Re: [PATCH net-next 07/11] net: ethernet: qualcomm: ppe: Add IPQ5424 QM configuration

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] ppe: debugfs queue counter iteration reads nonexistent queues on IPQ5424 causing bus errors
--

commit 4fb437e4b3cf979efa2cd54481de8f5ac5e4963f
Author: Luo Jie <jie.luo@oss.qualcomm.com>

net: ethernet: qualcomm: ppe: Add IPQ5424 QM configuration

This commit adds the Quality of Service (QM) configuration for the
IPQ5424 PPE. It configures the unicast and multicast queues, noting
that IPQ5424 has fewer PPE ports and thus lacks multicast queues
284 to 299.

> diff --git a/drivers/net/ethernet/qualcomm/ppe/ppe_config.c b/drivers/net/ethernet/qualcomm/ppe/ppe_config.c
> index 3afa571193238..dec8eed772539 100644
> --- a/drivers/net/ethernet/qualcomm/ppe/ppe_config.c
> +++ b/drivers/net/ethernet/qualcomm/ppe/ppe_config.c
> @@ -314,6 +314,37 @@ static const struct ppe_qm_queue_config ipq9574_ppe_qm_queue_config[] = {
>  	},
>  };
>  
> +/* Multicast queues are dedicated per PPE port. IPQ5424 has only 3 physical
> + * PPE ports, versus IPQ9574's 6 PPE ports, so multicast queues 284 to 299
> + * are not available on IPQ5424, and the buffer pool assigned to the general
> + * 'group0' is larger here, 2010 versus IPQ9574's 2000.
> + */

[Severity: High]
Since multicast queues 284 to 299 are not available on IPQ5424, will reading
or writing the debugfs counters for these queues cause a bus error?

In drivers/net/ethernet/qualcomm/ppe/ppe_debugfs.c:ppe_queue_counter_get(),
the code loops up to PPE_QUEUE_TX_COUNTER_TBL_ENTRIES (300):

	for (i = 0; i < PPE_QUEUE_TX_COUNTER_TBL_ENTRIES; i++) {
		...
		} else {
			int mq_offset = i - PPE_AC_UNICAST_QUEUE_CFG_TBL_ENTRIES;
			...
			if (mq_offset < PPE_P0_MULTICAST_QUEUE_NUM) {
				reg = PPE_CPU_PORT_MULTICAST_FORCE_DROP_CNT_TBL_ADDR(mq_offset);
			} else {
				mq_offset -= PPE_P0_MULTICAST_QUEUE_NUM;

				reg = PPE_P1_MULTICAST_DROP_CNT_TBL_ADDR;
				reg += (mq_offset / PPE_MULTICAST_QUEUE_NUM) *
					PPE_MULTICAST_QUEUE_PORT_ADDR_INC;

For queues 284-299, this calculates an MMIO address for non-existent logical
ports 4, 5, and 6 on IPQ5424.  Does this lead to an unmapped register access
and a kernel panic when a user reads the 'qm' debugfs file?

A similar unconditional loop occurs in ppe_packet_counter_write() up to queue
299:

	case PPE_CNT_QM:
		for (i = 0; i < PPE_QUEUE_TX_COUNTER_TBL_ENTRIES; i++) {

Could this also trigger a panic when writing to the 'qm' debugfs file?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008-qcom_ipq5424_ppe-v1-0-16caf43e44ee@oss.qualcomm.com?part=7