Re: [RFC net-next 1/2] octeontx2-af: reject an out of range MCAM counter on CN20K

[Ratheesh Kannoth <rkannoth@marvell.com>]

On 2026-11-11 at 15:04:25, Yicheng Zhong (zhongyicheng241@mails.ucas.ac.cn) wrote:
> The CN20K branch of rvu_mbox_handler_npc_mcam_counter_stats() derives the
> bank and the register offset from the counter argument without checking it
> against the table, unlike the path the other silicons take.  With a counter
> past mcam->total_entries the bank number selects a bank that does not exist,
> so the register offset leaves the NPC block and the caller reads a register
> of a neighbouring block.
>
> Bound the counter to the table before deriving bank and index, which keeps
> the access inside the block; an ownership check would need the caller to be
> compared against the MCAM entry owner and is not added here.
>
> Fixes: 4e527f1e5c15 ("octeontx2-af: npc: cn20k: Add new mailboxes for CN20K silicon")
> Signed-off-by: Yicheng Zhong <zhongyicheng2025@iscas.ac.cn>
> Signed-off-by: Yicheng Zhong <zhongyicheng241@mails.ucas.ac.cn>
> ---
>  drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
> index 42a601976db..be8e3518e7b 100644
> --- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
> +++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
> @@ -4015,6 +4015,13 @@ int rvu_mbox_handler_npc_mcam_counter_stats(struct rvu *rvu,
>  	 * has its own counter. No need to verify the counter index.
>  	 */
>  	if (is_cn20k(rvu->pdev)) {
> +		/* cntr is an MCAM entry index on CN20K.  An index past the
> +		 * table would derive a bank that does not exist and take the
> +		 * register offset out of the NPC block.
> +		 */
> +		if (req->cntr >= mcam->total_entries)
> +			return NPC_MCAM_INVALID_REQ;
> +
>  		index = req->cntr & (mcam->banksize - 1);
>  		bank = npc_get_bank(mcam, req->cntr);
>  		regval = rvu_read64(rvu, blkaddr,

npc_mcam_verify_counter() does the job. May be we should move that call up
to validate for all SoCs (!cn20k and cn20k) ?