From a8bd5ec00022cc6cf790b766abaa9c4f6c850add Mon Sep 17 00:00:00 2001 From: Richard Weinberger Date: Thu, 20 Jul 2023 14:51:56 +0200 Subject: [PATCH 1/6] net: wget: Avoid packet queue overflow Make sure to stay within bounds, as a misbehaving HTTP server can trigger a buffer overflow if not properly handled. Cc: Joe Hershberger Cc: Ramon Fried Signed-off-by: Richard Weinberger --- net/wget.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/net/wget.c b/net/wget.c index 2dbfeb1a1d5..8bb4d72db1a 100644 --- a/net/wget.c +++ b/net/wget.c @@ -35,7 +35,8 @@ struct pkt_qd { * The actual packet bufers are in the kernel space, and are * expected to be overwritten by the downloaded image. */ -static struct pkt_qd pkt_q[PKTBUFSRX / 4]; +#define PKTQ_SZ (PKTBUFSRX / 4) +static struct pkt_qd pkt_q[PKTQ_SZ]; static int pkt_q_idx; static unsigned long content_length; static unsigned int packets; @@ -202,6 +203,13 @@ static void wget_connected(uchar *pkt, unsigned int tcp_seq_num, pkt_q[pkt_q_idx].tcp_seq_num = tcp_seq_num; pkt_q[pkt_q_idx].len = len; pkt_q_idx++; + + if (pkt_q_idx >= PKTQ_SZ) { + printf("wget: Fatal error, queue overrun!\n"); + net_set_state(NETLOOP_FAIL); + + return; + } } else { debug_cond(DEBUG_WGET, "wget: Connected HTTP Header %p\n", pkt); /* sizeof(http_eom) - 1 is the string length of (http_eom) */ From 65adf86f1ac1712a794cbe8251cf8ab74e146302 Mon Sep 17 00:00:00 2001 From: Ravi Gunasekaran Date: Fri, 8 Sep 2023 16:33:51 +0530 Subject: [PATCH 2/6] configs: am65x_evm_r5_usbmsc_defconfig: Enable DWC3 wrapper for SPL commit 280f45d23977 ("configs: get rid of build warnings due to SPL_USB_DWC3_GENERIC") missed enabling DWC3 glue layer for usbmsc_defconfig and this broke boot from USB mass storage. Fix this by enabling DWC3 glue layer. Fixes: 280f45d23977 ("configs: get rid of build warnings due to SPL_USB_DWC3_GENERIC") Signed-off-by: Ravi Gunasekaran --- configs/am65x_evm_r5_usbmsc_defconfig | 2 ++ 1 file changed, 2 insertions(+) diff --git a/configs/am65x_evm_r5_usbmsc_defconfig b/configs/am65x_evm_r5_usbmsc_defconfig index 8da49c78c82..733a1c18742 100644 --- a/configs/am65x_evm_r5_usbmsc_defconfig +++ b/configs/am65x_evm_r5_usbmsc_defconfig @@ -85,6 +85,7 @@ CONFIG_SYS_I2C_OMAP24XX=y CONFIG_DM_MAILBOX=y CONFIG_K3_SEC_PROXY=y CONFIG_MISC=y +CONFIG_SPL_MISC=y CONFIG_K3_AVS0=y # CONFIG_MMC is not set CONFIG_PHY=y @@ -122,6 +123,7 @@ CONFIG_USB_XHCI_HCD=y CONFIG_USB_XHCI_DWC3=y CONFIG_USB_DWC3=y CONFIG_USB_DWC3_GENERIC=y +CONFIG_SPL_USB_DWC3_GENERIC=y CONFIG_USB_STORAGE=y CONFIG_SPL_USB_STORAGE=y CONFIG_USB_GADGET=y From c5b42e3e9e757ab44da3006e713d8d02b65aa9fe Mon Sep 17 00:00:00 2001 From: Ryosuke Saito Date: Thu, 3 Aug 2023 23:56:48 +0900 Subject: [PATCH 3/6] net: sni_netsec: Add workaround for timeout error The NETSEC GMAC occasionally falls into a weird state where MAC_REG_DESC_SOFT_RST has never been cleared and shows errors like the below when networking commands are issued: => ping 192.168.1.1 ethernet@522d0000 Waiting for PHY auto negotiation to complete... done netsec_wait_while_busy: timeout Using ethernet@522d0000 device ARP Retry count exceeded; starting again ping failed; host 192.168.1.1 is not alive It happens on not only 'ping' but also 'dhcp', 'tftp' and so on. Luckily, restarting the NETSEC GMAC and trying again seems to fix the problematic state. So first ensure that we haven't entered the state by checking MAC_REG_DESC_SOFT_RST to be cleared; otherwise, restarting NETSEC/PHY and trying again would work as a workaround. Signed-off-by: Ryosuke Saito Tested-by: Masahisa Kojima --- drivers/net/sni_netsec.c | 50 ++++++++++++++++++++++++++++++++-------- 1 file changed, 41 insertions(+), 9 deletions(-) diff --git a/drivers/net/sni_netsec.c b/drivers/net/sni_netsec.c index 9780f2092bd..71afe78fd28 100644 --- a/drivers/net/sni_netsec.c +++ b/drivers/net/sni_netsec.c @@ -286,6 +286,8 @@ struct netsec_rx_pkt_info { bool err_flag; }; +static int netsec_reset_hardware(struct netsec_priv *priv, bool load_ucode); + static void netsec_write_reg(struct netsec_priv *priv, u32 reg_addr, u32 val) { writel(val, priv->ioaddr + reg_addr); @@ -532,18 +534,11 @@ static int netsec_mac_update_to_phy_state(struct netsec_priv *priv) return 0; } -static int netsec_start_gmac(struct netsec_priv *priv) +static int netsec_reset_gmac(struct netsec_priv *priv) { u32 value = 0; int ret; - if (priv->max_speed != SPEED_1000) - value = (NETSEC_GMAC_MCR_REG_CST | - NETSEC_GMAC_MCR_REG_HALF_DUPLEX_COMMON); - - if (netsec_set_mac_reg(priv, GMAC_REG_MCR, value)) - return -ETIMEDOUT; - if (netsec_set_mac_reg(priv, GMAC_REG_BMR, NETSEC_GMAC_BMR_REG_RESET)) return -ETIMEDOUT; @@ -558,10 +553,47 @@ static int netsec_start_gmac(struct netsec_priv *priv) if (value & NETSEC_GMAC_BMR_REG_SWR) return -EAGAIN; + /** + * NETSEC GMAC sometimes shows the peculiar behaviour where + * MAC_REG_DESC_SOFT_RST never been cleared, resulting in the loss of + * sending packets. + * + * Workaround: + * Restart NETSEC and PHY, retry again. + */ netsec_write_reg(priv, MAC_REG_DESC_SOFT_RST, 1); - if (netsec_wait_while_busy(priv, MAC_REG_DESC_SOFT_RST, 1)) + udelay(1000); + if (netsec_read_reg(priv, MAC_REG_DESC_SOFT_RST)) { + phy_shutdown(priv->phydev); + netsec_reset_hardware(priv, false); + phy_startup(priv->phydev); + return -EAGAIN; + } + return 0; +} + +static int netsec_start_gmac(struct netsec_priv *priv) +{ + u32 value = 0; + u32 failure = 0; + int ret; + + if (priv->max_speed != SPEED_1000) + value = (NETSEC_GMAC_MCR_REG_CST | + NETSEC_GMAC_MCR_REG_HALF_DUPLEX_COMMON); + + if (netsec_set_mac_reg(priv, GMAC_REG_MCR, value)) return -ETIMEDOUT; + /* Reset GMAC */ + while ((ret = netsec_reset_gmac(priv)) == -EAGAIN && ++failure < 3) + ; + + if (ret) { + pr_err("%s: failed to reset gmac(err=%d).\n", __func__, ret); + return ret; + } + netsec_write_reg(priv, MAC_REG_DESC_INIT, 1); if (netsec_wait_while_busy(priv, MAC_REG_DESC_INIT, 1)) return -ETIMEDOUT; From 8cf61051ae6e13e253de0d18501c196bc70522fc Mon Sep 17 00:00:00 2001 From: Francois Berder Date: Fri, 8 Sep 2023 18:47:46 +0200 Subject: [PATCH 4/6] drivers: mediatek: Fix error handling in mtk_i2c_do_transfer Errors were handled only if an I2C transfer timed out and received a NACK which is very unlikely. This commit changes the condition such that errors are handled if an I2C transfer times out or received a NACK. Signed-off-by: Francois Berder Reviewed-by: Heiko Schocher --- drivers/i2c/mtk_i2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i2c/mtk_i2c.c b/drivers/i2c/mtk_i2c.c index 2f331d3216a..5592fe91817 100644 --- a/drivers/i2c/mtk_i2c.c +++ b/drivers/i2c/mtk_i2c.c @@ -621,7 +621,7 @@ static int mtk_i2c_do_transfer(struct mtk_i2c_priv *priv, i2c_writel(priv, REG_INTR_MASK, ~(restart_flag | I2C_HS_NACKERR | I2C_ACKERR | I2C_TRANSAC_COMP)); - if (!tmo && trans_error != 0) { + if (tmo || trans_error != 0) { if (tmo) { ret = -ETIMEDOUT; if (!priv->filter_msg) From ee9245853ef862bd244981651a8ca1ebf43e817f Mon Sep 17 00:00:00 2001 From: Fabio Estevam Date: Tue, 19 Sep 2023 10:39:11 -0300 Subject: [PATCH 5/6] pico-imx7d: Remove Vanessa from MAINTAINERS Vanessa's NXP e-mail is no longer active. Contacted her offline and she told me that she does not have access to the board anymore and it is OK to remove her from MAINTAINERS. Signed-off-by: Fabio Estevam --- board/technexion/pico-imx7d/MAINTAINERS | 1 - 1 file changed, 1 deletion(-) diff --git a/board/technexion/pico-imx7d/MAINTAINERS b/board/technexion/pico-imx7d/MAINTAINERS index 325e1735c39..5dccac4d55b 100644 --- a/board/technexion/pico-imx7d/MAINTAINERS +++ b/board/technexion/pico-imx7d/MAINTAINERS @@ -1,5 +1,4 @@ TechNexion PICO-IMX7D board -M: Vanessa Maegima M: Otavio Salvador S: Maintained F: board/technexion/pico-imx7d/ From ff6156f0300d3bf77e9d9091a4f1f6f9112d7278 Mon Sep 17 00:00:00 2001 From: Kunihiko Hayashi Date: Fri, 22 Sep 2023 17:54:09 +0900 Subject: [PATCH 6/6] MAINTAINERS: Step up as maintainers of UniPhier SoC platform Update maintainers for UniPhier SoC platform. Signed-off-by: Kunihiko Hayashi --- MAINTAINERS | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/MAINTAINERS b/MAINTAINERS index 0a10a436bce..281a3f81f73 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -723,7 +723,10 @@ F: drivers/usb/musb-new/ux500.c F: drivers/video/mcde_simple.c ARM UNIPHIER -S: Orphan (Since 2020-09) +M: Kunihiko Hayashi +R: Dai Okamura +S: Maintained +F: arch/arm/dts/uniphier-* F: arch/arm/mach-uniphier/ F: configs/uniphier_*_defconfig N: uniphier