[PATCH] net/bnxt: fix aliasing in firmware command writes

[PATCH] net/bnxt: fix aliasing in firmware command writes

[Alexander Goodkind]

Use memcpy to copy each firmware command word into a local uint32_t
before writing it to the card. Replace the uint32_t pointer reads in
bnxt_hwrm_send_message() with byte access.

Fixes: 1cd45aeb3270 ("net/bnxt: support Stratus VF device")
Cc: stable@dpdk.org

Signed-off-by: Alexander Goodkind <alex@goodkind.io>
---

VPP could not initialize the interfaces on my PowerEdge XR11 with a
Broadcom BCM57504 card, using SR-IOV virtual functions inside an Ubuntu
LXC container on Proxmox. The debugger showed an empty command header
immediately before the driver wrote it to the card.

The original pointer reads violate GCC's strict-aliasing rule [1].
The patched driver initialized the interfaces and transferred packets
with DPDK 26.03.0 and VPP 26.06-release. Separate build and software
tests passed against the current Broadcom source.

[1] https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html

 .mailmap                     |  1 +
 drivers/net/bnxt/bnxt_hwrm.c | 11 +++++++----
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.mailmap b/.mailmap
index 5d1df79860..3143e642b5 100644
--- a/.mailmap
+++ b/.mailmap
@@ -65,6 +65,7 @@ Alex Zelezniak <alexz@att.com>
 Alexander Bechikov <asb.tyum@gmail.com>
 Alexander Belyakov <abelyako@gmail.com>
 Alexander Chernavin <achernavin@netgate.com>
+Alexander Goodkind <alex@goodkind.io>
 Alexander Guy <alexander@andern.org>
 Alexander Kozyrev <akozyrev@nvidia.com> <akozyrev@mellanox.com>
 Alexander Matushevsky <matua@amazon.com>
diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index ab1521953a..573a33b2de 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -483,7 +483,7 @@ static int bnxt_hwrm_send_message(struct bnxt *bp,
void *msg,
 	unsigned int i;
 	struct input *req = msg;
 	struct output *resp = bp->hwrm_cmd_resp_addr;
-	uint32_t *data = msg;
+	const uint8_t *data = msg;
 	uint8_t *bar;
 	uint8_t *valid;
 	uint16_t max_req_len = bp->max_req_len;
@@ -526,7 +526,7 @@ static int bnxt_hwrm_send_message(struct bnxt *bp,
void *msg,
 		short_input.req_addr =
 			rte_cpu_to_le_64(bp->hwrm_short_cmd_req_dma_addr);

-		data = (uint32_t *)&short_input;
+		data = (const uint8_t *)&short_input;
 		msg_len = sizeof(short_input);

 		max_req_len = BNXT_HWRM_SHORT_REQ_LEN;
@@ -534,9 +534,12 @@ static int bnxt_hwrm_send_message(struct bnxt
*bp, void *msg,

 	/* Write request msg to hwrm channel */
 	for (i = 0; i < msg_len; i += 4) {
+		uint32_t request_word;
+
 		bar = (uint8_t *)bp->bar0 + bar_offset + i;
-		rte_write32(*data, bar);
-		data++;
+		memcpy(&request_word, data, sizeof(request_word));
+		rte_write32(request_word, bar);
+		data += sizeof(request_word);
 	}

 	/* Zero the rest of the request space */

base-commit: af80aca47b05d46f4a5e1951de3ce8372bd726b6
-- 
2.54.0 (Apple Git-157)

[PATCH v2] net/bnxt: fix aliasing in firmware command writes

[Alexander Goodkind]

Use memcpy to copy each firmware command word into a local uint32_t
before writing it to the card. Replace the uint32_t pointer reads in
bnxt_hwrm_send_message() with byte access.

Fixes: 1cd45aeb3270 ("net/bnxt: support Stratus VF device")
Cc: stable@dpdk.org

Signed-off-by: Alexander Goodkind <alex@goodkind.io>
---

v2: The previous patch got corrupted during email delivery.

VPP could not initialize the interfaces on my PowerEdge XR11 with a
Broadcom BCM57504 card, using SR-IOV virtual functions inside an Ubuntu
LXC container on Proxmox. The debugger showed an empty command header
immediately before the driver wrote it to the card.

The original pointer reads violate GCC's strict-aliasing rule [1].
The patched driver initialized the interfaces and transferred packets
with DPDK 26.03.0 and VPP 26.06-release. Separate build and software
tests passed against the current Broadcom source.

[1] https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html

 .mailmap                     |  1 +
 drivers/net/bnxt/bnxt_hwrm.c | 11 +++++++----
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.mailmap b/.mailmap
index 5d1df79860..3143e642b5 100644
--- a/.mailmap
+++ b/.mailmap
@@ -65,6 +65,7 @@ Alex Zelezniak <alexz@att.com>
 Alexander Bechikov <asb.tyum@gmail.com>
 Alexander Belyakov <abelyako@gmail.com>
 Alexander Chernavin <achernavin@netgate.com>
+Alexander Goodkind <alex@goodkind.io>
 Alexander Guy <alexander@andern.org>
 Alexander Kozyrev <akozyrev@nvidia.com> <akozyrev@mellanox.com>
 Alexander Matushevsky <matua@amazon.com>
diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index ab1521953a..573a33b2de 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -483,7 +483,7 @@ static int bnxt_hwrm_send_message(struct bnxt *bp, void *msg,
 	unsigned int i;
 	struct input *req = msg;
 	struct output *resp = bp->hwrm_cmd_resp_addr;
-	uint32_t *data = msg;
+	const uint8_t *data = msg;
 	uint8_t *bar;
 	uint8_t *valid;
 	uint16_t max_req_len = bp->max_req_len;
@@ -526,7 +526,7 @@ static int bnxt_hwrm_send_message(struct bnxt *bp, void *msg,
 		short_input.req_addr =
 			rte_cpu_to_le_64(bp->hwrm_short_cmd_req_dma_addr);
 
-		data = (uint32_t *)&short_input;
+		data = (const uint8_t *)&short_input;
 		msg_len = sizeof(short_input);
 
 		max_req_len = BNXT_HWRM_SHORT_REQ_LEN;
@@ -534,9 +534,12 @@ static int bnxt_hwrm_send_message(struct bnxt *bp, void *msg,
 
 	/* Write request msg to hwrm channel */
 	for (i = 0; i < msg_len; i += 4) {
+		uint32_t request_word;
+
 		bar = (uint8_t *)bp->bar0 + bar_offset + i;
-		rte_write32(*data, bar);
-		data++;
+		memcpy(&request_word, data, sizeof(request_word));
+		rte_write32(request_word, bar);
+		data += sizeof(request_word);
 	}
 
 	/* Zero the rest of the request space */

base-commit: af80aca47b05d46f4a5e1951de3ce8372bd726b6
-- 
2.54.0 (Apple Git-157)

Re: |WARNING| [v2] net/bnxt: fix aliasing in firmware command writes

[Alexander Goodkind]

> On the last iteration when i + 4 > msg_len, only msg_len - i bytes
> are copied.

The copy length is sizeof(request_word), so memcpy initializes the
entire uint32_t before rte_write32(). It does not shorten the copy
based on msg_len. The previous pointer dereference also read a full
uint32_t.

> Missing release notes update

Comparable fixes, including the enic aliasing fix [1] and the checksum
memcpy fix [2], did not include release-note entries. I followed that
precedent here, but I can add a release-note entry if the maintainers
would prefer one.

[1] https://github.com/DPDK/dpdk/commit/7895d17cf41094cb7d5ad67f484dd492f5a643bf
[2] https://github.com/DPDK/dpdk/commit/1c9a7fba5c90e0422b517404499ed106f647bcff

Re: |WARNING| [v2] net/bnxt: fix aliasing in firmware command writes

[Thomas Monjalon]

18/10/2026 05:02, Alexander Goodkind:
> > Missing release notes update
> 
> Comparable fixes, including the enic aliasing fix [1] and the checksum
> memcpy fix [2], did not include release-note entries. I followed that
> precedent here, but I can add a release-note entry if the maintainers
> would prefer one.

We don't mention fixes in release notes.