[openwrt/openwrt] kernel: vrx518_tc: fix RX desc phys to virt mapping

[LEDE Commits]

hauke pushed a commit to openwrt/openwrt.git, branch openwrt-24.10:
https://git.openwrt.org/9b32a8ec9d21197202f689225ca3ead817d5a689

commit 9b32a8ec9d21197202f689225ca3ead817d5a689
Author: Sergey Ryazanov <ryazanov.s.a at gmail.com>
AuthorDate: Thu Jan 23 00:26:51 2025 +0200

    kernel: vrx518_tc: fix RX desc phys to virt mapping
    
    It looks like VRX518 returns phys addr of data buffer in the 'data_ptr'
    field of the RX descriptor and an actual data offset within the buffer
    in the 'byte_off' field. In order to map the phys address back to
    virtual we need the original phys address of the allocated buffer.
    
    In the same driver applies offset to phys address before the mapping,
    what leads to WARN_ON triggering in plat_mem_virt() function with
    subsequent kernel panic:
    
      WARNING: CPU: 0 PID: 0 at .../sw_plat.c:764 0xbf306cd0 [vrx518_tc at 8af9f5d0+0x25000]
      ...
      Unable to handle kernel NULL pointer dereference at virtual address 00000000
      pgd = aff5701e
      [00000000] *pgd=00000000
      Internal error: Oops: 5 [#1] SMP ARM
    
    Noticed in ATM mode, when chip always returns byte_off = 4.
    
    In order to fix the issue, pass the phys address to plat_mem_virt() as
    is and apply byte_off later for proper DMA syncing and on mapped virtual
    address when copying RXed data into the skb.
    
    Run tested with FRITZ!Box 7530 on both ADSL and VDSL (thanks Jan) links.
    
    Fixes: 474bbe23b7 ("kernel: add Intel/Lantiq VRX518 TC driver")
    Tested-by: Jan Hoffmann <jan at 3e8.eu> # VDSL link
    Reported-and-tested-by: nebibigon93 at yandex.ru # ADSL link
    Signed-off-by: Sergey Ryazanov <ryazanov.s.a at gmail.com>
    Link: https://patchwork.ozlabs.org/project/openwrt/patch/20250122222654.21833-2-ryazanov.s.a@gmail.com/
    Signed-off-by: Hauke Mehrtens <hauke at hauke-m.de>
    (cherry picked from commit 7bd579689d2304c73c263be3e030d76c551d6e87)
---
 package/kernel/lantiq/vrx518_tc/patches/200-swplat.patch | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/package/kernel/lantiq/vrx518_tc/patches/200-swplat.patch b/package/kernel/lantiq/vrx518_tc/patches/200-swplat.patch
index edc97998b7..6596a8b913 100644
--- a/package/kernel/lantiq/vrx518_tc/patches/200-swplat.patch
+++ b/package/kernel/lantiq/vrx518_tc/patches/200-swplat.patch
@@ -855,12 +855,12 @@ This replaces it by a basic working implementation.
 -			continue;
 +
 +		// this seems to be a pointer to a DS PKT buffer
-+		phyaddr = desc->data_ptr + desc->byte_off;
++		phyaddr = desc->data_ptr;
 +		ptr = plat_mem_virt(phyaddr);
-+
 +		len = desc->data_len;
 +
-+		dma_sync_single_range_for_cpu(pdev, phyaddr, 0, len, DMA_FROM_DEVICE);
++		dma_sync_single_for_cpu(pdev, phyaddr, desc->byte_off + len,
++					DMA_FROM_DEVICE);
 +
 +		skb = netdev_alloc_skb(g_plat_priv->netdev, len);
 +		if (unlikely(!skb)) {
@@ -871,7 +871,7 @@ This replaces it by a basic working implementation.
 -		ring_idx_inc(rxout, idx);
 +
 +		dst = skb_put(skb, len);
-+		memcpy(dst, ptr, len);
++		memcpy(dst, ptr + desc->byte_off, len);
 +
 +		priv->tc_ops.recv(g_plat_priv->netdev, skb);
 +