Imported from e1aaf7ec00%5E%21/#F0
Signed-off-by: Pavel Kubelun <be.dissent@gmail.com>
CHROMIUM: net: ar8216: address security vulnerabilities in swconfig & ar8216
This patch does the following changes:
*address the security vulnerabilities in both swconfig framework and in
ar8216 driver (many bound check additions, and turned swconfig structure
signed element into unsigned when applicable)
*address a couple of whitespaces and indendation issues
BUG=chrome-os-partner:33096
TEST=none
Change-Id: I94ea78fcce8c1932cc584d1508c6e3b5dfb93ce9
Signed-off-by: Mathieu Olivari <mathieu@codeaurora.org>
Reviewed-on: https://chromium-review.googlesource.com/236490
Reviewed-by: Toshi Kikuchi <toshik@chromium.org>
Commit-Queue: Toshi Kikuchi <toshik@chromium.org>
Tested-by: Toshi Kikuchi <toshik@chromium.org>
Import from fd7b89dd46%5E%21/#F0
Signed-off-by: Pavel Kubelun <be.dissent@gmail.com>
CHROMIUM: drivers: ar8216: prevent device duplication in ar8xxx_dev_list
If probe is called twice, once for PHY0 and a second time for PHY4,
the same switch device will be added twice to ar8xxx_dev_list, while
supposedly this list should have one element per hardware switch present
in the system.
While no negative impact have been observed, it does happen if a
platform instanciates these two PHYs from device-tree, as an example.
Change-Id: Iddcbdf7d4adacb0af01975b73f8e56b4582e894e
Signed-off-by: Mathieu Olivari <mathieu@codeaurora.org>
Reviewed-on: https://chromium-review.googlesource.com/234790
Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
Reviewed-by: Toshi Kikuchi <toshik@chromium.org>
Tested-by: Toshi Kikuchi <toshik@chromium.org>
Import from c3fd96a7b8%5E%21/#F0
Signed-off-by: Pavel Kubelun <be.dissent@gmail.com>
CHROMIUM: drivers: ar8216: hold ar8xxx_dev_list_lock during use_count--
It is possible for the remove() callback to run twice in parallel, which
could result into --use_count returning only 1 in both cases and the
rest of the unregistration path to never be reached.
This case has never been observed in practice, but we will fix
preventively to make the code more robust.
BUG=chrome-os-partner:33096
TEST=none
Change-Id: If09abe27fdb2037f514f8674418bafaab3cbdef6
Signed-off-by: Mathieu Olivari <mathieu@codeaurora.org>
Reviewed-on: https://chromium-review.googlesource.com/232870
Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
Reviewed-by: Toshi Kikuchi <toshik@chromium.org>
Tested-by: Toshi Kikuchi <toshik@chromium.org>
Import from c05af20272
Signed-off-by: Pavel Kubelun <be.dissent@gmail.com>
CHROMIUM: drivers: ar8216: sync mib_work cancellation
ar8xxx_mib_stop() is called from ar8xxx_phy_remove(), so we want to make
sure the work doesn't run after priv is freed / the device ceases to
exist.
BUG=chrome-os-partner:33096
TEST=none
Change-Id: Iafb44ce93a87433adc4576e5fea5fda58d1f43a9
Signed-off-by: Mathieu Olivari <mathieu@codeaurora.org>
Reviewed-on: https://chromium-review.googlesource.com/232827
Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
Reviewed-by: Toshi Kikuchi <toshik@chromium.org>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Tested-by: Toshi Kikuchi <toshik@chromium.org>
Fix build on targets not using CONFIG_MODULE_STRIPPED.
Neither RTL8367_DRIVER_DESC nor RTL8367B_DRIVER_DESC are defined
anywhere. It worked for targets using CONFIG_MODULE_STRIPPED since our
module stripper no-ops the various module info macros.
Signed-off-by: Mathias Kresin <dev@kresin.me>
The commit "generic: ar8216: add sanity check to ar8216_probe"
(774da6c7a4) stated that PHY IDs
should be checked at address 0-4. However, the PHY 4 was
never check by the loop. This patch extends the check to be
similar to the Atheors SDK. It tries all 4 ports and skips
unconnected PHYs if necessary. If it cannot find any familiar
PHYs, it will prevent the phy driver from initializing.
This patch is necessary for the C-60. It doesn't have a
PHY at port 3, so this caused the check in ar8xxx_is_possible
to fail. As a result, the ethernet ports on the C-60 didn't
work.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
If the cpu port is connected through SGMII we need to enable SerDes for
it to work.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Acked-by: Felix Fietkau <nbd@nbd.name>
The clearfog u-boot does not initialize the switch at all, so we need to
power up the phys ourselves.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Acked-by: Felix Fietkau <nbd@nbd.name>
Some devices (e.g. Tenda AC9 based on BCM47189B0) have BCM53125 with
port 5 connected to the second Ethernet interface on the SoC. In such
case there is no PHY and we need to force link manually.
This assumes port 5 can be marked as enabled for such devices. It's not
implemented yet unfortunately.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Due to the missing carrier status set, the interface wasn't usable on a
BTHOMEHUB2B after ip link down and up as it is done in preinit.
Signed-off-by: Mathias Kresin <dev@kresin.me>
Our code was assuming CPU port uses the highest number. My BCM53573
device has eth0 connected to port 8 and eth1 connected to port 5. While
working on support for it I tried to:
1) Enable all ports (including port 8)
2) Set CPU port to 5
I noticed port 8 is not accessible anymore. It was just a development
process but it seems like something worth fixing anyway.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Acked-by: Jonas Gorski <jonas.gorski@gmail.com>
In kernel 4.7 there is upstreamed b53 driver using (mostly?) the same
symbols as our b53 does. Change our symbols so both drivers can coexist
in kernel tree.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Acked-by: Jonas Gorski <jonas.gorski@gmail.com>
The swconfig kernel infrastructure fails to do any permissions checks when
changing settings. As such an ordinary user account on a device with a
switch can change switch settings without any special permissions.
Routers generally have few non-admin users so this isn't a big hole, but it
is a security hole. Likely the greatest danger is for multifunction devices
which have a lot of extra daemons, compromising a low-security daemon would
allow one to modify switch settings and cause the router/switch to appear to
lock-up (or cause other sorts of troublesome nyetwork behavior).
Implement a check for CAP_NET_ADMIN in swconfig_set_attr() and deny any
requests originating from user contexts lacking this capability.
Reported-by: Elliott Mitchell <ehem+openwrt@m5p.com>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Combine all bus operations for one MMD access in one function.
Protecting all these bus operations with one lock also helps
to avoid potential issues due to bus operations intercepting
the register and data write.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 48914
The default TTL for address resolution table entries is 5 minutes
for all members of the AR8216 family. This can cause issues if
e.g. Wifi clients roam to another AP and their MAC appears on
another switch port suddenly. Then the client may not be reachable
until the old ARL entry expires.
I would have expected the switch to invalidate old entries if it
detects the same MAC on another port. But that's not the case.
Therefore make the TTL for ARL entries configurable.
The effective TTL will always be a multiple of 7 seconds.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 48913
The line before includes the port number anyway so there's no need
to duplicate the port number in the MIB info header.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 48912
The decimal values especially for TxByte and RxGoodByte are hard to read
once bigger amounts of data have been transferred.
Therefore complement the decimal values with info in GiB / MiB / KiB.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 48911
For unused switch ports all MIB values are zero. Displaying ~40 empty
MIB counters is just confusing and makes it hard to read the output of
swconfig dev <dev> show.
Therefore, if all MIB counters for a port are zero, just display
an info that the MIB counters are empty.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 48910
This patch adds speed_mask special file to LEDs connected to switch ports
via 'switch' trigger. It allows to choose which speeds to signal when link
is up. If router has more than one LED per port, they may light up
differently depending on how fast connection is. Default setting is 'all
speeds' so backward compatibility with system scripts (for example uci) is
maintained.
Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>
SVN-Revision: 48775
This patch changes swconfig_trig_port_mask_store() handler to utilize
kstrtoul() function instead of call to obsolete simple_strtoul(). Thanks
to this change, new handler takes less memory and makes port_mask special
file accept not only hexadecimal, but also decimal and octal numbers.
Signed-off-by: Michal Cieslakiewicz <michal.cieslakiewicz@wp.pl>
SVN-Revision: 48774
When dealing with Broadcom hardware we can simply use swconfig's generic
helper, we just need to do some validation of requested state.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 48623
Thanks to this change swconfig can access port PHYs e.g. when setting
port link state with a generic helper.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 48622
It's quite common for switches to have PHY per port so adding a generic
helper setting link state will help many drivers. It just needs an API
to access PHYs which this patch also adds.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 48621
Directly return the return value of genl_register_family_with_ops()
instead of storing it in a temporary variable, then returning it.
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
SVN-Revision: 48472
BCM531x5 has two pontential cpu ports, and header mode can be enabled
independently on both.
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
SVN-Revision: 48302
This add support for IGMP Snooping on atheros switches (disabled by default),
which avoids flooding the network with multicast data.
Tested on TL-WDR4300: disabling IGMP Snooping results in multicast flooding
on each specific port, enabling it back again prevents each port from
receiving all multicast packets.
Partially based on: http://patchwork.ozlabs.org/patch/418122/
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
SVN-Revision: 48268
Some switches can force link speed for a port. Let's add API that will
allow drivers to export this feature.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 48142
As explained earlier, using SWITCH_TYPE_LINK gives more flexibility,
it doesn't require e.g. string parsing to read some data.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 47999
So far we were sending link data as a string. It got some drawbacks:
1) Didn't allow writing clean user space apps reading link state. It was
needed to do some screen scraping.
2) Forced whole PORT_LINK communication to be string based. Adding
support for *setting* port link required passing string and parting
it in the kernel space.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 47997
In r45970 the MAC swap handling was made opt-in, however some boards
have been forgotten during the conversion. Since the reference design
uses this MAC swapping, and pretty much all known boards using this chip
seem to do so too, enabling the swapping is a more reasonable default
than leaving it disabled.
Change the code to still allow boards to opt-out of this.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 47956
Kernel 3.14 added aditional genphy_soft_reset phy reset to phy_init_hw in drivers/net/phy/phy_device.c
Since adm6996 does in driver soft reset and doesn't use BMCR_RESET for soft reset
add dummy soft_reset callback to adm6996 driver, like it is done in ar8216.
This fixes ticket #20147
Signed-off-by: Andrej Vlasic <andrej.vlasic0@gmail.com>
SVN-Revision: 47272
The previous "link" and "status" functions were non-standard,
and thus less useful for parsing.
Signed-off-by: Claudio Leite <leitec@staticky.com>
SVN-Revision: 46864
This also clears any bootloader-set FDB defaults. This had
caused issues creating port-based VLANs when mappings
overlapped previous VLANs. Packets destined to a port
not in the default port group flooded all ports.
Tested on a 88E6171 (Linksys EA4500) and 88E6172 ('1900AC)
Signed-off-by: Claudio Leite <leitec@staticky.com>
Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
SVN-Revision: 46699
If a link goes down, don't flush the complete ARL table.
Only flush the entries for the respective port.
Don't touch ARL table if a link goes up.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 46381
Adds functions for flushing ARL table entries per port.
Successfully tested on AR8327. Implementation for AR8216/AR8236/AR8316
is based on the AR8236 datasheet and assumes that the three chips
share a common ATU register layout.
Compile-tested only for AR8216/AR8236/AR8316.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 46380
Adds the chip-specific part of reading ARL table for AR8216/AR8236/AR8316.
It's based on the AR8236 datasheet and compile-tested only as I couldn't
find datasheets for AR8216/AR8316 and don't own devices with these chips.
The existing ar8216_atu_flush implementation was used for all three
chip types, therefore I guess they share a common ATU register layout.
More testing would be appreciated.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 46379
The position of the nvram header file on brcm47xx changed with kernel
version 4.1.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 46170
On two tested devices: Netgear R6250 (BCM53011 rev 2) and Luxul XWC-1000
(BCM53011 rev 3) it was possible to use port 7 and eth1 (instead of port
5 and eth0). It seems BCM53011 just like BCM53012 has 8 ports and
usually 3 of them are connected to the SoC.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 46104
AR8337 supports a configuration bit to swap MAC0 and MAC6.
Currently this is set in general if an AR8337 is detected and causes
issues with devices using an AR8334 (internally an AR8337, just
less chip pins).
And it might even cause issues with AR8337-based devices with
different board designs.
Swapping the MAC's however isn't needed for AR8337 in general.
It's just needed in case of certain board designs (affected devices
seem to be based on Atheros reference board AP135/136-010).
Therefore this configuration bit should be moved to platform data.
The patch includes the needed changes to the device initialization
code of affected devices. Hopefully I didn't miss any ..
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
SVN-Revision: 45970
On device reset the sizes for the vlan and port tables were wrongly
calculated based on the pointer size instead of the struct size. This
causes buffer overruns on 64 bit targets, resulting in panics.
Fix this by dereferencing the pointers.
Reported-by: Fedor Konstantinov <blmink@mink.su>
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
SVN-Revision: 45938
