Re: [PATCH net-next v2 3/3] net: ethernet: qualcomm: ppe: Add IPQ5332 support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net: qualcomm: ppe: out-of-bounds register write for multicast queue config
--

commit 685879ecd74a6118d193f93282001e1b28945b42
Author: Til Kaiser <mail@tk154.de>

net: ethernet: qualcomm: ppe: Add IPQ5332 support

IPQ5332 shares the IPQ9574 PPE architecture, but has only two front
panel ports and uses a different clock rate, interconnect paths, buffer
limits and scheduler arbitration.

> diff --git a/drivers/net/ethernet/qualcomm/ppe/ppe_config.c b/drivers/net/ethernet/qualcomm/ppe/ppe_config.c
> index 65ac6c0841d5a..91e6ee9524a60 100644
> --- a/drivers/net/ethernet/qualcomm/ppe/ppe_config.c
> +++ b/drivers/net/ethernet/qualcomm/ppe/ppe_config.c
[ ... ]
> @@ -264,6 +298,30 @@ static const struct ppe_qm_queue_config ipq9574_ppe_qm_queue_config[] = {
>  	},
>  };
>  
> +/* IPQ5332 unicast and multicast queue thresholds. */
> +static const struct ppe_qm_queue_config ipq5332_ppe_qm_queue_config[] = {
> +	{
> +		/* QM settings for unicast queues 0 to 255. */
> +		.queue_start	= 0,
> +		.queue_end	= 255,
> +		.prealloc_buf	= 0,
> +		.ceil		= 300,
> +		.weight		= 7,
> +		.resume_offset	= 18,
> +		.dynamic	= true,
> +	},
> +	{
> +		/* QM settings for multicast queues 256 to 299. */
> +		.queue_start	= 256,
> +		.queue_end	= 299,

[Severity: High]
Does ppe_config_qm() calculate the multicast queue register address correctly
when queue_id is >= 256?

In ppe_config_qm(), the code calculates the address like this:

			} else {
				reg = PPE_AC_MULTICAST_QUEUE_CFG_TBL_ADDR +
				      PPE_AC_MULTICAST_QUEUE_CFG_TBL_INC * queue_id;

Since queue_id ranges from 256 to 299 for multicast queues, and is not offset
by 256 (PPE_AC_UNICAST_QUEUE_CFG_TBL_ENTRIES) before multiplication, does this
result in an out-of-bounds address calculation?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016152449.934312-1-mail@tk154.de?part=3