[PATCH] net/bnxt: fix aliasing in firmware command writes

DPDK-dev Archive on lore.kernel.org
 help / color / mirror / Atom feed

* [PATCH] net/bnxt: fix aliasing in firmware command writes
@ 2026-10-18  1:49 Alexander Goodkind
  2026-10-18  2:29 ` [PATCH v2] " Alexander Goodkind
  0 siblings, 1 reply; 4+ messages in thread
From: Alexander Goodkind @ 2026-10-18  1:49 UTC (permalink / raw)
  To: kishore.padmanabha, ajit.khaparde; +Cc: dev, stable, thomas, tarick

Use memcpy to copy each firmware command word into a local uint32_t
before writing it to the card. Replace the uint32_t pointer reads in
bnxt_hwrm_send_message() with byte access.

Fixes: 1cd45aeb3270 ("net/bnxt: support Stratus VF device")
Cc: stable@dpdk.org

Signed-off-by: Alexander Goodkind <alex@goodkind.io>
---

VPP could not initialize the interfaces on my PowerEdge XR11 with a
Broadcom BCM57504 card, using SR-IOV virtual functions inside an Ubuntu
LXC container on Proxmox. The debugger showed an empty command header
immediately before the driver wrote it to the card.

The original pointer reads violate GCC's strict-aliasing rule [1].
The patched driver initialized the interfaces and transferred packets
with DPDK 26.03.0 and VPP 26.06-release. Separate build and software
tests passed against the current Broadcom source.

[1] https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html

 .mailmap                     |  1 +
 drivers/net/bnxt/bnxt_hwrm.c | 11 +++++++----
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.mailmap b/.mailmap
index 5d1df79860..3143e642b5 100644
--- a/.mailmap
+++ b/.mailmap
@@ -65,6 +65,7 @@ Alex Zelezniak <alexz@att.com>
 Alexander Bechikov <asb.tyum@gmail.com>
 Alexander Belyakov <abelyako@gmail.com>
 Alexander Chernavin <achernavin@netgate.com>
+Alexander Goodkind <alex@goodkind.io>
 Alexander Guy <alexander@andern.org>
 Alexander Kozyrev <akozyrev@nvidia.com> <akozyrev@mellanox.com>
 Alexander Matushevsky <matua@amazon.com>
diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index ab1521953a..573a33b2de 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -483,7 +483,7 @@ static int bnxt_hwrm_send_message(struct bnxt *bp,
void *msg,
 	unsigned int i;
 	struct input *req = msg;
 	struct output *resp = bp->hwrm_cmd_resp_addr;
-	uint32_t *data = msg;
+	const uint8_t *data = msg;
 	uint8_t *bar;
 	uint8_t *valid;
 	uint16_t max_req_len = bp->max_req_len;
@@ -526,7 +526,7 @@ static int bnxt_hwrm_send_message(struct bnxt *bp,
void *msg,
 		short_input.req_addr =
 			rte_cpu_to_le_64(bp->hwrm_short_cmd_req_dma_addr);

-		data = (uint32_t *)&short_input;
+		data = (const uint8_t *)&short_input;
 		msg_len = sizeof(short_input);

 		max_req_len = BNXT_HWRM_SHORT_REQ_LEN;
@@ -534,9 +534,12 @@ static int bnxt_hwrm_send_message(struct bnxt
*bp, void *msg,

 	/* Write request msg to hwrm channel */
 	for (i = 0; i < msg_len; i += 4) {
+		uint32_t request_word;
+
 		bar = (uint8_t *)bp->bar0 + bar_offset + i;
-		rte_write32(*data, bar);
-		data++;
+		memcpy(&request_word, data, sizeof(request_word));
+		rte_write32(request_word, bar);
+		data += sizeof(request_word);
 	}

 	/* Zero the rest of the request space */

base-commit: af80aca47b05d46f4a5e1951de3ce8372bd726b6
-- 
2.54.0 (Apple Git-157)

^ permalink raw reply related	[flat|nested] 4+ messages in thread

* [PATCH v2] net/bnxt: fix aliasing in firmware command writes
  2026-10-18  1:49 [PATCH] net/bnxt: fix aliasing in firmware command writes Alexander Goodkind
@ 2026-10-18  2:29 ` Alexander Goodkind
       [not found]   ` <20261018024910.5D1706051830@postal.iol.unh.edu>
  0 siblings, 1 reply; 4+ messages in thread
From: Alexander Goodkind @ 2026-10-18  2:29 UTC (permalink / raw)
  To: kishore.padmanabha, ajit.khaparde; +Cc: dev, stable, thomas, tarick

Use memcpy to copy each firmware command word into a local uint32_t
before writing it to the card. Replace the uint32_t pointer reads in
bnxt_hwrm_send_message() with byte access.

Fixes: 1cd45aeb3270 ("net/bnxt: support Stratus VF device")
Cc: stable@dpdk.org

Signed-off-by: Alexander Goodkind <alex@goodkind.io>
---

v2: The previous patch got corrupted during email delivery.

VPP could not initialize the interfaces on my PowerEdge XR11 with a
Broadcom BCM57504 card, using SR-IOV virtual functions inside an Ubuntu
LXC container on Proxmox. The debugger showed an empty command header
immediately before the driver wrote it to the card.

The original pointer reads violate GCC's strict-aliasing rule [1].
The patched driver initialized the interfaces and transferred packets
with DPDK 26.03.0 and VPP 26.06-release. Separate build and software
tests passed against the current Broadcom source.

[1] https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html

 .mailmap                     |  1 +
 drivers/net/bnxt/bnxt_hwrm.c | 11 +++++++----
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.mailmap b/.mailmap
index 5d1df79860..3143e642b5 100644
--- a/.mailmap
+++ b/.mailmap
@@ -65,6 +65,7 @@ Alex Zelezniak <alexz@att.com>
 Alexander Bechikov <asb.tyum@gmail.com>
 Alexander Belyakov <abelyako@gmail.com>
 Alexander Chernavin <achernavin@netgate.com>
+Alexander Goodkind <alex@goodkind.io>
 Alexander Guy <alexander@andern.org>
 Alexander Kozyrev <akozyrev@nvidia.com> <akozyrev@mellanox.com>
 Alexander Matushevsky <matua@amazon.com>
diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index ab1521953a..573a33b2de 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -483,7 +483,7 @@ static int bnxt_hwrm_send_message(struct bnxt *bp, void *msg,
 	unsigned int i;
 	struct input *req = msg;
 	struct output *resp = bp->hwrm_cmd_resp_addr;
-	uint32_t *data = msg;
+	const uint8_t *data = msg;
 	uint8_t *bar;
 	uint8_t *valid;
 	uint16_t max_req_len = bp->max_req_len;
@@ -526,7 +526,7 @@ static int bnxt_hwrm_send_message(struct bnxt *bp, void *msg,
 		short_input.req_addr =
 			rte_cpu_to_le_64(bp->hwrm_short_cmd_req_dma_addr);
 
-		data = (uint32_t *)&short_input;
+		data = (const uint8_t *)&short_input;
 		msg_len = sizeof(short_input);
 
 		max_req_len = BNXT_HWRM_SHORT_REQ_LEN;
@@ -534,9 +534,12 @@ static int bnxt_hwrm_send_message(struct bnxt *bp, void *msg,
 
 	/* Write request msg to hwrm channel */
 	for (i = 0; i < msg_len; i += 4) {
+		uint32_t request_word;
+
 		bar = (uint8_t *)bp->bar0 + bar_offset + i;
-		rte_write32(*data, bar);
-		data++;
+		memcpy(&request_word, data, sizeof(request_word));
+		rte_write32(request_word, bar);
+		data += sizeof(request_word);
 	}
 
 	/* Zero the rest of the request space */

base-commit: af80aca47b05d46f4a5e1951de3ce8372bd726b6
-- 
2.54.0 (Apple Git-157)


^ permalink raw reply related	[flat|nested] 4+ messages in thread

[parent not found: <20261018024910.5D1706051830@postal.iol.unh.edu>]

* Re: |WARNING| [v2] net/bnxt: fix aliasing in firmware command writes
       [not found]   ` <20261018024910.5D1706051830@postal.iol.unh.edu>
@ 2026-10-18  3:02     ` Alexander Goodkind
  2026-10-19 11:32       ` Thomas Monjalon
  0 siblings, 1 reply; 4+ messages in thread
From: Alexander Goodkind @ 2026-10-18  3:02 UTC (permalink / raw)
  To: dpdklab, kishore.padmanabha, ajit.khaparde
  Cc: dev, test-report, stable, thomas, tarick

> On the last iteration when i + 4 > msg_len, only msg_len - i bytes
> are copied.

The copy length is sizeof(request_word), so memcpy initializes the
entire uint32_t before rte_write32(). It does not shorten the copy
based on msg_len. The previous pointer dereference also read a full
uint32_t.

> Missing release notes update

Comparable fixes, including the enic aliasing fix [1] and the checksum
memcpy fix [2], did not include release-note entries. I followed that
precedent here, but I can add a release-note entry if the maintainers
would prefer one.

[1] https://github.com/DPDK/dpdk/commit/7895d17cf41094cb7d5ad67f484dd492f5a643bf
[2] https://github.com/DPDK/dpdk/commit/1c9a7fba5c90e0422b517404499ed106f647bcff

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: |WARNING| [v2] net/bnxt: fix aliasing in firmware command writes
  2026-10-18  3:02     ` |WARNING| [v2] " Alexander Goodkind
@ 2026-10-19 11:32       ` Thomas Monjalon
  0 siblings, 0 replies; 4+ messages in thread
From: Thomas Monjalon @ 2026-10-19 11:32 UTC (permalink / raw)
  To: dpdklab, kishore.padmanabha, ajit.khaparde, Alexander Goodkind
  Cc: dev, test-report, stable, tarick

18/10/2026 05:02, Alexander Goodkind:
> > Missing release notes update
> 
> Comparable fixes, including the enic aliasing fix [1] and the checksum
> memcpy fix [2], did not include release-note entries. I followed that
> precedent here, but I can add a release-note entry if the maintainers
> would prefer one.

We don't mention fixes in release notes.




^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2026-10-19 11:32 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-18  1:49 [PATCH] net/bnxt: fix aliasing in firmware command writes Alexander Goodkind
2026-10-18  2:29 ` [PATCH v2] " Alexander Goodkind
     [not found]   ` <20261018024910.5D1706051830@postal.iol.unh.edu>
2026-10-18  3:02     ` |WARNING| [v2] " Alexander Goodkind
2026-10-19 11:32       ` Thomas Monjalon

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox