Commit 0d5e2a82 authored by Doug Berger's avatar Doug Berger Committed by David S. Miller
Browse files

net: bcmgenet: synchronize UMAC_CMD access 



The UMAC_CMD register is written from different execution
contexts and has insufficient synchronization protections to
prevent possible corruption. Of particular concern are the
acceses from the phy_device delayed work context used by the
adjust_link call and the BH context that may be used by the
ndo_set_rx_mode call.

A spinlock is added to the driver to protect contended register
accesses (i.e. reg_lock) and it is used to synchronize accesses
to UMAC_CMD.

Fixes: 1c1008c7 ("net: bcmgenet: add main driver file")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDoug Berger <opendmb@gmail.com>
Acked-by: default avatarFlorian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2dbe5f19

drivers/net/ethernet/broadcom/genet/bcmgenet.c

+11 −1
Original line number Diff line number Diff line
@@ -2467,14 +2467,18 @@ static void umac_enable_set(struct bcmgenet_priv *priv, u32 mask, bool enable) 
{

	u32 reg;



	spin_lock_bh(&priv->reg_lock);

	reg = bcmgenet_umac_readl(priv, UMAC_CMD);

	if (reg & CMD_SW_RESET)

	if (reg & CMD_SW_RESET) {

		spin_unlock_bh(&priv->reg_lock);

		return;

	}

	if (enable)

		reg |= mask;

	else

		reg &= ~mask;

	bcmgenet_umac_writel(priv, reg, UMAC_CMD);

	spin_unlock_bh(&priv->reg_lock);



	/* UniMAC stops on a packet boundary, wait for a full-size packet

	 * to be processed
@@ -2490,8 +2494,10 @@ static void reset_umac(struct bcmgenet_priv *priv) 
	udelay(10);



	/* issue soft reset and disable MAC while updating its registers */

	spin_lock_bh(&priv->reg_lock);

	bcmgenet_umac_writel(priv, CMD_SW_RESET, UMAC_CMD);

	udelay(2);

	spin_unlock_bh(&priv->reg_lock);

}



static void bcmgenet_intr_disable(struct bcmgenet_priv *priv)
@@ -3597,16 +3603,19 @@ static void bcmgenet_set_rx_mode(struct net_device *dev) 
	 * 3. The number of filters needed exceeds the number filters

	 *    supported by the hardware.

	*/

	spin_lock(&priv->reg_lock);

	reg = bcmgenet_umac_readl(priv, UMAC_CMD);

	if ((dev->flags & (IFF_PROMISC | IFF_ALLMULTI)) ||

	    (nfilter > MAX_MDF_FILTER)) {

		reg |= CMD_PROMISC;

		bcmgenet_umac_writel(priv, reg, UMAC_CMD);

		spin_unlock(&priv->reg_lock);

		bcmgenet_umac_writel(priv, 0, UMAC_MDF_CTRL);

		return;

	} else {

		reg &= ~CMD_PROMISC;

		bcmgenet_umac_writel(priv, reg, UMAC_CMD);

		spin_unlock(&priv->reg_lock);

	}



	/* update MDF filter */
@@ -4005,6 +4014,7 @@ static int bcmgenet_probe(struct platform_device *pdev) 
		goto err;

	}



	spin_lock_init(&priv->reg_lock);

	spin_lock_init(&priv->lock);



	/* Set default pause parameters */

drivers/net/ethernet/broadcom/genet/bcmgenet.h

+3 −1
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0-only */

/*

 * Copyright (c) 2014-2020 Broadcom

 * Copyright (c) 2014-2024 Broadcom

 */



#ifndef __BCMGENET_H__
@@ -573,6 +573,8 @@ struct bcmgenet_rxnfc_rule { 
/* device context */

struct bcmgenet_priv {

	void __iomem *base;

	/* reg_lock: lock to serialize access to shared registers */

	spinlock_t reg_lock;

	enum bcmgenet_version version;

	struct net_device *dev;

drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c

+7 −1
Original line number Diff line number Diff line
@@ -2,7 +2,7 @@ 
/*

 * Broadcom GENET (Gigabit Ethernet) Wake-on-LAN support

 *

 * Copyright (c) 2014-2020 Broadcom

 * Copyright (c) 2014-2024 Broadcom

 */



#define pr_fmt(fmt)				"bcmgenet_wol: " fmt
@@ -151,6 +151,7 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv, 
	}



	/* Can't suspend with WoL if MAC is still in reset */

	spin_lock_bh(&priv->reg_lock);

	reg = bcmgenet_umac_readl(priv, UMAC_CMD);

	if (reg & CMD_SW_RESET)

		reg &= ~CMD_SW_RESET;
@@ -158,6 +159,7 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv, 
	/* disable RX */

	reg &= ~CMD_RX_EN;

	bcmgenet_umac_writel(priv, reg, UMAC_CMD);

	spin_unlock_bh(&priv->reg_lock);

	mdelay(10);



	if (priv->wolopts & (WAKE_MAGIC | WAKE_MAGICSECURE)) {
@@ -203,6 +205,7 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv, 
	}



	/* Enable CRC forward */

	spin_lock_bh(&priv->reg_lock);

	reg = bcmgenet_umac_readl(priv, UMAC_CMD);

	priv->crc_fwd_en = 1;

	reg |= CMD_CRC_FWD;
@@ -210,6 +213,7 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv, 
	/* Receiver must be enabled for WOL MP detection */

	reg |= CMD_RX_EN;

	bcmgenet_umac_writel(priv, reg, UMAC_CMD);

	spin_unlock_bh(&priv->reg_lock);



	reg = UMAC_IRQ_MPD_R;

	if (hfb_enable)
@@ -256,7 +260,9 @@ void bcmgenet_wol_power_up_cfg(struct bcmgenet_priv *priv, 
	}



	/* Disable CRC Forward */

	spin_lock_bh(&priv->reg_lock);

	reg = bcmgenet_umac_readl(priv, UMAC_CMD);

	reg &= ~CMD_CRC_FWD;

	bcmgenet_umac_writel(priv, reg, UMAC_CMD);

	spin_unlock_bh(&priv->reg_lock);

}

drivers/net/ethernet/broadcom/genet/bcmmii.c

+2 −0
Original line number Diff line number Diff line
@@ -76,6 +76,7 @@ static void bcmgenet_mac_config(struct net_device *dev) 
	reg |= RGMII_LINK;

	bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);



	spin_lock_bh(&priv->reg_lock);

	reg = bcmgenet_umac_readl(priv, UMAC_CMD);

	reg &= ~((CMD_SPEED_MASK << CMD_SPEED_SHIFT) |

		       CMD_HD_EN |
@@ -88,6 +89,7 @@ static void bcmgenet_mac_config(struct net_device *dev) 
		reg |= CMD_TX_EN | CMD_RX_EN;

	}

	bcmgenet_umac_writel(priv, reg, UMAC_CMD);

	spin_unlock_bh(&priv->reg_lock);



	active = phy_init_eee(phydev, 0) >= 0;

	bcmgenet_eee_enable_set(dev,