MFC r258155

ql_hw.[c,h]: set minimum thresholds on pkt size for lro path.
ql_ioctl.c: validate the length and address of buffer passed to QL_RD_FW_DUMP
MFC r258156
qls_ioctl.c: Validate the buffer and its length passed to QLA_MPI_DUMP.
             copyout dump only if qls_mpi_core_dump() is successful.
(like to credit x90c for pointing the issue)

Approved by: re (delphij)

4 files changed, 31 insertions, 5 deletions

diff --git a/sys/dev/qlxgbe/ql_hw.c b/sys/dev/qlxgbe/ql_hw.c
index 1a6e704..1d1e3f1 100644
--- a/sys/dev/qlxgbe/ql_hw.c
+++ b/sys/dev/qlxgbe/ql_hw.c
@@ -212,6 +212,12 @@ ql_hw_add_sysctls(qla_host_t *ha)
 		"Number of Rcv Rings Entries to post before updating"
 		" RDS Ring Producer Index");
 
+	ha->hw.min_lro_pkt_size = 512;
+	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
+		SYSCTL_CHILDREN(device_get_sysctl_tree(dev)),
+		OID_AUTO, "min_lro_pkt_size", CTLFLAG_RD, &ha->hw.min_lro_pkt_size,
+		ha->hw.min_lro_pkt_size, "minimum packet size to trigger lro");
+
 	ha->hw.mdump_active = 0;
         SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
                 SYSCTL_CHILDREN(device_get_sysctl_tree(dev)),
@@ -1069,6 +1075,11 @@ qla_config_fw_lro(qla_host_t *ha, uint16_t cntxt_id)
 
 	fw_lro->cntxt_id = cntxt_id;
 
+	if (ha->hw.min_lro_pkt_size) {
+		fw_lro->flags |= Q8_MBX_FW_LRO_LOW_THRESHOLD;
+		fw_lro->low_threshold = ha->hw.min_lro_pkt_size;
+	}
+
 	if (qla_mbx_cmd(ha, (uint32_t *)fw_lro,
 		(sizeof (q80_config_fw_lro_t) >> 2),
 		ha->hw.mbox, (sizeof (q80_config_fw_lro_rsp_t) >> 2), 0)) {
diff --git a/sys/dev/qlxgbe/ql_hw.h b/sys/dev/qlxgbe/ql_hw.h
index 4b4dd83..5928537 100644
--- a/sys/dev/qlxgbe/ql_hw.h
+++ b/sys/dev/qlxgbe/ql_hw.h
@@ -568,9 +568,13 @@ typedef struct _q80_config_fw_lro {
 #define Q8_MBX_FW_LRO_IPV6                     0x2
 #define Q8_MBX_FW_LRO_IPV4_WO_DST_IP_CHK       0x4
 #define Q8_MBX_FW_LRO_IPV6_WO_DST_IP_CHK       0x8
+#define Q8_MBX_FW_LRO_LOW_THRESHOLD            0x10
 
 	uint8_t		rsrvd;
 	uint16_t	cntxt_id;
+
+	uint16_t	low_threshold;
+	uint16_t	rsrvd0;
 } __packed q80_config_fw_lro_t;
 
 typedef struct _q80_config_fw_lro_rsp {
@@ -1521,6 +1525,7 @@ typedef struct _qla_hw {
 	uint32_t	health_count;
 
 	uint32_t	max_tx_segs;
+	uint32_t	min_lro_pkt_size;
 	
 	/* Flash Descriptor Table */
 	qla_flash_desc_table_t fdt;
diff --git a/sys/dev/qlxgbe/ql_ioctl.c b/sys/dev/qlxgbe/ql_ioctl.c
index 8ee74a5..cc47e3f 100644
--- a/sys/dev/qlxgbe/ql_ioctl.c
+++ b/sys/dev/qlxgbe/ql_ioctl.c
@@ -223,6 +223,13 @@ ql_eioctl(struct cdev *dev, u_long cmd, caddr_t data, int fflag,
 		}
 		
 		fw_dump = (qla_rd_fw_dump_t *)data;
+
+		if ((fw_dump->md_template == NULL) ||
+			(fw_dump->template_size != ha->hw.dma_buf.minidump.size)) {
+			rval = EINVAL;
+			break;
+		}
+
 		if ((rval = copyout(ha->hw.dma_buf.minidump.dma_b,
 			fw_dump->md_template, fw_dump->template_size)))
 			rval = ENXIO;
diff --git a/sys/dev/qlxge/qls_ioctl.c b/sys/dev/qlxge/qls_ioctl.c
index 5afa776..6b39fc9 100644
--- a/sys/dev/qlxge/qls_ioctl.c
+++ b/sys/dev/qlxge/qls_ioctl.c
@@ -100,13 +100,16 @@ qls_eioctl(struct cdev *dev, u_long cmd, caddr_t data, int fflag,
 		if (mpi_dump->size == 0) {
 			mpi_dump->size = sizeof (qls_mpi_coredump_t);
 		} else {
-			if (mpi_dump->size < sizeof (qls_mpi_coredump_t))
+			if ((mpi_dump->size != sizeof (qls_mpi_coredump_t)) ||
+				(mpi_dump->dbuf == NULL))
 				rval = EINVAL;
 			else {
-				qls_mpi_core_dump(ha);
-				rval = copyout( &ql_mpi_coredump,
-						mpi_dump->dbuf,
-						mpi_dump->size);
+				if (qls_mpi_core_dump(ha) == 0) {
+					rval = copyout(&ql_mpi_coredump,
+							mpi_dump->dbuf,
+							mpi_dump->size);
+				} else 
+					rval = ENXIO;
 
 				if (rval) {
 					device_printf(ha->pci_dev,