net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM

If the mtk_poll_rx() function detects the MTK_RESETTING flag, it will
jump to release_desc and refill the high word of the SDP on the 4GB RFB.
Subsequently, mtk_rx_clean will process an incorrect SDP, leading to a
panic.

Add patch from MediaTek's SDK to resolve this.

Fixes: 2d75891ebc09 ("net: ethernet: mtk_eth_soc: support 36-bit DMA addressing on MT7988")
Link: https://git01.mediatek.com/plugins/gitiles/openwrt/feeds/mtk-openwrt-feeds/+/71f47ea785699c6aa3b922d66c2bdc1a43da25b1
Signed-off-by: Chad Monroe <chad@monroe.io>
Link: https://patch.msgid.link/4adc2aaeb0fb1b9cdc56bf21cf8e7fa328daa345.1745715843.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index 83068925c589d923c4b22f297929c6b4acc037dd..8fda4ce80d811dcd96a9985036b330cc4bb82e20 100644 (file)
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -2248,14 +2248,18 @@ skip_rx:
                ring->data[idx] = new_data;
                rxd->rxd1 = (unsigned int)dma_addr;
 release_desc:
+               if (MTK_HAS_CAPS(eth->soc->caps, MTK_36BIT_DMA)) {
+                       if (unlikely(dma_addr == DMA_MAPPING_ERROR))
+                               addr64 = FIELD_GET(RX_DMA_ADDR64_MASK,
+                                                  rxd->rxd2);
+                       else
+                               addr64 = RX_DMA_PREP_ADDR64(dma_addr);
+               }
+
                if (MTK_HAS_CAPS(eth->soc->caps, MTK_SOC_MT7628))
                        rxd->rxd2 = RX_DMA_LSO;
                else
-                       rxd->rxd2 = RX_DMA_PREP_PLEN0(ring->buf_size);
-
-               if (MTK_HAS_CAPS(eth->soc->caps, MTK_36BIT_DMA) &&
-                   likely(dma_addr != DMA_MAPPING_ERROR))
-                       rxd->rxd2 |= RX_DMA_PREP_ADDR64(dma_addr);
+                       rxd->rxd2 = RX_DMA_PREP_PLEN0(ring->buf_size) | addr64;
 
                ring->calc_idx = idx;
                done++;