4.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dirk van der Merwe <dirk.vanderme...@netronome.com>


[ Upstream commit 1489bbd10e16079ce30a53d3c22a431fd47af791 ]

The NSP default buffer is a piece of NFP memory where additional
command data can be placed.  Its format has been copied from
host buffer, but the PCIe selection bits do not make sense in
this case.  If those get masked out from a NFP address - writes
to random place in the chip memory may be issued and crash the
device.

Even in the general NSP buffer case, it doesn't make sense to have the
PCIe selection bits there anymore. These are unused at the moment, and
when it becomes necessary, the PCIe selection bits should rather be
moved to another register to utilise more bits for the buffer address.

This has never been an issue because the buffer used to be
allocated in memory with less-than-38-bit-long address but that
is about to change.

Fixes: 1a64821c6af7 ("nfp: add support for service processor access")
Signed-off-by: Dirk van der Merwe <dirk.vanderme...@netronome.com>
Reviewed-by: Jakub Kicinski <jakub.kicin...@netronome.com>
Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
---
 drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c
+++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c
@@ -68,10 +68,11 @@
 /* CPP address to retrieve the data from */
 #define NSP_BUFFER             0x10
 #define   NSP_BUFFER_CPP       GENMASK_ULL(63, 40)
-#define   NSP_BUFFER_PCIE      GENMASK_ULL(39, 38)
-#define   NSP_BUFFER_ADDRESS   GENMASK_ULL(37, 0)
+#define   NSP_BUFFER_ADDRESS   GENMASK_ULL(39, 0)
 
 #define NSP_DFLT_BUFFER                0x18
+#define   NSP_DFLT_BUFFER_CPP  GENMASK_ULL(63, 40)
+#define   NSP_DFLT_BUFFER_ADDRESS      GENMASK_ULL(39, 0)
 
 #define NSP_DFLT_BUFFER_CONFIG 0x20
 #define   NSP_DFLT_BUFFER_SIZE_MB      GENMASK_ULL(7, 0)
@@ -412,8 +413,8 @@ static int nfp_nsp_command_buf(struct nf
        if (err < 0)
                return err;
 
-       cpp_id = FIELD_GET(NSP_BUFFER_CPP, reg) << 8;
-       cpp_buf = FIELD_GET(NSP_BUFFER_ADDRESS, reg);
+       cpp_id = FIELD_GET(NSP_DFLT_BUFFER_CPP, reg) << 8;
+       cpp_buf = FIELD_GET(NSP_DFLT_BUFFER_ADDRESS, reg);
 
        if (in_buf && in_size) {
                err = nfp_cpp_write(cpp, cpp_id, cpp_buf, in_buf, in_size);


Reply via email to