From owner-svn-src-stable@FreeBSD.ORG Fri Nov 22 00:26:22 2013 Return-Path: Delivered-To: svn-src-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 79D3EA63; Fri, 22 Nov 2013 00:26:22 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 682F924B4; Fri, 22 Nov 2013 00:26:22 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id rAM0QMuT028247; Fri, 22 Nov 2013 00:26:22 GMT (envelope-from davidcs@svn.freebsd.org) Received: (from davidcs@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id rAM0QLIS028243; Fri, 22 Nov 2013 00:26:21 GMT (envelope-from davidcs@svn.freebsd.org) Message-Id: <201311220026.rAM0QLIS028243@svn.freebsd.org> From: David C Somayajulu Date: Fri, 22 Nov 2013 00:26:21 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r258457 - in stable/10/sys/dev: qlxgbe qlxge X-SVN-Group: stable-10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable@freebsd.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: SVN commit messages for all the -stable branches of the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Nov 2013 00:26:22 -0000 Author: davidcs Date: Fri Nov 22 00:26:21 2013 New Revision: 258457 URL: http://svnweb.freebsd.org/changeset/base/258457 Log: MFC r258155 ql_hw.[c,h]: set minimum thresholds on pkt size for lro path. ql_ioctl.c: validate the length and address of buffer passed to QL_RD_FW_DUMP MFC r258156 qls_ioctl.c: Validate the buffer and its length passed to QLA_MPI_DUMP. copyout dump only if qls_mpi_core_dump() is successful. (like to credit x90c for pointing the issue) Approved by: re (delphij) Modified: stable/10/sys/dev/qlxgbe/ql_hw.c stable/10/sys/dev/qlxgbe/ql_hw.h stable/10/sys/dev/qlxgbe/ql_ioctl.c stable/10/sys/dev/qlxge/qls_ioctl.c Directory Properties: stable/10/sys/ (props changed) Modified: stable/10/sys/dev/qlxgbe/ql_hw.c ============================================================================== --- stable/10/sys/dev/qlxgbe/ql_hw.c Fri Nov 22 00:06:11 2013 (r258456) +++ stable/10/sys/dev/qlxgbe/ql_hw.c Fri Nov 22 00:26:21 2013 (r258457) @@ -212,6 +212,12 @@ ql_hw_add_sysctls(qla_host_t *ha) "Number of Rcv Rings Entries to post before updating" " RDS Ring Producer Index"); + ha->hw.min_lro_pkt_size = 512; + SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev), + SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), + OID_AUTO, "min_lro_pkt_size", CTLFLAG_RD, &ha->hw.min_lro_pkt_size, + ha->hw.min_lro_pkt_size, "minimum packet size to trigger lro"); + ha->hw.mdump_active = 0; SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev), SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), @@ -1069,6 +1075,11 @@ qla_config_fw_lro(qla_host_t *ha, uint16 fw_lro->cntxt_id = cntxt_id; + if (ha->hw.min_lro_pkt_size) { + fw_lro->flags |= Q8_MBX_FW_LRO_LOW_THRESHOLD; + fw_lro->low_threshold = ha->hw.min_lro_pkt_size; + } + if (qla_mbx_cmd(ha, (uint32_t *)fw_lro, (sizeof (q80_config_fw_lro_t) >> 2), ha->hw.mbox, (sizeof (q80_config_fw_lro_rsp_t) >> 2), 0)) { Modified: stable/10/sys/dev/qlxgbe/ql_hw.h ============================================================================== --- stable/10/sys/dev/qlxgbe/ql_hw.h Fri Nov 22 00:06:11 2013 (r258456) +++ stable/10/sys/dev/qlxgbe/ql_hw.h Fri Nov 22 00:26:21 2013 (r258457) @@ -568,9 +568,13 @@ typedef struct _q80_config_fw_lro { #define Q8_MBX_FW_LRO_IPV6 0x2 #define Q8_MBX_FW_LRO_IPV4_WO_DST_IP_CHK 0x4 #define Q8_MBX_FW_LRO_IPV6_WO_DST_IP_CHK 0x8 +#define Q8_MBX_FW_LRO_LOW_THRESHOLD 0x10 uint8_t rsrvd; uint16_t cntxt_id; + + uint16_t low_threshold; + uint16_t rsrvd0; } __packed q80_config_fw_lro_t; typedef struct _q80_config_fw_lro_rsp { @@ -1521,6 +1525,7 @@ typedef struct _qla_hw { uint32_t health_count; uint32_t max_tx_segs; + uint32_t min_lro_pkt_size; /* Flash Descriptor Table */ qla_flash_desc_table_t fdt; Modified: stable/10/sys/dev/qlxgbe/ql_ioctl.c ============================================================================== --- stable/10/sys/dev/qlxgbe/ql_ioctl.c Fri Nov 22 00:06:11 2013 (r258456) +++ stable/10/sys/dev/qlxgbe/ql_ioctl.c Fri Nov 22 00:26:21 2013 (r258457) @@ -223,6 +223,13 @@ ql_eioctl(struct cdev *dev, u_long cmd, } fw_dump = (qla_rd_fw_dump_t *)data; + + if ((fw_dump->md_template == NULL) || + (fw_dump->template_size != ha->hw.dma_buf.minidump.size)) { + rval = EINVAL; + break; + } + if ((rval = copyout(ha->hw.dma_buf.minidump.dma_b, fw_dump->md_template, fw_dump->template_size))) rval = ENXIO; Modified: stable/10/sys/dev/qlxge/qls_ioctl.c ============================================================================== --- stable/10/sys/dev/qlxge/qls_ioctl.c Fri Nov 22 00:06:11 2013 (r258456) +++ stable/10/sys/dev/qlxge/qls_ioctl.c Fri Nov 22 00:26:21 2013 (r258457) @@ -100,13 +100,16 @@ qls_eioctl(struct cdev *dev, u_long cmd, if (mpi_dump->size == 0) { mpi_dump->size = sizeof (qls_mpi_coredump_t); } else { - if (mpi_dump->size < sizeof (qls_mpi_coredump_t)) + if ((mpi_dump->size != sizeof (qls_mpi_coredump_t)) || + (mpi_dump->dbuf == NULL)) rval = EINVAL; else { - qls_mpi_core_dump(ha); - rval = copyout( &ql_mpi_coredump, - mpi_dump->dbuf, - mpi_dump->size); + if (qls_mpi_core_dump(ha) == 0) { + rval = copyout(&ql_mpi_coredump, + mpi_dump->dbuf, + mpi_dump->size); + } else + rval = ENXIO; if (rval) { device_printf(ha->pci_dev,