Commit e9b61e48 authored by Doug Berger's avatar Doug Berger Committed by sanglipeng1
Browse files

net: bcmgenet: synchronize UMAC_CMD access 

stable inclusion
from stable-v5.10.218
commit db7aa45c71914340568d492af38d4e391a051e7a
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IAX0QZ

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=db7aa45c71914340568d492af38d4e391a051e7a



--------------------------------

commit 0d5e2a82232605b337972fb2c7d0cbc46898aca1 upstream.

The UMAC_CMD register is written from different execution
contexts and has insufficient synchronization protections to
prevent possible corruption. Of particular concern are the
acceses from the phy_device delayed work context used by the
adjust_link call and the BH context that may be used by the
ndo_set_rx_mode call.

A spinlock is added to the driver to protect contended register
accesses (i.e. reg_lock) and it is used to synchronize accesses
to UMAC_CMD.

Fixes: 1c1008c7 ("net: bcmgenet: add main driver file")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDoug Berger <opendmb@gmail.com>
Acked-by: default avatarFlorian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarsanglipeng1 <sanglipeng1@jd.com>
parent 8f5f7487

drivers/net/ethernet/broadcom/genet/bcmgenet.c

+11 −1
Original line number Diff line number Diff line
@@ -2424,14 +2424,18 @@ static void umac_enable_set(struct bcmgenet_priv *priv, u32 mask, bool enable) 
{

	u32 reg;



	spin_lock_bh(&priv->reg_lock);

	reg = bcmgenet_umac_readl(priv, UMAC_CMD);

	if (reg & CMD_SW_RESET)

	if (reg & CMD_SW_RESET) {

		spin_unlock_bh(&priv->reg_lock);

		return;

	}

	if (enable)

		reg |= mask;

	else

		reg &= ~mask;

	bcmgenet_umac_writel(priv, reg, UMAC_CMD);

	spin_unlock_bh(&priv->reg_lock);



	/* UniMAC stops on a packet boundary, wait for a full-size packet

	 * to be processed
@@ -2447,8 +2451,10 @@ static void reset_umac(struct bcmgenet_priv *priv) 
	udelay(10);



	/* issue soft reset and disable MAC while updating its registers */

	spin_lock_bh(&priv->reg_lock);

	bcmgenet_umac_writel(priv, CMD_SW_RESET, UMAC_CMD);

	udelay(2);

	spin_unlock_bh(&priv->reg_lock);

}



static void bcmgenet_intr_disable(struct bcmgenet_priv *priv)
@@ -3576,16 +3582,19 @@ static void bcmgenet_set_rx_mode(struct net_device *dev) 
	 * 3. The number of filters needed exceeds the number filters

	 *    supported by the hardware.

	*/

	spin_lock(&priv->reg_lock);

	reg = bcmgenet_umac_readl(priv, UMAC_CMD);

	if ((dev->flags & (IFF_PROMISC | IFF_ALLMULTI)) ||

	    (nfilter > MAX_MDF_FILTER)) {

		reg |= CMD_PROMISC;

		bcmgenet_umac_writel(priv, reg, UMAC_CMD);

		spin_unlock(&priv->reg_lock);

		bcmgenet_umac_writel(priv, 0, UMAC_MDF_CTRL);

		return;

	} else {

		reg &= ~CMD_PROMISC;

		bcmgenet_umac_writel(priv, reg, UMAC_CMD);

		spin_unlock(&priv->reg_lock);

	}



	/* update MDF filter */
@@ -3979,6 +3988,7 @@ static int bcmgenet_probe(struct platform_device *pdev) 
		goto err;

	}



	spin_lock_init(&priv->reg_lock);

	spin_lock_init(&priv->lock);



	SET_NETDEV_DEV(dev, &pdev->dev);

drivers/net/ethernet/broadcom/genet/bcmgenet.h

+2 −0
Original line number Diff line number Diff line
@@ -627,6 +627,8 @@ struct bcmgenet_rxnfc_rule { 
/* device context */

struct bcmgenet_priv {

	void __iomem *base;

	/* reg_lock: lock to serialize access to shared registers */

	spinlock_t reg_lock;

	enum bcmgenet_version version;

	struct net_device *dev;

drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c

+6 −0
Original line number Diff line number Diff line
@@ -134,6 +134,7 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv, 
	}



	/* Can't suspend with WoL if MAC is still in reset */

	spin_lock_bh(&priv->reg_lock);

	reg = bcmgenet_umac_readl(priv, UMAC_CMD);

	if (reg & CMD_SW_RESET)

		reg &= ~CMD_SW_RESET;
@@ -141,6 +142,7 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv, 
	/* disable RX */

	reg &= ~CMD_RX_EN;

	bcmgenet_umac_writel(priv, reg, UMAC_CMD);

	spin_unlock_bh(&priv->reg_lock);

	mdelay(10);



	if (priv->wolopts & (WAKE_MAGIC | WAKE_MAGICSECURE)) {
@@ -186,6 +188,7 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv, 
	}



	/* Enable CRC forward */

	spin_lock_bh(&priv->reg_lock);

	reg = bcmgenet_umac_readl(priv, UMAC_CMD);

	priv->crc_fwd_en = 1;

	reg |= CMD_CRC_FWD;
@@ -193,6 +196,7 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv, 
	/* Receiver must be enabled for WOL MP detection */

	reg |= CMD_RX_EN;

	bcmgenet_umac_writel(priv, reg, UMAC_CMD);

	spin_unlock_bh(&priv->reg_lock);



	reg = UMAC_IRQ_MPD_R;

	if (hfb_enable)
@@ -239,7 +243,9 @@ void bcmgenet_wol_power_up_cfg(struct bcmgenet_priv *priv, 
	}



	/* Disable CRC Forward */

	spin_lock_bh(&priv->reg_lock);

	reg = bcmgenet_umac_readl(priv, UMAC_CMD);

	reg &= ~CMD_CRC_FWD;

	bcmgenet_umac_writel(priv, reg, UMAC_CMD);

	spin_unlock_bh(&priv->reg_lock);

}

drivers/net/ethernet/broadcom/genet/bcmmii.c

+2 −0
Original line number Diff line number Diff line
@@ -91,6 +91,7 @@ void bcmgenet_mii_setup(struct net_device *dev) 
		reg |= RGMII_LINK;

		bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);



		spin_lock_bh(&priv->reg_lock);

		reg = bcmgenet_umac_readl(priv, UMAC_CMD);

		reg &= ~((CMD_SPEED_MASK << CMD_SPEED_SHIFT) |

			       CMD_HD_EN |
@@ -103,6 +104,7 @@ void bcmgenet_mii_setup(struct net_device *dev) 
			reg |= CMD_TX_EN | CMD_RX_EN;

		}

		bcmgenet_umac_writel(priv, reg, UMAC_CMD);

		spin_unlock_bh(&priv->reg_lock);



		priv->eee.eee_active = phy_init_eee(phydev, 0) >= 0;

		bcmgenet_eee_enable_set(dev,