PRIVILEGE_MASK_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_PRIVILEGE_MASK; req.emr_in_buf = payload; @@ -2074,9 +2063,8 @@ efx_mcdi_set_workaround( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_WORKAROUND_IN_LEN, - MC_CMD_WORKAROUND_EXT_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_WORKAROUND_IN_LEN, + MC_CMD_WORKAROUND_EXT_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_WORKAROUND; req.emr_in_buf = payload; @@ -2118,8 +2106,7 @@ efx_mcdi_get_workarounds( { efx_mcdi_req_t req; - uint8_t payload[MC_CMD_GET_WORKAROUNDS_OUT_LEN]; + EFX_MCDI_DECLARE_BUF(payload, 0, MC_CMD_GET_WORKAROUNDS_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_WORKAROUNDS; req.emr_in_buf = NULL; @@ -2167,12 +2154,11 @@ efx_mcdi_get_phy_media_info( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_PHY_MEDIA_INFO_IN_LEN, - MC_CMD_GET_PHY_MEDIA_INFO_OUT_LEN( - EFX_PHY_MEDIA_INFO_PAGE_SIZE))]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_PHY_MEDIA_INFO_IN_LEN, + MC_CMD_GET_PHY_MEDIA_INFO_OUT_LEN( + EFX_PHY_MEDIA_INFO_PAGE_SIZE)); efx_rc_t rc; EFSYS_ASSERT((uint32_t)offset + len <= EFX_PHY_MEDIA_INFO_PAGE_SIZE); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_PHY_MEDIA_INFO; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/efx_mcdi.h b/drivers/net/sfc/base/efx_mcdi.h index 253a9e60b..d2685abc9 100644 --- a/drivers/net/sfc/base/efx_mcdi.h +++ b/drivers/net/sfc/base/efx_mcdi.h @@ -381,4 +381,15 @@ efx_mcdi_phy_module_get_info( (MC_CMD_PRIVILEGE_MASK_IN_GRP_ ## priv)) +/* + * The buffer size must be a multiple of dword to ensure that MCDI works + * properly with Siena based boards (which use on-chip buffer). Also, it + * should be at minimum the size of two dwords to allow space for extended + * error responses if the request/response buffer sizes are smaller. + */ +#define EFX_MCDI_DECLARE_BUF(_name, _in_len, _out_len) \ + uint8_t _name[P2ROUNDUP(MAX(MAX(_in_len, _out_len), \ + (2 * sizeof (efx_dword_t))), \ + sizeof (efx_dword_t))] = {0} + typedef enum efx_mcdi_feature_id_e { EFX_MCDI_FEATURE_FW_UPDATE = 0, diff --git a/drivers/net/sfc/base/efx_nic.c b/drivers/net/sfc/base/efx_nic.c index 0e8ed9c2a..c364bffba 100644 --- a/drivers/net/sfc/base/efx_nic.c +++ b/drivers/net/sfc/base/efx_nic.c @@ -790,11 +790,10 @@ efx_mcdi_get_loopback_modes( efx_nic_cfg_t *encp = &(enp->en_nic_cfg); efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_LOOPBACK_MODES_IN_LEN, - MC_CMD_GET_LOOPBACK_MODES_OUT_V2_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_LOOPBACK_MODES_IN_LEN, + MC_CMD_GET_LOOPBACK_MODES_OUT_V2_LEN); efx_qword_t mask; efx_qword_t modes; efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_LOOPBACK_MODES; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/efx_nvram.c b/drivers/net/sfc/base/efx_nvram.c index f9a6ee585..fdab7aafa 100644 --- a/drivers/net/sfc/base/efx_nvram.c +++ b/drivers/net/sfc/base/efx_nvram.c @@ -515,10 +515,9 @@ efx_mcdi_nvram_partitions( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_NVRAM_PARTITIONS_IN_LEN, - MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_NVRAM_PARTITIONS_IN_LEN, + MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX); unsigned int npartn; efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_NVRAM_PARTITIONS; req.emr_in_buf = payload; @@ -578,9 +577,8 @@ efx_mcdi_nvram_metadata( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_NVRAM_METADATA_IN_LEN, - MC_CMD_NVRAM_METADATA_OUT_LENMAX)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_NVRAM_METADATA_IN_LEN, + MC_CMD_NVRAM_METADATA_OUT_LENMAX); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_NVRAM_METADATA; req.emr_in_buf = payload; @@ -668,10 +666,9 @@ efx_mcdi_nvram_info( __out_opt uint32_t *write_sizep) { - uint8_t payload[MAX(MC_CMD_NVRAM_INFO_IN_LEN, - MC_CMD_NVRAM_INFO_V2_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_NVRAM_INFO_IN_LEN, + MC_CMD_NVRAM_INFO_V2_OUT_LEN); efx_mcdi_req_t req; efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_NVRAM_INFO; req.emr_in_buf = payload; @@ -729,10 +726,9 @@ efx_mcdi_nvram_update_start( __in uint32_t partn) { - uint8_t payload[MAX(MC_CMD_NVRAM_UPDATE_START_V2_IN_LEN, - MC_CMD_NVRAM_UPDATE_START_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_NVRAM_UPDATE_START_V2_IN_LEN, + MC_CMD_NVRAM_UPDATE_START_OUT_LEN); efx_mcdi_req_t req; efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_NVRAM_UPDATE_START; req.emr_in_buf = payload; @@ -771,6 +767,6 @@ efx_mcdi_nvram_read( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_NVRAM_READ_IN_V2_LEN, - MC_CMD_NVRAM_READ_OUT_LENMAX)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_NVRAM_READ_IN_V2_LEN, + MC_CMD_NVRAM_READ_OUT_LENMAX); efx_rc_t rc; @@ -780,5 +776,4 @@ efx_mcdi_nvram_read( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_NVRAM_READ; req.emr_in_buf = payload; @@ -826,9 +821,8 @@ efx_mcdi_nvram_erase( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_NVRAM_ERASE_IN_LEN, - MC_CMD_NVRAM_ERASE_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_NVRAM_ERASE_IN_LEN, + MC_CMD_NVRAM_ERASE_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_NVRAM_ERASE; req.emr_in_buf = payload; @@ -940,10 +934,9 @@ efx_mcdi_nvram_update_finish( const efx_nic_cfg_t *encp = &enp->en_nic_cfg; efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_NVRAM_UPDATE_FINISH_V2_IN_LEN, - MC_CMD_NVRAM_UPDATE_FINISH_V2_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_NVRAM_UPDATE_FINISH_V2_IN_LEN, + MC_CMD_NVRAM_UPDATE_FINISH_V2_OUT_LEN); uint32_t verify_result = MC_CMD_NVRAM_VERIFY_RC_UNKNOWN; efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_NVRAM_UPDATE_FINISH; req.emr_in_buf = payload; @@ -1011,10 +1004,9 @@ efx_mcdi_nvram_test( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_NVRAM_TEST_IN_LEN, - MC_CMD_NVRAM_TEST_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_NVRAM_TEST_IN_LEN, + MC_CMD_NVRAM_TEST_OUT_LEN); int result; efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_NVRAM_TEST; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/efx_tunnel.c b/drivers/net/sfc/base/efx_tunnel.c index 399fd540b..edb6be028 100644 --- a/drivers/net/sfc/base/efx_tunnel.c +++ b/drivers/net/sfc/base/efx_tunnel.c @@ -41,6 +41,7 @@ efx_mcdi_set_tunnel_encap_udp_ports( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_SET_TUNNEL_ENCAP_UDP_PORTS_IN_LENMAX, - MC_CMD_SET_TUNNEL_ENCAP_UDP_PORTS_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, + MC_CMD_SET_TUNNEL_ENCAP_UDP_PORTS_IN_LENMAX, + MC_CMD_SET_TUNNEL_ENCAP_UDP_PORTS_OUT_LEN); efx_word_t flags; efx_rc_t rc; @@ -53,5 +54,4 @@ efx_mcdi_set_tunnel_encap_udp_ports( entries_num = etcp->etc_udp_entries_num; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_SET_TUNNEL_ENCAP_UDP_PORTS; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/mcdi_mon.c b/drivers/net/sfc/base/mcdi_mon.c index 54f7ae5db..2fb1b8e35 100644 --- a/drivers/net/sfc/base/mcdi_mon.c +++ b/drivers/net/sfc/base/mcdi_mon.c @@ -299,6 +299,6 @@ efx_mcdi_read_sensors( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_READ_SENSORS_EXT_IN_LEN, - MC_CMD_READ_SENSORS_EXT_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_READ_SENSORS_EXT_IN_LEN, + MC_CMD_READ_SENSORS_EXT_OUT_LEN); uint32_t addr_lo, addr_hi; efx_rc_t rc; @@ -338,6 +338,6 @@ efx_mcdi_sensor_info_npages( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_SENSOR_INFO_EXT_IN_LEN, - MC_CMD_SENSOR_INFO_OUT_LENMAX)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_SENSOR_INFO_EXT_IN_LEN, + MC_CMD_SENSOR_INFO_OUT_LENMAX); int page; efx_rc_t rc; @@ -382,6 +382,6 @@ efx_mcdi_sensor_info( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_SENSOR_INFO_EXT_IN_LEN, - MC_CMD_SENSOR_INFO_OUT_LENMAX)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_SENSOR_INFO_EXT_IN_LEN, + MC_CMD_SENSOR_INFO_OUT_LENMAX); uint32_t page; efx_rc_t rc; diff --git a/drivers/net/sfc/base/siena_mac.c b/drivers/net/sfc/base/siena_mac.c index f8857cdd5..928dfc340 100644 --- a/drivers/net/sfc/base/siena_mac.c +++ b/drivers/net/sfc/base/siena_mac.c @@ -69,12 +69,11 @@ siena_mac_reconfigure( efx_oword_t multicast_hash[2]; efx_mcdi_req_t req; - uint8_t payload[MAX(MAX(MC_CMD_SET_MAC_IN_LEN, - MC_CMD_SET_MAC_OUT_LEN), - MAX(MC_CMD_SET_MCAST_HASH_IN_LEN, - MC_CMD_SET_MCAST_HASH_OUT_LEN))]; + EFX_MCDI_DECLARE_BUF(payload, + MAX(MC_CMD_SET_MAC_IN_LEN, MC_CMD_SET_MCAST_HASH_IN_LEN), + MAX(MC_CMD_SET_MAC_OUT_LEN, MC_CMD_SET_MCAST_HASH_OUT_LEN)); + unsigned int fcntl; efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_SET_MAC; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/siena_nic.c b/drivers/net/sfc/base/siena_nic.c index 31eef80b9..8a58986e8 100644 --- a/drivers/net/sfc/base/siena_nic.c +++ b/drivers/net/sfc/base/siena_nic.c @@ -19,9 +19,8 @@ siena_nic_get_partn_mask( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_NVRAM_TYPES_IN_LEN, - MC_CMD_NVRAM_TYPES_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_NVRAM_TYPES_IN_LEN, + MC_CMD_NVRAM_TYPES_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_NVRAM_TYPES; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/siena_nvram.c b/drivers/net/sfc/base/siena_nvram.c index 8cdd2df70..b8ea8a757 100644 --- a/drivers/net/sfc/base/siena_nvram.c +++ b/drivers/net/sfc/base/siena_nvram.c @@ -419,10 +419,9 @@ siena_nvram_get_subtype( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_BOARD_CFG_IN_LEN, - MC_CMD_GET_BOARD_CFG_OUT_LENMAX)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_BOARD_CFG_IN_LEN, + MC_CMD_GET_BOARD_CFG_OUT_LENMAX); efx_word_t *fw_list; efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_BOARD_CFG; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/siena_phy.c b/drivers/net/sfc/base/siena_phy.c index 4b2190d38..7eec9c747 100644 --- a/drivers/net/sfc/base/siena_phy.c +++ b/drivers/net/sfc/base/siena_phy.c @@ -170,9 +170,8 @@ siena_phy_get_link( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_LINK_IN_LEN, - MC_CMD_GET_LINK_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_LINK_IN_LEN, + MC_CMD_GET_LINK_OUT_LEN); efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_LINK; req.emr_in_buf = payload; @@ -245,8 +244,7 @@ siena_phy_reconfigure( efx_port_t *epp = &(enp->en_port); efx_mcdi_req_t req; - uint8_t payload[MAX(MAX(MC_CMD_SET_ID_LED_IN_LEN, - MC_CMD_SET_ID_LED_OUT_LEN), - MAX(MC_CMD_SET_LINK_IN_LEN, - MC_CMD_SET_LINK_OUT_LEN))]; + EFX_MCDI_DECLARE_BUF(payload, + MAX(MC_CMD_SET_ID_LED_IN_LEN, MC_CMD_SET_LINK_IN_LEN), + MAX(MC_CMD_SET_ID_LED_OUT_LEN, MC_CMD_SET_LINK_OUT_LEN)); uint32_t cap_mask; #if EFSYS_OPT_PHY_LED_CONTROL @@ -256,5 +254,4 @@ siena_phy_reconfigure( efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_SET_LINK; req.emr_in_buf = payload; @@ -362,10 +359,9 @@ siena_phy_verify( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_PHY_STATE_IN_LEN, - MC_CMD_GET_PHY_STATE_OUT_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_PHY_STATE_IN_LEN, + MC_CMD_GET_PHY_STATE_OUT_LEN); uint32_t state; efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_PHY_STATE; req.emr_in_buf = payload; @@ -531,6 +527,6 @@ siena_phy_stats_update( uint64_t smask; efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_PHY_STATS_IN_LEN, - MC_CMD_PHY_STATS_OUT_DMA_LEN)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_PHY_STATS_IN_LEN, + MC_CMD_PHY_STATS_OUT_DMA_LEN); efx_rc_t rc; @@ -540,5 +536,4 @@ siena_phy_stats_update( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_PHY_STATS; req.emr_in_buf = payload; @@ -627,6 +622,6 @@ siena_phy_bist_poll( { efx_nic_cfg_t *encp = &(enp->en_nic_cfg); - uint8_t payload[MAX(MC_CMD_POLL_BIST_IN_LEN, - MCDI_CTL_SDU_LEN_MAX)]; + EFX_MCDI_DECLARE_BUF(payload, MC_CMD_POLL_BIST_IN_LEN, + MCDI_CTL_SDU_LEN_MAX); uint32_t value_mask = 0; efx_mcdi_req_t req; @@ -634,5 +629,4 @@ siena_phy_bist_poll( efx_rc_t rc; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_POLL_BIST; req.emr_in_buf = payload; -- 2.19.0 --- Diff of the applied patch vs upstream commit (please double-check if non-empty: --- --- - 2018-11-21 15:59:13.920285512 +0000 +++ 0012-net-sfc-base-fix-out-of-bounds-read-when-dereferenci.patch 2018-11-21 15:59:13.000000000 +0000 @@ -1,8 +1,10 @@ -From ed42d18458cbdceb28f006fda9967141a7e79b92 Mon Sep 17 00:00:00 2001 +From 6c703736316d161efea833e2be9400f392d08acd Mon Sep 17 00:00:00 2001 From: Gautam Dawar Date: Mon, 10 Sep 2018 10:33:22 +0100 Subject: [PATCH] net/sfc/base: fix out of bounds read when dereferencing sdup +[ upstream commit ed42d18458cbdceb28f006fda9967141a7e79b92 ] + Introduce and use macro to make sure that MCDI buffers allocated on stack are rounded up properly. @@ -25,7 +27,6 @@ Fixes: 480a13044b8b ("net/sfc/base: support FW subvariant choice") Fixes: 6f60cc4a78b6 ("net/sfc/base: support equal stride super-buffer Rx mode") Fixes: 9a733758c046 ("net/sfc/base: support MARK and FLAG actions in filters") -Cc: stable@dpdk.org Signed-off-by: Gautam Dawar Signed-off-by: Andrew Rybchenko @@ -44,12 +45,12 @@ drivers/net/sfc/base/efx_nic.c | 5 +- drivers/net/sfc/base/efx_nvram.c | 40 +++++-------- drivers/net/sfc/base/efx_tunnel.c | 6 +- - drivers/net/sfc/base/mcdi_mon.c | 17 +++--- + drivers/net/sfc/base/mcdi_mon.c | 12 ++-- drivers/net/sfc/base/siena_mac.c | 9 ++- drivers/net/sfc/base/siena_nic.c | 5 +- drivers/net/sfc/base/siena_nvram.c | 5 +- drivers/net/sfc/base/siena_phy.c | 28 ++++----- - 19 files changed, 199 insertions(+), 273 deletions(-) + 19 files changed, 197 insertions(+), 270 deletions(-) diff --git a/drivers/net/sfc/base/ef10_ev.c b/drivers/net/sfc/base/ef10_ev.c index 7f89a7bf0..287550605 100644 @@ -237,7 +238,7 @@ req.emr_cmd = MC_CMD_SET_MAC; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/ef10_nic.c b/drivers/net/sfc/base/ef10_nic.c -index 9145c389c..332f6ef81 100644 +index d1985b3c5..0dd00e192 100644 --- a/drivers/net/sfc/base/ef10_nic.c +++ b/drivers/net/sfc/base/ef10_nic.c @@ -21,6 +21,6 @@ efx_mcdi_get_port_assignment( @@ -255,7 +256,7 @@ - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_PORT_ASSIGNMENT; req.emr_in_buf = payload; -@@ -68,6 +67,6 @@ efx_mcdi_get_port_modes( +@@ -67,6 +66,6 @@ efx_mcdi_get_port_modes( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_PORT_MODES_IN_LEN, @@ -264,13 +265,13 @@ + MC_CMD_GET_PORT_MODES_OUT_LEN); efx_rc_t rc; -@@ -76,5 +75,4 @@ efx_mcdi_get_port_modes( +@@ -75,5 +74,4 @@ efx_mcdi_get_port_modes( enp->en_family == EFX_FAMILY_MEDFORD2); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_PORT_MODES; req.emr_in_buf = payload; -@@ -181,11 +179,10 @@ efx_mcdi_vadaptor_alloc( +@@ -175,11 +173,10 @@ efx_mcdi_vadaptor_alloc( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_VADAPTOR_ALLOC_IN_LEN, @@ -284,7 +285,7 @@ - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_VADAPTOR_ALLOC; req.emr_in_buf = payload; -@@ -220,9 +217,8 @@ efx_mcdi_vadaptor_free( +@@ -214,9 +211,8 @@ efx_mcdi_vadaptor_free( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_VADAPTOR_FREE_IN_LEN, @@ -296,7 +297,7 @@ - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_VADAPTOR_FREE; req.emr_in_buf = payload; -@@ -254,6 +250,6 @@ efx_mcdi_get_mac_address_pf( +@@ -248,6 +244,6 @@ efx_mcdi_get_mac_address_pf( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_MAC_ADDRESSES_IN_LEN, @@ -305,13 +306,13 @@ + MC_CMD_GET_MAC_ADDRESSES_OUT_LEN); efx_rc_t rc; -@@ -262,5 +258,4 @@ efx_mcdi_get_mac_address_pf( +@@ -256,5 +252,4 @@ efx_mcdi_get_mac_address_pf( enp->en_family == EFX_FAMILY_MEDFORD2); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_MAC_ADDRESSES; req.emr_in_buf = payload; -@@ -313,6 +308,6 @@ efx_mcdi_get_mac_address_vf( +@@ -307,6 +302,6 @@ efx_mcdi_get_mac_address_vf( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_VPORT_GET_MAC_ADDRESSES_IN_LEN, @@ -320,13 +321,13 @@ + MC_CMD_VPORT_GET_MAC_ADDRESSES_OUT_LENMAX); efx_rc_t rc; -@@ -321,5 +316,4 @@ efx_mcdi_get_mac_address_vf( +@@ -315,5 +310,4 @@ efx_mcdi_get_mac_address_vf( enp->en_family == EFX_FAMILY_MEDFORD2); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_VPORT_GET_MAC_ADDRESSES; req.emr_in_buf = payload; -@@ -378,6 +372,6 @@ efx_mcdi_get_clock( +@@ -372,6 +366,6 @@ efx_mcdi_get_clock( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_CLOCK_IN_LEN, @@ -335,13 +336,13 @@ + MC_CMD_GET_CLOCK_OUT_LEN); efx_rc_t rc; -@@ -386,5 +380,4 @@ efx_mcdi_get_clock( +@@ -380,5 +374,4 @@ efx_mcdi_get_clock( enp->en_family == EFX_FAMILY_MEDFORD2); - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_CLOCK; req.emr_in_buf = payload; -@@ -436,10 +429,9 @@ efx_mcdi_get_rxdp_config( +@@ -430,10 +423,9 @@ efx_mcdi_get_rxdp_config( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_RXDP_CONFIG_IN_LEN, @@ -354,7 +355,7 @@ - memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_RXDP_CONFIG; req.emr_in_buf = payload; -@@ -496,9 +488,8 @@ efx_mcdi_get_vector_cfg( +@@ -490,9 +482,8 @@ efx_mcdi_get_vector_cfg( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_VECTOR_CFG_IN_LEN, @@ -366,7 +367,7 @@ - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_VECTOR_CFG; req.emr_in_buf = payload; -@@ -546,6 +537,6 @@ efx_mcdi_alloc_vis( +@@ -540,6 +531,6 @@ efx_mcdi_alloc_vis( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_ALLOC_VIS_IN_LEN, @@ -375,13 +376,13 @@ + MC_CMD_ALLOC_VIS_EXT_OUT_LEN); efx_rc_t rc; -@@ -555,5 +546,4 @@ efx_mcdi_alloc_vis( +@@ -549,5 +540,4 @@ efx_mcdi_alloc_vis( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_ALLOC_VIS; req.emr_in_buf = payload; -@@ -638,6 +628,6 @@ efx_mcdi_alloc_piobuf( +@@ -632,6 +622,6 @@ efx_mcdi_alloc_piobuf( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_ALLOC_PIOBUF_IN_LEN, @@ -390,13 +391,13 @@ + MC_CMD_ALLOC_PIOBUF_OUT_LEN); efx_rc_t rc; -@@ -647,5 +637,4 @@ efx_mcdi_alloc_piobuf( +@@ -641,5 +631,4 @@ efx_mcdi_alloc_piobuf( } - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_ALLOC_PIOBUF; req.emr_in_buf = payload; -@@ -686,9 +675,8 @@ efx_mcdi_free_piobuf( +@@ -680,9 +669,8 @@ efx_mcdi_free_piobuf( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_FREE_PIOBUF_IN_LEN, @@ -408,7 +409,7 @@ - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_FREE_PIOBUF; req.emr_in_buf = payload; -@@ -721,9 +709,8 @@ efx_mcdi_link_piobuf( +@@ -715,9 +703,8 @@ efx_mcdi_link_piobuf( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_LINK_PIOBUF_IN_LEN, @@ -420,7 +421,7 @@ - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_LINK_PIOBUF; req.emr_in_buf = payload; -@@ -756,9 +743,8 @@ efx_mcdi_unlink_piobuf( +@@ -750,9 +737,8 @@ efx_mcdi_unlink_piobuf( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_UNLINK_PIOBUF_IN_LEN, @@ -432,7 +433,7 @@ - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_UNLINK_PIOBUF; req.emr_in_buf = payload; -@@ -958,9 +944,8 @@ ef10_mcdi_get_pf_count( +@@ -952,9 +938,8 @@ ef10_mcdi_get_pf_count( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_PF_COUNT_IN_LEN, @@ -444,7 +445,7 @@ - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_PF_COUNT; req.emr_in_buf = payload; -@@ -1002,6 +987,6 @@ ef10_get_datapath_caps( +@@ -996,6 +981,6 @@ ef10_get_datapath_caps( efx_nic_cfg_t *encp = &(enp->en_nic_cfg); efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_CAPABILITIES_IN_LEN, @@ -453,13 +454,13 @@ + MC_CMD_GET_CAPABILITIES_V5_OUT_LEN); efx_rc_t rc; -@@ -1010,5 +995,4 @@ ef10_get_datapath_caps( +@@ -1004,5 +989,4 @@ ef10_get_datapath_caps( - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_CAPABILITIES; req.emr_in_buf = payload; -@@ -2047,6 +2031,6 @@ ef10_nic_reset( +@@ -2040,6 +2024,6 @@ ef10_nic_reset( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_ENTITY_RESET_IN_LEN, @@ -468,13 +469,13 @@ + MC_CMD_ENTITY_RESET_OUT_LEN); efx_rc_t rc; -@@ -2057,5 +2041,4 @@ ef10_nic_reset( +@@ -2050,5 +2034,4 @@ ef10_nic_reset( goto fail2; - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_ENTITY_RESET; req.emr_in_buf = payload; -@@ -2394,9 +2377,8 @@ efx_mcdi_get_nic_global( +@@ -2387,9 +2370,8 @@ efx_mcdi_get_nic_global( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_GET_NIC_GLOBAL_IN_LEN, @@ -486,7 +487,7 @@ - (void) memset(payload, 0, sizeof (payload)); req.emr_cmd = MC_CMD_GET_NIC_GLOBAL; req.emr_in_buf = payload; -@@ -2438,8 +2420,7 @@ efx_mcdi_set_nic_global( +@@ -2431,8 +2413,7 @@ efx_mcdi_set_nic_global( { efx_mcdi_req_t req; - uint8_t payload[MC_CMD_SET_NIC_GLOBAL_IN_LEN]; @@ -661,7 +662,7 @@ req.emr_cmd = MC_CMD_RSS_CONTEXT_SET_TABLE; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/ef10_tx.c b/drivers/net/sfc/base/ef10_tx.c -index 4d77d76d7..5f3df42b9 100644 +index e74d39540..20816f2fc 100644 --- a/drivers/net/sfc/base/ef10_tx.c +++ b/drivers/net/sfc/base/ef10_tx.c @@ -32,6 +32,6 @@ efx_mcdi_init_txq( @@ -692,7 +693,7 @@ req.emr_cmd = MC_CMD_FINI_TXQ; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/efx_lic.c b/drivers/net/sfc/base/efx_lic.c -index 2b06e2d1e..2a6da2647 100644 +index 49c00347f..1ca1bf477 100644 --- a/drivers/net/sfc/base/efx_lic.c +++ b/drivers/net/sfc/base/efx_lic.c @@ -302,10 +302,9 @@ efx_mcdi_fc_license_update_license( @@ -1032,10 +1033,10 @@ req.emr_cmd = MC_CMD_GET_PHY_MEDIA_INFO; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/efx_mcdi.h b/drivers/net/sfc/base/efx_mcdi.h -index d2cd1e9e1..40072405e 100644 +index 253a9e60b..d2685abc9 100644 --- a/drivers/net/sfc/base/efx_mcdi.h +++ b/drivers/net/sfc/base/efx_mcdi.h -@@ -385,4 +385,15 @@ efx_mcdi_phy_module_get_info( +@@ -381,4 +381,15 @@ efx_mcdi_phy_module_get_info( (MC_CMD_PRIVILEGE_MASK_IN_GRP_ ## priv)) +/* @@ -1070,7 +1071,7 @@ req.emr_cmd = MC_CMD_GET_LOOPBACK_MODES; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/efx_nvram.c b/drivers/net/sfc/base/efx_nvram.c -index d7b1a6778..5296c59b8 100644 +index f9a6ee585..fdab7aafa 100644 --- a/drivers/net/sfc/base/efx_nvram.c +++ b/drivers/net/sfc/base/efx_nvram.c @@ -515,10 +515,9 @@ efx_mcdi_nvram_partitions( @@ -1198,10 +1199,10 @@ req.emr_cmd = MC_CMD_SET_TUNNEL_ENCAP_UDP_PORTS; req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/mcdi_mon.c b/drivers/net/sfc/base/mcdi_mon.c -index 0e860168a..b53de0d68 100644 +index 54f7ae5db..2fb1b8e35 100644 --- a/drivers/net/sfc/base/mcdi_mon.c +++ b/drivers/net/sfc/base/mcdi_mon.c -@@ -192,6 +192,6 @@ efx_mcdi_read_sensors( +@@ -299,6 +299,6 @@ efx_mcdi_read_sensors( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_READ_SENSORS_EXT_IN_LEN, @@ -1210,7 +1211,7 @@ + MC_CMD_READ_SENSORS_EXT_OUT_LEN); uint32_t addr_lo, addr_hi; efx_rc_t rc; -@@ -231,6 +231,6 @@ efx_mcdi_sensor_info_npages( +@@ -338,6 +338,6 @@ efx_mcdi_sensor_info_npages( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_SENSOR_INFO_EXT_IN_LEN, @@ -1219,7 +1220,7 @@ + MC_CMD_SENSOR_INFO_OUT_LENMAX); int page; efx_rc_t rc; -@@ -275,6 +275,6 @@ efx_mcdi_sensor_info( +@@ -382,6 +382,6 @@ efx_mcdi_sensor_info( { efx_mcdi_req_t req; - uint8_t payload[MAX(MC_CMD_SENSOR_INFO_EXT_IN_LEN, @@ -1228,21 +1229,6 @@ + MC_CMD_SENSOR_INFO_OUT_LENMAX); uint32_t page; efx_rc_t rc; -@@ -344,6 +344,6 @@ efx_mcdi_sensor_info_page( - { - efx_mcdi_req_t req; -- uint8_t payload[MAX(MC_CMD_SENSOR_INFO_EXT_IN_LEN, -- MC_CMD_SENSOR_INFO_OUT_LENMAX)]; -+ EFX_MCDI_DECLARE_BUF(payload, MC_CMD_SENSOR_INFO_EXT_IN_LEN, -+ MC_CMD_SENSOR_INFO_OUT_LENMAX); - efx_rc_t rc; - uint32_t mask_copy; -@@ -357,5 +357,4 @@ efx_mcdi_sensor_info_page( - ((sizeof (*mask_part) * 8) - 1) * sizeof (efx_mon_stat_limits_t)); - -- (void) memset(payload, 0, sizeof (payload)); - req.emr_cmd = MC_CMD_SENSOR_INFO; - req.emr_in_buf = payload; diff --git a/drivers/net/sfc/base/siena_mac.c b/drivers/net/sfc/base/siena_mac.c index f8857cdd5..928dfc340 100644 --- a/drivers/net/sfc/base/siena_mac.c