Author: davidcs
Date: Fri Nov 22 00:26:21 2013
New Revision: 258457
URL: http://svnweb.freebsd.org/changeset/base/258457

Log:
  MFC r258155
  ql_hw.[c,h]: set minimum thresholds on pkt size for lro path.
  ql_ioctl.c: validate the length and address of buffer passed to QL_RD_FW_DUMP
  MFC r258156
  qls_ioctl.c: Validate the buffer and its length passed to QLA_MPI_DUMP.
               copyout dump only if qls_mpi_core_dump() is successful.
  (like to credit x90c for pointing the issue)
  
  Approved by: re (delphij)

Modified:
  stable/10/sys/dev/qlxgbe/ql_hw.c
  stable/10/sys/dev/qlxgbe/ql_hw.h
  stable/10/sys/dev/qlxgbe/ql_ioctl.c
  stable/10/sys/dev/qlxge/qls_ioctl.c
Directory Properties:
  stable/10/sys/   (props changed)

Modified: stable/10/sys/dev/qlxgbe/ql_hw.c
==============================================================================
--- stable/10/sys/dev/qlxgbe/ql_hw.c    Fri Nov 22 00:06:11 2013        
(r258456)
+++ stable/10/sys/dev/qlxgbe/ql_hw.c    Fri Nov 22 00:26:21 2013        
(r258457)
@@ -212,6 +212,12 @@ ql_hw_add_sysctls(qla_host_t *ha)
                "Number of Rcv Rings Entries to post before updating"
                " RDS Ring Producer Index");
 
+       ha->hw.min_lro_pkt_size = 512;
+       SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
+               SYSCTL_CHILDREN(device_get_sysctl_tree(dev)),
+               OID_AUTO, "min_lro_pkt_size", CTLFLAG_RD, 
&ha->hw.min_lro_pkt_size,
+               ha->hw.min_lro_pkt_size, "minimum packet size to trigger lro");
+
        ha->hw.mdump_active = 0;
         SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
                 SYSCTL_CHILDREN(device_get_sysctl_tree(dev)),
@@ -1069,6 +1075,11 @@ qla_config_fw_lro(qla_host_t *ha, uint16
 
        fw_lro->cntxt_id = cntxt_id;
 
+       if (ha->hw.min_lro_pkt_size) {
+               fw_lro->flags |= Q8_MBX_FW_LRO_LOW_THRESHOLD;
+               fw_lro->low_threshold = ha->hw.min_lro_pkt_size;
+       }
+
        if (qla_mbx_cmd(ha, (uint32_t *)fw_lro,
                (sizeof (q80_config_fw_lro_t) >> 2),
                ha->hw.mbox, (sizeof (q80_config_fw_lro_rsp_t) >> 2), 0)) {

Modified: stable/10/sys/dev/qlxgbe/ql_hw.h
==============================================================================
--- stable/10/sys/dev/qlxgbe/ql_hw.h    Fri Nov 22 00:06:11 2013        
(r258456)
+++ stable/10/sys/dev/qlxgbe/ql_hw.h    Fri Nov 22 00:26:21 2013        
(r258457)
@@ -568,9 +568,13 @@ typedef struct _q80_config_fw_lro {
 #define Q8_MBX_FW_LRO_IPV6                     0x2
 #define Q8_MBX_FW_LRO_IPV4_WO_DST_IP_CHK       0x4
 #define Q8_MBX_FW_LRO_IPV6_WO_DST_IP_CHK       0x8
+#define Q8_MBX_FW_LRO_LOW_THRESHOLD            0x10
 
        uint8_t         rsrvd;
        uint16_t        cntxt_id;
+
+       uint16_t        low_threshold;
+       uint16_t        rsrvd0;
 } __packed q80_config_fw_lro_t;
 
 typedef struct _q80_config_fw_lro_rsp {
@@ -1521,6 +1525,7 @@ typedef struct _qla_hw {
        uint32_t        health_count;
 
        uint32_t        max_tx_segs;
+       uint32_t        min_lro_pkt_size;
        
        /* Flash Descriptor Table */
        qla_flash_desc_table_t fdt;

Modified: stable/10/sys/dev/qlxgbe/ql_ioctl.c
==============================================================================
--- stable/10/sys/dev/qlxgbe/ql_ioctl.c Fri Nov 22 00:06:11 2013        
(r258456)
+++ stable/10/sys/dev/qlxgbe/ql_ioctl.c Fri Nov 22 00:26:21 2013        
(r258457)
@@ -223,6 +223,13 @@ ql_eioctl(struct cdev *dev, u_long cmd, 
                }
                
                fw_dump = (qla_rd_fw_dump_t *)data;
+
+               if ((fw_dump->md_template == NULL) ||
+                       (fw_dump->template_size != 
ha->hw.dma_buf.minidump.size)) {
+                       rval = EINVAL;
+                       break;
+               }
+
                if ((rval = copyout(ha->hw.dma_buf.minidump.dma_b,
                        fw_dump->md_template, fw_dump->template_size)))
                        rval = ENXIO;

Modified: stable/10/sys/dev/qlxge/qls_ioctl.c
==============================================================================
--- stable/10/sys/dev/qlxge/qls_ioctl.c Fri Nov 22 00:06:11 2013        
(r258456)
+++ stable/10/sys/dev/qlxge/qls_ioctl.c Fri Nov 22 00:26:21 2013        
(r258457)
@@ -100,13 +100,16 @@ qls_eioctl(struct cdev *dev, u_long cmd,
                if (mpi_dump->size == 0) {
                        mpi_dump->size = sizeof (qls_mpi_coredump_t);
                } else {
-                       if (mpi_dump->size < sizeof (qls_mpi_coredump_t))
+                       if ((mpi_dump->size != sizeof (qls_mpi_coredump_t)) ||
+                               (mpi_dump->dbuf == NULL))
                                rval = EINVAL;
                        else {
-                               qls_mpi_core_dump(ha);
-                               rval = copyout( &ql_mpi_coredump,
-                                               mpi_dump->dbuf,
-                                               mpi_dump->size);
+                               if (qls_mpi_core_dump(ha) == 0) {
+                                       rval = copyout(&ql_mpi_coredump,
+                                                       mpi_dump->dbuf,
+                                                       mpi_dump->size);
+                               } else 
+                                       rval = ENXIO;
 
                                if (rval) {
                                        device_printf(ha->pci_dev,
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"

Reply via email to