[PATCH 00/14] common/sfc_efx/base: fix code analysis issues

[PATCH 00/14] common/sfc_efx/base: fix code analysis issues

[Ivan Malov]

This series addresses code analysis defects in the
common/sfc_efx/base library.

The first four patches fix excessive stack consumption in
MCDI helper functions, each exceeding 1 KB on-stack, by
switching to heap-allocated payload buffers.

The remaining ten patches correct SAL annotations, add NULL
checks across netport and filter helpers, resolving
uninitialised memory, buffer overrun, and potential
dereference issues. The final patch widens loop
variable types to address a CodeQL warning.

Andy Moreton (14):
  common/sfc_efx/base: reduce stack in RSS context table write
  common/sfc_efx/base: reduce stack in get addr regions MCDI
  common/sfc_efx/base: reduce stack in set addr regions MCDI
  common/sfc_efx/base: reduce stack in netport stat describe
  common/sfc_efx/base: fix filter saved spec handling
  common/sfc_efx/base: fix annotations in client MAC addr get
  common/sfc_efx/base: fix annotations in HW-SW mask converter
  common/sfc_efx/base: fix annotations in get fixed port props
  common/sfc_efx/base: fix annotations in SW-HW enum converter
  common/sfc_efx/base: fix annotation in netport stat describe
  common/sfc_efx/base: fix flex array in netport stat describe
  common/sfc_efx/base: fix filter in SW-HW mask converter
  common/sfc_efx/base: rework SW mask to HW enum converter
  common/sfc_efx/base: cleanup wider type comparisons in loops

 drivers/common/sfc_efx/base/ef10_filter.c |  11 +-
 drivers/common/sfc_efx/base/ef10_mcdi.c   |   2 +-
 drivers/common/sfc_efx/base/ef10_nvram.c  |   4 +-
 drivers/common/sfc_efx/base/ef10_rx.c     |  22 +++-
 drivers/common/sfc_efx/base/efx.h         |   3 +-
 drivers/common/sfc_efx/base/efx_bootcfg.c |   2 +-
 drivers/common/sfc_efx/base/efx_mcdi.c    |  50 +++++--
 drivers/common/sfc_efx/base/efx_np.c      | 152 ++++++++++++----------
 drivers/common/sfc_efx/base/mcdi_mon.c    |   2 +-
 9 files changed, 155 insertions(+), 93 deletions(-)

-- 
2.47.3

[PATCH 01/14] common/sfc_efx/base: reduce stack in RSS context table write

[Ivan Malov]

From: Andy Moreton <andy.moreton@amd.com>

Code analysis reports an error for excessive stack consumption
(over 1KB). Use a heap allocated payload buffer instead.

Fixes: e7ea5f304f0f ("common/sfc_efx/base: support selecting RSS table entry count")
Cc: stable@dpdk.org

Signed-off-by: Andy Moreton <andy.moreton@amd.com>
Reviewed-by: Ivan Malov <ivan.malov@arknetworks.am>
Reviewed-by: Viacheslav Galaktionov <viacheslav.galaktionov@arknetworks.am>
---
 drivers/common/sfc_efx/base/ef10_rx.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/drivers/common/sfc_efx/base/ef10_rx.c b/drivers/common/sfc_efx/base/ef10_rx.c
index afc9cf025f..ed9943dc2c 100644
--- a/drivers/common/sfc_efx/base/ef10_rx.c
+++ b/drivers/common/sfc_efx/base/ef10_rx.c
@@ -394,11 +394,10 @@ efx_mcdi_rss_context_write_table(
 	__in			unsigned int nentries)
 {
 	const efx_nic_cfg_t *encp = efx_nic_cfg_get(enp);
+	uint8_t *payload = NULL;
 	efx_mcdi_req_t req;
-	EFX_MCDI_DECLARE_BUF(payload,
-	     MC_CMD_RSS_CONTEXT_WRITE_TABLE_IN_LENMAX_MCDI2,
-	     MC_CMD_RSS_CONTEXT_WRITE_TABLE_OUT_LEN);
 	unsigned int i;
+	size_t size;
 	int rc;
 
 	if (nentries >
@@ -413,6 +412,15 @@ efx_mcdi_rss_context_write_table(
 		goto fail2;
 	}
 
+	size = MAX(MC_CMD_RSS_CONTEXT_WRITE_TABLE_IN_LEN(nentries),
+	    MC_CMD_RSS_CONTEXT_WRITE_TABLE_OUT_LEN);
+
+	EFSYS_KMEM_ALLOC(enp->en_esip, size, payload);
+	if (payload == NULL) {
+		rc = ENOMEM;
+		goto fail3;
+	}
+
 	req.emr_cmd = MC_CMD_RSS_CONTEXT_WRITE_TABLE;
 	req.emr_in_buf = payload;
 	req.emr_in_length = MC_CMD_RSS_CONTEXT_WRITE_TABLE_IN_LEN(nentries);
@@ -425,7 +433,7 @@ efx_mcdi_rss_context_write_table(
 	for (i = 0; i < nentries; ++i) {
 		if (table[i] >= encp->enc_rx_scale_indirection_max_nqueues) {
 			rc = EINVAL;
-			goto fail3;
+			goto fail4;
 		}
 
 		MCDI_IN_POPULATE_INDEXED_DWORD_2(req,
@@ -437,13 +445,17 @@ efx_mcdi_rss_context_write_table(
 	efx_mcdi_execute(enp, &req);
 	if (req.emr_rc != 0) {
 		rc = req.emr_rc;
-		goto fail4;
+		goto fail5;
 	}
 
+	EFSYS_KMEM_FREE(enp->en_esip, size, payload);
 	return (0);
 
+fail5:
+	EFSYS_PROBE(fail5);
 fail4:
 	EFSYS_PROBE(fail4);
+	EFSYS_KMEM_FREE(enp->en_esip, size, payload);
 fail3:
 	EFSYS_PROBE(fail3);
 fail2:
-- 
2.47.3

[PATCH 02/14] common/sfc_efx/base: reduce stack in get addr regions MCDI

[Ivan Malov]

From: Andy Moreton <andy.moreton@amd.com>

Code analysis reports an error for excessive stack consumption
(over 1KB). Use a heap allocated payload buffer instead.

Fixes: 60fb370c7bc9 ("common/sfc_efx/base: support NIC DMA memory regions API")
Cc: stable@dpdk.org

Signed-off-by: Andy Moreton <andy.moreton@amd.com>
Reviewed-by: Ivan Malov <ivan.malov@arknetworks.am>
Reviewed-by: Viacheslav Galaktionov <viacheslav.galaktionov@arknetworks.am>
---
 drivers/common/sfc_efx/base/efx_mcdi.c | 26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/drivers/common/sfc_efx/base/efx_mcdi.c b/drivers/common/sfc_efx/base/efx_mcdi.c
index 670b0d5cda..7dc58992be 100644
--- a/drivers/common/sfc_efx/base/efx_mcdi.c
+++ b/drivers/common/sfc_efx/base/efx_mcdi.c
@@ -3439,15 +3439,24 @@ efx_mcdi_get_nic_addr_regions(
 	__in		efx_nic_t *enp,
 	__out		efx_nic_dma_region_info_t *endrip)
 {
-	EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_DESC_ADDR_REGIONS_IN_LEN,
-		MC_CMD_GET_DESC_ADDR_REGIONS_OUT_LENMAX_MCDI2);
+	uint8_t *payload = NULL;
 	efx_xword_t *regions;
 	efx_mcdi_req_t req;
+	size_t size;
 	efx_rc_t rc;
 	size_t alloc_size;
 	unsigned int nregions;
 	unsigned int i;
 
+	size = MAX(MC_CMD_GET_DESC_ADDR_REGIONS_IN_LEN,
+	    MC_CMD_GET_DESC_ADDR_REGIONS_OUT_LENMAX_MCDI2);
+
+	EFSYS_KMEM_ALLOC(enp->en_esip, size, payload);
+	if (payload == NULL) {
+		rc = ENOMEM;
+		goto fail1;
+	}
+
 	req.emr_cmd = MC_CMD_GET_DESC_ADDR_REGIONS;
 	req.emr_in_buf = payload;
 	req.emr_in_length = MC_CMD_GET_DESC_ADDR_REGIONS_IN_LEN;
@@ -3458,13 +3467,13 @@ efx_mcdi_get_nic_addr_regions(
 
 	if (req.emr_rc != 0) {
 		rc = req.emr_rc;
-		goto fail1;
+		goto fail2;
 	}
 
 	if (req.emr_out_length_used <
 	    MC_CMD_GET_DESC_ADDR_REGIONS_OUT_LENMIN) {
 		rc = EMSGSIZE;
-		goto fail2;
+		goto fail3;
 	}
 
 	nregions = MC_CMD_GET_DESC_ADDR_REGIONS_OUT_REGIONS_NUM(
@@ -3477,7 +3486,7 @@ efx_mcdi_get_nic_addr_regions(
 	alloc_size = nregions * sizeof(endrip->endri_regions[0]);
 	if (alloc_size / sizeof (endrip->endri_regions[0]) != nregions) {
 		rc = ENOMEM;
-		goto fail3;
+		goto fail4;
 	}
 
 	EFSYS_KMEM_ALLOC(enp->en_esip,
@@ -3485,7 +3494,7 @@ efx_mcdi_get_nic_addr_regions(
 	    endrip->endri_regions);
 	if (endrip->endri_regions == NULL) {
 		rc = ENOMEM;
-		goto fail4;
+		goto fail5;
 	}
 
 	endrip->endri_count = nregions;
@@ -3517,14 +3526,19 @@ efx_mcdi_get_nic_addr_regions(
 		        DESC_ADDR_REGION_TRGT_ADDR_ALIGN_LOG2);
 	}
 
+	EFSYS_KMEM_FREE(enp->en_esip, size, payload);
+
 	return (0);
 
+fail5:
+	EFSYS_PROBE(fail5);
 fail4:
 	EFSYS_PROBE(fail4);
 fail3:
 	EFSYS_PROBE(fail3);
 fail2:
 	EFSYS_PROBE(fail2);
+	EFSYS_KMEM_FREE(enp->en_esip, size, payload);
 fail1:
 	EFSYS_PROBE1(fail1, efx_rc_t, rc);
 
-- 
2.47.3

[PATCH 03/14] common/sfc_efx/base: reduce stack in set addr regions MCDI

[Ivan Malov]

From: Andy Moreton <andy.moreton@amd.com>

Code analysis reports an error for excessive stack consumption
(over 1KB). Use a heap allocated payload buffer instead.

Fixes: 60fb370c7bc9 ("common/sfc_efx/base: support NIC DMA memory regions API")
Cc: stable@dpdk.org

Signed-off-by: Andy Moreton <andy.moreton@amd.com>
Reviewed-by: Ivan Malov <ivan.malov@arknetworks.am>
Reviewed-by: Viacheslav Galaktionov <viacheslav.galaktionov@arknetworks.am>
---
 drivers/common/sfc_efx/base/efx_mcdi.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/drivers/common/sfc_efx/base/efx_mcdi.c b/drivers/common/sfc_efx/base/efx_mcdi.c
index 7dc58992be..58ad1a1bc1 100644
--- a/drivers/common/sfc_efx/base/efx_mcdi.c
+++ b/drivers/common/sfc_efx/base/efx_mcdi.c
@@ -3550,12 +3550,11 @@ efx_mcdi_set_nic_addr_regions(
 	__in		efx_nic_t *enp,
 	__in		const efx_nic_dma_region_info_t *endrip)
 {
-	EFX_MCDI_DECLARE_BUF(payload,
-		MC_CMD_SET_DESC_ADDR_REGIONS_IN_LENMAX_MCDI2,
-		MC_CMD_SET_DESC_ADDR_REGIONS_OUT_LEN);
 	efx_qword_t *trgt_addr_base;
+	uint8_t *payload = NULL;
 	efx_mcdi_req_t req;
 	unsigned int i;
+	size_t size;
 	efx_rc_t rc;
 
 	if (endrip->endri_count >
@@ -3564,6 +3563,15 @@ efx_mcdi_set_nic_addr_regions(
 		goto fail1;
 	}
 
+	size = MAX(MC_CMD_SET_DESC_ADDR_REGIONS_IN_LEN(endrip->endri_count),
+	    MC_CMD_SET_DESC_ADDR_REGIONS_OUT_LEN);
+
+	EFSYS_KMEM_ALLOC(enp->en_esip, size, payload);
+	if (payload == NULL) {
+		rc = ENOMEM;
+		goto fail2;
+	}
+
 	req.emr_cmd = MC_CMD_SET_DESC_ADDR_REGIONS;
 	req.emr_in_buf = payload;
 	req.emr_in_length =
@@ -3598,11 +3606,16 @@ efx_mcdi_set_nic_addr_regions(
 
 	if (req.emr_rc != 0) {
 		rc = req.emr_rc;
-		goto fail2;
+		goto fail3;
 	}
 
+	EFSYS_KMEM_FREE(enp->en_esip, size, payload);
+
 	return (0);
 
+fail3:
+	EFSYS_PROBE(fail3);
+	EFSYS_KMEM_FREE(enp->en_esip, size, payload);
 fail2:
 	EFSYS_PROBE(fail2);
 fail1:
-- 
2.47.3

[PATCH 04/14] common/sfc_efx/base: reduce stack in netport stat describe

[Ivan Malov]

From: Andy Moreton <andy.moreton@amd.com>

Code analysis reports an error for excessive stack consumption
(over 1KB). Use a heap allocated payload buffer instead.

Fixes: f2f77453cb9f ("common/sfc_efx/base: fill in software LUT for MAC statistics")
Cc: stable@dpdk.org

Signed-off-by: Andy Moreton <andy.moreton@amd.com>
Reviewed-by: Ivan Malov <ivan.malov@arknetworks.am>
Reviewed-by: Viacheslav Galaktionov <viacheslav.galaktionov@arknetworks.am>
---
 drivers/common/sfc_efx/base/efx_np.c | 37 +++++++++++++++++++---------
 1 file changed, 25 insertions(+), 12 deletions(-)

diff --git a/drivers/common/sfc_efx/base/efx_np.c b/drivers/common/sfc_efx/base/efx_np.c
index 45f3cd07ed..5044eabdd3 100644
--- a/drivers/common/sfc_efx/base/efx_np.c
+++ b/drivers/common/sfc_efx/base/efx_np.c
@@ -778,22 +778,30 @@ efx_np_stats_describe(
 	__out_opt			uint32_t *nprocessedp,
 	__out_opt			uint32_t *nstats_maxp)
 {
-	EFX_MCDI_DECLARE_BUF(payload,
-	    MC_CMD_MAC_STATISTICS_DESCRIPTOR_IN_LEN,
-	    MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_LENMAX_MCDI2);
+	uint8_t *payload = NULL;
 	uint32_t nprocessed;
 	efx_mcdi_req_t req;
 	uint8_t *entries;
 	uint32_t stride;
 	unsigned int i;
 	size_t out_sz;
+	size_t size;
 	efx_rc_t rc;
 
-	req.emr_out_length = MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_LENMAX_MCDI2;
-	req.emr_in_length = MC_CMD_MAC_STATISTICS_DESCRIPTOR_IN_LEN;
+	size = MAX(MC_CMD_MAC_STATISTICS_DESCRIPTOR_IN_LEN,
+	    MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_LENMAX_MCDI2);
+
+	EFSYS_KMEM_ALLOC(enp->en_esip, size, payload);
+	if (payload == NULL) {
+		rc = ENOMEM;
+		goto fail1;
+	}
+
 	req.emr_cmd = MC_CMD_MAC_STATISTICS_DESCRIPTOR;
-	req.emr_out_buf = payload;
 	req.emr_in_buf = payload;
+	req.emr_in_length = MC_CMD_MAC_STATISTICS_DESCRIPTOR_IN_LEN;
+	req.emr_out_buf = payload;
+	req.emr_out_length = MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_LENMAX_MCDI2;
 
 	MCDI_IN_SET_DWORD(req, MAC_STATISTICS_DESCRIPTOR_IN_PORT_HANDLE, nph);
 	MCDI_IN_SET_DWORD(req, MAC_STATISTICS_DESCRIPTOR_IN_OFFSET, req_ofst);
@@ -802,13 +810,13 @@ efx_np_stats_describe(
 
 	if (req.emr_rc != 0) {
 		rc = req.emr_rc;
-		goto fail1;
+		goto fail2;
 	}
 
 	out_sz = req.emr_out_length_used;
 	if (out_sz < MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_LENMIN) {
 		rc = EMSGSIZE;
-		goto fail2;
+		goto fail3;
 	}
 
 	if (nstats_maxp != NULL) {
@@ -818,13 +826,13 @@ efx_np_stats_describe(
 	}
 
 	if (lut_nentries == 0 || lut == NULL || nprocessedp == NULL)
-		return (0);
+		goto out;
 
 	stride = MCDI_OUT_DWORD(req, MAC_STATISTICS_DESCRIPTOR_OUT_ENTRY_SIZE);
 	nprocessed = MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_ENTRIES_NUM(out_sz);
 	if (nprocessed == 0) {
 		rc = EMSGSIZE;
-		goto fail3;
+		goto fail4;
 	}
 
 	entries = MCDI_OUT2(req, uint8_t,
@@ -834,14 +842,19 @@ efx_np_stats_describe(
 		efx_np_stat_describe(entries + i * stride, lut_nentries, lut);
 
 	*nprocessedp = nprocessed;
+
+out:
+	EFSYS_KMEM_FREE(enp->en_esip, size, payload);
+
 	return (0);
 
+fail4:
+	EFSYS_PROBE(fail4);
 fail3:
 	EFSYS_PROBE(fail3);
-
 fail2:
 	EFSYS_PROBE(fail2);
-
+	EFSYS_KMEM_FREE(enp->en_esip, size, payload);
 fail1:
 	EFSYS_PROBE1(fail1, efx_rc_t, rc);
 	return (rc);
-- 
2.47.3

[PATCH 05/14] common/sfc_efx/base: fix filter saved spec handling

[Ivan Malov]

From: Andy Moreton <andy.moreton@amd.com>

Code Analysis notes that saved_spec can be NULL when passed into
ef10_filter_add_select_action and ef10_filter_add_execute_action
from ef10_filter_add_internal.

Fix the annotations to show that the saved_spec is optional, and
add NULL checks before dereferencing it.

Fixes: 585c22edb29c ("net/sfc/base: handle manual and auto filter clashes in EF10")
Cc: stable@dpdk.org

Signed-off-by: Andy Moreton <andy.moreton@amd.com>
Reviewed-by: Ivan Malov <ivan.malov@arknetworks.am>
Reviewed-by: Viacheslav Galaktionov <viacheslav.galaktionov@arknetworks.am>
---
 drivers/common/sfc_efx/base/ef10_filter.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/common/sfc_efx/base/ef10_filter.c b/drivers/common/sfc_efx/base/ef10_filter.c
index 2a10720122..0d69ec5ba8 100644
--- a/drivers/common/sfc_efx/base/ef10_filter.c
+++ b/drivers/common/sfc_efx/base/ef10_filter.c
@@ -690,7 +690,7 @@ ef10_filter_add_lookup_equal_spec(
 
 static			void
 ef10_filter_add_select_action(
-	__in		efx_filter_spec_t *saved_spec,
+	__in_opt	efx_filter_spec_t *saved_spec,
 	__in		efx_filter_spec_t *spec,
 	__out		enum ef10_filter_add_action_e *action,
 	__out		efx_filter_spec_t **overridden_spec)
@@ -752,7 +752,7 @@ ef10_filter_add_select_action(
 static	__checkReturn	efx_rc_t
 ef10_filter_add_execute_action(
 	__in		efx_nic_t *enp,
-	__in		efx_filter_spec_t *saved_spec,
+	__in_opt	efx_filter_spec_t *saved_spec,
 	__in		efx_filter_spec_t *spec,
 	__in		efx_filter_spec_t *overridden_spec,
 	__in		enum ef10_filter_add_action_e action,
@@ -769,7 +769,8 @@ ef10_filter_add_execute_action(
 		goto out_unlock;
 	} else if (action == EF10_FILTER_ADD_STORE) {
 		EFSYS_ASSERT(overridden_spec != NULL);
-		saved_spec->efs_overridden_spec = overridden_spec;
+		if (saved_spec != NULL)
+			saved_spec->efs_overridden_spec = overridden_spec;
 		goto out_unlock;
 	}
 
@@ -806,7 +807,7 @@ ef10_filter_add_execute_action(
 
 	EFSYS_LOCK(enp->en_eslp, state);
 
-	if (action == EF10_FILTER_ADD_REPLACE) {
+	if ((action == EF10_FILTER_ADD_REPLACE) && (saved_spec != NULL)) {
 		/* Update the fields that may differ */
 		saved_spec->efs_priority = spec->efs_priority;
 		saved_spec->efs_flags = spec->efs_flags;
-- 
2.47.3

[PATCH 06/14] common/sfc_efx/base: fix annotations in client MAC addr get

[Ivan Malov]

From: Andy Moreton <andy.moreton@amd.com>

Fix annotations to show the size written to addr_bytes.

Fixes: 78b82063df10 ("common/sfc_efx/base: manage VNIC MAC address by MCDI handle")
Cc: stable@dpdk.org

Signed-off-by: Andy Moreton <andy.moreton@amd.com>
Reviewed-by: Ivan Malov <ivan.malov@arknetworks.am>
Reviewed-by: Viacheslav Galaktionov <viacheslav.galaktionov@arknetworks.am>
---
 drivers/common/sfc_efx/base/efx.h      | 3 ++-
 drivers/common/sfc_efx/base/efx_mcdi.c | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/common/sfc_efx/base/efx.h b/drivers/common/sfc_efx/base/efx.h
index 2aa52b401d..b8d1ccd7bd 100644
--- a/drivers/common/sfc_efx/base/efx.h
+++ b/drivers/common/sfc_efx/base/efx.h
@@ -439,7 +439,8 @@ extern	__checkReturn	efx_rc_t
 efx_mcdi_client_mac_addr_get(
 	__in		efx_nic_t *enp,
 	__in		uint32_t client_handle,
-	__out		uint8_t addr_bytes[EFX_MAC_ADDR_LEN]);
+	__out_bcount(EFX_MAC_ADDR_LEN)
+			uint8_t addr_bytes[EFX_MAC_ADDR_LEN]);
 
 LIBEFX_API
 extern	__checkReturn	efx_rc_t
diff --git a/drivers/common/sfc_efx/base/efx_mcdi.c b/drivers/common/sfc_efx/base/efx_mcdi.c
index 58ad1a1bc1..8f14f38cdc 100644
--- a/drivers/common/sfc_efx/base/efx_mcdi.c
+++ b/drivers/common/sfc_efx/base/efx_mcdi.c
@@ -737,7 +737,8 @@ efx_mcdi_get_own_client_handle(
 efx_mcdi_client_mac_addr_get(
 	__in		efx_nic_t *enp,
 	__in		uint32_t client_handle,
-	__out		uint8_t addr_bytes[EFX_MAC_ADDR_LEN])
+	__out_bcount(EFX_MAC_ADDR_LEN)
+			uint8_t addr_bytes[EFX_MAC_ADDR_LEN])
 {
 	efx_mcdi_req_t req;
 	EFX_MCDI_DECLARE_BUF(payload,
-- 
2.47.3

[PATCH 07/14] common/sfc_efx/base: fix annotations in HW-SW mask converter

[Ivan Malov]

From: Andy Moreton <andy.moreton@amd.com>

Code analysis reports that efx_np_cap_mask_hw_to_sw does not always write
to sw_cap_maskp. Fix the annotation to show it is valid on input, and
initialise the mask in efx_np_cap_hw_data_to_sw_mask.

Fixes: a90549f527eb ("common/sfc_efx/base: get netport fixed capabilities on probe")
Cc: stable@dpdk.org

Signed-off-by: Andy Moreton <andy.moreton@amd.com>
Reviewed-by: Ivan Malov <ivan.malov@arknetworks.am>
Reviewed-by: Viacheslav Galaktionov <viacheslav.galaktionov@arknetworks.am>
---
 drivers/common/sfc_efx/base/efx_np.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/common/sfc_efx/base/efx_np.c b/drivers/common/sfc_efx/base/efx_np.c
index 5044eabdd3..baee83e58e 100644
--- a/drivers/common/sfc_efx/base/efx_np.c
+++ b/drivers/common/sfc_efx/base/efx_np.c
@@ -190,7 +190,7 @@ efx_np_cap_mask_hw_to_sw(
 	__in				unsigned int hw_sw_map_nentries,
 	__in_bcount(hw_cap_data_nbytes)	const uint8_t *hw_cap_data,
 	__in				size_t hw_cap_data_nbytes,
-	__out				uint32_t *sw_cap_maskp)
+	__inout				uint32_t *sw_cap_maskp)
 {
 	FOREACH_SUP_CAP(hw_sw_map, hw_sw_map_nentries,
 	    hw_cap_data, hw_cap_data_nbytes) {
@@ -216,6 +216,8 @@ efx_np_cap_hw_data_to_sw_mask(
 	__in			const uint8_t *hw_data,
 	__out			uint32_t *sw_maskp)
 {
+	*sw_maskp = 0;
+
 	EFX_NP_CAP_MASK_HW_TO_SW(efx_np_cap_map_tech, ETH_AN_FIELDS_TECH_MASK,
 	    hw_data, sw_maskp);
 
@@ -429,21 +431,21 @@ efx_np_link_state(
 	_NOTE(ARGUNUSED(lbp))
 #endif /* EFSYS_OPT_LOOPBACK */
 
-	if (lsp->enls_an_supported != B_FALSE)
-		lsp->enls_adv_cap_mask |= 1U << EFX_PHY_CAP_AN;
-
 	efx_np_cap_hw_data_to_sw_mask(
 	    MCDI_OUT2(req, const uint8_t, LINK_STATE_OUT_ADVERTISED_ABILITIES),
 	    &lsp->enls_adv_cap_mask);
 
-	if (status_flags & (1U << MC_CMD_LINK_STATUS_FLAGS_AN_ABLE))
-		lsp->enls_lp_cap_mask |= 1U << EFX_PHY_CAP_AN;
+	if (lsp->enls_an_supported != B_FALSE)
+		lsp->enls_adv_cap_mask |= 1U << EFX_PHY_CAP_AN;
 
 	efx_np_cap_hw_data_to_sw_mask(
 	    MCDI_OUT2(req, const uint8_t,
 		    LINK_STATE_OUT_LINK_PARTNER_ABILITIES),
 	    &lsp->enls_lp_cap_mask);
 
+	if (status_flags & (1U << MC_CMD_LINK_STATUS_FLAGS_AN_ABLE))
+		lsp->enls_lp_cap_mask |= 1U << EFX_PHY_CAP_AN;
+
 	tech = MCDI_OUT_WORD(req, LINK_STATE_OUT_LINK_TECHNOLOGY);
 
 	if (tech < EFX_ARRAY_SIZE(efx_np_tech_to_lane_count))
-- 
2.47.3

[PATCH 08/14] common/sfc_efx/base: fix annotations in get fixed port props

[Ivan Malov]

From: Andy Moreton <andy.moreton@amd.com>

Code analysis reports a buffer overrun for the sup_cap_rawp argument.
Fix the annotation to show the writable buffer size.

Fixes: a90549f527eb ("common/sfc_efx/base: get netport fixed capabilities on probe")
Cc: stable@dpdk.org

Signed-off-by: Andy Moreton <andy.moreton@amd.com>
Reviewed-by: Ivan Malov <ivan.malov@arknetworks.am>
Reviewed-by: Viacheslav Galaktionov <viacheslav.galaktionov@arknetworks.am>
---
 drivers/common/sfc_efx/base/efx_np.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/common/sfc_efx/base/efx_np.c b/drivers/common/sfc_efx/base/efx_np.c
index baee83e58e..8b8e37c0e1 100644
--- a/drivers/common/sfc_efx/base/efx_np.c
+++ b/drivers/common/sfc_efx/base/efx_np.c
@@ -235,7 +235,8 @@ static	__checkReturn		efx_rc_t
 efx_np_get_fixed_port_props(
 	__in			efx_nic_t *enp,
 	__in			efx_np_handle_t nph,
-	__out_opt		uint8_t *sup_cap_rawp,
+	__out_bcount_opt(MC_CMD_ETH_AN_FIELDS_LEN)
+				uint8_t *sup_cap_rawp,
 	__out_opt		uint32_t *sup_cap_maskp,
 	__out_opt		efx_qword_t *loopback_cap_maskp)
 {
-- 
2.47.3

[PATCH 09/14] common/sfc_efx/base: fix annotations in SW-HW enum converter

[Ivan Malov]

From: Andy Moreton <andy.moreton@amd.com>

Code analysis reports returning uninitialised memory in *enum_hwp.
Fix the annotations to show that the write only occurs on successful
return.

Fixes: 2be7d23f3fe6 ("common/sfc_efx/base: fill in loopback modes on netport probe")
Cc: stable@dpdk.org

Signed-off-by: Andy Moreton <andy.moreton@amd.com>
Reviewed-by: Ivan Malov <ivan.malov@arknetworks.am>
Reviewed-by: Viacheslav Galaktionov <viacheslav.galaktionov@arknetworks.am>
---
 drivers/common/sfc_efx/base/efx_np.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/common/sfc_efx/base/efx_np.c b/drivers/common/sfc_efx/base/efx_np.c
index 8b8e37c0e1..6cf5aeac11 100644
--- a/drivers/common/sfc_efx/base/efx_np.c
+++ b/drivers/common/sfc_efx/base/efx_np.c
@@ -504,6 +504,7 @@ efx_np_sw_link_mode_to_cap(
 	return (0);
 }
 
+__success(*supportedp != 0)
 static					void
 efx_np_cap_enum_sw_to_hw(
 	__in_ecount(hw_sw_map_nentries)	const struct efx_np_cap_map *hw_sw_map,
-- 
2.47.3

[PATCH 10/14] common/sfc_efx/base: fix annotation in netport stat describe

[Ivan Malov]

From: Andy Moreton <andy.moreton@amd.com>

Code analysis reported a NULL dereference of the lut parameter.
Fix the annotation to show it is not optional (must be non-NULL).

Fixes: f2f77453cb9f ("common/sfc_efx/base: fill in software LUT for MAC statistics")
Cc: stable@dpdk.org

Signed-off-by: Andy Moreton <andy.moreton@amd.com>
Reviewed-by: Ivan Malov <ivan.malov@arknetworks.am>
Reviewed-by: Viacheslav Galaktionov <viacheslav.galaktionov@arknetworks.am>
---
 drivers/common/sfc_efx/base/efx_np.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/common/sfc_efx/base/efx_np.c b/drivers/common/sfc_efx/base/efx_np.c
index 6cf5aeac11..86e5d11506 100644
--- a/drivers/common/sfc_efx/base/efx_np.c
+++ b/drivers/common/sfc_efx/base/efx_np.c
@@ -734,7 +734,7 @@ static					void
 efx_np_stat_describe(
 	__in				uint8_t *hw_entry_buf,
 	__in				unsigned int lut_nentries,
-	__out_ecount_opt(lut_nentries)	efx_np_stat_t *lut)
+	__out_ecount(lut_nentries)	efx_np_stat_t *lut)
 {
 	const efx_np_stat_t *map;
 	efx_mac_stat_t sw_id;
-- 
2.47.3

[PATCH 11/14] common/sfc_efx/base: fix flex array in netport stat describe

[Ivan Malov]

From: Andy Moreton <andy.moreton@amd.com>

Code analysis reported returning uninitialised memory at *lut and
*nprocessedp. Refactor to ensure these parameters are only used
when non-NULL.

This function should also be using the ENTRY_COUNT field for the
number of descriptors returned, as the descriptor size is not
known statically (they are extensible). Also use the MORE_ENTRIES
flag to determine if all of the descriptors have been fetched.

Fixes: f2f77453cb9f ("common/sfc_efx/base: fill in software LUT for MAC statistics")
Cc: stable@dpdk.org

Signed-off-by: Andy Moreton <andy.moreton@amd.com>
Reviewed-by: Ivan Malov <ivan.malov@arknetworks.am>
Reviewed-by: Viacheslav Galaktionov <viacheslav.galaktionov@arknetworks.am>
---
 drivers/common/sfc_efx/base/efx_np.c | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/drivers/common/sfc_efx/base/efx_np.c b/drivers/common/sfc_efx/base/efx_np.c
index 86e5d11506..af06c10ecc 100644
--- a/drivers/common/sfc_efx/base/efx_np.c
+++ b/drivers/common/sfc_efx/base/efx_np.c
@@ -783,10 +783,11 @@ efx_np_stats_describe(
 	__out_opt			uint32_t *nstats_maxp)
 {
 	uint8_t *payload = NULL;
-	uint32_t nprocessed;
 	efx_mcdi_req_t req;
 	uint8_t *entries;
 	uint32_t stride;
+	uint32_t count;
+	uint32_t more;
 	unsigned int i;
 	size_t out_sz;
 	size_t size;
@@ -829,25 +830,28 @@ efx_np_stats_describe(
 		    sizeof (efx_qword_t);
 	}
 
-	if (lut_nentries == 0 || lut == NULL || nprocessedp == NULL)
-		goto out;
-
 	stride = MCDI_OUT_DWORD(req, MAC_STATISTICS_DESCRIPTOR_OUT_ENTRY_SIZE);
-	nprocessed = MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_ENTRIES_NUM(out_sz);
-	if (nprocessed == 0) {
+	count = MCDI_OUT_DWORD(req, MAC_STATISTICS_DESCRIPTOR_OUT_ENTRY_COUNT);
+	more = MCDI_OUT_DWORD(req, MAC_STATISTICS_DESCRIPTOR_OUT_MORE_ENTRIES);
+
+	if ((count == 0) && (more != 0)) {
 		rc = EMSGSIZE;
 		goto fail4;
 	}
 
-	entries = MCDI_OUT2(req, uint8_t,
-	    MAC_STATISTICS_DESCRIPTOR_OUT_ENTRIES);
+	if (lut != NULL) {
+		entries = MCDI_OUT2(req, uint8_t,
+		    MAC_STATISTICS_DESCRIPTOR_OUT_ENTRIES);
 
-	for (i = 0; i < nprocessed; ++i)
-		efx_np_stat_describe(entries + i * stride, lut_nentries, lut);
+		for (i = 0; i < count; ++i) {
+			efx_np_stat_describe(entries + i * stride,
+			    lut_nentries, lut);
+		}
+	}
 
-	*nprocessedp = nprocessed;
+	if (nprocessedp != NULL)
+		*nprocessedp = count;
 
-out:
 	EFSYS_KMEM_FREE(enp->en_esip, size, payload);
 
 	return (0);
-- 
2.47.3

[PATCH 12/14] common/sfc_efx/base: fix filter in SW-HW mask converter

[Ivan Malov]

From: Andy Moreton <andy.moreton@amd.com>

Code analysis reports that the optional filter_arg could be used to invoke
the callback, but that function has type efx_np_cap_filter_cb, where the
argument is required. Add a NULL check to ensure that the filter_arg
is valid when invoking the callback.

Fixes: b50ff442479c ("common/sfc_efx/base: support controls for netport lane count")
Cc: stable@dpdk.org

Signed-off-by: Andy Moreton <andy.moreton@amd.com>
Reviewed-by: Ivan Malov <ivan.malov@arknetworks.am>
Reviewed-by: Viacheslav Galaktionov <viacheslav.galaktionov@arknetworks.am>
---
 drivers/common/sfc_efx/base/efx_np.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/common/sfc_efx/base/efx_np.c b/drivers/common/sfc_efx/base/efx_np.c
index af06c10ecc..180f24c8e5 100644
--- a/drivers/common/sfc_efx/base/efx_np.c
+++ b/drivers/common/sfc_efx/base/efx_np.c
@@ -1160,7 +1160,7 @@ efx_np_cap_mask_sw_to_hw(
 	__in				uint32_t mask_sw,
 	__in_opt			efx_np_cap_filter_cb *filter_cb,
 	__in_opt			void *filter_arg,
-	__out				uint8_t *mask_hwp)
+	__inout				uint8_t *mask_hwp)
 {
 	FOREACH_SUP_CAP(hw_sw_map, hw_sw_map_nentries,
 	    hw_cap_data, hw_cap_data_nbytes) {
@@ -1169,8 +1169,8 @@ efx_np_cap_mask_sw_to_hw(
 		if ((mask_sw & flag_sw) != flag_sw)
 			continue;
 
-		if (filter_cb != NULL &&
-		    filter_cb(hw_sw_map->encm_hw, filter_arg) == B_FALSE)
+		if ((filter_cb != NULL) && (filter_arg != NULL) &&
+		    (filter_cb(hw_sw_map->encm_hw, filter_arg) == B_FALSE))
 			continue;
 
 		mask_hwp[CAP_BYTE(hw_sw_map)] |= CAP_FLAG(hw_sw_map);
-- 
2.47.3

[PATCH 13/14] common/sfc_efx/base: rework SW mask to HW enum converter

[Ivan Malov]

From: Andy Moreton <andy.moreton@amd.com>

Code analysis reports that *enum_hwp is not written on successful
return on some paths through this function. Refactor to simplify the
code, and adjust the annotations so it is clear that *enum_hwp is only
written on successful return. Adjust FEC handling in efx_np_link_ctrl
to allow for *supportedp always being updated.

Code analysis also reports that the optional filter_arg can be NULL
when invoking filter_cb, but the callback argument is not optional.
Check that filter_arg is non-NULL to ensure correct usage.

Fixes: 8e79cd30230d ("common/sfc_efx/base: implement PHY link control for Medford4")
Cc: stable@dpdk.org

Signed-off-by: Andy Moreton <andy.moreton@amd.com>
Reviewed-by: Ivan Malov <ivan.malov@arknetworks.am>
Reviewed-by: Viacheslav Galaktionov <viacheslav.galaktionov@arknetworks.am>
---
 drivers/common/sfc_efx/base/efx_np.c | 65 ++++++++++++++--------------
 1 file changed, 32 insertions(+), 33 deletions(-)

diff --git a/drivers/common/sfc_efx/base/efx_np.c b/drivers/common/sfc_efx/base/efx_np.c
index 180f24c8e5..4ba3c7d260 100644
--- a/drivers/common/sfc_efx/base/efx_np.c
+++ b/drivers/common/sfc_efx/base/efx_np.c
@@ -1202,59 +1202,57 @@ efx_np_cap_mask_sw_to_hw(
 	    (_filter_cb), (_filter_arg), (_mask_hwp))
 
 static					void
+__success(*supportedp != 0)
 efx_np_cap_sw_mask_to_hw_enum(
 	__in_ecount(hw_sw_map_nentries)	const struct efx_np_cap_map *hw_sw_map,
 	__in				unsigned int hw_sw_map_nentries,
 	__in_bcount(hw_cap_data_nbytes)	const uint8_t *hw_cap_data,
 	__in				size_t hw_cap_data_nbytes,
 	__in				uint32_t mask_sw,
+	__in				uint16_t enum_hw_def,
 	__in_opt			efx_np_cap_filter_cb *filter_cb,
 	__in_opt			void *filter_arg,
 	__out				boolean_t *supportedp,
 	__out_opt			uint16_t *enum_hwp)
 {
-	unsigned int sw_nflags_req = 0;
-	uint32_t sw_check_mask = 0;
+	boolean_t supported = B_FALSE;
+	uint32_t flags_seen = 0;
 	unsigned int i;
 
 	for (i = 0; i < hw_sw_map_nentries; ++i) {
-		uint32_t flag_sw = 1U << hw_sw_map->encm_sw;
-		unsigned int byte_idx = CAP_BYTE(hw_sw_map);
-		uint8_t flag_hw = CAP_FLAG(hw_sw_map);
+		uint32_t flag_sw = 1U << hw_sw_map[i].encm_sw;
+		unsigned int byte_idx = CAP_BYTE(&hw_sw_map[i]);
+		uint8_t flag_hw = CAP_FLAG(&hw_sw_map[i]);
 
-		if (byte_idx >= hw_cap_data_nbytes) {
-			++(hw_sw_map);
+		if (byte_idx >= hw_cap_data_nbytes)
 			continue;
-		}
 
-		if ((mask_sw & flag_sw) == flag_sw) {
-			if ((sw_check_mask & flag_sw) == 0)
-				++(sw_nflags_req);
+		if ((mask_sw & flag_sw) != flag_sw)
+			continue;
 
-			sw_check_mask |= flag_sw;
+		flags_seen |= flag_sw;
 
-			if ((hw_cap_data[byte_idx] & flag_hw) == flag_hw) {
-				if (filter_cb == NULL ||
-				    filter_cb(hw_sw_map->encm_hw, filter_arg) !=
-				    B_FALSE) {
-					mask_sw &= ~(flag_sw);
+		if ((hw_cap_data[byte_idx] & flag_hw) != flag_hw)
+			continue;
 
-					if (enum_hwp != NULL)
-						*enum_hwp = hw_sw_map->encm_hw;
-				}
-			}
-		}
+		if ((filter_cb != NULL) && (filter_arg != NULL) &&
+		    (filter_cb(hw_sw_map[i].encm_hw, filter_arg) == B_FALSE))
+			continue;
+
+		if (enum_hwp != NULL)
+			*enum_hwp = hw_sw_map[i].encm_hw;
 
-		++(hw_sw_map);
+		supported = B_TRUE;
 	}
 
-	if (sw_check_mask != 0 && (mask_sw & sw_check_mask) == sw_check_mask) {
-		/* Failed to select the enum by at least one capability bit. */
-		*supportedp = B_FALSE;
-		return;
+	if (flags_seen == 0) {
+		if (enum_hwp != NULL)
+			*enum_hwp = enum_hw_def;
+
+		supported = B_TRUE;
 	}
 
-	*supportedp = B_TRUE;
+	*supportedp = supported;
 }
 
 /*
@@ -1266,12 +1264,13 @@ efx_np_cap_sw_mask_to_hw_enum(
  */
 #define	EFX_NP_CAP_SW_MASK_TO_HW_ENUM(					\
 	    _hw_sw_cap_map, _hw_cap_section, _hw_cap_data,		\
-	    _mask_sw, _filter_cb, _filter_arg, _supportedp, _enum_hwp)	\
+	    _mask_sw, _enum_hw_def, _filter_cb, _filter_arg,		\
+	    _supportedp, _enum_hwp)					\
 	efx_np_cap_sw_mask_to_hw_enum((_hw_sw_cap_map),			\
 	    EFX_ARRAY_SIZE(_hw_sw_cap_map),				\
 	    MCDI_STRUCT_MEMBER((_hw_cap_data), const uint8_t,		\
 		    MC_CMD_##_hw_cap_section),				\
-	    MC_CMD_##_hw_cap_section##_LEN, (_mask_sw),			\
+	    MC_CMD_##_hw_cap_section##_LEN, (_mask_sw), (_enum_hw_def),	\
 	    (_filter_cb), (_filter_arg),				\
 	    (_supportedp), (_enum_hwp))
 
@@ -1386,6 +1385,7 @@ efx_np_link_ctrl(
 	} else {
 		EFX_NP_CAP_SW_MASK_TO_HW_ENUM(efx_np_cap_map_tech,
 		    ETH_AN_FIELDS_TECH_MASK, cap_data_raw, cap_mask_sw,
+		    MC_CMD_ETH_TECH_AUTO,
 		    efx_np_filter_tech_by_lane_count_cb, &lane_count,
 		    &supported, &link_tech);
 
@@ -1414,10 +1414,9 @@ efx_np_link_ctrl(
 		 */
 		EFX_NP_CAP_SW_MASK_TO_HW_ENUM(efx_np_cap_map_fec_req,
 		    ETH_AN_FIELDS_FEC_MASK, cap_data_raw, cap_mask_sw,
-		    NULL, NULL, &supported, &cap_enum_hw);
+		    MC_CMD_FEC_AUTO, NULL, NULL, &supported, &cap_enum_hw);
 
-		if ((cap_mask_sw & EFX_PHY_CAP_FEC_MASK) != 0
-		    && supported == B_FALSE) {
+		if (supported == B_FALSE) {
 			rc = ENOTSUP;
 			goto fail5;
 		}
-- 
2.47.3

[PATCH 14/14] common/sfc_efx/base: cleanup wider type comparisons in loops

[Ivan Malov]

From: Andy Moreton <andy.moreton@amd.com>

CodeQL reports errors for comparisons between narrow and wider
types in loop conditions [cpp/infiniteloop]. Use the wider types
to fix that.

Signed-off-by: Andy Moreton <andy.moreton@amd.com>
Reviewed-by: Ivan Malov <ivan.malov@arknetworks.am>
Reviewed-by: Viacheslav Galaktionov <viacheslav.galaktionov@arknetworks.am>
---
 drivers/common/sfc_efx/base/ef10_filter.c | 2 +-
 drivers/common/sfc_efx/base/ef10_mcdi.c   | 2 +-
 drivers/common/sfc_efx/base/ef10_nvram.c  | 4 ++--
 drivers/common/sfc_efx/base/efx_bootcfg.c | 2 +-
 drivers/common/sfc_efx/base/mcdi_mon.c    | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/common/sfc_efx/base/ef10_filter.c b/drivers/common/sfc_efx/base/ef10_filter.c
index 0d69ec5ba8..7d845f1446 100644
--- a/drivers/common/sfc_efx/base/ef10_filter.c
+++ b/drivers/common/sfc_efx/base/ef10_filter.c
@@ -1300,7 +1300,7 @@ ef10_filter_supported_filters(
 	size_t mcdi_list_length;
 	size_t mcdi_encap_list_length;
 	size_t list_length;
-	uint32_t i;
+	size_t i;
 	uint32_t next_buf_idx;
 	size_t next_buf_length;
 	efx_rc_t rc;
diff --git a/drivers/common/sfc_efx/base/ef10_mcdi.c b/drivers/common/sfc_efx/base/ef10_mcdi.c
index f852d1cde3..6f3492efe4 100644
--- a/drivers/common/sfc_efx/base/ef10_mcdi.c
+++ b/drivers/common/sfc_efx/base/ef10_mcdi.c
@@ -140,7 +140,7 @@ ef10_mcdi_send_request(
 	const efx_mcdi_transport_t *emtp = enp->en_mcdi.em_emtp;
 	efsys_mem_t *esmp = emtp->emt_dma_mem;
 	efx_dword_t dword;
-	unsigned int pos;
+	size_t pos;
 
 	EFSYS_ASSERT(EFX_FAMILY_IS_EF100(enp) || EFX_FAMILY_IS_EF10(enp));
 
diff --git a/drivers/common/sfc_efx/base/ef10_nvram.c b/drivers/common/sfc_efx/base/ef10_nvram.c
index ce8357fa94..fd9564760a 100644
--- a/drivers/common/sfc_efx/base/ef10_nvram.c
+++ b/drivers/common/sfc_efx/base/ef10_nvram.c
@@ -2386,7 +2386,7 @@ ef10_nvram_type_to_partn(
 	efx_mcdi_iface_t *emip = &(enp->en_mcdi.em_emip);
 	ef10_parttbl_entry_t *parttbl = NULL;
 	size_t parttbl_rows = 0;
-	unsigned int i;
+	size_t i;
 
 	EFSYS_ASSERT3U(type, !=, EFX_NVRAM_INVALID);
 	EFSYS_ASSERT3U(type, <, EFX_NVRAM_NTYPES);
@@ -2418,7 +2418,7 @@ ef10_nvram_partn_to_type(
 	efx_mcdi_iface_t *emip = &(enp->en_mcdi.em_emip);
 	ef10_parttbl_entry_t *parttbl = NULL;
 	size_t parttbl_rows = 0;
-	unsigned int i;
+	size_t i;
 
 	EFSYS_ASSERT(typep != NULL);
 
diff --git a/drivers/common/sfc_efx/base/efx_bootcfg.c b/drivers/common/sfc_efx/base/efx_bootcfg.c
index c5b8182a3d..83379ea34c 100644
--- a/drivers/common/sfc_efx/base/efx_bootcfg.c
+++ b/drivers/common/sfc_efx/base/efx_bootcfg.c
@@ -140,8 +140,8 @@ efx_dhcp_csum(
 	__in_bcount(size)	uint8_t const *data,
 	__in			size_t size)
 {
-	unsigned int pos;
 	uint8_t checksum = 0;
+	size_t pos;
 
 	for (pos = 0; pos < size; pos++)
 		checksum += data[pos];
diff --git a/drivers/common/sfc_efx/base/mcdi_mon.c b/drivers/common/sfc_efx/base/mcdi_mon.c
index 2089840d2c..c5510e53a8 100644
--- a/drivers/common/sfc_efx/base/mcdi_mon.c
+++ b/drivers/common/sfc_efx/base/mcdi_mon.c
@@ -30,7 +30,7 @@ mcdi_mon_decode_stats(
 {
 	efx_mcdi_iface_t *emip = &(enp->en_mcdi.em_emip);
 	efx_mon_stat_portmask_t port_mask;
-	uint16_t sensor;
+	size_t sensor;
 	size_t sensor_max;
 	uint32_t stat_mask[(EFX_MON_NSTATS + 31) / 32];
 	uint32_t idx = 0;
-- 
2.47.3

Re: [PATCH 00/14] common/sfc_efx/base: fix code analysis issues

[Stephen Hemminger]

On Tue, 11 Aug 2026 21:48:07 +0400
Ivan Malov <ivan.malov@arknetworks.am> wrote:

> This series addresses code analysis defects in the
> common/sfc_efx/base library.
> 
> The first four patches fix excessive stack consumption in
> MCDI helper functions, each exceeding 1 KB on-stack, by
> switching to heap-allocated payload buffers.
> 
> The remaining ten patches correct SAL annotations, add NULL
> checks across netport and filter helpers, resolving
> uninitialised memory, buffer overrun, and potential
> dereference issues. The final patch widens loop
> variable types to address a CodeQL warning.
> 
> Andy Moreton (14):
>   common/sfc_efx/base: reduce stack in RSS context table write
>   common/sfc_efx/base: reduce stack in get addr regions MCDI
>   common/sfc_efx/base: reduce stack in set addr regions MCDI
>   common/sfc_efx/base: reduce stack in netport stat describe
>   common/sfc_efx/base: fix filter saved spec handling
>   common/sfc_efx/base: fix annotations in client MAC addr get
>   common/sfc_efx/base: fix annotations in HW-SW mask converter
>   common/sfc_efx/base: fix annotations in get fixed port props
>   common/sfc_efx/base: fix annotations in SW-HW enum converter
>   common/sfc_efx/base: fix annotation in netport stat describe
>   common/sfc_efx/base: fix flex array in netport stat describe
>   common/sfc_efx/base: fix filter in SW-HW mask converter
>   common/sfc_efx/base: rework SW mask to HW enum converter
>   common/sfc_efx/base: cleanup wider type comparisons in loops
> 
>  drivers/common/sfc_efx/base/ef10_filter.c |  11 +-
>  drivers/common/sfc_efx/base/ef10_mcdi.c   |   2 +-
>  drivers/common/sfc_efx/base/ef10_nvram.c  |   4 +-
>  drivers/common/sfc_efx/base/ef10_rx.c     |  22 +++-
>  drivers/common/sfc_efx/base/efx.h         |   3 +-
>  drivers/common/sfc_efx/base/efx_bootcfg.c |   2 +-
>  drivers/common/sfc_efx/base/efx_mcdi.c    |  50 +++++--
>  drivers/common/sfc_efx/base/efx_np.c      | 152 ++++++++++++----------
>  drivers/common/sfc_efx/base/mcdi_mon.c    |   2 +-
>  9 files changed, 155 insertions(+), 93 deletions(-)
> 

Since AI review by CI is limited. Went with more detailed review
and it spotted lots of issues.

Reviewed the series applied on top of c1a46b9 ("doc: remove unreferenced
KNI and examples figures"). All 14 patches apply cleanly.

Patch 01-04: common/sfc_efx/base: reduce stack in ...

Info: All four conversions replace EFX_MCDI_DECLARE_BUF() with a plain
MAX(IN_LEN, OUT_LEN) size for EFSYS_KMEM_ALLOC. That drops the two
guarantees the macro provides:

  #define EFX_MCDI_BUF_SIZE(_in_len, _out_len)                          \
        EFX_P2ROUNDUP(size_t,                                           \
                MAX(MAX(_in_len, _out_len), (2 * sizeof (efx_dword_t))),\
                sizeof (efx_dword_t))

The dword rounding is not cosmetic: ef10_mcdi_send_request() reads the
payload a full dword at a time

        for (pos = 0; pos < sdu_len; pos += sizeof (efx_dword_t))
                dword = *(efx_dword_t *)((uint8_t *)sdup + pos);

so a non-dword-multiple allocation would be read past its end. For these
four call sites the lengths happen to be dword multiples (4+4*n, 992,
8+8*n, 1020), so there is no defect today, but open-coding MAX() removes
the property for future length changes. Suggest

        size = EFX_MCDI_BUF_SIZE(MC_CMD_..._IN_LEN(n), MC_CMD_..._OUT_LEN);

which is a drop-in and keeps the invariant documented in efx_mcdi.h.

Error path handling in all four is correct: the ENOMEM label sits below
the EFSYS_KMEM_FREE so the failed allocation is not freed, and every
later label falls through to it.

Patch 05: common/sfc_efx/base: fix filter saved spec handling

Info: The two added NULL checks are unreachable. In
ef10_filter_add_select_action(), saved_spec == NULL forces
*action = EF10_FILTER_ADD_NEW; every path that yields ADD_STORE,
ADD_REPLACE or ADD_REFRESH is inside the else branch where saved_spec is
non-NULL. So in ef10_filter_add_execute_action() both

        } else if (action == EF10_FILTER_ADD_STORE) {
                EFSYS_ASSERT(overridden_spec != NULL);
                if (saved_spec != NULL)

and

        if ((action == EF10_FILTER_ADD_REPLACE) && (saved_spec != NULL)) {

test an invariant that already holds. The __in_opt annotations are
accurate and worth keeping, but the STORE branch already asserts its
sibling invariant one line above; an EFSYS_ASSERT(saved_spec != NULL)
would match local style and keep the invariant explicit rather than
silently skipping the efs_overridden_spec assignment if it were ever
violated.

Patch 09: common/sfc_efx/base: fix annotations in SW-HW enum converter

Info: __success() is placed above "static void" here, but in patch 13 it
is placed between "static void" and the function name. Every existing
use in the tree puts it on the return type line, e.g. ef10_nvram.c:941

        __checkReturn   __success(return != B_FALSE)    boolean_t
        ef10_nvram_buffer_find_item(

Please pick one placement for both patches, preferably the existing one.

Patch 11: common/sfc_efx/base: fix flex array in netport stat describe

Error: count and stride are firmware-supplied and are now used to index
the response buffer with no bound derived from the response length:

        stride = MCDI_OUT_DWORD(req, MAC_STATISTICS_DESCRIPTOR_OUT_ENTRY_SIZE);
        count = MCDI_OUT_DWORD(req, MAC_STATISTICS_DESCRIPTOR_OUT_ENTRY_COUNT);
        ...
                for (i = 0; i < count; ++i) {
                        efx_np_stat_describe(entries + i * stride,

entries points at payload + 20 in a 1020-byte allocation, and
efx_np_stat_describe() reads 8 bytes at each entry. Any count beyond
(out_sz - 20) / stride reads response bytes that were never written, and
count * stride above 1000 reads past the end of the heap allocation.

The old code derived the iteration count from out_sz via
MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_ENTRIES_NUM(out_sz), which was
wrong for stride > 8 as the commit message says, but it did bound the
loop by the data actually received. The replacement needs to validate
both fields, e.g. after reading them:

        if (stride < MC_CMD_STAT_DESC_LEN ||
            count > (out_sz -
                     MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_ENTRIES_OFST) /
                    stride) {
                rc = EMSGSIZE;
                goto fail4;
        }

The stride test must come first, since stride == 0 is otherwise a
division by zero.

Warning: MORE_ENTRIES is a one-bit field inside FLAGS:

        MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_FLAGS_OFST 8
        MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_MORE_ENTRIES_OFST 8
        MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_MORE_ENTRIES_LBN 0
        MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_MORE_ENTRIES_WIDTH 1

but the patch reads the whole 32-bit FLAGS dword and tests it against
zero. Any future flag bit added to FLAGS makes (count == 0 && more != 0)
fail a legitimate final response with EMSGSIZE, which fails
efx_np_stats_assign() and therefore probe. Use the field accessor:

        more = MCDI_OUT_DWORD_FIELD(req,
            MAC_STATISTICS_DESCRIPTOR_OUT_FLAGS,
            MAC_STATISTICS_DESCRIPTOR_OUT_MORE_ENTRIES);

Patch 13: common/sfc_efx/base: rework SW mask to HW enum converter

Error: The FEC default overwrites the deliberate MC_CMD_FEC_NONE choice.
Just above the call, efx_np_link_ctrl() computes

        if ((cap_mask_sw & EFX_PHY_CAP_FEC_MASK) == 0)
                cap_enum_hw = MC_CMD_FEC_NONE;
        else
                cap_enum_hw = MC_CMD_FEC_AUTO;

and the comment below it still says "If the mask has got no
'FEC_REQUESTED' bits, use 'NONE' or 'AUTO' from above." Before this
patch that worked because *enum_hwp was left untouched when nothing
matched. Now the flags_seen == 0 path unconditionally assigns the
default, and the call passes a hardcoded MC_CMD_FEC_AUTO:

        EFX_NP_CAP_SW_MASK_TO_HW_ENUM(efx_np_cap_map_fec_req,
            ETH_AN_FIELDS_FEC_MASK, cap_data_raw, cap_mask_sw,
            MC_CMD_FEC_AUTO, NULL, NULL, &supported, &cap_enum_hw);

So a request with no FEC bits at all now programs FEC_MODE = AUTO
instead of NONE, i.e. a user asking for no FEC gets negotiated FEC.
Passing cap_enum_hw itself as the default preserves the intent.

Error: The selection order changes from first supported HW enum to last.
The old loop cleared the matched bit

        mask_sw &= ~(flag_sw);
        if (enum_hwp != NULL)
                *enum_hwp = hw_sw_map->encm_hw;

so later map entries carrying the same encm_sw failed the
(mask_sw & flag_sw) == flag_sw test and could not overwrite *enum_hwp.
The new loop has no clearing, so every match overwrites and the last
entry wins. efx_np_cap_map_tech is one-to-many: EFX_PHY_CAP_100000FDX
maps to fifteen MC_CMD_ETH_TECH_* values, so with the default lane count
(filter returns B_TRUE for everything) a fixed-link 100G request now
programs 100GBASE_CR10 where it previously programmed 100GBASE_KR4.
That is a functional change, not a simplification. If the previous
selection is intended, break out of the loop on the first match.

Warning: In the fixed-link branch the default changes the programmed
technology as well. link_tech is initialised to MC_CMD_ETH_TECH_NONE,
and previously stayed NONE when no requested tech bit was present in the
map; it is now overwritten with MC_CMD_ETH_TECH_AUTO. This may well be
the desired fix, but it is not mentioned in the commit message and
should be.

Info: __success() placement differs from patch 09 and from the rest of
the tree; see the note on patch 09.

Patches 06, 07, 08, 10, 12 and 14 look correct to me.

For 07, the added "*sw_maskp = 0" is safe: efx_np_link_state() memsets
*lsp before the calls, and the AN bit reordering keeps both masks
correct. For 08, MC_CMD_ETH_AN_FIELDS_LEN and
MC_CMD_GET_FIXED_PORT_PROPERTIES_OUT_ABILITIES_LEN are both 25, and
ep_np_cap_data_raw is declared with the former, so the annotation
matches the memcpy. For 12, both existing callers pass either a non-NULL
filter_arg or NULL for both, so the added check is inert today.

Not build tested on my side.