Re: [PATCH net] mlxsw: Initialize register query payloads

[Ido Schimmel <idosch@nvidia.com>]

On Wed, Oct 14, 2026 at 07:31:17PM +0200, Til Kaiser wrote:
> MFGD register queries can exhaust EMAD retries and leave Mellanox
> Spectrum switches stuck during boot or shutdown when running OpenWrt
> built with GCC 15.

I assume that you don't have CONFIG_INIT_STACK_ALL_ZERO enabled?

> 
> An example failure is shown below with the second line wrapped:
> 
>   EMAD retries (5/5) (tid=9b544fc100001f35)
>   EMAD reg access failed (tid=9b544fc100001f35,reg_id=90f0(mfgd),
>                           type=query,status=0(operation performed))
> 
> On an SN2100, the failure occurs during driver teardown on reboot.
> On an SN3420, it occurs while probing mlxsw_spectrum during boot.

Can you share the firmware versions?

> 
> The register query API transmits the supplied payload to the device
> before replacing it with the response. Both MFGD callers pass an
> uninitialized stack buffer, so the request contains arbitrary register
> field values and reserved bits. This makes the request depend on stack
> contents and compiler code generation.
> 
> Initialize both MFGD query buffers in the firmware fatal event
> configuration and reporter test paths. The initialization has been
> confirmed to eliminate the boot and shutdown hangs on both switches.
> The subsequent read-modify-write still preserves the other fields
> returned by the device.
> 
> Also initialize the FORE fan fault query and the MOGCR mirroring policer
> base query, which pass entirely uninitialized payloads. Restore the MTMP
> query initialization in the temperature history reset path, where only
> the slot and sensor index fields are set before querying the register.
> 
> This follows commit 5b0907407e7f ("mlxsw: core: Zero payload buffers for
> couple of registers"), which initialized other query payloads after a
> firmware field length bug caused firmware to consume uninitialized data.
> 
> Fixes: 7d83ee111008 ("mlxsw: core: Introduce fw_fatal health reporter")
> Fixes: 2c6a33cd334b ("mlxsw: core: Extend hwmon interface with fan fault attribute")
> Fixes: 4039504e6a0c ("mlxsw: spectrum_span: Allow setting policer on a SPAN agent")
> Fixes: b890ad418e1f ("mlxsw: core_hwmon: Extend internal structures to support multi hwmon objects")
> Cc: stable@vger.kernel.org
> Signed-off-by: Til Kaiser <mail@tk154.de>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>