Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit db389e74 authored by Doug Berger's avatar Doug Berger Committed by Greg Kroah-Hartman
Browse files

net: bcmgenet: synchronize UMAC_CMD access 



commit 0d5e2a82232605b337972fb2c7d0cbc46898aca1 upstream.

The UMAC_CMD register is written from different execution
contexts and has insufficient synchronization protections to
prevent possible corruption. Of particular concern are the
acceses from the phy_device delayed work context used by the
adjust_link call and the BH context that may be used by the
ndo_set_rx_mode call.

A spinlock is added to the driver to protect contended register
accesses (i.e. reg_lock) and it is used to synchronize accesses
to UMAC_CMD.

Fixes: 1c1008c7 ("net: bcmgenet: add main driver file")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDoug Berger <opendmb@gmail.com>
Acked-by: default avatarFlorian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ae59f1f4

drivers/net/ethernet/broadcom/genet/bcmgenet.c

+11 −1
Original line number Diff line number Diff line
@@ -1990,14 +1990,18 @@ static void umac_enable_set(struct bcmgenet_priv *priv, u32 mask, bool enable) 
{

	u32 reg;



	spin_lock_bh(&priv->reg_lock);

	reg = bcmgenet_umac_readl(priv, UMAC_CMD);

	if (reg & CMD_SW_RESET)

	if (reg & CMD_SW_RESET) {

		spin_unlock_bh(&priv->reg_lock);

		return;

	}

	if (enable)

		reg |= mask;

	else

		reg &= ~mask;

	bcmgenet_umac_writel(priv, reg, UMAC_CMD);

	spin_unlock_bh(&priv->reg_lock);



	/* UniMAC stops on a packet boundary, wait for a full-size packet

	 * to be processed
@@ -2013,8 +2017,10 @@ static void reset_umac(struct bcmgenet_priv *priv) 
	udelay(10);



	/* issue soft reset and disable MAC while updating its registers */

	spin_lock_bh(&priv->reg_lock);

	bcmgenet_umac_writel(priv, CMD_SW_RESET, UMAC_CMD);

	udelay(2);

	spin_unlock_bh(&priv->reg_lock);

}



static void bcmgenet_intr_disable(struct bcmgenet_priv *priv)
@@ -3148,16 +3154,19 @@ static void bcmgenet_set_rx_mode(struct net_device *dev) 
	 * 3. The number of filters needed exceeds the number filters

	 *    supported by the hardware.

	*/

	spin_lock(&priv->reg_lock);

	reg = bcmgenet_umac_readl(priv, UMAC_CMD);

	if ((dev->flags & (IFF_PROMISC | IFF_ALLMULTI)) ||

	    (nfilter > MAX_MDF_FILTER)) {

		reg |= CMD_PROMISC;

		bcmgenet_umac_writel(priv, reg, UMAC_CMD);

		spin_unlock(&priv->reg_lock);

		bcmgenet_umac_writel(priv, 0, UMAC_MDF_CTRL);

		return;

	} else {

		reg &= ~CMD_PROMISC;

		bcmgenet_umac_writel(priv, reg, UMAC_CMD);

		spin_unlock(&priv->reg_lock);

	}



	/* update MDF filter */
@@ -3515,6 +3524,7 @@ static int bcmgenet_probe(struct platform_device *pdev) 
		goto err;

	}



	spin_lock_init(&priv->reg_lock);

	spin_lock_init(&priv->lock);



	SET_NETDEV_DEV(dev, &pdev->dev);

drivers/net/ethernet/broadcom/genet/bcmgenet.h

+2 −0
Original line number Diff line number Diff line
@@ -608,6 +608,8 @@ struct bcmgenet_rx_ring { 
/* device context */

struct bcmgenet_priv {

	void __iomem *base;

	/* reg_lock: lock to serialize access to shared registers */

	spinlock_t reg_lock;

	enum bcmgenet_version version;

	struct net_device *dev;

drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c

+6 −0
Original line number Diff line number Diff line
@@ -133,6 +133,7 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv, 
	}



	/* Can't suspend with WoL if MAC is still in reset */

	spin_lock_bh(&priv->reg_lock);

	reg = bcmgenet_umac_readl(priv, UMAC_CMD);

	if (reg & CMD_SW_RESET)

		reg &= ~CMD_SW_RESET;
@@ -140,6 +141,7 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv, 
	/* disable RX */

	reg &= ~CMD_RX_EN;

	bcmgenet_umac_writel(priv, reg, UMAC_CMD);

	spin_unlock_bh(&priv->reg_lock);

	mdelay(10);



	reg = bcmgenet_umac_readl(priv, UMAC_MPD_CTRL);
@@ -163,6 +165,7 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv, 
		  retries);



	/* Enable CRC forward */

	spin_lock_bh(&priv->reg_lock);

	reg = bcmgenet_umac_readl(priv, UMAC_CMD);

	priv->crc_fwd_en = 1;

	reg |= CMD_CRC_FWD;
@@ -170,6 +173,7 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv, 
	/* Receiver must be enabled for WOL MP detection */

	reg |= CMD_RX_EN;

	bcmgenet_umac_writel(priv, reg, UMAC_CMD);

	spin_unlock_bh(&priv->reg_lock);



	return 0;

}
@@ -191,8 +195,10 @@ void bcmgenet_wol_power_up_cfg(struct bcmgenet_priv *priv, 
	bcmgenet_umac_writel(priv, reg, UMAC_MPD_CTRL);



	/* Disable CRC Forward */

	spin_lock_bh(&priv->reg_lock);

	reg = bcmgenet_umac_readl(priv, UMAC_CMD);

	reg &= ~CMD_CRC_FWD;

	bcmgenet_umac_writel(priv, reg, UMAC_CMD);

	spin_unlock_bh(&priv->reg_lock);

	priv->crc_fwd_en = 0;

}

drivers/net/ethernet/broadcom/genet/bcmmii.c

+2 −0
Original line number Diff line number Diff line
@@ -91,6 +91,7 @@ void bcmgenet_mii_setup(struct net_device *dev) 
		reg |= RGMII_LINK;

		bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);



		spin_lock_bh(&priv->reg_lock);

		reg = bcmgenet_umac_readl(priv, UMAC_CMD);

		reg &= ~((CMD_SPEED_MASK << CMD_SPEED_SHIFT) |

			       CMD_HD_EN |
@@ -103,6 +104,7 @@ void bcmgenet_mii_setup(struct net_device *dev) 
			reg |= CMD_TX_EN | CMD_RX_EN;

		}

		bcmgenet_umac_writel(priv, reg, UMAC_CMD);

		spin_unlock_bh(&priv->reg_lock);



		priv->eee.eee_active = phy_init_eee(phydev, 0) >= 0;

		bcmgenet_eee_enable_set(dev,