[PATCH] net/bnxt: fix l2_db_multi_page_size_kb position in func_qcfg output

[PATCH] net/bnxt: fix l2_db_multi_page_size_kb position in func_qcfg output

[Mohammad Shuab Siddique]

From: Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>

The field was placed at incorrect offset in hwrm_func_qcfg_output causing
legacy_l2_db_size_kb to read svif_info instead, producing a doorbell offset
exceeding BAR2 and resulting in SIGSEGV on BCM57608.

Move l2_db_multi_page_size_kb after mirror_vnic_id to match firmware
response layout.

Fixes: 04102f2ffc8c ("net/bnxt: update HWRM API to version 1.10.1.6")
Fixes: 7a1f9c782b50 ("net/bnxt: add multi-doorbell support")

Cc: stable@dpdk.org

Signed-off-by: Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>
---
 drivers/net/bnxt/hsi_struct_def_dpdk.h | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/bnxt/hsi_struct_def_dpdk.h b/drivers/net/bnxt/hsi_struct_def_dpdk.h
index 26d5e9ca78..1a8874f5b6 100644
--- a/drivers/net/bnxt/hsi_struct_def_dpdk.h
+++ b/drivers/net/bnxt/hsi_struct_def_dpdk.h
@@ -16277,12 +16277,6 @@ struct __rte_packed_begin hwrm_func_qcfg_output {
 	 * of the doorbell BAR between L2 and RoCE is required.
 	 */
 	uint16_t	l2_doorbell_bar_size_kb;
-	/*
-	 * The size of the doorbell BAR in KBytes reserved for multi-L2
-	 * doorbell pages. This area is a subset of l2_doorbell_bar_size_kb,
-	 * which is size of the total doorbell BAR space reserved for L2.
-	 */
-	uint16_t	l2_db_multi_page_size_kb;
 	/*
 	 * A bitmask indicating the active endpoints. Each bit represents a
 	 * specific endpoint, with bit 0 indicating EP 0 and bit 3 indicating
@@ -16605,6 +16599,12 @@ struct __rte_packed_begin hwrm_func_qcfg_output {
 	 * or a raw QP.
 	 */
 	uint16_t	mirror_vnic_id;
+	/*
+	 * The size of the doorbell BAR in KBytes reserved for multi-L2
+	 * doorbell pages. This area is a subset of l2_doorbell_bar_size_kb,
+	 * which is size of the total doorbell BAR space reserved for L2.
+	 */
+	uint16_t	l2_db_multi_page_size_kb;
 	uint8_t	unused_7[7];
 	/*
 	 * This field is used in Output records to indicate that the output
-- 
2.47.3

Re: [PATCH] net/bnxt: fix l2_db_multi_page_size_kb position in func_qcfg output

[Kishore Padmanabha]

[-- Attachment #1.1: Type: text/plain, Size: 2505 bytes --]

On Tue, Mar 24, 2026 at 4:46 PM Mohammad Shuab Siddique <
mohammad-shuab.siddique@broadcom.com> wrote:

> From: Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>
>
> The field was placed at incorrect offset in hwrm_func_qcfg_output causing
> legacy_l2_db_size_kb to read svif_info instead, producing a doorbell offset
> exceeding BAR2 and resulting in SIGSEGV on BCM57608.
>
> Move l2_db_multi_page_size_kb after mirror_vnic_id to match firmware
> response layout.
>
> Fixes: 04102f2ffc8c ("net/bnxt: update HWRM API to version 1.10.1.6")
> Fixes: 7a1f9c782b50 ("net/bnxt: add multi-doorbell support")
>
> Cc: stable@dpdk.org
>
> Signed-off-by: Mohammad Shuab Siddique <
> mohammad-shuab.siddique@broadcom.com>
>
Acked-by:  Kishore Padmanabha <kishore.padmanabha@broadcom.com>

> ---
>  drivers/net/bnxt/hsi_struct_def_dpdk.h | 12 ++++++------
>  1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/net/bnxt/hsi_struct_def_dpdk.h
> b/drivers/net/bnxt/hsi_struct_def_dpdk.h
> index 26d5e9ca78..1a8874f5b6 100644
> --- a/drivers/net/bnxt/hsi_struct_def_dpdk.h
> +++ b/drivers/net/bnxt/hsi_struct_def_dpdk.h
> @@ -16277,12 +16277,6 @@ struct __rte_packed_begin hwrm_func_qcfg_output {
>          * of the doorbell BAR between L2 and RoCE is required.
>          */
>         uint16_t        l2_doorbell_bar_size_kb;
> -       /*
> -        * The size of the doorbell BAR in KBytes reserved for multi-L2
> -        * doorbell pages. This area is a subset of
> l2_doorbell_bar_size_kb,
> -        * which is size of the total doorbell BAR space reserved for L2.
> -        */
> -       uint16_t        l2_db_multi_page_size_kb;
>         /*
>          * A bitmask indicating the active endpoints. Each bit represents a
>          * specific endpoint, with bit 0 indicating EP 0 and bit 3
> indicating
> @@ -16605,6 +16599,12 @@ struct __rte_packed_begin hwrm_func_qcfg_output {
>          * or a raw QP.
>          */
>         uint16_t        mirror_vnic_id;
> +       /*
> +        * The size of the doorbell BAR in KBytes reserved for multi-L2
> +        * doorbell pages. This area is a subset of
> l2_doorbell_bar_size_kb,
> +        * which is size of the total doorbell BAR space reserved for L2.
> +        */
> +       uint16_t        l2_db_multi_page_size_kb;
>         uint8_t unused_7[7];
>         /*
>          * This field is used in Output records to indicate that the output
> --
> 2.47.3
>
>

[-- Attachment #1.2: Type: text/html, Size: 3551 bytes --]

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5493 bytes --]

Re: [PATCH] net/bnxt: fix l2_db_multi_page_size_kb position in func_qcfg output

[Thomas Monjalon]

24/03/2026 22:02, Kishore Padmanabha:
> On Tue, Mar 24, 2026 at 4:46 PM Mohammad Shuab Siddique <
> mohammad-shuab.siddique@broadcom.com> wrote:
> 
> > From: Mohammad Shuab Siddique <mohammad-shuab.siddique@broadcom.com>
> >
> > The field was placed at incorrect offset in hwrm_func_qcfg_output causing
> > legacy_l2_db_size_kb to read svif_info instead, producing a doorbell offset
> > exceeding BAR2 and resulting in SIGSEGV on BCM57608.
> >
> > Move l2_db_multi_page_size_kb after mirror_vnic_id to match firmware
> > response layout.
> >
> > Fixes: 04102f2ffc8c ("net/bnxt: update HWRM API to version 1.10.1.6")

looks not related

> > Fixes: 7a1f9c782b50 ("net/bnxt: add multi-doorbell support")
> >
> > Cc: stable@dpdk.org

not needed as it is only fixing a recent commit

> >
> > Signed-off-by: Mohammad Shuab Siddique <
> > mohammad-shuab.siddique@broadcom.com>
> >
> Acked-by:  Kishore Padmanabha <kishore.padmanabha@broadcom.com>

Bugzilla ID: 1909
Reported-by: Oleksandr Nahnybida <oleksandrn@interfacemasters.com>

Applied, thanks.