[PATCH stable v4.4 1/2] net: stmmac: use correct DMA buffer size in the RX descriptor

[PATCH stable v4.4 1/2] net: stmmac: use correct DMA buffer size in the RX descriptor

[Aviraj CJ]

upstream 583e6361414903c5206258a30e5bd88cb03c0254 commit

We always program the maximum DMA buffer size into the receive descriptor,
although the allocated size may be less. E.g. with the default MTU size
we allocate only 1536 bytes. If somebody sends us a bigger frame, then
memory may get corrupted.

Program DMA using exact buffer sizes.

Signed-off-by: Aaro Koskinen <aaro.koskinen@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[acj: backport to v4.4 -stable :
- Modified patch since v4.4 driver has no support for Big endian
- Skipped the section modifying non-existent functions in dwmac4_descs.c and
dwxgmac2_descs.c ]
Signed-off-by: Aviraj CJ <acj@cisco.com>
---
 drivers/net/ethernet/stmicro/stmmac/common.h      |  2 +-
 drivers/net/ethernet/stmicro/stmmac/descs_com.h   | 14 ++++++++++----
 drivers/net/ethernet/stmicro/stmmac/enh_desc.c    | 10 +++++++---
 drivers/net/ethernet/stmicro/stmmac/norm_desc.c   | 10 +++++++---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |  4 ++--
 5 files changed, 27 insertions(+), 13 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index 623c6ed8764a..803df6a32ba9 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -301,7 +301,7 @@ struct dma_features {
 struct stmmac_desc_ops {
 	/* DMA RX descriptor ring initialization */
 	void (*init_rx_desc) (struct dma_desc *p, int disable_rx_ic, int mode,
-			      int end);
+			      int end, int bfsize);
 	/* DMA TX descriptor ring initialization */
 	void (*init_tx_desc) (struct dma_desc *p, int mode, int end);
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/descs_com.h b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
index 6f2cc78c5cf5..6b83fc8e6fbe 100644
--- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h
+++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
@@ -33,9 +33,10 @@
 /* Specific functions used for Ring mode */
 
 /* Enhanced descriptors */
-static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end)
+static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end, int bfsize)
 {
-	p->des01.erx.buffer2_size = BUF_SIZE_8KiB - 1;
+	if (bfsize == BUF_SIZE_16KiB)
+		p->des01.erx.buffer2_size = BUF_SIZE_8KiB - 1;
 	if (end)
 		p->des01.erx.end_ring = 1;
 }
@@ -61,9 +62,14 @@ static inline void enh_set_tx_desc_len_on_ring(struct dma_desc *p, int len)
 }
 
 /* Normal descriptors */
-static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end)
+static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end, int bfsize)
 {
-	p->des01.rx.buffer2_size = BUF_SIZE_2KiB - 1;
+	int size;
+
+	if (bfsize >= BUF_SIZE_2KiB) {
+		size = min(bfsize - BUF_SIZE_2KiB + 1, BUF_SIZE_2KiB - 1);
+		p->des01.rx.buffer2_size = size;
+	}
 	if (end)
 		p->des01.rx.end_ring = 1;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
index 7d944449f5ef..9ecb3a948f86 100644
--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
@@ -238,16 +238,20 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
 }
 
 static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
-				  int mode, int end)
+				  int mode, int end, int bfsize)
 {
+	int bfsize1;
+
 	p->des01.all_flags = 0;
 	p->des01.erx.own = 1;
-	p->des01.erx.buffer1_size = BUF_SIZE_8KiB - 1;
+
+	bfsize1 = min(bfsize, BUF_SIZE_8KiB - 1);
+	p->des01.erx.buffer1_size = bfsize1;
 
 	if (mode == STMMAC_CHAIN_MODE)
 		ehn_desc_rx_set_on_chain(p, end);
 	else
-		ehn_desc_rx_set_on_ring(p, end);
+		ehn_desc_rx_set_on_ring(p, end, bfsize);
 
 	if (disable_rx_ic)
 		p->des01.erx.disable_ic = 1;
diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
index 48c3456445b2..07e0c03cfb10 100644
--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
@@ -121,16 +121,20 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x,
 }
 
 static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode,
-			       int end)
+			       int end, int bfsize)
 {
+	int bfsize1;
+
 	p->des01.all_flags = 0;
 	p->des01.rx.own = 1;
-	p->des01.rx.buffer1_size = BUF_SIZE_2KiB - 1;
+
+	bfsize1 = min(bfsize, (BUF_SIZE_2KiB - 1));
+	p->des01.rx.buffer1_size = bfsize1;
 
 	if (mode == STMMAC_CHAIN_MODE)
 		ndesc_rx_set_on_chain(p, end);
 	else
-		ndesc_rx_set_on_ring(p, end);
+		ndesc_rx_set_on_ring(p, end, bfsize);
 
 	if (disable_rx_ic)
 		p->des01.rx.disable_ic = 1;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index f4d6512f066c..e9d41e03121c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -964,11 +964,11 @@ static void stmmac_clear_descriptors(struct stmmac_priv *priv)
 		if (priv->extend_desc)
 			priv->hw->desc->init_rx_desc(&priv->dma_erx[i].basic,
 						     priv->use_riwt, priv->mode,
-						     (i == rxsize - 1));
+						     (i == rxsize - 1), priv->dma_buf_sz);
 		else
 			priv->hw->desc->init_rx_desc(&priv->dma_rx[i],
 						     priv->use_riwt, priv->mode,
-						     (i == rxsize - 1));
+						     (i == rxsize - 1), priv->dma_buf_sz);
 	for (i = 0; i < txsize; i++)
 		if (priv->extend_desc)
 			priv->hw->desc->init_tx_desc(&priv->dma_etx[i].basic,
-- 
2.19.1

[PATCH stable v4.4 2/2] net: stmmac: don't stop NAPI processing when dropping a packet

[Aviraj CJ]

upstream 07b3975352374c3f5ebb4a42ef0b253fe370542d commit

Currently, if we drop a packet, we exit from NAPI loop before the budget
is consumed. In some situations this will make the RX processing stall
e.g. when flood pinging the system with oversized packets, as the
errorneous packets are not dropped efficiently.

If we drop a packet, we should just continue to the next one as long as
the budget allows.

Signed-off-by: Aaro Koskinen <aaro.koskinen@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[acj: backport v4.4 -stable
-adjust context]
Signed-off-by: Aviraj CJ <acj@cisco.com>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index e9d41e03121c..28a6b7764044 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2176,8 +2176,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv)
 static int stmmac_rx(struct stmmac_priv *priv, int limit)
 {
 	unsigned int rxsize = priv->dma_rx_size;
-	unsigned int entry = priv->cur_rx % rxsize;
-	unsigned int next_entry;
+	unsigned int next_entry = priv->cur_rx % rxsize;
 	unsigned int count = 0;
 	int coe = priv->hw->rx_csum;
 
@@ -2189,9 +2188,11 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit)
 			stmmac_display_ring((void *)priv->dma_rx, rxsize, 0);
 	}
 	while (count < limit) {
-		int status;
+		int status, entry;
 		struct dma_desc *p;
 
+		entry = next_entry;
+
 		if (priv->extend_desc)
 			p = (struct dma_desc *)(priv->dma_erx + entry);
 		else
@@ -2239,7 +2240,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit)
 			/*  check if frame_len fits the preallocated memory */
 			if (frame_len > priv->dma_buf_sz) {
 				priv->dev->stats.rx_length_errors++;
-				break;
+				continue;
 			}
 
 			/* ACS is set; GMAC core strips PAD/FCS for IEEE 802.3
@@ -2260,7 +2261,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit)
 				pr_err("%s: Inconsistent Rx descriptor chain\n",
 				       priv->dev->name);
 				priv->dev->stats.rx_dropped++;
-				break;
+				continue;
 			}
 			prefetch(skb->data - NET_IP_ALIGN);
 			priv->rx_skbuff[entry] = NULL;
@@ -2291,7 +2292,6 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit)
 			priv->dev->stats.rx_packets++;
 			priv->dev->stats.rx_bytes += frame_len;
 		}
-		entry = next_entry;
 	}
 
 	stmmac_rx_refill(priv);
-- 
2.19.1

Re: [PATCH stable v4.4 1/2] net: stmmac: use correct DMA buffer size in the RX descriptor

[Greg KH]

On Mon, Dec 16, 2019 at 09:52:27PM -0800, Aviraj CJ wrote:
> upstream 583e6361414903c5206258a30e5bd88cb03c0254 commit
> 
> We always program the maximum DMA buffer size into the receive descriptor,
> although the allocated size may be less. E.g. with the default MTU size
> we allocate only 1536 bytes. If somebody sends us a bigger frame, then
> memory may get corrupted.
> 
> Program DMA using exact buffer sizes.
> 
> Signed-off-by: Aaro Koskinen <aaro.koskinen@nokia.com>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> [acj: backport to v4.4 -stable :
> - Modified patch since v4.4 driver has no support for Big endian
> - Skipped the section modifying non-existent functions in dwmac4_descs.c and
> dwxgmac2_descs.c ]
> Signed-off-by: Aviraj CJ <acj@cisco.com>

I can't take stable patches for an older tree and have it "skip" newer
stable trees.  To be specific, this patch is already in the 4.19.41
release, but if I were to take it into the 4.4.y tree, then anyone
upgrading to 4.9.y or 4.14.y afterward would run into the same issue.

So can you also send backports to 4.9.y and 4.14.y so that I can take
this fix into all trees?

Same for patch 2/2.

thanks,

greg k-h

Re: [PATCH stable v4.4 1/2] net: stmmac: use correct DMA buffer size in the RX descriptor

[Ben Hutchings]

[-- Attachment #1: Type: text/plain, Size: 6370 bytes --]

On Mon, 2019-12-16 at 21:52 -0800, Aviraj CJ wrote:
> upstream 583e6361414903c5206258a30e5bd88cb03c0254 commit
> 
> We always program the maximum DMA buffer size into the receive descriptor,
> although the allocated size may be less. E.g. with the default MTU size
> we allocate only 1536 bytes. If somebody sends us a bigger frame, then
> memory may get corrupted.
> 
> Program DMA using exact buffer sizes.
> 
> Signed-off-by: Aaro Koskinen <aaro.koskinen@nokia.com>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> [acj: backport to v4.4 -stable :
> - Modified patch since v4.4 driver has no support for Big endian
> - Skipped the section modifying non-existent functions in dwmac4_descs.c and
> dwxgmac2_descs.c ]
> Signed-off-by: Aviraj CJ <acj@cisco.com>

I've queued up these two fixes for 3.16.  This first patch needed a
little more adjustment as I had previously backported commit
8137b6ef0ce4 "net: stmmac: Fix RX packet size > 8191".  Perhaps that
should also be applied to 4.4?

Ben.

> ---
>  drivers/net/ethernet/stmicro/stmmac/common.h      |  2 +-
>  drivers/net/ethernet/stmicro/stmmac/descs_com.h   | 14 ++++++++++----
>  drivers/net/ethernet/stmicro/stmmac/enh_desc.c    | 10 +++++++---
>  drivers/net/ethernet/stmicro/stmmac/norm_desc.c   | 10 +++++++---
>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |  4 ++--
>  5 files changed, 27 insertions(+), 13 deletions(-)
> 
> diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
> index 623c6ed8764a..803df6a32ba9 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/common.h
> +++ b/drivers/net/ethernet/stmicro/stmmac/common.h
> @@ -301,7 +301,7 @@ struct dma_features {
>  struct stmmac_desc_ops {
>  	/* DMA RX descriptor ring initialization */
>  	void (*init_rx_desc) (struct dma_desc *p, int disable_rx_ic, int mode,
> -			      int end);
> +			      int end, int bfsize);
>  	/* DMA TX descriptor ring initialization */
>  	void (*init_tx_desc) (struct dma_desc *p, int mode, int end);
>  
> diff --git a/drivers/net/ethernet/stmicro/stmmac/descs_com.h b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
> index 6f2cc78c5cf5..6b83fc8e6fbe 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h
> +++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
> @@ -33,9 +33,10 @@
>  /* Specific functions used for Ring mode */
>  
>  /* Enhanced descriptors */
> -static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end)
> +static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end, int bfsize)
>  {
> -	p->des01.erx.buffer2_size = BUF_SIZE_8KiB - 1;
> +	if (bfsize == BUF_SIZE_16KiB)
> +		p->des01.erx.buffer2_size = BUF_SIZE_8KiB - 1;
>  	if (end)
>  		p->des01.erx.end_ring = 1;
>  }
> @@ -61,9 +62,14 @@ static inline void enh_set_tx_desc_len_on_ring(struct dma_desc *p, int len)
>  }
>  
>  /* Normal descriptors */
> -static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end)
> +static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end, int bfsize)
>  {
> -	p->des01.rx.buffer2_size = BUF_SIZE_2KiB - 1;
> +	int size;
> +
> +	if (bfsize >= BUF_SIZE_2KiB) {
> +		size = min(bfsize - BUF_SIZE_2KiB + 1, BUF_SIZE_2KiB - 1);
> +		p->des01.rx.buffer2_size = size;
> +	}
>  	if (end)
>  		p->des01.rx.end_ring = 1;
>  }
> diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
> index 7d944449f5ef..9ecb3a948f86 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
> @@ -238,16 +238,20 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
>  }
>  
>  static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
> -				  int mode, int end)
> +				  int mode, int end, int bfsize)
>  {
> +	int bfsize1;
> +
>  	p->des01.all_flags = 0;
>  	p->des01.erx.own = 1;
> -	p->des01.erx.buffer1_size = BUF_SIZE_8KiB - 1;
> +
> +	bfsize1 = min(bfsize, BUF_SIZE_8KiB - 1);
> +	p->des01.erx.buffer1_size = bfsize1;
>  
>  	if (mode == STMMAC_CHAIN_MODE)
>  		ehn_desc_rx_set_on_chain(p, end);
>  	else
> -		ehn_desc_rx_set_on_ring(p, end);
> +		ehn_desc_rx_set_on_ring(p, end, bfsize);
>  
>  	if (disable_rx_ic)
>  		p->des01.erx.disable_ic = 1;
> diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
> index 48c3456445b2..07e0c03cfb10 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
> @@ -121,16 +121,20 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x,
>  }
>  
>  static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode,
> -			       int end)
> +			       int end, int bfsize)
>  {
> +	int bfsize1;
> +
>  	p->des01.all_flags = 0;
>  	p->des01.rx.own = 1;
> -	p->des01.rx.buffer1_size = BUF_SIZE_2KiB - 1;
> +
> +	bfsize1 = min(bfsize, (BUF_SIZE_2KiB - 1));
> +	p->des01.rx.buffer1_size = bfsize1;
>  
>  	if (mode == STMMAC_CHAIN_MODE)
>  		ndesc_rx_set_on_chain(p, end);
>  	else
> -		ndesc_rx_set_on_ring(p, end);
> +		ndesc_rx_set_on_ring(p, end, bfsize);
>  
>  	if (disable_rx_ic)
>  		p->des01.rx.disable_ic = 1;
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index f4d6512f066c..e9d41e03121c 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> @@ -964,11 +964,11 @@ static void stmmac_clear_descriptors(struct stmmac_priv *priv)
>  		if (priv->extend_desc)
>  			priv->hw->desc->init_rx_desc(&priv->dma_erx[i].basic,
>  						     priv->use_riwt, priv->mode,
> -						     (i == rxsize - 1));
> +						     (i == rxsize - 1), priv->dma_buf_sz);
>  		else
>  			priv->hw->desc->init_rx_desc(&priv->dma_rx[i],
>  						     priv->use_riwt, priv->mode,
> -						     (i == rxsize - 1));
> +						     (i == rxsize - 1), priv->dma_buf_sz);
>  	for (i = 0; i < txsize; i++)
>  		if (priv->extend_desc)
>  			priv->hw->desc->init_tx_desc(&priv->dma_etx[i].basic,
-- 
Ben Hutchings
The program is absolutely right; therefore, the computer must be wrong.


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]