[PATCH net 0/2] net: ethernet: qualcomm: ppe: Fix queue access and port validation

[PATCH net 0/2] net: ethernet: qualcomm: ppe: Fix queue access and port validation

[Til Kaiser]

Patch 1 corrects multicast admission control table accesses. The table
uses indices 0 through 43 for global queues 256 through 299, and each
entry contains three words. The driver currently uses the global queue
ID as the index and accesses five words.

Patch 2 applies the PPE port constraints to every container and port
naming form accepted by the common switch schema. This prevents ports
from bypassing the reg limit and required PPE clocks and resets.

These fixes were split out of the IPQ5332 support series. The feature
patches are submitted separately to net-next.

Previous discussion:
  https://lore.kernel.org/netdev/20261005152915.101780-1-mail@tk154.de/

Thanks,
Til

Til Kaiser (2):
  net: ethernet: qualcomm: ppe: Fix multicast queue admission control
    access
  dt-bindings: net: qcom,ipq9574-ppe: Apply PPE constraints to all
    switch ports

 .../devicetree/bindings/net/qcom,ipq9574-ppe.yaml          | 5 +++--
 drivers/net/ethernet/qualcomm/ppe/ppe_config.c             | 7 +++++--
 2 files changed, 8 insertions(+), 4 deletions(-)


base-commit: 191aa41548b2d2b6af534a6d5cf84a552435c74c
-- 
2.56.0

[PATCH net 1/2] net: ethernet: qualcomm: ppe: Fix multicast queue admission control access

[Til Kaiser]

Multicast queues have global IDs 256 through 299, but their admission
control table has 44 entries indexed from zero. Using the global queue
ID accesses registers beyond that table, leaving the multicast
thresholds unconfigured. Subtract the unicast queue count when
addressing the multicast table. Keep the global IDs for enqueue and
dequeue operations.

Each multicast admission control entry contains three words at a 16-byte
stride. Limit the bulk accesses to those three words instead of
accessing five words, which also reaches the next entry.

The indexing issue was reported by Sashiko.

Fixes: 806268dc7efd ("net: ethernet: qualcomm: Initialize PPE queue management for IPQ9574")
Link: https://lore.kernel.org/netdev/179143027873.434549.15034517641240789690@kernel.org/
Signed-off-by: Til Kaiser <mail@tk154.de>
---
 drivers/net/ethernet/qualcomm/ppe/ppe_config.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/qualcomm/ppe/ppe_config.c b/drivers/net/ethernet/qualcomm/ppe/ppe_config.c
index 125b73be92b1..95b29db45580 100644
--- a/drivers/net/ethernet/qualcomm/ppe/ppe_config.c
+++ b/drivers/net/ethernet/qualcomm/ppe/ppe_config.c
@@ -1474,7 +1474,7 @@ static int ppe_config_qm(struct ppe_device *ppe_dev)
 {
 	const struct ppe_qm_queue_config *queue_cfg;
 	int ret, i, queue_id, queue_cfg_count;
-	u32 reg, multicast_queue_cfg[5];
+	u32 reg, multicast_queue_cfg[3];
 	u32 unicast_queue_cfg[4];
 	u32 group_cfg[3];
 
@@ -1530,8 +1530,11 @@ static int ppe_config_qm(struct ppe_device *ppe_dev)
 				if (ret)
 					goto qm_config_fail;
 			} else {
+				int mc_queue_id = queue_id -
+					PPE_AC_UNICAST_QUEUE_CFG_TBL_ENTRIES;
+
 				reg = PPE_AC_MULTICAST_QUEUE_CFG_TBL_ADDR +
-				      PPE_AC_MULTICAST_QUEUE_CFG_TBL_INC * queue_id;
+				      PPE_AC_MULTICAST_QUEUE_CFG_TBL_INC * mc_queue_id;
 
 				ret = regmap_bulk_read(ppe_dev->regmap, reg,
 						       multicast_queue_cfg,
-- 
2.56.0

[PATCH net 2/2] dt-bindings: net: qcom,ipq9574-ppe: Apply PPE constraints to all switch ports

[Til Kaiser]

The generic ethernet-switch schema accepts both ports and ethernet-ports
containers and both port and ethernet-port child nodes. The PPE binding
only applies its port constraints to ethernet-port nodes with addresses
matching [1-6]+ inside ethernet-ports.

As a result, ethernet-port@7 with reg = <7> is accepted without the PPE
port ID limit. The alternative container and child naming forms also
bypass the required PPE clocks and resets.

Match the same container and child node patterns as ethernet-switch.yaml
so that every accepted switch port receives the PPE constraints. Keep
the valid port IDs constrained by reg.

Fixes: 1898fc572118 ("dt-bindings: net: Add PPE for Qualcomm IPQ9574 SoC")
Signed-off-by: Til Kaiser <mail@tk154.de>
---
 Documentation/devicetree/bindings/net/qcom,ipq9574-ppe.yaml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Documentation/devicetree/bindings/net/qcom,ipq9574-ppe.yaml b/Documentation/devicetree/bindings/net/qcom,ipq9574-ppe.yaml
index 6d0b21a10732..a5e8aab500ed 100644
--- a/Documentation/devicetree/bindings/net/qcom,ipq9574-ppe.yaml
+++ b/Documentation/devicetree/bindings/net/qcom,ipq9574-ppe.yaml
@@ -173,9 +173,10 @@ properties:
       - interrupts
       - interrupt-names
 
-  ethernet-ports:
+patternProperties:
+  "^(ethernet-)?ports$":
     patternProperties:
-      "^ethernet-port@[1-6]+$":
+      "^(ethernet-)?port@[0-9a-f]+$":
         type: object
         unevaluatedProperties: false
         $ref: ethernet-switch-port.yaml#
-- 
2.56.0

Re: [PATCH net 0/2] net: ethernet: qualcomm: ppe: Fix queue access and port validation

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net 0/2] net: ethernet: qualcomm: ppe: Fix queue access and port validation

[Til Kaiser]

On 10/16/26 5:09 PM, netdev-bot+sinfo@kernel.org wrote:
> Hi!
> 
> This is an automated message. This series looks like a fix, but its
> commit messages seem to be missing some information:
> 
>  - Whether the issue was actually triggered, or is only theoretical
>    (e.g. found by code inspection). If it was triggered please include
>    the symptoms, like the stack trace or error messages.
> 
>  - What hardware the change was tested on. For driver fixes please
>    mention the device (and if relevant firmware version) used for
>    testing, or say that the change was not tested on real hardware.
> 
> Please do not repost the series just to address the above. Instead,
> reply to this email with the missing information, so that reviewers
> can take it into account. If the series needs another revision for
> other reasons, please include the information in the commit messages
> then.
> 
> The evaluation is done by an LLM so it may be wrong, if you think
> that is the case please reply and explain.

Hi,

The multicast indexing issue was reported by Sashiko. The oversized
bulk access was found during follow-up code inspection. These issues
were identified through review, rather than an observed hardware
failure. The register layout was checked against Qualcomm’s QSDK.

The binding issue was reproduced with compiled example DTBs and
dt-validate. I tested the fixes on the Ubiquiti UniFi 7 Pro XGS
access point (IPQ5332).

Thanks,
Til