From e8f6ca11167d4753386340ce88444b5445dff831 Mon Sep 17 00:00:00 2001 From: Dharmender Garg Date: Mon, 26 Oct 2026 14:57:56 +0530 Subject: [PATCH 1/2] bnge: cap RSS contexts and RX rings to the RSS table size The hardware supports at most BNGE_RSS_TABLE_MAX_TBL (8) RSS contexts. They are stored in vnic->fw_rss_cos_lb_ctx[8] and back a 512-entry (BNGE_MAX_RSS_TABLE_ENTRIES) indirection table and DMA buffer, so at most 512 RX rings can be served by RSS. bnge_cal_nr_rss_ctxs() has no upper bound, so with more RX rings it returns more than 8 contexts: bnge_setup_vnic() writes past fw_rss_cos_lb_ctx[], bnge_set_dflt_rss_indir_tbl() and bnge_fill_hw_rss_tbl() write past the indirection table and its DMA buffer, and the pad computation in bnge_set_dflt_rss_indir_tbl() underflows into a huge memset(). Cap the number of contexts at BNGE_RSS_TABLE_MAX_TBL and the number of RX rings at BNGE_MAX_RSS_TABLE_ENTRIES, so the sizes derived from the ring count always fit the arrays. Fixes: 627c67f038d2 ("bng_en: Add resource management support") Signed-off-by: Dharmender Garg Reviewed-by: Vikas Gupta Reviewed-by: Simon Horman Link: https://patch.msgid.link/20261026092757.9168-2-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/broadcom/bnge/bnge_resc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_resc.c b/drivers/net/ethernet/broadcom/bnge/bnge_resc.c index 7c26943c5cb3..65ef34536e36 100644 --- a/drivers/net/ethernet/broadcom/bnge/bnge_resc.c +++ b/drivers/net/ethernet/broadcom/bnge/bnge_resc.c @@ -182,8 +182,9 @@ int bnge_cal_nr_rss_ctxs(u16 rx_rings) if (!rx_rings) return 0; - return bnge_adjust_pow_two(rx_rings - 1, - BNGE_RSS_TABLE_ENTRIES); + return min_t(int, bnge_adjust_pow_two(rx_rings - 1, + BNGE_RSS_TABLE_ENTRIES), + BNGE_RSS_TABLE_MAX_TBL); } static u16 bnge_rss_ctxs_in_use(struct bnge_dev *bd, @@ -459,6 +460,7 @@ static void _bnge_get_max_rings(struct bnge_dev *bd, u16 *max_rx, } *max_rx = min_t(int, *max_rx, max_ring_grps); + *max_rx = min_t(int, *max_rx, BNGE_MAX_RSS_TABLE_ENTRIES); } static int bnge_get_max_rings(struct bnge_dev *bd, u16 *max_rx, From 8b97091eae744a577573797e5d5abc3e0da10769 Mon Sep 17 00:00:00 2001 From: Dharmender Garg Date: Mon, 26 Oct 2026 14:57:57 +0530 Subject: [PATCH 2/2] bnge: fix RSS table sizing for large RX ring counts bnge_adjust_pow_two() adds one block before rounding up to a power of two only when the quotient is 0 or 1. A larger quotient that is already a power of two is returned unchanged, so 129-192 RX rings get a 128-entry RSS indirection table and 257-320 rings a 256-entry one. The rings above the table size never receive default RSS traffic. bnxt_calc_nr_ring_pages() always adds one, which is correct. Make bnge_adjust_pow_two() always add one block before rounding up. bnge_adjust_pow_two() also sizes the RX, RX aggregation, TX and completion ring pages. For the default 511-entry rings their page counts do not change. The completion ring is sized from more than the default depth, so its page count changes where the old code dropped a partial page. With 8K ring pages, TPA off and the default rings, its budget is 1533 entries and the page count goes from 2 to 4. With 4K ring pages and TPA on, when the firmware reports a max_aggs_supported of 260 to 387, it goes from 16 to 32. In these cases the old completion ring held fewer entries than its budget. Fixes: 627c67f038d2 ("bng_en: Add resource management support") Signed-off-by: Dharmender Garg Reviewed-by: Vikas Gupta Reviewed-by: Simon Horman Link: https://patch.msgid.link/20261026092757.9168-3-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/broadcom/bnge/bnge_resc.h | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_resc.h b/drivers/net/ethernet/broadcom/bnge/bnge_resc.h index b62a634669f6..c0b6992d7f82 100644 --- a/drivers/net/ethernet/broadcom/bnge/bnge_resc.h +++ b/drivers/net/ethernet/broadcom/bnge/bnge_resc.h @@ -81,13 +81,10 @@ bnge_adjust_pow_two(u32 total_ent, u16 ent_per_blk) { u32 blks = total_ent / ent_per_blk; - if (blks == 0 || blks == 1) - return ++blks; + if (!blks) + return 1; - if (!is_power_of_2(blks)) - blks = roundup_pow_of_two(blks); - - return blks; + return roundup_pow_of_two(blks + 1); } #define BNGE_MAX_ROCE_MSIX 64