From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794046405; b=thYPMbVGg1HNkPEWnOh8pB8wvIeWQgveccOBJg9UCa6y8XxI4yxFQ8fWof1d0ZPU1m1w k8chevxbRt/6xrjmkD2S3RpRbZgMpt7YHfbnnz6jT0jbOmJKHuyJP4pa3SN6Gn2z8UsAu K5eDyO4pyZq77Pli+iwyFP75DC8zrd+ccUghUxlzBxCFW8rc9zmKOFt2VwNDe6seNFfTC LM7B7nOvSJ5j6I/y3YTyVmCZe8xKQcMAvv7TdM0bXOrDGuhDdwfwsP0Bk+aA2S9y/y+xm LTRDHTmLSb1Y4cOZGr7XiUO12d7pxeYZMSm5rCrXZPmGKcgGbq0i0RnYCgEyDz5NsNA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794046405; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=S3cmTkd05W52gaIUpTqcBB2T87BFVjp1pEQmnydAC7Y=; b=RPwHOHJ4ypCdIx4NO0/ypWII5FZnLKY6vueFtYkRj1sT1IZqCxpONtkGaRgaIANKB7M2 LAVfDsc61RDR+dLBhPeV+Mrp5Ye02ycFEcF8TSdiogEhhngNwUeDBOYlyCf/0nxLOxprj bSnB3RwrbRoR+q92w9kg/AVSG+QcK42rCcoU5yMK61K670j+O9r9T1xtw9U7ultQTkEfg GTL2ibZFP5dkZ2leZYi3xJgvjpj/yntN6/J1lQzEEt3gHD1nNAWfvlD3jIwNQktS4zKsf WWsRYyJQLnAWWIqBa2cAn7UZ9alA1/ymtoHKJItaFiz4k7BznvYL7U+MrNje/uO1JMA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=hMqut105; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5CE91606A326 for ; Sat, 7 Nov 2026 10:13:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=hMqut105 Received: by smtp.kernel.org (Postfix) with ESMTPSA id B69B61F0089F; Sat, 7 Nov 2026 10:13:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794046405; bh=S3cmTkd05W52gaIUpTqcBB2T87BFVjp1pEQmnydAC7Y=; h=From:To:Cc:Subject:Date; b=hMqut105V6HBKjHl1Rd+sr9GhVJXe6XieRdkAq67V5S8yEgzqFGDVW+LJ9cKd+dYv mj4B5wtMQV9vgwi4WgK9x1hy4syScCds+0OSYJG65jh7lAyoak1iVafLbGYrcELJ2F MYAlywBJcc/vCDWQIMv2ZzkeScu8mfBwnK90dTjNKLsFdYfLdmg6IbAGMZqHLO7r6N JqHdEwJtn4YHEh3S5QdrUmptMw3CakZQ2BpkOch2bjIuE9TeXu3r7/JMvAI1/T6nGK pMMlwOeULhE5W/caSe6gJHfaaTX1RLlf7TbzRzNTin1kUEyhC9UkI+qSjunRmBM7Iy grD24uIMWKtEA== From: Sasha Levin To: mail@tk154.de, idosch@nvidia.com, kuba@kernel.org Cc: stable@vger.kernel.org Subject: FAILED: patch "[PATCH] mlxsw: Initialize register query payloads" failed to apply to 6.18-stable tree Date: Sat, 7 Nov 2026 05:13:23 -0500 Message-ID: <20261107051323-failed-6.18-15b7a86a8888@kernel.org> X-Mailer: git-send-email 2.53.0 X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.18-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y git checkout FETCH_HEAD git cherry-pick -x 15b7a86a8888dc6a8fd19e181757e32389de9064 # git commit -s git send-email --to '' --in-reply-to '20261107051323-failed-6.18-15b7a86a8888@kernel.org' --subject-prefix 'PATCH 6.18.y' 'HEAD^..' Thanks, Sasha ------------------ original commit in Linus's tree ------------------ >From 15b7a86a8888dc6a8fd19e181757e32389de9064 Mon Sep 17 00:00:00 2001 From: Til Kaiser Date: Wed, 14 Oct 2026 19:31:17 +0200 Subject: [PATCH] mlxsw: Initialize register query payloads MFGD register queries can exhaust EMAD retries and leave Mellanox Spectrum switches stuck during boot or shutdown when running OpenWrt built with GCC 15. An example failure is shown below with the second line wrapped: EMAD retries (5/5) (tid=9b544fc100001f35) EMAD reg access failed (tid=9b544fc100001f35,reg_id=90f0(mfgd), type=query,status=0(operation performed)) On an SN2100, the failure occurs during driver teardown on reboot. On an SN3420, it occurs while probing mlxsw_spectrum during boot. The register query API transmits the supplied payload to the device before replacing it with the response. Both MFGD callers pass an uninitialized stack buffer, so the request contains arbitrary register field values and reserved bits. This makes the request depend on stack contents and compiler code generation. Initialize both MFGD query buffers in the firmware fatal event configuration and reporter test paths. The initialization has been confirmed to eliminate the boot and shutdown hangs on both switches. The subsequent read-modify-write still preserves the other fields returned by the device. Also initialize the FORE fan fault query and the MOGCR mirroring policer base query, which pass entirely uninitialized payloads. Restore the MTMP query initialization in the temperature history reset path, where only the slot and sensor index fields are set before querying the register. This follows commit 5b0907407e7f ("mlxsw: core: Zero payload buffers for couple of registers"), which initialized other query payloads after a firmware field length bug caused firmware to consume uninitialized data. Tested with firmware 2020.1148 and with 2016.3900 from linux-firmware. Fixes: 7d83ee111008 ("mlxsw: core: Introduce fw_fatal health reporter") Fixes: 2c6a33cd334b ("mlxsw: core: Extend hwmon interface with fan fault attribute") Fixes: 4039504e6a0c ("mlxsw: spectrum_span: Allow setting policer on a SPAN agent") Fixes: b890ad418e1f ("mlxsw: core_hwmon: Extend internal structures to support multi hwmon objects") Cc: stable@vger.kernel.org Signed-off-by: Til Kaiser Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20261014173117.26305-1-mail@tk154.de Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/mellanox/mlxsw/core.c | 4 ++-- drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c | 4 ++-- drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c index 308d8a94865f8..42e9689d7f357 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/core.c +++ b/drivers/net/ethernet/mellanox/mlxsw/core.c @@ -2001,7 +2001,7 @@ mlxsw_core_health_fw_fatal_test(struct devlink_health_reporter *reporter, struct netlink_ext_ack *extack) { struct mlxsw_core *mlxsw_core = devlink_health_reporter_priv(reporter); - char mfgd_pl[MLXSW_REG_MFGD_LEN]; + char mfgd_pl[MLXSW_REG_MFGD_LEN] = {0}; int err; /* Read the register first to make sure no other bits are changed. */ @@ -2022,7 +2022,7 @@ mlxsw_core_health_fw_fatal_ops = { static int mlxsw_core_health_fw_fatal_config(struct mlxsw_core *mlxsw_core, bool enable) { - char mfgd_pl[MLXSW_REG_MFGD_LEN]; + char mfgd_pl[MLXSW_REG_MFGD_LEN] = {0}; int err; /* Read the register first to make sure no other bits are changed. */ diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c b/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c index 30f172ce822cf..a5e7aee730d6a 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c +++ b/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c @@ -120,7 +120,7 @@ static ssize_t mlxsw_hwmon_temp_rst_store(struct device *dev, container_of(attr, struct mlxsw_hwmon_attr, dev_attr); struct mlxsw_hwmon_dev *mlxsw_hwmon_dev = mlxsw_hwmon_attr->mlxsw_hwmon_dev; struct mlxsw_hwmon *mlxsw_hwmon = mlxsw_hwmon_dev->hwmon; - char mtmp_pl[MLXSW_REG_MTMP_LEN]; + char mtmp_pl[MLXSW_REG_MTMP_LEN] = {0}; unsigned long val; int index; int err; @@ -177,7 +177,7 @@ static ssize_t mlxsw_hwmon_fan_fault_show(struct device *dev, container_of(attr, struct mlxsw_hwmon_attr, dev_attr); struct mlxsw_hwmon_dev *mlxsw_hwmon_dev = mlxsw_hwmon_attr->mlxsw_hwmon_dev; struct mlxsw_hwmon *mlxsw_hwmon = mlxsw_hwmon_dev->hwmon; - char fore_pl[MLXSW_REG_FORE_LEN]; + char fore_pl[MLXSW_REG_FORE_LEN] = {0}; bool fault; int err; diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c index ae63d549b5429..d54fe5e612963 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c @@ -1720,7 +1720,7 @@ static int mlxsw_sp2_span_init(struct mlxsw_sp *mlxsw_sp) static int mlxsw_sp2_span_policer_id_base_set(struct mlxsw_sp *mlxsw_sp, u16 policer_id_base) { - char mogcr_pl[MLXSW_REG_MOGCR_LEN]; + char mogcr_pl[MLXSW_REG_MOGCR_LEN] = {0}; int err; err = mlxsw_reg_query(mlxsw_sp->core, MLXSW_REG(mogcr), mogcr_pl); -- 2.53.0