[PATCH net v2] net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM

[PATCH net v2] net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM

[Daniel Golle]

From: Chad Monroe <chad@monroe.io>

If the mtk_poll_rx() function detects the MTK_RESETTING flag, it will
jump to release_desc and refill the high word of the SDP on the 4GB RFB.
Subsequently, mtk_rx_clean will process an incorrect SDP, leading to a
panic.

Add patch from MediaTek's SDK to resolve this.

Fixes: 2d75891ebc09 ("net: ethernet: mtk_eth_soc: support 36-bit DMA addressing on MT7988")
Link: https://git01.mediatek.com/plugins/gitiles/openwrt/feeds/mtk-openwrt-feeds/+/71f47ea785699c6aa3b922d66c2bdc1a43da25b1
Signed-off-by: Chad Monroe <chad@monroe.io>
---
Changes since v1:
 * fix Link:
 * improve formatting

 drivers/net/ethernet/mediatek/mtk_eth_soc.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index 47807b202310..a817fdf468d4 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -2252,14 +2252,18 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
 		ring->data[idx] = new_data;
 		rxd->rxd1 = (unsigned int)dma_addr;
 release_desc:
+		if (MTK_HAS_CAPS(eth->soc->caps, MTK_36BIT_DMA)) {
+			if (unlikely(dma_addr == DMA_MAPPING_ERROR))
+				addr64 = FIELD_GET(RX_DMA_ADDR64_MASK,
+						   rxd->rxd2);
+			else
+				addr64 = RX_DMA_PREP_ADDR64(dma_addr);
+		}
+
 		if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628))
 			rxd->rxd2 = RX_DMA_LSO;
 		else
-			rxd->rxd2 = RX_DMA_PREP_PLEN0(ring->buf_size);
-
-		if (MTK_HAS_CAPS(eth->soc->caps, MTK_36BIT_DMA) &&
-		    likely(dma_addr != DMA_MAPPING_ERROR))
-			rxd->rxd2 |= RX_DMA_PREP_ADDR64(dma_addr);
+			rxd->rxd2 = RX_DMA_PREP_PLEN0(ring->buf_size) | addr64;
 
 		ring->calc_idx = idx;
 		done++;
-- 
2.49.0

Re: [PATCH net v2] net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM

[Jakub Kicinski]

On Sun, 27 Apr 2025 02:05:44 +0100 Daniel Golle wrote:
> +		if (MTK_HAS_CAPS(eth->soc->caps, MTK_36BIT_DMA)) {
> +			if (unlikely(dma_addr == DMA_MAPPING_ERROR))
> +				addr64 = FIELD_GET(RX_DMA_ADDR64_MASK,
> +						   rxd->rxd2);
> +			else
> +				addr64 = RX_DMA_PREP_ADDR64(dma_addr);

I guess it's correct but FWIW it reads slightly weird that in one
branch we use FIELD_GET() and in the other "PREP". I get that the
macros are a bit complicated but to the reader its not obvious whether
the value stored in addr64 is expected to be shifted or not 🤷️

> + rxd->rxd2 = RX_DMA_PREP_PLEN0(ring->buf_size) | addr64; 

Re: [PATCH net v2] net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Sun, 27 Apr 2025 02:05:44 +0100 you wrote:
> From: Chad Monroe <chad@monroe.io>
> 
> If the mtk_poll_rx() function detects the MTK_RESETTING flag, it will
> jump to release_desc and refill the high word of the SDP on the 4GB RFB.
> Subsequently, mtk_rx_clean will process an incorrect SDP, leading to a
> panic.
> 
> [...]

Here is the summary with links:
  - [net,v2] net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM
    https://git.kernel.org/netdev/net/c/6e0490fc36cd

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html