[PATCH net v3 0/2] bnge fixes

[PATCH net v3 0/2] bnge fixes

[Vikas Gupta]

Hi,

This series fixes RSS indirection table and context sizing for large RX
ring counts. Patch 1 caps the hardware RSS context count and RX rings
to the RSS table size, preventing out-of-bounds writes and an oversized
memset(). Patch 2 fixes the indirection table sizing so rings above
the table size still receive default RSS traffic.

Thanks,
Vikas

v2->v3:
  - Fix Sashiko (Nipa) review comments.

v1->v2:
  - Fix Sashiko (Nipa) review comments.


Dharmender Garg (2):
  bnge: cap RSS contexts and RX rings to the RSS table size
  bnge: fix RSS table sizing for large RX ring counts

 drivers/net/ethernet/broadcom/bnge/bnge_resc.c | 6 ++++--
 drivers/net/ethernet/broadcom/bnge/bnge_resc.h | 9 +++------
 2 files changed, 7 insertions(+), 8 deletions(-)

-- 
2.52.0

[PATCH net v3 1/2] bnge: cap RSS contexts and RX rings to the RSS table size

[Vikas Gupta]

From: Dharmender Garg <dharmender.garg@broadcom.com>

The hardware supports at most BNGE_RSS_TABLE_MAX_TBL (8) RSS contexts.
They are stored in vnic->fw_rss_cos_lb_ctx[8] and back a 512-entry
(BNGE_MAX_RSS_TABLE_ENTRIES) indirection table and DMA buffer, so at
most 512 RX rings can be served by RSS.

bnge_cal_nr_rss_ctxs() has no upper bound, so with more RX rings it
returns more than 8 contexts: bnge_setup_vnic() writes past
fw_rss_cos_lb_ctx[], bnge_set_dflt_rss_indir_tbl() and
bnge_fill_hw_rss_tbl() write past the indirection table and its DMA
buffer, and the pad computation in bnge_set_dflt_rss_indir_tbl()
underflows into a huge memset().

Cap the number of contexts at BNGE_RSS_TABLE_MAX_TBL and the number
of RX rings at BNGE_MAX_RSS_TABLE_ENTRIES, so the sizes derived from
the ring count always fit the arrays.

Fixes: 627c67f038d2 ("bng_en: Add resource management support")
Signed-off-by: Dharmender Garg <dharmender.garg@broadcom.com>
Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com>
---
 drivers/net/ethernet/broadcom/bnge/bnge_resc.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_resc.c b/drivers/net/ethernet/broadcom/bnge/bnge_resc.c
index 4711dd4945ff..b540eed12fc6 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge_resc.c
+++ b/drivers/net/ethernet/broadcom/bnge/bnge_resc.c
@@ -182,8 +182,9 @@ int bnge_cal_nr_rss_ctxs(u16 rx_rings)
 	if (!rx_rings)
 		return 0;
 
-	return bnge_adjust_pow_two(rx_rings - 1,
-				   BNGE_RSS_TABLE_ENTRIES);
+	return min_t(int, bnge_adjust_pow_two(rx_rings - 1,
+					      BNGE_RSS_TABLE_ENTRIES),
+		     BNGE_RSS_TABLE_MAX_TBL);
 }
 
 static u16 bnge_rss_ctxs_in_use(struct bnge_dev *bd,
@@ -459,6 +460,7 @@ static void _bnge_get_max_rings(struct bnge_dev *bd, u16 *max_rx,
 	}
 
 	*max_rx = min_t(int, *max_rx, max_ring_grps);
+	*max_rx = min_t(int, *max_rx, BNGE_MAX_RSS_TABLE_ENTRIES);
 }
 
 static int bnge_get_max_rings(struct bnge_dev *bd, u16 *max_rx,
-- 
2.52.0

[PATCH net v3 2/2] bnge: fix RSS table sizing for large RX ring counts

[Vikas Gupta]

From: Dharmender Garg <dharmender.garg@broadcom.com>

bnge_adjust_pow_two() adds one block before rounding up to a power of
two only when the quotient is 0 or 1. A larger quotient that is
already a power of two is returned unchanged, so 129-192 RX rings
get a 128-entry RSS indirection table and 257-320 rings a 256-entry
one. The rings above the table size never receive default RSS traffic.
bnxt_calc_nr_ring_pages() always adds one, which is correct.

Make bnge_adjust_pow_two() always add one block before rounding up.

bnge_adjust_pow_two() also sizes the RX, RX aggregation, TX and
completion ring pages. For the default 511-entry rings their page
counts do not change. The completion ring is sized from more than
the default depth, so its page count changes where the old code
dropped a partial page. With 8K ring pages, TPA off and the default
rings, its budget is 1533 entries and the page count goes from 2 to 4.
With 4K ring pages and TPA on, when the firmware reports a
max_aggs_supported of 260 to 387, it goes from 16 to 32.
In these cases the old completion ring held fewer entries than
its budget.

Fixes: 627c67f038d2 ("bng_en: Add resource management support")
Signed-off-by: Dharmender Garg <dharmender.garg@broadcom.com>
Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com>
---
 drivers/net/ethernet/broadcom/bnge/bnge_resc.h | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_resc.h b/drivers/net/ethernet/broadcom/bnge/bnge_resc.h
index b62a634669f6..c0b6992d7f82 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge_resc.h
+++ b/drivers/net/ethernet/broadcom/bnge/bnge_resc.h
@@ -81,13 +81,10 @@ bnge_adjust_pow_two(u32 total_ent, u16 ent_per_blk)
 {
 	u32 blks = total_ent / ent_per_blk;
 
-	if (blks == 0 || blks == 1)
-		return ++blks;
+	if (!blks)
+		return 1;
 
-	if (!is_power_of_2(blks))
-		blks = roundup_pow_of_two(blks);
-
-	return blks;
+	return roundup_pow_of_two(blks + 1);
 }
 
 #define BNGE_MAX_ROCE_MSIX		64
-- 
2.52.0

Re: [PATCH net v3 0/2] bnge fixes

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net v3 0/2] bnge fixes

[Vikas Gupta]

Hi,
  We found these issues during the Sashiko code review.
  The fixes were tested on the Thor Ultra platform.

Thanks,
Vikas

On Mon, Oct 26, 2026 at 3:00 PM <netdev-bot+sinfo@kernel.org> wrote:
>
> Hi!
>
> This is an automated message. This series looks like a fix, but its
> commit messages seem to be missing some information:
>
>  - How the issue was discovered, e.g. hit in production, hit during
>    development, syzbot report, manual code inspection, LLM or static
>    analysis tool scan.
>
>  - Whether the issue was actually triggered, or is only theoretical
>    (e.g. found by code inspection). If it was triggered please include
>    the symptoms, like the stack trace or error messages.
>
>  - What hardware the change was tested on. For driver fixes please
>    mention the device (and if relevant firmware version) used for
>    testing, or say that the change was not tested on real hardware.
>
> Please do not repost the series just to address the above. Instead,
> reply to this email with the missing information, so that reviewers
> can take it into account. If the series needs another revision for
> other reasons, please include the information in the commit messages
> then.
>
> The evaluation is done by an LLM so it may be wrong, if you think
> that is the case please reply and explain.

Re: [PATCH net v3 1/2] bnge: cap RSS contexts and RX rings to the RSS table size

[Simon Horman]

On Mon, Oct 26, 2026 at 02:57:56PM +0530, Vikas Gupta wrote:
> From: Dharmender Garg <dharmender.garg@broadcom.com>
> 
> The hardware supports at most BNGE_RSS_TABLE_MAX_TBL (8) RSS contexts.
> They are stored in vnic->fw_rss_cos_lb_ctx[8] and back a 512-entry
> (BNGE_MAX_RSS_TABLE_ENTRIES) indirection table and DMA buffer, so at
> most 512 RX rings can be served by RSS.
> 
> bnge_cal_nr_rss_ctxs() has no upper bound, so with more RX rings it
> returns more than 8 contexts: bnge_setup_vnic() writes past
> fw_rss_cos_lb_ctx[], bnge_set_dflt_rss_indir_tbl() and
> bnge_fill_hw_rss_tbl() write past the indirection table and its DMA
> buffer, and the pad computation in bnge_set_dflt_rss_indir_tbl()
> underflows into a huge memset().
> 
> Cap the number of contexts at BNGE_RSS_TABLE_MAX_TBL and the number
> of RX rings at BNGE_MAX_RSS_TABLE_ENTRIES, so the sizes derived from
> the ring count always fit the arrays.
> 
> Fixes: 627c67f038d2 ("bng_en: Add resource management support")
> Signed-off-by: Dharmender Garg <dharmender.garg@broadcom.com>
> Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com>
> ---
>  drivers/net/ethernet/broadcom/bnge/bnge_resc.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_resc.c b/drivers/net/ethernet/broadcom/bnge/bnge_resc.c
> index 4711dd4945ff..b540eed12fc6 100644
> --- a/drivers/net/ethernet/broadcom/bnge/bnge_resc.c
> +++ b/drivers/net/ethernet/broadcom/bnge/bnge_resc.c
> @@ -182,8 +182,9 @@ int bnge_cal_nr_rss_ctxs(u16 rx_rings)
>  	if (!rx_rings)
>  		return 0;
>  
> -	return bnge_adjust_pow_two(rx_rings - 1,
> -				   BNGE_RSS_TABLE_ENTRIES);
> +	return min_t(int, bnge_adjust_pow_two(rx_rings - 1,
> +					      BNGE_RSS_TABLE_ENTRIES),
> +		     BNGE_RSS_TABLE_MAX_TBL);
>  }

nit: I expect that min() is sufficient here as the return value of
     bnge_adjust_pow_two is unsigned and BNGE_RSS_TABLE_MAX_TBL
     is a non-negative constant.

That notwithstanding this looks good to me.

Reviewed-by: Simon Horman <horms@kernel.org>

...

Re: [PATCH net v3 2/2] bnge: fix RSS table sizing for large RX ring counts

[Simon Horman]

On Mon, Oct 26, 2026 at 02:57:57PM +0530, Vikas Gupta wrote:
> From: Dharmender Garg <dharmender.garg@broadcom.com>
> 
> bnge_adjust_pow_two() adds one block before rounding up to a power of
> two only when the quotient is 0 or 1. A larger quotient that is
> already a power of two is returned unchanged, so 129-192 RX rings
> get a 128-entry RSS indirection table and 257-320 rings a 256-entry
> one. The rings above the table size never receive default RSS traffic.
> bnxt_calc_nr_ring_pages() always adds one, which is correct.
> 
> Make bnge_adjust_pow_two() always add one block before rounding up.
> 
> bnge_adjust_pow_two() also sizes the RX, RX aggregation, TX and
> completion ring pages. For the default 511-entry rings their page
> counts do not change. The completion ring is sized from more than
> the default depth, so its page count changes where the old code
> dropped a partial page. With 8K ring pages, TPA off and the default
> rings, its budget is 1533 entries and the page count goes from 2 to 4.
> With 4K ring pages and TPA on, when the firmware reports a
> max_aggs_supported of 260 to 387, it goes from 16 to 32.
> In these cases the old completion ring held fewer entries than
> its budget.
> 
> Fixes: 627c67f038d2 ("bng_en: Add resource management support")
> Signed-off-by: Dharmender Garg <dharmender.garg@broadcom.com>
> Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com>

Reviewed-by: Simon Horman <horms@kernel.org>