From b993bd65ec249c842afefd39010946650bec4f8e Mon Sep 17 00:00:00 2001 From: Yasuharu Shibata Date: Sun, 2 Jun 2024 17:24:03 +0900 Subject: [PATCH] bcmgenet: fix Rx buffer corruption caused by lack of cache flush When bcmgenet complete to write Rx buffer with the DMA, some U-Boot commands write data to the buffer directly. Those write data will become dirty in CPU cache. After this driver calls free_pkt to the buffer, the buffer is assigned as the future Rx buffer. At some point, if bcmgenet writes to a buffer with DMA and CPU cache flushes dirty data to the buffer, the buffer is corrupted. This patch calls flush_dcache_range in free_pkt to immediately flush the data written by U-Boot command and prevent data corruption. This issue can be reproduced using wget on Raspberry Pi4. If wget receives data larger than RX_BUF_LENGTH * RX_DESCS = 2048 * 256 bytes, it will timeout due to data corruption. In addition, if LOG_DEBUG is enabled in net/tcp.c, the following error log is output. TCP RX TCP xSum Error Signed-off-by: Yasuharu Shibata --- drivers/net/bcmgenet.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/bcmgenet.c b/drivers/net/bcmgenet.c index 4e1f8ed7a4..a0264dc386 100644 --- a/drivers/net/bcmgenet.c +++ b/drivers/net/bcmgenet.c @@ -360,6 +360,10 @@ static int bcmgenet_gmac_free_pkt(struct udevice *dev, uchar *packet, int length) { struct bcmgenet_eth_priv *priv = dev_get_priv(dev); + void *desc_base = priv->rx_desc_base + priv->rx_index * DMA_DESC_SIZE; + u32 addr = readl(desc_base + DMA_DESC_ADDRESS_LO); + + flush_dcache_range(addr, addr + RX_BUF_LENGTH); /* Tell the MAC we have consumed that last receive buffer. */ priv->c_index = (priv->c_index + 1) & 0xFFFF; -- 2.39.5