[PATCH 0/3] i40e base code update

DPDK-dev Archive on lore.kernel.org
 help / color / mirror / Atom feed

* [PATCH 0/3] i40e base code update
@ 2026-05-19 14:52 Ciara Loftus
  2026-05-19 14:52 ` [PATCH 1/3] net/i40e/base: fix integer overflow in NVM timing logic Ciara Loftus
                   ` (3 more replies)
  0 siblings, 4 replies; 5+ messages in thread
From: Ciara Loftus @ 2026-05-19 14:52 UTC (permalink / raw)
  To: dev; +Cc: Ciara Loftus

Update the i40e base code. Both patches address integer type width issues
that can cause incorrect behaviour and are candidates for stable backport.

Chinh Cao (1):
  net/i40e/base: fix integer overflow in NVM timing logic

Ciara Loftus (1):
  net/i40e/base: update version info

Deepthi Kavalur (1):
  net/i40e/base: fix loop counter width in DCB parsing

 .mailmap                                     |  1 +
 drivers/net/intel/i40e/base/README           |  4 +-
 drivers/net/intel/i40e/base/i40e_dcb.c       |  6 +-
 drivers/net/intel/i40e/base/i40e_nvm.c       | 67 +++++++++++++-------
 drivers/net/intel/i40e/base/i40e_prototype.h |  2 +-
 drivers/net/intel/i40e/base/i40e_type.h      |  2 +-
 drivers/net/intel/i40e/i40e_ethdev.c         |  3 +-
 7 files changed, 55 insertions(+), 30 deletions(-)

-- 
2.43.0


^ permalink raw reply	[flat|nested] 5+ messages in thread

* [PATCH 1/3] net/i40e/base: fix integer overflow in NVM timing logic
  2026-05-19 14:52 [PATCH 0/3] i40e base code update Ciara Loftus
@ 2026-05-19 14:52 ` Ciara Loftus
  2026-05-19 14:52 ` [PATCH 2/3] net/i40e/base: fix loop counter width in DCB parsing Ciara Loftus
                   ` (2 subsequent siblings)
  3 siblings, 0 replies; 5+ messages in thread
From: Ciara Loftus @ 2026-05-19 14:52 UTC (permalink / raw)
  To: dev; +Cc: Chinh Cao, stable, Ciara Loftus

From: Chinh Cao <chinh.t.cao@intel.com>

Rename gtime to gtime_start/gtime_current with elapsed tracking
to avoid signed/unsigned comparison overflow. Widen sr_size from
u16 to u32 and NVM buffer offset parameters from u16 to u32.
Add helper get_elapsed_time() for wrap-safe timer arithmetic.

Fixes: c61390d94d46 ("net/i40e/base: make semaphore timeout 32-bit")
Fixes: cb593a832630 ("net/i40e/base: reduce size of time variables")
Fixes: 8db9e2a1b232 ("i40e: base driver")
Cc: stable@dpdk.org

Signed-off-by: Chinh Cao <chinh.t.cao@intel.com>
Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
---
 drivers/net/intel/i40e/base/i40e_nvm.c       | 67 +++++++++++++-------
 drivers/net/intel/i40e/base/i40e_prototype.h |  2 +-
 drivers/net/intel/i40e/base/i40e_type.h      |  2 +-
 drivers/net/intel/i40e/i40e_ethdev.c         |  3 +-
 4 files changed, 49 insertions(+), 25 deletions(-)

diff --git a/drivers/net/intel/i40e/base/i40e_nvm.c b/drivers/net/intel/i40e/base/i40e_nvm.c
index 00a207ca81..fd1a987c56 100644
--- a/drivers/net/intel/i40e/base/i40e_nvm.c
+++ b/drivers/net/intel/i40e/base/i40e_nvm.c
@@ -49,6 +49,20 @@ enum i40e_status_code i40e_init_nvm(struct i40e_hw *hw)
 	return ret_code;
 }
 
+/**
+ * get_elapsed_time - Compute elapsed hardware timer ticks
+ * @from: The start timer value
+ * @to: The current timer value
+ *
+ * Returns the elapsed time as the difference between the current and start
+ * timer values. The subtraction is wrap-safe for unsigned 32-bit values,
+ * meaning it correctly handles timer wrap-around.
+ **/
+static u32 get_elapsed_time(u32 from, u32 to)
+{
+	return (u32)(to - from); /* wrap-safe */
+}
+
 /**
  * i40e_acquire_nvm - Generic request for acquiring the NVM ownership
  * @hw: pointer to the HW structure
@@ -61,7 +75,7 @@ enum i40e_status_code i40e_acquire_nvm(struct i40e_hw *hw,
 				       enum i40e_aq_resource_access_type access)
 {
 	enum i40e_status_code ret_code = I40E_SUCCESS;
-	u32 gtime, timeout;
+	u32 gtime_start, gtime_current, timeout, elapsed;
 	u32 time_left = 0;
 
 	DEBUGFUNC("i40e_acquire_nvm");
@@ -72,10 +86,12 @@ enum i40e_status_code i40e_acquire_nvm(struct i40e_hw *hw,
 	ret_code = i40e_aq_request_resource(hw, I40E_NVM_RESOURCE_ID, access,
 					    0, &time_left, NULL);
 	/* Reading the Global Device Timer */
-	gtime = rd32(hw, I40E_GLVFGEN_TIMER);
+	gtime_start = rd32(hw, I40E_GLVFGEN_TIMER);
+	gtime_current = gtime_start;
+	elapsed = 0;
 
 	/* Store the timeout */
-	hw->nvm.hw_semaphore_timeout = I40E_MS_TO_GTIME(time_left) + gtime;
+	hw->nvm.hw_semaphore_timeout = I40E_MS_TO_GTIME(time_left) + gtime_start;
 
 	if (ret_code)
 		i40e_debug(hw, I40E_DEBUG_NVM,
@@ -84,17 +100,20 @@ enum i40e_status_code i40e_acquire_nvm(struct i40e_hw *hw,
 
 	if (ret_code && time_left) {
 		/* Poll until the current NVM owner timeouts */
-		timeout = I40E_MS_TO_GTIME(I40E_MAX_NVM_TIMEOUT) + gtime;
-		while ((s32)(gtime - timeout) < 0 && time_left) {
+		timeout = I40E_MS_TO_GTIME(I40E_MAX_NVM_TIMEOUT);
+
+		while (elapsed < timeout && time_left) {
 			i40e_msec_delay(10);
-			gtime = rd32(hw, I40E_GLVFGEN_TIMER);
+			gtime_current = rd32(hw, I40E_GLVFGEN_TIMER);
+			elapsed = get_elapsed_time(gtime_start, gtime_current);
 			ret_code = i40e_aq_request_resource(hw,
 							I40E_NVM_RESOURCE_ID,
 							access, 0, &time_left,
 							NULL);
 			if (ret_code == I40E_SUCCESS) {
 				hw->nvm.hw_semaphore_timeout =
-					    I40E_MS_TO_GTIME(time_left) + gtime;
+					I40E_MS_TO_GTIME(time_left) +
+					gtime_current;
 				break;
 			}
 		}
@@ -110,7 +129,6 @@ enum i40e_status_code i40e_acquire_nvm(struct i40e_hw *hw,
 	return ret_code;
 }
 
-
 /**
  * i40e_acquire_nvm_ex - Specific request only for
  * OID_INTEL_FLASH_INFO_TIMEOUT for acquiring the NVM ownership
@@ -121,13 +139,12 @@ enum i40e_status_code i40e_acquire_nvm(struct i40e_hw *hw,
  * This function will request NVM ownership for reading
  * via the proper Admin Command.
  **/
-
 enum i40e_status_code i40e_acquire_nvm_ex(struct i40e_hw *hw,
 				       enum i40e_aq_resource_access_type access,
 					   u32 custom_timeout)
 {
 	enum i40e_status_code ret_code = I40E_SUCCESS;
-	u32 gtime, timeout;
+	u32 gtime_start, gtime_current, timeout, elapsed;
 	u32 time_left = 0;
 
 	DEBUGFUNC("i40e_acquire_nvm");
@@ -138,10 +155,12 @@ enum i40e_status_code i40e_acquire_nvm_ex(struct i40e_hw *hw,
 	ret_code = i40e_aq_request_resource(hw, I40E_NVM_RESOURCE_ID, access,
 					    0, &time_left, NULL);
 	/* Reading the Global Device Timer */
-	gtime = rd32(hw, I40E_GLVFGEN_TIMER);
+	gtime_start = rd32(hw, I40E_GLVFGEN_TIMER);
+	gtime_current = gtime_start;
+	elapsed = 0;
 
 	/* Store the timeout */
-	hw->nvm.hw_semaphore_timeout = I40E_MS_TO_GTIME(time_left) + gtime;
+	hw->nvm.hw_semaphore_timeout = I40E_MS_TO_GTIME(time_left) + gtime_start;
 
 	if (ret_code)
 		i40e_debug(hw, I40E_DEBUG_NVM,
@@ -151,17 +170,20 @@ enum i40e_status_code i40e_acquire_nvm_ex(struct i40e_hw *hw,
 
 	if (ret_code && time_left) {
 		/* Poll until the current NVM owner timeouts */
-		timeout = I40E_MS_TO_GTIME(custom_timeout) + gtime;
-		while ((gtime < timeout) && time_left) {
+		timeout = I40E_MS_TO_GTIME(custom_timeout);
+
+		while (elapsed < timeout && time_left) {
 			i40e_msec_delay(10);
-			gtime = rd32(hw, I40E_GLVFGEN_TIMER);
+			gtime_current = rd32(hw, I40E_GLVFGEN_TIMER);
+			elapsed = get_elapsed_time(gtime_start, gtime_current);
 			ret_code = i40e_aq_request_resource(hw,
 							I40E_NVM_RESOURCE_ID,
 							access, 0, &time_left,
 							NULL);
 			if (ret_code == I40E_SUCCESS) {
 				hw->nvm.hw_semaphore_timeout =
-					    I40E_MS_TO_GTIME(time_left) + gtime;
+					I40E_MS_TO_GTIME(time_left) +
+					gtime_current;
 				break;
 			}
 		}
@@ -245,7 +267,7 @@ static enum i40e_status_code i40e_poll_sr_srctl_done_bit(struct i40e_hw *hw)
  * Reads one 16 bit word from the Shadow RAM using the GLNVM_SRCTL register.
  **/
 STATIC enum i40e_status_code i40e_read_nvm_word_srctl(struct i40e_hw *hw,
-						      u16 offset,
+						      u32 offset,
 						      u16 *data)
 {
 	enum i40e_status_code ret_code = I40E_ERR_TIMEOUT;
@@ -516,11 +538,12 @@ i40e_read_nvm_module_data(struct i40e_hw *hw, u8 module_ptr, u16 module_offset,
  * method. The buffer read is preceded by the NVM ownership take
  * and followed by the release.
  **/
-STATIC enum i40e_status_code i40e_read_nvm_buffer_srctl(struct i40e_hw *hw, u16 offset,
+STATIC enum i40e_status_code i40e_read_nvm_buffer_srctl(struct i40e_hw *hw, u32 offset,
 							u16 *words, u16 *data)
 {
 	enum i40e_status_code ret_code = I40E_SUCCESS;
-	u16 index, word;
+	u32 index;
+	u16 word;
 
 	DEBUGFUNC("i40e_read_nvm_buffer_srctl");
 
@@ -549,7 +572,7 @@ STATIC enum i40e_status_code i40e_read_nvm_buffer_srctl(struct i40e_hw *hw, u16
  * method. The buffer read is preceded by the NVM ownership take
  * and followed by the release.
  **/
-STATIC enum i40e_status_code i40e_read_nvm_buffer_aq(struct i40e_hw *hw, u16 offset,
+STATIC enum i40e_status_code i40e_read_nvm_buffer_aq(struct i40e_hw *hw, u32 offset,
 						     u16 *words, u16 *data)
 {
 	enum i40e_status_code ret_code;
@@ -608,7 +631,7 @@ STATIC enum i40e_status_code i40e_read_nvm_buffer_aq(struct i40e_hw *hw, u16 off
  * method.
  **/
 enum i40e_status_code __i40e_read_nvm_buffer(struct i40e_hw *hw,
-					     u16 offset,
+					     u32 offset,
 					     u16 *words, u16 *data)
 {
 	if (hw->flags & I40E_HW_FLAG_AQ_SRCTL_ACCESS_ENABLE)
@@ -767,7 +790,7 @@ enum i40e_status_code i40e_calc_nvm_checksum(struct i40e_hw *hw, u16 *checksum)
 	u16 checksum_local = 0;
 	u16 vpd_module = 0;
 	u16 *data;
-	u16 i = 0;
+	u32 i = 0;
 
 	DEBUGFUNC("i40e_calc_nvm_checksum");
 
diff --git a/drivers/net/intel/i40e/base/i40e_prototype.h b/drivers/net/intel/i40e/base/i40e_prototype.h
index e7e6d4c427..6f6bafa43c 100644
--- a/drivers/net/intel/i40e/base/i40e_prototype.h
+++ b/drivers/net/intel/i40e/base/i40e_prototype.h
@@ -482,7 +482,7 @@ enum i40e_status_code i40e_write_nvm_aq(struct i40e_hw *hw, u8 module,
 					bool last_command);
 enum i40e_status_code __i40e_read_nvm_word(struct i40e_hw *hw, u16 offset,
 					   u16 *data);
-enum i40e_status_code __i40e_read_nvm_buffer(struct i40e_hw *hw, u16 offset,
+enum i40e_status_code __i40e_read_nvm_buffer(struct i40e_hw *hw, u32 offset,
 					     u16 *words, u16 *data);
 enum i40e_status_code __i40e_write_nvm_word(struct i40e_hw *hw, u32 offset,
 					  void *data);
diff --git a/drivers/net/intel/i40e/base/i40e_type.h b/drivers/net/intel/i40e/base/i40e_type.h
index 968e1982a6..05a08b2057 100644
--- a/drivers/net/intel/i40e/base/i40e_type.h
+++ b/drivers/net/intel/i40e/base/i40e_type.h
@@ -449,7 +449,7 @@ enum i40e_aq_resource_access_type {
 struct i40e_nvm_info {
 	u32 hw_semaphore_timeout; /* usec global time (GTIME resolution) */
 	u32 timeout;              /* [ms] */
-	u16 sr_size;              /* Shadow RAM size in words */
+	u32 sr_size;              /* Shadow RAM size in words */
 	bool blank_nvm_mode;      /* is NVM empty (no FW present)*/
 	u16 version;              /* NVM package version */
 	u32 eetrack;              /* NVM data version */
diff --git a/drivers/net/intel/i40e/i40e_ethdev.c b/drivers/net/intel/i40e/i40e_ethdev.c
index 100a751225..13f3c23fef 100644
--- a/drivers/net/intel/i40e/i40e_ethdev.c
+++ b/drivers/net/intel/i40e/i40e_ethdev.c
@@ -11357,7 +11357,8 @@ static int i40e_get_eeprom(struct rte_eth_dev *dev,
 {
 	struct i40e_hw *hw = I40E_DEV_PRIVATE_TO_HW(dev->data->dev_private);
 	uint16_t *data = eeprom->data;
-	uint16_t offset, length, cnt_words;
+	uint32_t offset, length;
+	uint16_t cnt_words;
 	int ret_code;
 
 	offset = eeprom->offset >> 1;
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread

* [PATCH 2/3] net/i40e/base: fix loop counter width in DCB parsing
  2026-05-19 14:52 [PATCH 0/3] i40e base code update Ciara Loftus
  2026-05-19 14:52 ` [PATCH 1/3] net/i40e/base: fix integer overflow in NVM timing logic Ciara Loftus
@ 2026-05-19 14:52 ` Ciara Loftus
  2026-05-19 14:52 ` [PATCH 3/3] net/i40e/base: update version info Ciara Loftus
  2026-05-20 10:17 ` [PATCH 0/3] i40e base code update Bruce Richardson
  3 siblings, 0 replies; 5+ messages in thread
From: Ciara Loftus @ 2026-05-19 14:52 UTC (permalink / raw)
  To: dev; +Cc: Deepthi Kavalur, stable, Ciara Loftus

From: Deepthi Kavalur <deepthi.kavalur@intel.com>

Loop counters in i40e_parse_cee_app_tlv() and
i40e_add_ieee_app_pri_tlv() are declared as u8 but compared against
numapps which is u32. If numapps exceeds 255 the counter wraps,
truncating the iteration. Widen the counters to u32.

Fixes: 166dceeeeafc ("i40e/base: add parsing for CEE DCBX TLVs")
Fixes: 0d9d27bb8684 ("i40e/base: prepare local LLDP MIB in TLV")
Cc: stable@dpdk.org

Signed-off-by: Deepthi Kavalur <deepthi.kavalur@intel.com>
Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
---
 .mailmap                               | 1 +
 drivers/net/intel/i40e/base/i40e_dcb.c | 6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.mailmap b/.mailmap
index f3130df686..6121833c25 100644
--- a/.mailmap
+++ b/.mailmap
@@ -371,6 +371,7 @@ Dean Marx <dmarx@iol.unh.edu>
 Declan Doherty <declan.doherty@intel.com>
 Deepak Khandelwal <deepak.khandelwal@intel.com>
 Deepak Kumar Jain <deepak.k.jain@intel.com>
+Deepthi Kavalur <deepthi.kavalur@intel.com>
 Deirdre O'Connor <deirdre.o.connor@intel.com>
 Dekel Peled <dekelp@nvidia.com> <dekelp@mellanox.com>
 Dengdui Huang <huangdengdui@huawei.com>
diff --git a/drivers/net/intel/i40e/base/i40e_dcb.c b/drivers/net/intel/i40e/base/i40e_dcb.c
index 04322ea034..c1d97fabab 100644
--- a/drivers/net/intel/i40e/base/i40e_dcb.c
+++ b/drivers/net/intel/i40e/base/i40e_dcb.c
@@ -364,7 +364,7 @@ static void i40e_parse_cee_app_tlv(struct i40e_cee_feat_tlv *tlv,
 {
 	u16 length, typelength, offset = 0;
 	struct i40e_cee_app_prio *app;
-	u8 i;
+	u32 i;
 
 	typelength = I40E_NTOHS(tlv->hdr.typelen);
 	length = (u16)((typelength & I40E_LLDP_TLV_LEN_MASK) >>
@@ -1169,9 +1169,9 @@ static void i40e_add_ieee_app_pri_tlv(struct i40e_lldp_org_tlv *tlv,
 				      struct i40e_dcbx_config *dcbcfg)
 {
 	u16 typelength, length, offset = 0;
-	u8 priority, selector, i = 0;
 	u8 *buf = tlv->tlvinfo;
-	u32 ouisubtype;
+	u32 ouisubtype, i = 0;
+	u8 priority, selector;
 
 	/* No APP TLVs then just return */
 	if (dcbcfg->numapps == 0)
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread

* [PATCH 3/3] net/i40e/base: update version info
  2026-05-19 14:52 [PATCH 0/3] i40e base code update Ciara Loftus
  2026-05-19 14:52 ` [PATCH 1/3] net/i40e/base: fix integer overflow in NVM timing logic Ciara Loftus
  2026-05-19 14:52 ` [PATCH 2/3] net/i40e/base: fix loop counter width in DCB parsing Ciara Loftus
@ 2026-05-19 14:52 ` Ciara Loftus
  2026-05-20 10:17 ` [PATCH 0/3] i40e base code update Bruce Richardson
  3 siblings, 0 replies; 5+ messages in thread
From: Ciara Loftus @ 2026-05-19 14:52 UTC (permalink / raw)
  To: dev; +Cc: Ciara Loftus

Update README with the date of when the latest snapshot was generated.

Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
---
 drivers/net/intel/i40e/base/README | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/intel/i40e/base/README b/drivers/net/intel/i40e/base/README
index c5305ffae0..59cae0fc90 100644
--- a/drivers/net/intel/i40e/base/README
+++ b/drivers/net/intel/i40e/base/README
@@ -1,12 +1,12 @@
 /* SPDX-License-Identifier: BSD-3-Clause
- * Copyright(c) 2017-2024 Intel Corporation
+ * Copyright(c) 2017-2026 Intel Corporation
  */
 
 Intel® I40E driver
 ==================
 
 This directory contains source code of i40e base driver generated on
-2024-08-30 released by the team which develops
+2026-05-07 released by the team which develops
 basic drivers for any i40e NIC. The directory of base/ contains the
 original source package.
 This driver is valid for the product(s) listed below
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread

* Re: [PATCH 0/3] i40e base code update
  2026-05-19 14:52 [PATCH 0/3] i40e base code update Ciara Loftus
                   ` (2 preceding siblings ...)
  2026-05-19 14:52 ` [PATCH 3/3] net/i40e/base: update version info Ciara Loftus
@ 2026-05-20 10:17 ` Bruce Richardson
  3 siblings, 0 replies; 5+ messages in thread
From: Bruce Richardson @ 2026-05-20 10:17 UTC (permalink / raw)
  To: Ciara Loftus; +Cc: dev

On Tue, May 19, 2026 at 02:52:20PM +0000, Ciara Loftus wrote:
> Update the i40e base code. Both patches address integer type width issues
> that can cause incorrect behaviour and are candidates for stable backport.
> 
> Chinh Cao (1):
>   net/i40e/base: fix integer overflow in NVM timing logic
> 
> Ciara Loftus (1):
>   net/i40e/base: update version info
> 
> Deepthi Kavalur (1):
>   net/i40e/base: fix loop counter width in DCB parsing
> 
Series-Acked-by: Bruce Richardson <bruce.richardson@intel.com>

Applied to dpdk-next-net-intel.
Thanks,
/Bruce
>  .mailmap                                     |  1 +
>  drivers/net/intel/i40e/base/README           |  4 +-
>  drivers/net/intel/i40e/base/i40e_dcb.c       |  6 +-
>  drivers/net/intel/i40e/base/i40e_nvm.c       | 67 +++++++++++++-------
>  drivers/net/intel/i40e/base/i40e_prototype.h |  2 +-
>  drivers/net/intel/i40e/base/i40e_type.h      |  2 +-
>  drivers/net/intel/i40e/i40e_ethdev.c         |  3 +-
>  7 files changed, 55 insertions(+), 30 deletions(-)
> 
> -- 
> 2.43.0
> 

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2026-05-20 10:18 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-19 14:52 [PATCH 0/3] i40e base code update Ciara Loftus
2026-05-19 14:52 ` [PATCH 1/3] net/i40e/base: fix integer overflow in NVM timing logic Ciara Loftus
2026-05-19 14:52 ` [PATCH 2/3] net/i40e/base: fix loop counter width in DCB parsing Ciara Loftus
2026-05-19 14:52 ` [PATCH 3/3] net/i40e/base: update version info Ciara Loftus
2026-05-20 10:17 ` [PATCH 0/3] i40e base code update Bruce Richardson

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox