* [PATCH net 1/2] net: dsa: mxl862xx: bound FDB dump walk by table capacity
[not found] <20261022200434.80182-1-memoriaru@foxmail.com>
@ 2026-10-22 20:04 ` memoriaru
2026-10-22 20:07 ` netdev-bot+sinfo
2026-10-23 20:21 ` netdev-bot+sashiko
2026-10-22 20:04 ` [PATCH net 2/2] net: dsa: mxl862xx: reject bridge_id 0 from BRIDGE_ALLOC memoriaru
1 sibling, 2 replies; 25+ messages in thread
From: memoriaru @ 2026-10-22 20:04 UTC (permalink / raw)
To: netdev; +Cc: daniel, andrew, olteanv, johan, kuba
From: Zhang Hewei <memoriaru@foxmail.com>
The switch MAC table walk in mxl862xx_port_fdb_dump() only exits on the
device-controlled "last" flag. A device (or its firmware) that never
sets last=1 keeps the driver looping forever with RTNL held, and every
matching entry invokes the DSA callback, growing kernel memory without
bound.
The exact MAC table capacity is not part of the public driver API; bound
the walk by a conservative upper bound (16k entries, well above any
documented table size for this family) and return -EIO when exceeded.
Reported-by: memoriaru <memoriaru@foxmail.com>
Signed-off-by: Zhang Hewei <memoriaru@foxmail.com>
---
drivers/net/dsa/mxl862xx/mxl862xx.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c
index e05ad52..12cd407 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx.c
@@ -1497,12 +1497,15 @@ static int mxl862xx_port_fdb_del(struct dsa_switch *ds, int port,
return ret;
}
+#define MXL862XX_MAC_TABLE_FDB_SIZE 16384
+
static int mxl862xx_port_fdb_dump(struct dsa_switch *ds, int port,
dsa_fdb_dump_cb_t *cb, void *data)
{
struct mxl862xx_mac_table_read param = { .initial = 1 };
struct mxl862xx_priv *priv = ds->priv;
u32 entry_port_id;
+ unsigned long count = 0;
int ret;
while (true) {
@@ -1510,6 +1513,16 @@ static int mxl862xx_port_fdb_dump(struct dsa_switch *ds, int port,
if (ret)
return ret;
+ /* The MAC table capacity is fixed by the device. A walk longer
+ * than that means the device (or its firmware) is not
+ * responding correctly; bail out instead of looping forever
+ * with RTNL held.
+ */
+ if (count++ >= MXL862XX_MAC_TABLE_FDB_SIZE) {
+ dev_err(ds->dev, "FDB dump exceeded table capacity\n");
+ return -EIO;
+ }
+
if (param.last)
break;
--
2.39.5 (Apple Git-154)
^ permalink raw reply related [flat|nested] 25+ messages in thread
* [PATCH net 2/2] net: dsa: mxl862xx: reject bridge_id 0 from BRIDGE_ALLOC
[not found] <20261022200434.80182-1-memoriaru@foxmail.com>
2026-10-22 20:04 ` [PATCH net 1/2] net: dsa: mxl862xx: bound FDB dump walk by table capacity memoriaru
@ 2026-10-22 20:04 ` memoriaru
2026-10-23 20:21 ` netdev-bot+sashiko
2026-10-23 20:40 ` [PATCH net v2 0/2] net: dsa: mxl862xx: bound FDB dump walk and validate BRIDGE_ALLOC ids memoriaru
1 sibling, 2 replies; 25+ messages in thread
From: memoriaru @ 2026-10-22 20:04 UTC (permalink / raw)
To: netdev; +Cc: daniel, andrew, olteanv, johan, kuba
From: Zhang Hewei <memoriaru@foxmail.com>
The device controls bridge_id in the BRIDGE_ALLOC response.
mxl862xx_allocate_bridge() only checks the transport status (ret < 0)
and returns le16_to_cpu(bridge_id) verbatim.
The API header states that "ID 0 is not used for historic reasons"
(mxl862xx-api.h:243-244), and MXL862XX_DEFAULT_BRIDGE == 0 is used for
the CPU port. Accepting id 0 assigns fid = 0 to a standalone user port,
merging its filtering domain with the CPU port's; duplicate non-zero ids
returned for two ports collapse their per-port FID isolation.
Reject the protocol-invalid value 0 with -EIO.
Reported-by: memoriaru <memoriaru@foxmail.com>
Signed-off-by: Zhang Hewei <memoriaru@foxmail.com>
---
drivers/net/dsa/mxl862xx/mxl862xx.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c
index 12cd407..dbe2001 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx.c
@@ -593,7 +593,16 @@ static int mxl862xx_allocate_bridge(struct mxl862xx_priv *priv)
if (ret)
return ret;
- return le16_to_cpu(br_alloc.bridge_id);
+ /* Per the API spec, id 0 is not used for historic reasons. Accepting
+ * it verbatim collides with MXL862XX_DEFAULT_BRIDGE (the CPU port),
+ * silently merging the port's FID with the CPU port's filtering
+ * domain.
+ */
+ ret = le16_to_cpu(br_alloc.bridge_id);
+ if (ret == 0)
+ return -EIO;
+
+ return ret;
}
static void mxl862xx_free_bridge(struct dsa_switch *ds,
@@ -1513,9 +1522,11 @@ static int mxl862xx_port_fdb_dump(struct dsa_switch *ds, int port,
if (ret)
return ret;
- /* The MAC table capacity is fixed by the device. A walk longer
- * than that means the device (or its firmware) is not
- * responding correctly; bail out instead of looping forever
+ /* The exact MAC table capacity is not part of the public
+ * driver API. Use a conservative upper bound: 16k entries is
+ * well above any documented table size for this family, while
+ * a device that stopped responding correctly (e.g. firmware
+ * crash mid-walk) would otherwise keep us looping forever
* with RTNL held.
*/
if (count++ >= MXL862XX_MAC_TABLE_FDB_SIZE) {
--
2.39.5 (Apple Git-154)
^ permalink raw reply related [flat|nested] 25+ messages in thread
* Re: [PATCH net 1/2] net: dsa: mxl862xx: bound FDB dump walk by table capacity
2026-10-22 20:04 ` [PATCH net 1/2] net: dsa: mxl862xx: bound FDB dump walk by table capacity memoriaru
@ 2026-10-22 20:07 ` netdev-bot+sinfo
2026-10-22 20:14 ` memoriaru
2026-10-23 20:21 ` netdev-bot+sashiko
1 sibling, 1 reply; 25+ messages in thread
From: netdev-bot+sinfo @ 2026-10-22 20:07 UTC (permalink / raw)
To: memoriaru; +Cc: netdev, daniel, andrew, olteanv, johan, kuba
Hi!
This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:
- How the issue was discovered, e.g. hit in production, hit during
development, syzbot report, manual code inspection, LLM or static
analysis tool scan.
- Whether the issue was actually triggered, or is only theoretical
(e.g. found by code inspection). If it was triggered please include
the symptoms, like the stack trace or error messages.
Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.
The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [PATCH net 1/2] net: dsa: mxl862xx: bound FDB dump walk by table capacity
2026-10-22 20:07 ` netdev-bot+sinfo
@ 2026-10-22 20:14 ` memoriaru
0 siblings, 0 replies; 25+ messages in thread
From: memoriaru @ 2026-10-22 20:14 UTC (permalink / raw)
To: netdev
From: Zhang Hewei <memoriaru@foxmail.com>
Hi,
Replying with the missing context requested by the bot:
Discovery: both issues were found by manual code inspection, while
auditing this driver's handling of device-controlled responses (the
MAC table walk and the BRIDGE_ALLOC reply).
Trigger status:
Patch 1 (unbounded FDB dump walk): the loop mechanism was reproduced
in-kernel. A self-contained module carrying the verbatim loop shape of
mxl862xx_port_fdb_dump() (device transport stubbed) was built against
the official Ubuntu 6.8.0-71 kernel headers and loaded under QEMU (TCG,
unmodified official vmlinuz): the walk never terminated on its own
(100M iterations logged; a real table holds 4-16k entries). The
reproduction is fully automated in Docker and needs no special
hardware. I do not have access to mxl862xx hardware, so this
exercises the driver-side loop logic, not the real device.
Patch 2 (bridge_id == 0 accepted): reproduced at the logic level in
the same module: the driver consumes the firmware-supplied bridge_id
with only a ret < 0 check, so id 0 -- which the API header declares
unused (mxl862xx-api.h:243-244) and which equals
MXL862XX_DEFAULT_BRIDGE (the CPU port) -- is accepted verbatim as the
port FID, merging the port's filtering domain with the CPU port's.
Whether a device can be made to actually return 0 is unknown without
hardware; per the API spec such a reply is already protocol-invalid.
Build status: the reproduction module compiles and runs on the
official kernel; the two patch hunks themselves are small and
mechanical and have not been compile-tested against a full kernel
tree (no mxl862xx hardware available here). Reproduction code can be
shared on request.
Thanks,
Zhang Hewei
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [PATCH net 1/2] net: dsa: mxl862xx: bound FDB dump walk by table capacity
2026-10-22 20:04 ` [PATCH net 1/2] net: dsa: mxl862xx: bound FDB dump walk by table capacity memoriaru
2026-10-22 20:07 ` netdev-bot+sinfo
@ 2026-10-23 20:21 ` netdev-bot+sashiko
2026-10-23 20:32 ` memoriaru
1 sibling, 1 reply; 25+ messages in thread
From: netdev-bot+sashiko @ 2026-10-23 20:21 UTC (permalink / raw)
To: memoriaru; +Cc: netdev, daniel, andrew, olteanv, johan, kuba
Thank you for your contribution! Sashiko AI review found 3 potential
issue(s) to consider.
Critical: 0 · High: 0 · Medium: 1 (1) · Low: 2
If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).
- [Medium] net: dsa: mxl862xx: off-by-one in mxl862xx_port_fdb_dump()
capacity check
- [Low] The commit message for "net: dsa: mxl862xx: bound FDB dump walk
by table capacity" says that with firmware that never sets last=1,…
- [Low] The patch is presented as a fix for an infinite loop with RTNL
held, but it has no Fixes: tag.
Pre-existing issues:
- [Medium] The kernel-doc for struct mxl862xx_mac_table_read
(drivers/net/dsa/mxl862xx/mxl862xx-api.h) says "@last: Indicates that…
--
net: dsa: mxl862xx: bound FDB dump walk by table capacity
This commit caps the MAC table walk in mxl862xx_port_fdb_dump() at 16384
entries. If the firmware has not set the last flag by then, the walk
stops with -EIO and logs an error. The goal is to avoid an endless loop
with RTNL held when the firmware never reports the end of the table.
> A device (or its firmware) that never
> sets last=1 keeps the driver looping forever with RTNL held, and every
> matching entry invokes the DSA callback, growing kernel memory without
> bound.
[Severity: Low]
Is the "growing kernel memory without bound" part accurate?
The only callback passed to port_fdb_dump is dsa_user_port_fdb_do_dump(),
reached via dsa_user_fdb_dump()->dsa_port_fdb_dump(). It does not allocate
anything per entry. It writes into the fixed-size netlink dump skb and
returns -EMSGSIZE once the skb is full:
net/dsa/user.c:dsa_user_port_fdb_do_dump() {
...
if (dump->idx < ctx->fdb_idx)
goto skip;
nlh = nlmsg_put(dump->skb, portid, seq, RTM_NEWNEIGH,
sizeof(*ndm), NLM_F_MULTI);
if (!nlh)
return -EMSGSIZE;
...
nla_put_failure:
nlmsg_cancel(dump->skb, nlh);
return -EMSGSIZE;
}
mxl862xx_port_fdb_dump() already returns on any non-zero cb() result, so
the walk ends when the skb fills up. Skipped entries use no space.
Before this patch, the unbounded cost was CPU and RTNL hold time spent
looping over entries that don't match the port, or that are skipped. It
was not memory growth. Could the commit message describe it that way?
> Reported-by: memoriaru <memoriaru@foxmail.com>
> Signed-off-by: Zhang Hewei <memoriaru@foxmail.com>
[Severity: Low]
Should this have a Fixes: tag? The unbounded while (true) walk in
mxl862xx_port_fdb_dump() came in with:
Fixes: 340bdf984613 ("net: dsa: mxl862xx: implement bridge offloading")
The Reported-by: uses the same address as the Signed-off-by:. There is
also no Closes: or Link: tag, which checkpatch warns about. Was this seen
on real hardware?
The trigger also looks narrower than described. Firmware that has
stopped responding already fails in mxl862xx_busy_wait():
return readx_poll_timeout(mxl862xx_ctrl_read, priv, val,
!(val & CTRL_BUSY_MASK), 15, 500000);
Garbled replies are rejected with -EIO by the CRC-6 check in
mxl862xx_issue_cmd() and the CRC-16 check on the read payload in
mxl862xx_api_wrap(). Both of these already leave the loop through the
existing "if (ret) return ret;".
So the only new case covered seems to be firmware that keeps sending
well-formed, CRC-valid replies but never sets last. Could the commit
message and the "not responding correctly" code comment say that more
precisely?
> diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c
> index e05ad52cd297e..12cd40756a0c9 100644
> --- a/drivers/net/dsa/mxl862xx/mxl862xx.c
> +++ b/drivers/net/dsa/mxl862xx/mxl862xx.c
[ ... ]
> @@ -1510,6 +1513,16 @@ static int mxl862xx_port_fdb_dump(struct dsa_switch *ds, int port,
> if (ret)
> return ret;
>
> + /* The MAC table capacity is fixed by the device. A walk longer
> + * than that means the device (or its firmware) is not
> + * responding correctly; bail out instead of looping forever
> + * with RTNL held.
> + */
> + if (count++ >= MXL862XX_MAC_TABLE_FDB_SIZE) {
> + dev_err(ds->dev, "FDB dump exceeded table capacity\n");
> + return -EIO;
> + }
> +
> if (param.last)
> break;
[Severity: Medium]
Does this bound count the terminating read as if it were an entry?
The count check runs before the param.last test. Suppose the table
holds exactly MXL862XX_MAC_TABLE_FDB_SIZE entries:
- The 16384 reads that return entries with last == 0 take count from
0 to 16384.
- The next read is the one with last == 1.
- At that point count++ >= 16384 is already true.
So mxl862xx_port_fdb_dump() logs "FDB dump exceeded table capacity"
and returns -EIO instead of finishing the walk.
A table that is exactly at the cap fails the whole dump, even though
the firmware ended the walk correctly. The error message is also
wrong in that case, because nothing was exceeded. 16384 is meant to
be well above any real table size, so this may not be reachable on
current parts. The check still treats the sentinel as an entry,
though.
Would it be cleaner to test param.last first and only count reads
that actually carry an entry? Moving the bound below the
"if (param.last) break;" keeps the same protection against firmware
that never sets last.
The kernel-doc for struct mxl862xx_mac_table_read suggests the
last == 1 reply may itself carry a valid entry. If so, the counting
here should line up with whatever is decided about handling that
final reply.
[Severity: Medium]
This is a pre-existing issue, not one introduced by this patch, but can
this break drop the final MAC table entry?
The kernel-doc for struct mxl862xx_mac_table_read in mxl862xx-api.h
says:
* @last: Indicates that the read operation returned last entry
That reads as if the last=1 response still carries a valid entry. The
loop breaks before it looks at param.port_id, param.mac or param.tci, so
that response is never passed to cb().
If the firmware fills in the entry fields along with last=1, every FDB
dump would silently leave out the final entry. If it doesn't, the
kernel-doc is misleading. The tree doesn't show which firmware behaviour
is correct. This code dates back to commit 340bdf984613.
Taken together, the code change looks fine. All three points concern
the commit message, the trailers, or code that was already there.
--
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/tencent_A56873DA4A296F5D794B6A5989A180A21C05%40qq.com
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [PATCH net 2/2] net: dsa: mxl862xx: reject bridge_id 0 from BRIDGE_ALLOC
2026-10-22 20:04 ` [PATCH net 2/2] net: dsa: mxl862xx: reject bridge_id 0 from BRIDGE_ALLOC memoriaru
@ 2026-10-23 20:21 ` netdev-bot+sashiko
2026-10-23 20:40 ` [PATCH net v2 0/2] net: dsa: mxl862xx: bound FDB dump walk and validate BRIDGE_ALLOC ids memoriaru
1 sibling, 0 replies; 25+ messages in thread
From: netdev-bot+sashiko @ 2026-10-23 20:21 UTC (permalink / raw)
To: memoriaru; +Cc: netdev, daniel, andrew, olteanv, johan, kuba
Thank you for your contribution! Sashiko AI review found 4 potential
issue(s) to consider.
Critical: 0 · High: 0 · Medium: 2 · Low: 2
If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).
- [Medium] mxl862xx_allocate_bridge()
(drivers/net/dsa/mxl862xx/mxl862xx.c:587-606) still checks the device-…
- [Medium] net: dsa: mxl862xx: off-by-one check order in
mxl862xx_port_fdb_dump()
- [Low] The commit message does not mention one of the two hunks, and
that hunk has nothing to do with bridge_id.
- [Low] The commit message has several gaps.
--
net: dsa: mxl862xx: reject bridge_id 0 from BRIDGE_ALLOC
This patch makes mxl862xx_allocate_bridge() return -EIO when the
BRIDGE_ALLOC response carries bridge_id 0. That value is reserved by the
API and collides with MXL862XX_DEFAULT_BRIDGE, which the CPU port uses.
The patch also rewrites the comment on the iteration bound in
mxl862xx_port_fdb_dump().
> mxl862xx_allocate_bridge() only checks the transport status (ret < 0)
> and returns le16_to_cpu(bridge_id) verbatim.
[Severity: Low]
I have a few small questions about the commit message.
The code being replaced checks "if (ret) return ret;", not ret < 0.
Should the description match the code?
Should this have a Fixes: tag? git blame shows all of
mxl862xx_allocate_bridge() came from:
Fixes: 340bdf984613 ("net: dsa: mxl862xx: implement bridge offloading")
The message doesn't mention that 0 is also the "not allocated" value
for priv->bridges[]:
mxl862xx_port_bridge_join() {
...
if (!priv->bridges[bridge.num]) {
ret = mxl862xx_allocate_bridge(priv);
...
}
mxl862xx_get_fid() {
...
case DSA_DB_BRIDGE:
if (!priv->bridges[db.bridge.num])
return -ENOENT;
...
}
So with an id of 0, the bridge also looked unallocated. Each later join
allocated it again, and bridge FDB and MDB operations failed with -ENOENT.
Would it be worth describing this as well?
Firmware that follows the API never returns 0, so this change guards
against firmware that breaks the API. Could the message say so? It would
help with net vs net-next and stable decisions.
The Reported-by: trailer has the author's own address and there's no
Closes: link. Is that intended?
> diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c
> index 12cd40756a0c9..dbe20014d090e 100644
> --- a/drivers/net/dsa/mxl862xx/mxl862xx.c
> +++ b/drivers/net/dsa/mxl862xx/mxl862xx.c
> @@ -593,7 +593,16 @@ static int mxl862xx_allocate_bridge(struct mxl862xx_priv *priv)
> if (ret)
> return ret;
>
> - return le16_to_cpu(br_alloc.bridge_id);
> + /* Per the API spec, id 0 is not used for historic reasons. Accepting
> + * it verbatim collides with MXL862XX_DEFAULT_BRIDGE (the CPU port),
> + * silently merging the port's FID with the CPU port's filtering
> + * domain.
> + */
> + ret = le16_to_cpu(br_alloc.bridge_id);
> + if (ret == 0)
> + return -EIO;
> +
> + return ret;
> }
[Severity: Medium]
Is rejecting only 0 enough to cover what the commit message describes?
Every other u16 value is still returned as a valid FID.
The kernel-doc for struct mxl862xx_bridge_alloc in mxl862xx-api.h says:
* @bridge_id: If the bridge allocation is successful, a valid ID will be
* returned in this field. Otherwise, INVALID_HANDLE is
* returned.
The driver doesn't define or check INVALID_HANDLE. If it is ~0, as in
the MaxLinear GSW API, 65535 would be accepted as a FID.
The commit message also says "duplicate non-zero ids returned for two
ports collapse their per-port FID isolation". However, nothing compares
the returned id with priv->ports[*].fid or priv->bridges[*], so
duplicates still get through.
There's also no upper bound check against the hardware FID range.
Commit 340bdf984613 says the switch supports at most 63 bridges.
Both callers only check for ret < 0 and then use the value:
mxl862xx_port_setup()
priv->ports[port].fid = ret;
-> mxl862xx_bridge_config_fwd(), mxl862xx_set_bridge_port()
mxl862xx_port_bridge_join()
priv->bridges[bridge.num] = ret;
-> mxl862xx_sync_bridge_members(), mxl862xx_get_fid(), BRIDGE_FREE
mxl862xx_port_fdb_del() matches an entry only by FID, VID and MAC. So if
two domains get the same FID, deleting an FDB entry in one domain can
remove an entry belonging to the other.
Should this check also reject INVALID_HANDLE, ids outside the hardware
range, and ids that are already in use?
[ ... ]
> @@ -1513,9 +1522,11 @@ static int mxl862xx_port_fdb_dump(struct dsa_switch *ds, int port,
> if (ret)
> return ret;
>
> - /* The MAC table capacity is fixed by the device. A walk longer
> - * than that means the device (or its firmware) is not
> - * responding correctly; bail out instead of looping forever
> + /* The exact MAC table capacity is not part of the public
> + * driver API. Use a conservative upper bound: 16k entries is
> + * well above any documented table size for this family, while
> + * a device that stopped responding correctly (e.g. firmware
> + * crash mid-walk) would otherwise keep us looping forever
> * with RTNL held.
> */
> if (count++ >= MXL862XX_MAC_TABLE_FDB_SIZE) {
[Severity: Medium]
The previous patch introduced this, not this one, but this hunk
rewrites the comment above it anyway. Is the bound checked in the
right place?
In mxl862xx_port_fdb_dump() the count check runs before the
param.last test. The final MXL862XX_MAC_TABLEENTRYREAD response only
sets last and carries no entry, but it is still counted against
MXL862XX_MAC_TABLE_FDB_SIZE.
With N valid entries the loop does N + 1 reads. On the last read,
count is already N. If the table holds exactly
MXL862XX_MAC_TABLE_FDB_SIZE entries, the dump returns -EIO and logs
"FDB dump exceeded table capacity". The firmware ended the walk
correctly, yet bridge fdb show fails on a full table.
The macro name and the error message both call 16384 the table
capacity. A full table is exactly the case the bound is meant to
allow. Should the param.last test be moved above the count check?
[Severity: Low]
This isn't a bug, but this hunk has nothing to do with bridge_id, and the
commit message doesn't mention it. It rewrites the comment that the
previous patch in the series added ("net: dsa: mxl862xx: bound FDB dump
walk by table capacity").
Should it be squashed into that patch instead?
The new comment says 16384 is not the table capacity, but the code
around it still says it is:
#define MXL862XX_MAC_TABLE_FDB_SIZE 16384
...
dev_err(ds->dev, "FDB dump exceeded table capacity\n");
The previous patch's subject also says "by table capacity". Should the
macro name and the error message be changed to match the new comment?
--
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/tencent_A56873DA4A296F5D794B6A5989A180A21C05%40qq.com
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [PATCH net 1/2] net: dsa: mxl862xx: bound FDB dump walk by table capacity
2026-10-23 20:21 ` netdev-bot+sashiko
@ 2026-10-23 20:32 ` memoriaru
0 siblings, 0 replies; 25+ messages in thread
From: memoriaru @ 2026-10-23 20:32 UTC (permalink / raw)
To: netdev
From: Zhang Hewei <memoriaru@foxmail.com>
Thanks -- reviewed both Medium findings against the tree. Planning a
v2; replies to each below.
[Medium] off-by-one in the capacity check: the fix is warranted, with
one nuance on the premise. The kernel-doc for @last says "Indicates
that the read operation returned last entry", which reads as last
being set on the response that carries the final entry -- under that
reading, a walk of exactly MXL862XX_MAC_TABLE_FDB_SIZE entries
completes before the check trips. If instead the terminal response
carries no entry (and still counts as a read), the current order
rejects a correctly ended full table. The public headers do not
settle which it is, so v2 moves the param.last test above the count
check and drops the protocol dependency entirely; the macro name and
the error message get reworded to "conservative upper bound" to match
the comment.
[Medium] is rejecting only bridge_id 0 enough: fair. INVALID_HANDLE
is referenced by the API docs but never defined or checked by the
driver, so if it is 0xffff (the MaxLinear GSW convention), a failed
allocation would currently be consumed as a FID. v2 rejects 0xffff as
well, and range-checks the id once the driver-side bridge limit is
confirmed. Duplicate-id detection: the cross-domain fdb_del
consequence you describe is real; I'll see how far validation can go
without inventing API facts that are absent from the public headers.
The Lows are accepted too: the comment hunk moves into patch 1, the
"growing kernel memory without bound" wording is dropped (reported
entries consume the fixed netlink dump skb and -EMSGSIZE aborts the
walk; the unbounded case is a device answering forever with entries
that are filtered out before the callback), Fixes: tags will be
added, and the self Reported-by trailer goes away.
pw-bot: cr
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH net v2 0/2] net: dsa: mxl862xx: bound FDB dump walk and validate BRIDGE_ALLOC ids
@ 2026-10-23 20:40 ` memoriaru
2026-10-23 20:44 ` netdev-bot+sinfo
` (2 more replies)
0 siblings, 3 replies; 25+ messages in thread
From: memoriaru @ 2026-10-23 20:40 UTC (permalink / raw)
To: netdev; +Cc: daniel, andrew, olteanv, johan, kuba
From: Zhang Hewei <memoriaru@foxmail.com>
Here is a v2 of the two mxl862xx robustness fixes, reworked after
the sashiko AI review.
Changes since v1 (https://lore.kernel.org/netdev/tencent_A56873DA4A296F5D794B6A5989A180A21C05@qq.com/):
- the walk limit is now checked after the "last" test: the walk
needs one read more than the number of entries it reports, so
checking before it rejected a correctly ended walk of a full table
- macro name, error message and comments say "conservative read
limit" instead of "table capacity", which the exact value is not
- the "growing kernel memory without bound" wording is gone:
entries whose port id does not match never reach the callback,
which is exactly why the walk needs its own bound (the netlink
dump skb never fills)
- BRIDGE_ALLOC validation now also rejects 0xffff (INVALID_HANDLE is
documented but never defined; the MaxLinear GSW API uses 0xffff)
and ids already in use, closing the duplicate-FID collapse
- Fixes: tags added (both issues come from the bridge offloading
commit), self Reported-by trailers dropped, and the comment hunk
that v1 carried in patch 2 is folded into patch 1
Base-commit: f47d223627f80cb7a1eb14c585fe6cb35de5e984
Zhang Hewei (2):
net: dsa: mxl862xx: bound FDB dump walk with a read limit
net: dsa: mxl862xx: validate the bridge id returned by BRIDGE_ALLOC
drivers/net/dsa/mxl862xx/mxl862xx-api.h | 1584 +++++++++++++++++++++++
drivers/net/dsa/mxl862xx/mxl862xx.c | 57 +-
drivers/net/dsa/mxl862xx/mxl862xx.h | 343 +++++
3 files changed, 1983 insertions(+), 1 deletion(-)
create mode 100644 drivers/net/dsa/mxl862xx/mxl862xx-api.h
create mode 100644 drivers/net/dsa/mxl862xx/mxl862xx.h
--
2.39.5 (Apple Git-154)
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH net v2 1/2] net: dsa: mxl862xx: bound FDB dump walk with a read limit
[not found] <20261023204006.24923-1-memoriaru@foxmail.com>
@ 2026-10-23 20:40 ` memoriaru
2026-10-23 20:40 ` [PATCH net v2 2/2] net: dsa: mxl862xx: validate the bridge id returned by BRIDGE_ALLOC memoriaru
1 sibling, 0 replies; 25+ messages in thread
From: memoriaru @ 2026-10-23 20:40 UTC (permalink / raw)
To: netdev; +Cc: daniel, andrew, olteanv, johan, kuba
From: Zhang Hewei <memoriaru@foxmail.com>
mxl862xx_port_fdb_dump() walks the MAC table in a while (true) loop
whose only exit is the device-controlled "last" flag. Entries whose
port id does not match the dumped port are skipped without invoking
the DSA callback, so the netlink dump buffer never fills either: a
device (or its firmware) that keeps answering with entries for other
ports and never sets last keeps the driver walking forever with RTNL
held.
The exact MAC table capacity is not part of the public driver API.
Use a conservative read limit (16k, well above any documented table
size for this family) and return -EIO when it is exceeded. The limit
is checked after the "last" test so that a correctly ended walk of a
full table is not rejected: the walk needs one read more than the
number of entries it reports.
Fixes: 340bdf984613c4a9 ("net: dsa: mxl862xx: implement bridge offloading")
Signed-off-by: Zhang Hewei <memoriaru@foxmail.com>
---
drivers/net/dsa/mxl862xx/mxl862xx-api.h | 1584 +++++++++++++++++++++++
drivers/net/dsa/mxl862xx/mxl862xx.c | 20 +
drivers/net/dsa/mxl862xx/mxl862xx.h | 343 +++++
3 files changed, 1947 insertions(+)
create mode 100644 drivers/net/dsa/mxl862xx/mxl862xx-api.h
create mode 100644 drivers/net/dsa/mxl862xx/mxl862xx.h
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-api.h b/drivers/net/dsa/mxl862xx/mxl862xx-api.h
new file mode 100644
index 0000000..a180a5d
--- /dev/null
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-api.h
@@ -0,0 +1,1584 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef __MXL862XX_API_H
+#define __MXL862XX_API_H
+
+#include <linux/bits.h>
+#include <linux/if_ether.h>
+
+/**
+ * struct mdio_relay_data - relayed access to the switch internal MDIO bus
+ * @data: data to be read or written
+ * @phy: PHY index
+ * @mmd: MMD device
+ * @reg: register index
+ */
+struct mdio_relay_data {
+ __le16 data;
+ u8 phy;
+ u8 mmd;
+ __le16 reg;
+} __packed;
+
+/**
+ * struct mxl862xx_register_mod - Register access parameter to directly
+ * modify internal registers
+ * @addr: Register address offset for modification
+ * @data: Value to write to the register address
+ * @mask: Mask of bits to be modified (1 to modify, 0 to ignore)
+ *
+ * Used for direct register modification operations.
+ */
+struct mxl862xx_register_mod {
+ __le16 addr;
+ __le16 data;
+ __le16 mask;
+} __packed;
+
+/**
+ * enum mxl862xx_mac_table_filter - Source/Destination MAC address filtering
+ *
+ * @MXL862XX_MAC_FILTER_NONE: no filter
+ * @MXL862XX_MAC_FILTER_SRC: source address filter
+ * @MXL862XX_MAC_FILTER_DEST: destination address filter
+ * @MXL862XX_MAC_FILTER_BOTH: both source and destination filter
+ */
+enum mxl862xx_mac_table_filter {
+ MXL862XX_MAC_FILTER_NONE = 0,
+ MXL862XX_MAC_FILTER_SRC = BIT(0),
+ MXL862XX_MAC_FILTER_DEST = BIT(1),
+ MXL862XX_MAC_FILTER_BOTH = BIT(0) | BIT(1),
+};
+
+#define MXL862XX_TCI_VLAN_ID GENMASK(11, 0)
+#define MXL862XX_TCI_VLAN_CFI_DEI BIT(12)
+#define MXL862XX_TCI_VLAN_PRI GENMASK(15, 13)
+
+/* Set in port_id to use port_map[] as a portmap bitmap instead of a single
+ * port ID. When clear, port_id selects one port; when set, the firmware
+ * ignores the lower bits of port_id and writes port_map[] directly into
+ * the PCE bridge port map.
+ */
+#define MXL862XX_PORTMAP_FLAG BIT(31)
+
+/**
+ * struct mxl862xx_mac_table_add - MAC Table Entry to be added
+ * @fid: Filtering Identifier (FID) (not supported by all switches)
+ * @port_id: Ethernet Port number
+ * @port_map: Bridge Port Map
+ * @sub_if_id: Sub-Interface Identifier Destination
+ * @age_timer: Aging Time in seconds
+ * @vlan_id: STAG VLAN Id
+ * @static_entry: Static Entry (value will be aged out if not set to static)
+ * @traffic_class: Egress queue traffic class
+ * @mac: MAC Address to add to the table
+ * @filter_flag: See &enum mxl862xx_mac_table_filter
+ * @igmp_controlled: Packet is marked as IGMP controlled if destination MAC
+ * address matches MAC in this entry
+ * @associated_mac: Associated Mac address
+ * @tci: TCI for B-Step
+ * Bit [0:11] - VLAN ID
+ * Bit [12] - VLAN CFI/DEI
+ * Bit [13:15] - VLAN PRI
+ */
+struct mxl862xx_mac_table_add {
+ __le16 fid;
+ __le32 port_id;
+ __le16 port_map[8];
+ __le16 sub_if_id;
+ __le32 age_timer;
+ __le16 vlan_id;
+ u8 static_entry;
+ u8 traffic_class;
+ u8 mac[ETH_ALEN];
+ u8 filter_flag;
+ u8 igmp_controlled;
+ u8 associated_mac[ETH_ALEN];
+ __le16 tci;
+} __packed;
+
+/**
+ * struct mxl862xx_mac_table_remove - MAC Table Entry to be removed
+ * @fid: Filtering Identifier (FID)
+ * @mac: MAC Address to be removed from the table.
+ * @filter_flag: See &enum mxl862xx_mac_table_filter
+ * @tci: TCI for B-Step
+ * Bit [0:11] - VLAN ID
+ * Bit [12] - VLAN CFI/DEI
+ * Bit [13:15] - VLAN PRI
+ */
+struct mxl862xx_mac_table_remove {
+ __le16 fid;
+ u8 mac[ETH_ALEN];
+ u8 filter_flag;
+ __le16 tci;
+} __packed;
+
+/**
+ * struct mxl862xx_mac_table_read - MAC Table Entry to be read
+ * @initial: Restart the get operation from the beginning of the table
+ * @last: Indicates that the read operation returned last entry
+ * @fid: Get the MAC table entry belonging to the given Filtering Identifier
+ * @port_id: The Bridge Port ID
+ * @port_map: Bridge Port Map
+ * @age_timer: Aging Time
+ * @vlan_id: STAG VLAN Id
+ * @static_entry: Indicates if this is a Static Entry
+ * @sub_if_id: Sub-Interface Identifier Destination
+ * @mac: MAC Address. Filled out by the switch API implementation.
+ * @filter_flag: See &enum mxl862xx_mac_table_filter
+ * @igmp_controlled: Packet is marked as IGMP controlled if destination MAC
+ * address matches the MAC in this entry
+ * @entry_changed: Indicate if the Entry has Changed
+ * @associated_mac: Associated MAC address
+ * @hit_status: MAC Table Hit Status Update
+ * @tci: TCI for B-Step
+ * Bit [0:11] - VLAN ID
+ * Bit [12] - VLAN CFI/DEI
+ * Bit [13:15] - VLAN PRI
+ * @first_bridge_port_id: The port this MAC address has first been learned.
+ * This is used for loop detection.
+ */
+struct mxl862xx_mac_table_read {
+ u8 initial;
+ u8 last;
+ __le16 fid;
+ __le32 port_id;
+ __le16 port_map[8];
+ __le32 age_timer;
+ __le16 vlan_id;
+ u8 static_entry;
+ __le16 sub_if_id;
+ u8 mac[ETH_ALEN];
+ u8 filter_flag;
+ u8 igmp_controlled;
+ u8 entry_changed;
+ u8 associated_mac[ETH_ALEN];
+ u8 hit_status;
+ __le16 tci;
+ __le16 first_bridge_port_id;
+} __packed;
+
+/**
+ * struct mxl862xx_mac_table_query - MAC Table Entry key-based lookup
+ * @mac: MAC Address to search for (input)
+ * @fid: Filtering Identifier (input)
+ * @found: Set by firmware: 1 if entry was found, 0 if not
+ * @port_id: Bridge Port ID (output; MSB set if portmap mode)
+ * @port_map: Bridge Port Map (output; valid for static entries)
+ * @sub_if_id: Sub-Interface Identifier Destination
+ * @age_timer: Aging Time
+ * @vlan_id: STAG VLAN Id
+ * @static_entry: Indicates if this is a Static Entry
+ * @filter_flag: See &enum mxl862xx_mac_table_filter (input+output)
+ * @igmp_controlled: IGMP controlled flag
+ * @entry_changed: Entry changed flag
+ * @associated_mac: Associated MAC address
+ * @hit_status: MAC Table Hit Status Update
+ * @tci: TCI (VLAN ID + CFI/DEI + PRI) (input)
+ * @first_bridge_port_id: First learned bridge port
+ */
+struct mxl862xx_mac_table_query {
+ u8 mac[ETH_ALEN];
+ __le16 fid;
+ u8 found;
+ __le32 port_id;
+ __le16 port_map[8];
+ __le16 sub_if_id;
+ __le32 age_timer;
+ __le16 vlan_id;
+ u8 static_entry;
+ u8 filter_flag;
+ u8 igmp_controlled;
+ u8 entry_changed;
+ u8 associated_mac[ETH_ALEN];
+ u8 hit_status;
+ __le16 tci;
+ __le16 first_bridge_port_id;
+} __packed;
+
+/**
+ * enum mxl862xx_mac_clear_type - MAC table clear type
+ * @MXL862XX_MAC_CLEAR_PHY_PORT: clear dynamic entries based on port_id
+ * @MXL862XX_MAC_CLEAR_DYNAMIC: clear all dynamic entries
+ */
+enum mxl862xx_mac_clear_type {
+ MXL862XX_MAC_CLEAR_PHY_PORT = 0,
+ MXL862XX_MAC_CLEAR_DYNAMIC,
+};
+
+/**
+ * struct mxl862xx_mac_table_clear - MAC table clear
+ * @type: see &enum mxl862xx_mac_clear_type
+ * @port_id: physical port id
+ */
+struct mxl862xx_mac_table_clear {
+ u8 type;
+ u8 port_id;
+} __packed;
+
+/**
+ * enum mxl862xx_age_timer - Aging Timer Value.
+ * @MXL862XX_AGETIMER_1_SEC: 1 second aging time
+ * @MXL862XX_AGETIMER_10_SEC: 10 seconds aging time
+ * @MXL862XX_AGETIMER_300_SEC: 300 seconds aging time
+ * @MXL862XX_AGETIMER_1_HOUR: 1 hour aging time
+ * @MXL862XX_AGETIMER_1_DAY: 24 hours aging time
+ * @MXL862XX_AGETIMER_CUSTOM: Custom aging time in seconds
+ */
+enum mxl862xx_age_timer {
+ MXL862XX_AGETIMER_1_SEC = 1,
+ MXL862XX_AGETIMER_10_SEC,
+ MXL862XX_AGETIMER_300_SEC,
+ MXL862XX_AGETIMER_1_HOUR,
+ MXL862XX_AGETIMER_1_DAY,
+ MXL862XX_AGETIMER_CUSTOM,
+};
+
+/**
+ * struct mxl862xx_bridge_alloc - Bridge Allocation
+ * @bridge_id: If the bridge allocation is successful, a valid ID will be
+ * returned in this field. Otherwise, INVALID_HANDLE is
+ * returned. For bridge free, this field should contain a
+ * valid ID returned by the bridge allocation. ID 0 is not
+ * used for historic reasons.
+ *
+ * Used by MXL862XX_BRIDGE_ALLOC and MXL862XX_BRIDGE_FREE.
+ */
+struct mxl862xx_bridge_alloc {
+ __le16 bridge_id;
+};
+
+/**
+ * enum mxl862xx_bridge_config_mask - Bridge configuration mask
+ * @MXL862XX_BRIDGE_CONFIG_MASK_MAC_LEARNING_LIMIT:
+ * Mask for mac_learning_limit_enable and mac_learning_limit.
+ * @MXL862XX_BRIDGE_CONFIG_MASK_MAC_LEARNED_COUNT:
+ * Mask for mac_learning_count
+ * @MXL862XX_BRIDGE_CONFIG_MASK_MAC_DISCARD_COUNT:
+ * Mask for learning_discard_event
+ * @MXL862XX_BRIDGE_CONFIG_MASK_SUB_METER:
+ * Mask for sub_metering_enable and traffic_sub_meter_id
+ * @MXL862XX_BRIDGE_CONFIG_MASK_FORWARDING_MODE:
+ * Mask for forward_broadcast, forward_unknown_multicast_ip,
+ * forward_unknown_multicast_non_ip and forward_unknown_unicast.
+ * @MXL862XX_BRIDGE_CONFIG_MASK_ALL: Enable all
+ * @MXL862XX_BRIDGE_CONFIG_MASK_FORCE: Bypass any check for debug purpose
+ */
+enum mxl862xx_bridge_config_mask {
+ MXL862XX_BRIDGE_CONFIG_MASK_MAC_LEARNING_LIMIT = BIT(0),
+ MXL862XX_BRIDGE_CONFIG_MASK_MAC_LEARNED_COUNT = BIT(1),
+ MXL862XX_BRIDGE_CONFIG_MASK_MAC_DISCARD_COUNT = BIT(2),
+ MXL862XX_BRIDGE_CONFIG_MASK_SUB_METER = BIT(3),
+ MXL862XX_BRIDGE_CONFIG_MASK_FORWARDING_MODE = BIT(4),
+ MXL862XX_BRIDGE_CONFIG_MASK_ALL = 0x7FFFFFFF,
+ MXL862XX_BRIDGE_CONFIG_MASK_FORCE = BIT(31)
+};
+
+/**
+ * enum mxl862xx_bridge_port_egress_meter - Meters for egress traffic type
+ * @MXL862XX_BRIDGE_PORT_EGRESS_METER_BROADCAST:
+ * Index of broadcast traffic meter
+ * @MXL862XX_BRIDGE_PORT_EGRESS_METER_MULTICAST:
+ * Index of known multicast traffic meter
+ * @MXL862XX_BRIDGE_PORT_EGRESS_METER_UNKNOWN_MC_IP:
+ * Index of unknown multicast IP traffic meter
+ * @MXL862XX_BRIDGE_PORT_EGRESS_METER_UNKNOWN_MC_NON_IP:
+ * Index of unknown multicast non-IP traffic meter
+ * @MXL862XX_BRIDGE_PORT_EGRESS_METER_UNKNOWN_UC:
+ * Index of unknown unicast traffic meter
+ * @MXL862XX_BRIDGE_PORT_EGRESS_METER_OTHERS:
+ * Index of traffic meter for other types
+ * @MXL862XX_BRIDGE_PORT_EGRESS_METER_MAX: Number of index
+ */
+enum mxl862xx_bridge_port_egress_meter {
+ MXL862XX_BRIDGE_PORT_EGRESS_METER_BROADCAST = 0,
+ MXL862XX_BRIDGE_PORT_EGRESS_METER_MULTICAST,
+ MXL862XX_BRIDGE_PORT_EGRESS_METER_UNKNOWN_MC_IP,
+ MXL862XX_BRIDGE_PORT_EGRESS_METER_UNKNOWN_MC_NON_IP,
+ MXL862XX_BRIDGE_PORT_EGRESS_METER_UNKNOWN_UC,
+ MXL862XX_BRIDGE_PORT_EGRESS_METER_OTHERS,
+ MXL862XX_BRIDGE_PORT_EGRESS_METER_MAX,
+};
+
+/**
+ * struct mxl862xx_qos_meter_cfg - Rate meter configuration
+ * @enable: Enable/disable meter
+ * @meter_id: Meter ID (assigned by firmware on alloc)
+ * @meter_name: Meter name string
+ * @meter_type: Meter algorithm type (srTCM = 0, trTCM = 1)
+ * @cbs: Committed Burst Size (in bytes)
+ * @res1: Reserved
+ * @ebs: Excess Burst Size (in bytes)
+ * @res2: Reserved
+ * @rate: Committed Information Rate (in kbit/s)
+ * @pi_rate: Peak Information Rate (in kbit/s)
+ * @colour_blind_mode: Colour-blind mode enable
+ * @pkt_mode: Packet mode enable
+ * @local_overhd: Local overhead accounting enable
+ * @local_overhd_val: Local overhead accounting value
+ */
+struct mxl862xx_qos_meter_cfg {
+ u8 enable;
+ __le16 meter_id;
+ char meter_name[32];
+ __le32 meter_type;
+ __le32 cbs;
+ __le32 res1;
+ __le32 ebs;
+ __le32 res2;
+ __le32 rate;
+ __le32 pi_rate;
+ u8 colour_blind_mode;
+ u8 pkt_mode;
+ u8 local_overhd;
+ __le16 local_overhd_val;
+} __packed;
+
+/**
+ * enum mxl862xx_bridge_forward_mode - Bridge forwarding type of packet
+ * @MXL862XX_BRIDGE_FORWARD_FLOOD: Packet is flooded to port members of
+ * ingress bridge port
+ * @MXL862XX_BRIDGE_FORWARD_DISCARD: Packet is discarded
+ */
+enum mxl862xx_bridge_forward_mode {
+ MXL862XX_BRIDGE_FORWARD_FLOOD = 0,
+ MXL862XX_BRIDGE_FORWARD_DISCARD,
+};
+
+/**
+ * struct mxl862xx_bridge_config - Bridge Configuration
+ * @bridge_id: Bridge ID (FID)
+ * @mask: See &enum mxl862xx_bridge_config_mask
+ * @mac_learning_limit_enable: Enable MAC learning limitation
+ * @mac_learning_limit: Max number of MAC addresses that can be learned in
+ * this bridge (all bridge ports)
+ * @mac_learning_count: Number of MAC addresses learned from this bridge
+ * @learning_discard_event: Number of learning discard events due to
+ * hardware resource not available
+ * @sub_metering_enable: Traffic metering on type of traffic (such as
+ * broadcast, multicast, unknown unicast, etc) applies
+ * @traffic_sub_meter_id: Meter for bridge process with specific type (such
+ * as broadcast, multicast, unknown unicast, etc)
+ * @forward_broadcast: Forwarding mode of broadcast traffic. See
+ * &enum mxl862xx_bridge_forward_mode
+ * @forward_unknown_multicast_ip: Forwarding mode of unknown multicast IP
+ * traffic.
+ * See &enum mxl862xx_bridge_forward_mode
+ * @forward_unknown_multicast_non_ip: Forwarding mode of unknown multicast
+ * non-IP traffic.
+ * See &enum mxl862xx_bridge_forward_mode
+ * @forward_unknown_unicast: Forwarding mode of unknown unicast traffic. See
+ * &enum mxl862xx_bridge_forward_mode
+ */
+struct mxl862xx_bridge_config {
+ __le16 bridge_id;
+ __le32 mask; /* enum mxl862xx_bridge_config_mask */
+ u8 mac_learning_limit_enable;
+ __le16 mac_learning_limit;
+ __le16 mac_learning_count;
+ __le32 learning_discard_event;
+ u8 sub_metering_enable[MXL862XX_BRIDGE_PORT_EGRESS_METER_MAX];
+ __le16 traffic_sub_meter_id[MXL862XX_BRIDGE_PORT_EGRESS_METER_MAX];
+ __le32 forward_broadcast; /* enum mxl862xx_bridge_forward_mode */
+ __le32 forward_unknown_multicast_ip; /* enum mxl862xx_bridge_forward_mode */
+ __le32 forward_unknown_multicast_non_ip; /* enum mxl862xx_bridge_forward_mode */
+ __le32 forward_unknown_unicast; /* enum mxl862xx_bridge_forward_mode */
+} __packed;
+
+/**
+ * struct mxl862xx_bridge_port_alloc - Bridge Port Allocation
+ * @bridge_port_id: If the bridge port allocation is successful, a valid ID
+ * will be returned in this field. Otherwise, INVALID_HANDLE
+ * is returned. For bridge port free, this field should
+ * contain a valid ID returned by the bridge port allocation.
+ *
+ * Used by MXL862XX_BRIDGE_PORT_ALLOC and MXL862XX_BRIDGE_PORT_FREE.
+ */
+struct mxl862xx_bridge_port_alloc {
+ __le16 bridge_port_id;
+};
+
+/**
+ * enum mxl862xx_bridge_port_config_mask - Bridge Port configuration mask
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_BRIDGE_ID:
+ * Mask for bridge_id
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_INGRESS_VLAN:
+ * Mask for ingress_extended_vlan_enable,
+ * ingress_extended_vlan_block_id and ingress_extended_vlan_block_size
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_EGRESS_VLAN:
+ * Mask for egress_extended_vlan_enable, egress_extended_vlan_block_id
+ * and egress_extended_vlan_block_size
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_INGRESS_MARKING:
+ * Mask for ingress_marking_mode
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_EGRESS_REMARKING:
+ * Mask for egress_remarking_mode
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_INGRESS_METER:
+ * Mask for ingress_metering_enable and ingress_traffic_meter_id
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_EGRESS_SUB_METER:
+ * Mask for egress_sub_metering_enable and egress_traffic_sub_meter_id
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_EGRESS_CTP_MAPPING:
+ * Mask for dest_logical_port_id, pmapper_enable, dest_sub_if_id_group,
+ * pmapper_mapping_mode, pmapper_id_valid and pmapper
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_BRIDGE_PORT_MAP:
+ * Mask for bridge_port_map
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_MC_DEST_IP_LOOKUP:
+ * Mask for mc_dest_ip_lookup_disable
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_MC_SRC_IP_LOOKUP:
+ * Mask for mc_src_ip_lookup_enable
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_MC_DEST_MAC_LOOKUP:
+ * Mask for dest_mac_lookup_disable
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_MC_SRC_MAC_LEARNING:
+ * Mask for src_mac_learning_disable
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_MAC_SPOOFING:
+ * Mask for mac_spoofing_detect_enable
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_PORT_LOCK:
+ * Mask for port_lock_enable
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_MAC_LEARNING_LIMIT:
+ * Mask for mac_learning_limit_enable and mac_learning_limit
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_MAC_LEARNED_COUNT:
+ * Mask for mac_learning_count
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_INGRESS_VLAN_FILTER:
+ * Mask for ingress_vlan_filter_enable, ingress_vlan_filter_block_id
+ * and ingress_vlan_filter_block_size
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_EGRESS_VLAN_FILTER1:
+ * Mask for bypass_egress_vlan_filter1, egress_vlan_filter1enable,
+ * egress_vlan_filter1block_id and egress_vlan_filter1block_size
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_EGRESS_VLAN_FILTER2:
+ * Mask for egress_vlan_filter2enable, egress_vlan_filter2block_id and
+ * egress_vlan_filter2block_size
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_VLAN_BASED_MAC_LEARNING:
+ * Mask for vlan_tag_selection, vlan_src_mac_priority_enable,
+ * vlan_src_mac_dei_enable, vlan_src_mac_vid_enable,
+ * vlan_dst_mac_priority_enable, vlan_dst_mac_dei_enable and
+ * vlan_dst_mac_vid_enable
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_VLAN_BASED_MULTICAST_LOOKUP:
+ * Mask for vlan_multicast_priority_enable,
+ * vlan_multicast_dei_enable and vlan_multicast_vid_enable
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_LOOP_VIOLATION_COUNTER:
+ * Mask for loop_violation_count
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_ALL: Enable all
+ * @MXL862XX_BRIDGE_PORT_CONFIG_MASK_FORCE: Bypass any check for debug purpose
+ */
+enum mxl862xx_bridge_port_config_mask {
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_BRIDGE_ID = BIT(0),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_INGRESS_VLAN = BIT(1),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_EGRESS_VLAN = BIT(2),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_INGRESS_MARKING = BIT(3),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_EGRESS_REMARKING = BIT(4),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_INGRESS_METER = BIT(5),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_EGRESS_SUB_METER = BIT(6),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_EGRESS_CTP_MAPPING = BIT(7),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_BRIDGE_PORT_MAP = BIT(8),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_MC_DEST_IP_LOOKUP = BIT(9),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_MC_SRC_IP_LOOKUP = BIT(10),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_MC_DEST_MAC_LOOKUP = BIT(11),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_MC_SRC_MAC_LEARNING = BIT(12),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_MAC_SPOOFING = BIT(13),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_PORT_LOCK = BIT(14),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_MAC_LEARNING_LIMIT = BIT(15),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_MAC_LEARNED_COUNT = BIT(16),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_INGRESS_VLAN_FILTER = BIT(17),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_EGRESS_VLAN_FILTER1 = BIT(18),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_EGRESS_VLAN_FILTER2 = BIT(19),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_VLAN_BASED_MAC_LEARNING = BIT(20),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_VLAN_BASED_MULTICAST_LOOKUP = BIT(21),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_LOOP_VIOLATION_COUNTER = BIT(22),
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_ALL = 0x7FFFFFFF,
+ MXL862XX_BRIDGE_PORT_CONFIG_MASK_FORCE = BIT(31)
+};
+
+/**
+ * enum mxl862xx_color_marking_mode - Color Marking Mode
+ * @MXL862XX_MARKING_ALL_GREEN: mark packets (except critical) to green
+ * @MXL862XX_MARKING_INTERNAL_MARKING: do not change color and priority
+ * @MXL862XX_MARKING_DEI: DEI mark mode
+ * @MXL862XX_MARKING_PCP_8P0D: PCP 8P0D mark mode
+ * @MXL862XX_MARKING_PCP_7P1D: PCP 7P1D mark mode
+ * @MXL862XX_MARKING_PCP_6P2D: PCP 6P2D mark mode
+ * @MXL862XX_MARKING_PCP_5P3D: PCP 5P3D mark mode
+ * @MXL862XX_MARKING_DSCP_AF: DSCP AF class
+ */
+enum mxl862xx_color_marking_mode {
+ MXL862XX_MARKING_ALL_GREEN = 0,
+ MXL862XX_MARKING_INTERNAL_MARKING,
+ MXL862XX_MARKING_DEI,
+ MXL862XX_MARKING_PCP_8P0D,
+ MXL862XX_MARKING_PCP_7P1D,
+ MXL862XX_MARKING_PCP_6P2D,
+ MXL862XX_MARKING_PCP_5P3D,
+ MXL862XX_MARKING_DSCP_AF,
+};
+
+/**
+ * enum mxl862xx_color_remarking_mode - Color Remarking Mode
+ * @MXL862XX_REMARKING_NONE: values from last process stage
+ * @MXL862XX_REMARKING_DEI: DEI mark mode
+ * @MXL862XX_REMARKING_PCP_8P0D: PCP 8P0D mark mode
+ * @MXL862XX_REMARKING_PCP_7P1D: PCP 7P1D mark mode
+ * @MXL862XX_REMARKING_PCP_6P2D: PCP 6P2D mark mode
+ * @MXL862XX_REMARKING_PCP_5P3D: PCP 5P3D mark mode
+ * @MXL862XX_REMARKING_DSCP_AF: DSCP AF class
+ */
+enum mxl862xx_color_remarking_mode {
+ MXL862XX_REMARKING_NONE = 0,
+ MXL862XX_REMARKING_DEI = 2,
+ MXL862XX_REMARKING_PCP_8P0D,
+ MXL862XX_REMARKING_PCP_7P1D,
+ MXL862XX_REMARKING_PCP_6P2D,
+ MXL862XX_REMARKING_PCP_5P3D,
+ MXL862XX_REMARKING_DSCP_AF,
+};
+
+/**
+ * enum mxl862xx_pmapper_mapping_mode - P-mapper Mapping Mode
+ * @MXL862XX_PMAPPER_MAPPING_PCP: Use PCP for VLAN tagged packets to derive
+ * sub interface ID group
+ * @MXL862XX_PMAPPER_MAPPING_LAG: Use LAG Index for Pmapper access
+ * regardless of IP and VLAN packet
+ * @MXL862XX_PMAPPER_MAPPING_DSCP: Use DSCP for VLAN tagged IP packets to
+ * derive sub interface ID group
+ */
+enum mxl862xx_pmapper_mapping_mode {
+ MXL862XX_PMAPPER_MAPPING_PCP = 0,
+ MXL862XX_PMAPPER_MAPPING_LAG,
+ MXL862XX_PMAPPER_MAPPING_DSCP,
+};
+
+/**
+ * struct mxl862xx_pmapper - P-mapper Configuration
+ * @pmapper_id: Index of P-mapper (0-31)
+ * @dest_sub_if_id_group: Sub interface ID group. Entry 0 is for non-IP and
+ * non-VLAN tagged packets.
+ * Entries 1-8 are PCP mapping entries for VLAN tagged
+ * packets.
+ * Entries 9-72 are DSCP or LAG mapping entries.
+ *
+ * Used by CTP port config and bridge port config. In case of LAG, it is
+ * user's responsibility to provide the mapped entries in given P-mapper
+ * table. In other modes the entries are auto mapped from input packet.
+ */
+struct mxl862xx_pmapper {
+ __le16 pmapper_id;
+ u8 dest_sub_if_id_group[73];
+} __packed;
+
+/**
+ * struct mxl862xx_bridge_port_config - Bridge Port Configuration
+ * @bridge_port_id: Bridge Port ID allocated by bridge port allocation
+ * @mask: See &enum mxl862xx_bridge_port_config_mask
+ * @bridge_id: Bridge ID (FID) to which this bridge port is associated
+ * @ingress_extended_vlan_enable: Enable extended VLAN processing for
+ * ingress traffic
+ * @ingress_extended_vlan_block_id: Extended VLAN block allocated for
+ * ingress traffic
+ * @ingress_extended_vlan_block_size: Extended VLAN block size for ingress
+ * traffic
+ * @egress_extended_vlan_enable: Enable extended VLAN processing for egress
+ * traffic
+ * @egress_extended_vlan_block_id: Extended VLAN block allocated for egress
+ * traffic
+ * @egress_extended_vlan_block_size: Extended VLAN block size for egress
+ * traffic
+ * @ingress_marking_mode: Ingress color marking mode. See
+ * &enum mxl862xx_color_marking_mode
+ * @egress_remarking_mode: Color remarking for egress traffic. See
+ * &enum mxl862xx_color_remarking_mode
+ * @ingress_metering_enable: Traffic metering on ingress traffic applies
+ * @ingress_traffic_meter_id: Meter for ingress Bridge Port process
+ * @egress_sub_metering_enable: Traffic metering on various types of egress
+ * traffic
+ * @egress_traffic_sub_meter_id: Meter for egress Bridge Port process with
+ * specific type
+ * @dest_logical_port_id: Destination logical port
+ * @pmapper_enable: Enable P-mapper
+ * @dest_sub_if_id_group: Destination sub interface ID group when
+ * pmapper_enable is false
+ * @pmapper_mapping_mode: P-mapper mapping mode. See
+ * &enum mxl862xx_pmapper_mapping_mode
+ * @pmapper_id_valid: When true, P-mapper is re-used; when false,
+ * allocation is handled by API
+ * @pmapper: P-mapper configuration used when pmapper_enable is true
+ * @bridge_port_map: Port map defining broadcast domain. Each bit
+ * represents one bridge port. Bridge port ID is
+ * index * 16 + bit offset.
+ * @mc_dest_ip_lookup_disable: Disable multicast IP destination table
+ * lookup
+ * @mc_src_ip_lookup_enable: Enable multicast IP source table lookup
+ * @dest_mac_lookup_disable: Disable destination MAC lookup; packet treated
+ * as unknown
+ * @src_mac_learning_disable: Disable source MAC address learning
+ * @mac_spoofing_detect_enable: Enable MAC spoofing detection
+ * @port_lock_enable: Enable port locking
+ * @mac_learning_limit_enable: Enable MAC learning limitation
+ * @mac_learning_limit: Maximum number of MAC addresses that can be learned
+ * from this bridge port
+ * @loop_violation_count: Number of loop violation events from this bridge
+ * port
+ * @mac_learning_count: Number of MAC addresses learned from this bridge
+ * port
+ * @ingress_vlan_filter_enable: Enable ingress VLAN filter
+ * @ingress_vlan_filter_block_id: VLAN filter block of ingress traffic
+ * @ingress_vlan_filter_block_size: VLAN filter block size for ingress
+ * traffic
+ * @bypass_egress_vlan_filter1: For ingress traffic, bypass VLAN filter 1
+ * at egress bridge port processing
+ * @egress_vlan_filter1enable: Enable egress VLAN filter 1
+ * @egress_vlan_filter1block_id: VLAN filter block 1 of egress traffic
+ * @egress_vlan_filter1block_size: VLAN filter block 1 size
+ * @egress_vlan_filter2enable: Enable egress VLAN filter 2
+ * @egress_vlan_filter2block_id: VLAN filter block 2 of egress traffic
+ * @egress_vlan_filter2block_size: VLAN filter block 2 size
+ * @vlan_tag_selection: VLAN tag selection for MAC address/multicast
+ * learning, lookup and filtering.
+ * 0 - Intermediate outer VLAN tag is used.
+ * 1 - Original outer VLAN tag is used.
+ * @vlan_src_mac_priority_enable: Enable VLAN Priority field for source MAC
+ * learning and filtering
+ * @vlan_src_mac_dei_enable: Enable VLAN DEI/CFI field for source MAC
+ * learning and filtering
+ * @vlan_src_mac_vid_enable: Enable VLAN ID field for source MAC learning
+ * and filtering
+ * @vlan_dst_mac_priority_enable: Enable VLAN Priority field for destination
+ * MAC lookup and filtering
+ * @vlan_dst_mac_dei_enable: Enable VLAN CFI/DEI field for destination MAC
+ * lookup and filtering
+ * @vlan_dst_mac_vid_enable: Enable VLAN ID field for destination MAC lookup
+ * and filtering
+ * @vlan_multicast_priority_enable: Enable VLAN Priority field for IP
+ * multicast lookup
+ * @vlan_multicast_dei_enable: Enable VLAN CFI/DEI field for IP multicast
+ * lookup
+ * @vlan_multicast_vid_enable: Enable VLAN ID field for IP multicast lookup
+ */
+struct mxl862xx_bridge_port_config {
+ __le16 bridge_port_id;
+ __le32 mask; /* enum mxl862xx_bridge_port_config_mask */
+ __le16 bridge_id;
+ u8 ingress_extended_vlan_enable;
+ __le16 ingress_extended_vlan_block_id;
+ __le16 ingress_extended_vlan_block_size;
+ u8 egress_extended_vlan_enable;
+ __le16 egress_extended_vlan_block_id;
+ __le16 egress_extended_vlan_block_size;
+ __le32 ingress_marking_mode; /* enum mxl862xx_color_marking_mode */
+ __le32 egress_remarking_mode; /* enum mxl862xx_color_remarking_mode */
+ u8 ingress_metering_enable;
+ __le16 ingress_traffic_meter_id;
+ u8 egress_sub_metering_enable[MXL862XX_BRIDGE_PORT_EGRESS_METER_MAX];
+ __le16 egress_traffic_sub_meter_id[MXL862XX_BRIDGE_PORT_EGRESS_METER_MAX];
+ u8 dest_logical_port_id;
+ u8 pmapper_enable;
+ __le16 dest_sub_if_id_group;
+ __le32 pmapper_mapping_mode; /* enum mxl862xx_pmapper_mapping_mode */
+ u8 pmapper_id_valid;
+ struct mxl862xx_pmapper pmapper;
+ __le16 bridge_port_map[8];
+ u8 mc_dest_ip_lookup_disable;
+ u8 mc_src_ip_lookup_enable;
+ u8 dest_mac_lookup_disable;
+ u8 src_mac_learning_disable;
+ u8 mac_spoofing_detect_enable;
+ u8 port_lock_enable;
+ u8 mac_learning_limit_enable;
+ __le16 mac_learning_limit;
+ __le16 loop_violation_count;
+ __le16 mac_learning_count;
+ u8 ingress_vlan_filter_enable;
+ __le16 ingress_vlan_filter_block_id;
+ __le16 ingress_vlan_filter_block_size;
+ u8 bypass_egress_vlan_filter1;
+ u8 egress_vlan_filter1enable;
+ __le16 egress_vlan_filter1block_id;
+ __le16 egress_vlan_filter1block_size;
+ u8 egress_vlan_filter2enable;
+ __le16 egress_vlan_filter2block_id;
+ __le16 egress_vlan_filter2block_size;
+ u8 vlan_tag_selection;
+ u8 vlan_src_mac_priority_enable;
+ u8 vlan_src_mac_dei_enable;
+ u8 vlan_src_mac_vid_enable;
+ u8 vlan_dst_mac_priority_enable;
+ u8 vlan_dst_mac_dei_enable;
+ u8 vlan_dst_mac_vid_enable;
+ u8 vlan_multicast_priority_enable;
+ u8 vlan_multicast_dei_enable;
+ u8 vlan_multicast_vid_enable;
+} __packed;
+
+/**
+ * struct mxl862xx_cfg - Global Switch configuration Attributes
+ * @mac_table_age_timer: See &enum mxl862xx_age_timer
+ * @age_timer: Custom MAC table aging timer in seconds
+ * @max_packet_len: Maximum Ethernet packet length
+ * @learning_limit_action: Automatic MAC address table learning limitation
+ * consecutive action
+ * @mac_locking_action: Accept or discard MAC port locking violation
+ * packets
+ * @mac_spoofing_action: Accept or discard MAC spoofing and port MAC locking
+ * violation packets
+ * @pause_mac_mode_src: Pause frame MAC source address mode
+ * @pause_mac_src: Pause frame MAC source address
+ */
+struct mxl862xx_cfg {
+ __le32 mac_table_age_timer; /* enum mxl862xx_age_timer */
+ __le32 age_timer;
+ __le16 max_packet_len;
+ u8 learning_limit_action;
+ u8 mac_locking_action;
+ u8 mac_spoofing_action;
+ u8 pause_mac_mode_src;
+ u8 pause_mac_src[ETH_ALEN];
+} __packed;
+
+/**
+ * enum mxl862xx_extended_vlan_filter_type - Extended VLAN filter tag type
+ * @MXL862XX_EXTENDEDVLAN_FILTER_TYPE_NORMAL: Normal tagged
+ * @MXL862XX_EXTENDEDVLAN_FILTER_TYPE_NO_FILTER: No filter (wildcard)
+ * @MXL862XX_EXTENDEDVLAN_FILTER_TYPE_DEFAULT: Default entry
+ * @MXL862XX_EXTENDEDVLAN_FILTER_TYPE_NO_TAG: Untagged
+ */
+enum mxl862xx_extended_vlan_filter_type {
+ MXL862XX_EXTENDEDVLAN_FILTER_TYPE_NORMAL = 0,
+ MXL862XX_EXTENDEDVLAN_FILTER_TYPE_NO_FILTER = 1,
+ MXL862XX_EXTENDEDVLAN_FILTER_TYPE_DEFAULT = 2,
+ MXL862XX_EXTENDEDVLAN_FILTER_TYPE_NO_TAG = 3,
+};
+
+/**
+ * enum mxl862xx_extended_vlan_filter_tpid - Extended VLAN filter TPID
+ * @MXL862XX_EXTENDEDVLAN_FILTER_TPID_NO_FILTER: No TPID filter
+ * @MXL862XX_EXTENDEDVLAN_FILTER_TPID_8021Q: 802.1Q TPID
+ * @MXL862XX_EXTENDEDVLAN_FILTER_TPID_VTETYPE: VLAN type extension
+ */
+enum mxl862xx_extended_vlan_filter_tpid {
+ MXL862XX_EXTENDEDVLAN_FILTER_TPID_NO_FILTER = 0,
+ MXL862XX_EXTENDEDVLAN_FILTER_TPID_8021Q = 1,
+ MXL862XX_EXTENDEDVLAN_FILTER_TPID_VTETYPE = 2,
+};
+
+/**
+ * enum mxl862xx_extended_vlan_filter_dei - Extended VLAN filter DEI
+ * @MXL862XX_EXTENDEDVLAN_FILTER_DEI_NO_FILTER: No DEI filter
+ * @MXL862XX_EXTENDEDVLAN_FILTER_DEI_0: DEI = 0
+ * @MXL862XX_EXTENDEDVLAN_FILTER_DEI_1: DEI = 1
+ */
+enum mxl862xx_extended_vlan_filter_dei {
+ MXL862XX_EXTENDEDVLAN_FILTER_DEI_NO_FILTER = 0,
+ MXL862XX_EXTENDEDVLAN_FILTER_DEI_0 = 1,
+ MXL862XX_EXTENDEDVLAN_FILTER_DEI_1 = 2,
+};
+
+/**
+ * enum mxl862xx_extended_vlan_treatment_remove_tag - Tag removal action
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_NOT_REMOVE_TAG: Do not remove tag
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_REMOVE_1_TAG: Remove one tag
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_REMOVE_2_TAG: Remove two tags
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_DISCARD_UPSTREAM: Discard frame
+ */
+enum mxl862xx_extended_vlan_treatment_remove_tag {
+ MXL862XX_EXTENDEDVLAN_TREATMENT_NOT_REMOVE_TAG = 0,
+ MXL862XX_EXTENDEDVLAN_TREATMENT_REMOVE_1_TAG = 1,
+ MXL862XX_EXTENDEDVLAN_TREATMENT_REMOVE_2_TAG = 2,
+ MXL862XX_EXTENDEDVLAN_TREATMENT_DISCARD_UPSTREAM = 3,
+};
+
+/**
+ * enum mxl862xx_extended_vlan_treatment_priority - Treatment priority mode
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_PRIORITY_VAL: Use explicit value
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_INNER_PRIORITY: Copy from inner tag
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_OUTER_PRIORITY: Copy from outer tag
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_DSCP: Derive from DSCP
+ */
+enum mxl862xx_extended_vlan_treatment_priority {
+ MXL862XX_EXTENDEDVLAN_TREATMENT_PRIORITY_VAL = 0,
+ MXL862XX_EXTENDEDVLAN_TREATMENT_INNER_PRIORITY = 1,
+ MXL862XX_EXTENDEDVLAN_TREATMENT_OUTER_PRIORITY = 2,
+ MXL862XX_EXTENDEDVLAN_TREATMENT_DSCP = 3,
+};
+
+/**
+ * enum mxl862xx_extended_vlan_treatment_vid - Treatment VID mode
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_VID_VAL: Use explicit VID value
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_INNER_VID: Copy from inner tag
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_OUTER_VID: Copy from outer tag
+ */
+enum mxl862xx_extended_vlan_treatment_vid {
+ MXL862XX_EXTENDEDVLAN_TREATMENT_VID_VAL = 0,
+ MXL862XX_EXTENDEDVLAN_TREATMENT_INNER_VID = 1,
+ MXL862XX_EXTENDEDVLAN_TREATMENT_OUTER_VID = 2,
+};
+
+/**
+ * enum mxl862xx_extended_vlan_treatment_tpid - Treatment TPID mode
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_INNER_TPID: Copy from inner tag
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_OUTER_TPID: Copy from outer tag
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_VTETYPE: Use VLAN type extension
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_8021Q: Use 802.1Q TPID
+ */
+enum mxl862xx_extended_vlan_treatment_tpid {
+ MXL862XX_EXTENDEDVLAN_TREATMENT_INNER_TPID = 0,
+ MXL862XX_EXTENDEDVLAN_TREATMENT_OUTER_TPID = 1,
+ MXL862XX_EXTENDEDVLAN_TREATMENT_VTETYPE = 2,
+ MXL862XX_EXTENDEDVLAN_TREATMENT_8021Q = 3,
+};
+
+/**
+ * enum mxl862xx_extended_vlan_treatment_dei - Treatment DEI mode
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_INNER_DEI: Copy from inner tag
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_OUTER_DEI: Copy from outer tag
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_DEI_0: Set DEI to 0
+ * @MXL862XX_EXTENDEDVLAN_TREATMENT_DEI_1: Set DEI to 1
+ */
+enum mxl862xx_extended_vlan_treatment_dei {
+ MXL862XX_EXTENDEDVLAN_TREATMENT_INNER_DEI = 0,
+ MXL862XX_EXTENDEDVLAN_TREATMENT_OUTER_DEI = 1,
+ MXL862XX_EXTENDEDVLAN_TREATMENT_DEI_0 = 2,
+ MXL862XX_EXTENDEDVLAN_TREATMENT_DEI_1 = 3,
+};
+
+/**
+ * enum mxl862xx_extended_vlan_4_tpid_mode - 4-TPID mode selector
+ * @MXL862XX_EXTENDEDVLAN_TPID_VTETYPE_1: VLAN TPID type 1
+ * @MXL862XX_EXTENDEDVLAN_TPID_VTETYPE_2: VLAN TPID type 2
+ * @MXL862XX_EXTENDEDVLAN_TPID_VTETYPE_3: VLAN TPID type 3
+ * @MXL862XX_EXTENDEDVLAN_TPID_VTETYPE_4: VLAN TPID type 4
+ */
+enum mxl862xx_extended_vlan_4_tpid_mode {
+ MXL862XX_EXTENDEDVLAN_TPID_VTETYPE_1 = 0,
+ MXL862XX_EXTENDEDVLAN_TPID_VTETYPE_2 = 1,
+ MXL862XX_EXTENDEDVLAN_TPID_VTETYPE_3 = 2,
+ MXL862XX_EXTENDEDVLAN_TPID_VTETYPE_4 = 3,
+};
+
+/**
+ * enum mxl862xx_extended_vlan_filter_ethertype - Filter EtherType match
+ * @MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_NO_FILTER: No filter
+ * @MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_IPOE: IPoE
+ * @MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_PPPOE: PPPoE
+ * @MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_ARP: ARP
+ * @MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_IPV6IPOE: IPv6 IPoE
+ * @MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_EAPOL: EAPOL
+ * @MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_DHCPV4: DHCPv4
+ * @MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_DHCPV6: DHCPv6
+ */
+enum mxl862xx_extended_vlan_filter_ethertype {
+ MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_NO_FILTER = 0,
+ MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_IPOE = 1,
+ MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_PPPOE = 2,
+ MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_ARP = 3,
+ MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_IPV6IPOE = 4,
+ MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_EAPOL = 5,
+ MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_DHCPV4 = 6,
+ MXL862XX_EXTENDEDVLAN_FILTER_ETHERTYPE_DHCPV6 = 7,
+};
+
+/**
+ * struct mxl862xx_extendedvlan_filter_vlan - Per-tag filter in Extended VLAN
+ * @type: Tag presence/type match (see &enum mxl862xx_extended_vlan_filter_type)
+ * @priority_enable: Enable PCP value matching
+ * @priority_val: PCP value to match
+ * @vid_enable: Enable VID matching
+ * @vid_val: VID value to match
+ * @tpid: TPID match mode (see &enum mxl862xx_extended_vlan_filter_tpid)
+ * @dei: DEI match mode (see &enum mxl862xx_extended_vlan_filter_dei)
+ */
+struct mxl862xx_extendedvlan_filter_vlan {
+ __le32 type;
+ u8 priority_enable;
+ __le32 priority_val;
+ u8 vid_enable;
+ __le32 vid_val;
+ __le32 tpid;
+ __le32 dei;
+} __packed;
+
+/**
+ * struct mxl862xx_extendedvlan_filter - Extended VLAN filter configuration
+ * @original_packet_filter_mode: If true, filter on original (pre-treatment)
+ * packet
+ * @filter_4_tpid_mode: 4-TPID mode (see &enum mxl862xx_extended_vlan_4_tpid_mode)
+ * @outer_vlan: Outer VLAN tag filter
+ * @inner_vlan: Inner VLAN tag filter
+ * @ether_type: EtherType filter (see
+ * &enum mxl862xx_extended_vlan_filter_ethertype)
+ */
+struct mxl862xx_extendedvlan_filter {
+ u8 original_packet_filter_mode;
+ __le32 filter_4_tpid_mode;
+ struct mxl862xx_extendedvlan_filter_vlan outer_vlan;
+ struct mxl862xx_extendedvlan_filter_vlan inner_vlan;
+ __le32 ether_type;
+} __packed;
+
+/**
+ * struct mxl862xx_extendedvlan_treatment_vlan - Per-tag treatment in
+ * Extended VLAN
+ * @priority_mode: Priority assignment mode
+ * (see &enum mxl862xx_extended_vlan_treatment_priority)
+ * @priority_val: Priority value (when mode is VAL)
+ * @vid_mode: VID assignment mode
+ * (see &enum mxl862xx_extended_vlan_treatment_vid)
+ * @vid_val: VID value (when mode is VAL)
+ * @tpid: TPID assignment mode
+ * (see &enum mxl862xx_extended_vlan_treatment_tpid)
+ * @dei: DEI assignment mode
+ * (see &enum mxl862xx_extended_vlan_treatment_dei)
+ */
+struct mxl862xx_extendedvlan_treatment_vlan {
+ __le32 priority_mode;
+ __le32 priority_val;
+ __le32 vid_mode;
+ __le32 vid_val;
+ __le32 tpid;
+ __le32 dei;
+} __packed;
+
+/**
+ * struct mxl862xx_extendedvlan_treatment - Extended VLAN treatment
+ * @remove_tag: Tag removal action
+ * (see &enum mxl862xx_extended_vlan_treatment_remove_tag)
+ * @treatment_4_tpid_mode: 4-TPID treatment mode
+ * @add_outer_vlan: Add outer VLAN tag
+ * @outer_vlan: Outer VLAN tag treatment parameters
+ * @add_inner_vlan: Add inner VLAN tag
+ * @inner_vlan: Inner VLAN tag treatment parameters
+ * @reassign_bridge_port: Reassign to different bridge port
+ * @new_bridge_port_id: New bridge port ID
+ * @new_dscp_enable: Enable new DSCP assignment
+ * @new_dscp: New DSCP value
+ * @new_traffic_class_enable: Enable new traffic class assignment
+ * @new_traffic_class: New traffic class value
+ * @new_meter_enable: Enable new metering
+ * @s_new_traffic_meter_id: New traffic meter ID
+ * @dscp2pcp_map: DSCP to PCP mapping table (64 entries)
+ * @loopback_enable: Enable loopback
+ * @da_sa_swap_enable: Enable DA/SA swap
+ * @mirror_enable: Enable mirroring
+ */
+struct mxl862xx_extendedvlan_treatment {
+ __le32 remove_tag;
+ __le32 treatment_4_tpid_mode;
+ u8 add_outer_vlan;
+ struct mxl862xx_extendedvlan_treatment_vlan outer_vlan;
+ u8 add_inner_vlan;
+ struct mxl862xx_extendedvlan_treatment_vlan inner_vlan;
+ u8 reassign_bridge_port;
+ __le16 new_bridge_port_id;
+ u8 new_dscp_enable;
+ __le16 new_dscp;
+ u8 new_traffic_class_enable;
+ u8 new_traffic_class;
+ u8 new_meter_enable;
+ __le16 s_new_traffic_meter_id;
+ u8 dscp2pcp_map[64];
+ u8 loopback_enable;
+ u8 da_sa_swap_enable;
+ u8 mirror_enable;
+} __packed;
+
+/**
+ * struct mxl862xx_extendedvlan_alloc - Extended VLAN block allocation
+ * @number_of_entries: Number of entries to allocate (input) / allocated
+ * (output)
+ * @extended_vlan_block_id: Block ID assigned by firmware (output on alloc,
+ * input on free)
+ *
+ * Used with %MXL862XX_EXTENDEDVLAN_ALLOC and %MXL862XX_EXTENDEDVLAN_FREE.
+ */
+struct mxl862xx_extendedvlan_alloc {
+ __le16 number_of_entries;
+ __le16 extended_vlan_block_id;
+} __packed;
+
+/**
+ * struct mxl862xx_extendedvlan_config - Extended VLAN entry configuration
+ * @extended_vlan_block_id: Block ID from allocation
+ * @entry_index: Entry index within the block
+ * @filter: Filter (match) configuration
+ * @treatment: Treatment (action) configuration
+ *
+ * Used with %MXL862XX_EXTENDEDVLAN_SET and %MXL862XX_EXTENDEDVLAN_GET.
+ */
+struct mxl862xx_extendedvlan_config {
+ __le16 extended_vlan_block_id;
+ __le16 entry_index;
+ struct mxl862xx_extendedvlan_filter filter;
+ struct mxl862xx_extendedvlan_treatment treatment;
+} __packed;
+
+/**
+ * enum mxl862xx_vlan_filter_tci_mask - VLAN Filter TCI mask
+ * @MXL862XX_VLAN_FILTER_TCI_MASK_VID: TCI mask for VLAN ID
+ * @MXL862XX_VLAN_FILTER_TCI_MASK_PCP: TCI mask for VLAN PCP
+ * @MXL862XX_VLAN_FILTER_TCI_MASK_TCI: TCI mask for VLAN TCI
+ */
+enum mxl862xx_vlan_filter_tci_mask {
+ MXL862XX_VLAN_FILTER_TCI_MASK_VID = 0,
+ MXL862XX_VLAN_FILTER_TCI_MASK_PCP = 1,
+ MXL862XX_VLAN_FILTER_TCI_MASK_TCI = 2,
+};
+
+/**
+ * struct mxl862xx_vlanfilter_alloc - VLAN Filter block allocation
+ * @number_of_entries: Number of entries to allocate (input) / allocated
+ * (output)
+ * @vlan_filter_block_id: Block ID assigned by firmware (output on alloc,
+ * input on free)
+ * @discard_untagged: Discard untagged packets
+ * @discard_unmatched_tagged: Discard tagged packets that do not match any
+ * entry in the block
+ * @use_default_port_vid: Use default port VLAN ID for filtering
+ *
+ * Used with %MXL862XX_VLANFILTER_ALLOC and %MXL862XX_VLANFILTER_FREE.
+ */
+struct mxl862xx_vlanfilter_alloc {
+ __le16 number_of_entries;
+ __le16 vlan_filter_block_id;
+ u8 discard_untagged;
+ u8 discard_unmatched_tagged;
+ u8 use_default_port_vid;
+} __packed;
+
+/**
+ * struct mxl862xx_vlanfilter_config - VLAN Filter entry configuration
+ * @vlan_filter_block_id: Block ID from allocation
+ * @entry_index: Entry index within the block
+ * @vlan_filter_mask: TCI field(s) to match (see
+ * &enum mxl862xx_vlan_filter_tci_mask)
+ * @val: TCI value(s) to match (VID, PCP, or full TCI depending on mask)
+ * @discard_matched: When true, discard frames matching this entry;
+ * when false, allow them
+ *
+ * Used with %MXL862XX_VLANFILTER_SET and %MXL862XX_VLANFILTER_GET.
+ */
+struct mxl862xx_vlanfilter_config {
+ __le16 vlan_filter_block_id;
+ __le16 entry_index;
+ __le32 vlan_filter_mask; /* enum mxl862xx_vlan_filter_tci_mask */
+ __le32 val;
+ u8 discard_matched;
+} __packed;
+
+/**
+ * enum mxl862xx_ss_sp_tag_mask - Special tag valid field indicator bits
+ * @MXL862XX_SS_SP_TAG_MASK_RX: valid RX special tag mode
+ * @MXL862XX_SS_SP_TAG_MASK_TX: valid TX special tag mode
+ * @MXL862XX_SS_SP_TAG_MASK_RX_PEN: valid RX special tag info over preamble
+ * @MXL862XX_SS_SP_TAG_MASK_TX_PEN: valid TX special tag info over preamble
+ */
+enum mxl862xx_ss_sp_tag_mask {
+ MXL862XX_SS_SP_TAG_MASK_RX = BIT(0),
+ MXL862XX_SS_SP_TAG_MASK_TX = BIT(1),
+ MXL862XX_SS_SP_TAG_MASK_RX_PEN = BIT(2),
+ MXL862XX_SS_SP_TAG_MASK_TX_PEN = BIT(3),
+};
+
+/**
+ * enum mxl862xx_ss_sp_tag_rx - RX special tag mode
+ * @MXL862XX_SS_SP_TAG_RX_NO_TAG_NO_INSERT: packet does NOT have special
+ * tag and special tag is NOT inserted
+ * @MXL862XX_SS_SP_TAG_RX_NO_TAG_INSERT: packet does NOT have special tag
+ * and special tag is inserted
+ * @MXL862XX_SS_SP_TAG_RX_TAG_NO_INSERT: packet has special tag and special
+ * tag is NOT inserted
+ */
+enum mxl862xx_ss_sp_tag_rx {
+ MXL862XX_SS_SP_TAG_RX_NO_TAG_NO_INSERT = 0,
+ MXL862XX_SS_SP_TAG_RX_NO_TAG_INSERT = 1,
+ MXL862XX_SS_SP_TAG_RX_TAG_NO_INSERT = 2,
+};
+
+/**
+ * enum mxl862xx_ss_sp_tag_tx - TX special tag mode
+ * @MXL862XX_SS_SP_TAG_TX_NO_TAG_NO_REMOVE: packet does NOT have special
+ * tag and special tag is NOT removed
+ * @MXL862XX_SS_SP_TAG_TX_TAG_REPLACE: packet has special tag and special
+ * tag is replaced
+ * @MXL862XX_SS_SP_TAG_TX_TAG_NO_REMOVE: packet has special tag and special
+ * tag is NOT removed
+ * @MXL862XX_SS_SP_TAG_TX_TAG_REMOVE: packet has special tag and special
+ * tag is removed
+ */
+enum mxl862xx_ss_sp_tag_tx {
+ MXL862XX_SS_SP_TAG_TX_NO_TAG_NO_REMOVE = 0,
+ MXL862XX_SS_SP_TAG_TX_TAG_REPLACE = 1,
+ MXL862XX_SS_SP_TAG_TX_TAG_NO_REMOVE = 2,
+ MXL862XX_SS_SP_TAG_TX_TAG_REMOVE = 3,
+};
+
+/**
+ * enum mxl862xx_ss_sp_tag_rx_pen - RX special tag info over preamble
+ * @MXL862XX_SS_SP_TAG_RX_PEN_ALL_0: special tag info inserted from byte 2
+ * to 7 are all 0
+ * @MXL862XX_SS_SP_TAG_RX_PEN_BYTE_5_IS_16: special tag byte 5 is 16, other
+ * bytes from 2 to 7 are 0
+ * @MXL862XX_SS_SP_TAG_RX_PEN_BYTE_5_FROM_PREAMBLE: special tag byte 5 is
+ * from preamble field, others
+ * are 0
+ * @MXL862XX_SS_SP_TAG_RX_PEN_BYTE_2_TO_7_FROM_PREAMBLE: special tag byte 2
+ * to 7 are from preamble
+ * field
+ */
+enum mxl862xx_ss_sp_tag_rx_pen {
+ MXL862XX_SS_SP_TAG_RX_PEN_ALL_0 = 0,
+ MXL862XX_SS_SP_TAG_RX_PEN_BYTE_5_IS_16 = 1,
+ MXL862XX_SS_SP_TAG_RX_PEN_BYTE_5_FROM_PREAMBLE = 2,
+ MXL862XX_SS_SP_TAG_RX_PEN_BYTE_2_TO_7_FROM_PREAMBLE = 3,
+};
+
+/**
+ * struct mxl862xx_ss_sp_tag - Special tag port settings
+ * @pid: port ID (1~16)
+ * @mask: See &enum mxl862xx_ss_sp_tag_mask
+ * @rx: See &enum mxl862xx_ss_sp_tag_rx
+ * @tx: See &enum mxl862xx_ss_sp_tag_tx
+ * @rx_pen: See &enum mxl862xx_ss_sp_tag_rx_pen
+ * @tx_pen: TX special tag info over preamble
+ * 0 - disabled
+ * 1 - enabled
+ */
+struct mxl862xx_ss_sp_tag {
+ u8 pid;
+ u8 mask; /* enum mxl862xx_ss_sp_tag_mask */
+ u8 rx; /* enum mxl862xx_ss_sp_tag_rx */
+ u8 tx; /* enum mxl862xx_ss_sp_tag_tx */
+ u8 rx_pen; /* enum mxl862xx_ss_sp_tag_rx_pen */
+ u8 tx_pen; /* boolean */
+} __packed;
+
+/**
+ * enum mxl862xx_logical_port_mode - Logical port mode
+ * @MXL862XX_LOGICAL_PORT_8BIT_WLAN: WLAN with 8-bit station ID
+ * @MXL862XX_LOGICAL_PORT_9BIT_WLAN: WLAN with 9-bit station ID
+ * @MXL862XX_LOGICAL_PORT_ETHERNET: Ethernet port
+ * @MXL862XX_LOGICAL_PORT_OTHER: Others
+ */
+enum mxl862xx_logical_port_mode {
+ MXL862XX_LOGICAL_PORT_8BIT_WLAN = 0,
+ MXL862XX_LOGICAL_PORT_9BIT_WLAN,
+ MXL862XX_LOGICAL_PORT_ETHERNET,
+ MXL862XX_LOGICAL_PORT_OTHER = 0xFF,
+};
+
+/**
+ * struct mxl862xx_ctp_port_assignment - CTP Port Assignment/association
+ * with logical port
+ * @logical_port_id: Logical Port Id. The valid range is hardware dependent
+ * @first_ctp_port_id: First CTP (Connectivity Termination Port) ID mapped
+ * to above logical port ID
+ * @number_of_ctp_port: Total number of CTP Ports mapped above logical port
+ * ID
+ * @mode: Logical port mode to define sub interface ID format. See
+ * &enum mxl862xx_logical_port_mode
+ * @bridge_port_id: Bridge Port ID (not FID). For allocation, each CTP
+ * allocated is mapped to the Bridge Port given by this field.
+ * The Bridge Port will be configured to use first CTP as
+ * egress CTP.
+ */
+struct mxl862xx_ctp_port_assignment {
+ u8 logical_port_id;
+ __le16 first_ctp_port_id;
+ __le16 number_of_ctp_port;
+ __le32 mode; /* enum mxl862xx_logical_port_mode */
+ __le16 bridge_port_id;
+} __packed;
+
+/**
+ * enum mxl862xx_stp_port_state - Spanning Tree Protocol port states
+ * @MXL862XX_STP_PORT_STATE_FORWARD: Forwarding state
+ * @MXL862XX_STP_PORT_STATE_DISABLE: Disabled/Discarding state
+ * @MXL862XX_STP_PORT_STATE_LEARNING: Learning state
+ * @MXL862XX_STP_PORT_STATE_BLOCKING: Blocking/Listening
+ */
+enum mxl862xx_stp_port_state {
+ MXL862XX_STP_PORT_STATE_FORWARD = 0,
+ MXL862XX_STP_PORT_STATE_DISABLE,
+ MXL862XX_STP_PORT_STATE_LEARNING,
+ MXL862XX_STP_PORT_STATE_BLOCKING,
+};
+
+/**
+ * struct mxl862xx_stp_port_cfg - Configures the Spanning Tree Protocol state
+ * @port_id: Port number
+ * @fid: Filtering Identifier (FID)
+ * @port_state: See &enum mxl862xx_stp_port_state
+ */
+struct mxl862xx_stp_port_cfg {
+ __le16 port_id;
+ __le16 fid;
+ __le32 port_state; /* enum mxl862xx_stp_port_state */
+} __packed;
+
+/**
+ * struct mxl862xx_sys_fw_image_version - Firmware version information
+ * @iv_major: firmware major version
+ * @iv_minor: firmware minor version
+ * @iv_revision: firmware revision
+ * @iv_build_num: firmware build number
+ */
+struct mxl862xx_sys_fw_image_version {
+ u8 iv_major;
+ u8 iv_minor;
+ __le16 iv_revision;
+ __le32 iv_build_num;
+} __packed;
+
+/**
+ * enum mxl862xx_port_type - Port Type
+ * @MXL862XX_LOGICAL_PORT: Logical Port
+ * @MXL862XX_PHYSICAL_PORT: Physical Port
+ * @MXL862XX_CTP_PORT: Connectivity Termination Port (CTP)
+ * @MXL862XX_BRIDGE_PORT: Bridge Port
+ */
+enum mxl862xx_port_type {
+ MXL862XX_LOGICAL_PORT = 0,
+ MXL862XX_PHYSICAL_PORT,
+ MXL862XX_CTP_PORT,
+ MXL862XX_BRIDGE_PORT,
+};
+
+/**
+ * enum mxl862xx_rmon_port_type - RMON counter table type
+ * @MXL862XX_RMON_CTP_PORT_RX: CTP RX counters
+ * @MXL862XX_RMON_CTP_PORT_TX: CTP TX counters
+ * @MXL862XX_RMON_BRIDGE_PORT_RX: Bridge port RX counters
+ * @MXL862XX_RMON_BRIDGE_PORT_TX: Bridge port TX counters
+ * @MXL862XX_RMON_CTP_PORT_PCE_BYPASS: CTP PCE bypass counters
+ * @MXL862XX_RMON_TFLOW_RX: TFLOW RX counters
+ * @MXL862XX_RMON_TFLOW_TX: TFLOW TX counters
+ * @MXL862XX_RMON_QMAP: QMAP counters
+ * @MXL862XX_RMON_METER: Meter counters
+ * @MXL862XX_RMON_PMAC: PMAC counters
+ */
+enum mxl862xx_rmon_port_type {
+ MXL862XX_RMON_CTP_PORT_RX = 0,
+ MXL862XX_RMON_CTP_PORT_TX,
+ MXL862XX_RMON_BRIDGE_PORT_RX,
+ MXL862XX_RMON_BRIDGE_PORT_TX,
+ MXL862XX_RMON_CTP_PORT_PCE_BYPASS,
+ MXL862XX_RMON_TFLOW_RX,
+ MXL862XX_RMON_TFLOW_TX,
+ MXL862XX_RMON_QMAP = 0x0e,
+ MXL862XX_RMON_METER = 0x19,
+ MXL862XX_RMON_PMAC = 0x1c,
+};
+
+/**
+ * struct mxl862xx_rmon_port_cnt - RMON counters for a port
+ * @port_type: Port type for counter retrieval (see &enum mxl862xx_port_type)
+ * @port_id: Ethernet port number (zero-based)
+ * @sub_if_id_group: Sub-interface ID group
+ * @pce_bypass: Separate CTP Tx counters when PCE is bypassed
+ * @rx_extended_vlan_discard_pkts: Discarded at extended VLAN operation
+ * @mtu_exceed_discard_pkts: Discarded due to MTU exceeded
+ * @tx_under_size_good_pkts: Tx undersize (<64) packet count
+ * @tx_oversize_good_pkts: Tx oversize (>1518) packet count
+ * @rx_good_pkts: Received good packet count
+ * @rx_unicast_pkts: Received unicast packet count
+ * @rx_broadcast_pkts: Received broadcast packet count
+ * @rx_multicast_pkts: Received multicast packet count
+ * @rx_fcserror_pkts: Received FCS error packet count
+ * @rx_under_size_good_pkts: Received undersize good packet count
+ * @rx_oversize_good_pkts: Received oversize good packet count
+ * @rx_under_size_error_pkts: Received undersize error packet count
+ * @rx_good_pause_pkts: Received good pause packet count
+ * @rx_oversize_error_pkts: Received oversize error packet count
+ * @rx_align_error_pkts: Received alignment error packet count
+ * @rx_filtered_pkts: Filtered packet count
+ * @rx64byte_pkts: Received 64-byte packet count
+ * @rx127byte_pkts: Received 65-127 byte packet count
+ * @rx255byte_pkts: Received 128-255 byte packet count
+ * @rx511byte_pkts: Received 256-511 byte packet count
+ * @rx1023byte_pkts: Received 512-1023 byte packet count
+ * @rx_max_byte_pkts: Received 1024-max byte packet count
+ * @tx_good_pkts: Transmitted good packet count
+ * @tx_unicast_pkts: Transmitted unicast packet count
+ * @tx_broadcast_pkts: Transmitted broadcast packet count
+ * @tx_multicast_pkts: Transmitted multicast packet count
+ * @tx_single_coll_count: Transmit single collision count
+ * @tx_mult_coll_count: Transmit multiple collision count
+ * @tx_late_coll_count: Transmit late collision count
+ * @tx_excess_coll_count: Transmit excessive collision count
+ * @tx_coll_count: Transmit collision count
+ * @tx_pause_count: Transmit pause packet count
+ * @tx64byte_pkts: Transmitted 64-byte packet count
+ * @tx127byte_pkts: Transmitted 65-127 byte packet count
+ * @tx255byte_pkts: Transmitted 128-255 byte packet count
+ * @tx511byte_pkts: Transmitted 256-511 byte packet count
+ * @tx1023byte_pkts: Transmitted 512-1023 byte packet count
+ * @tx_max_byte_pkts: Transmitted 1024-max byte packet count
+ * @tx_dropped_pkts: Transmit dropped packet count
+ * @tx_acm_dropped_pkts: Transmit ACM dropped packet count
+ * @rx_dropped_pkts: Received dropped packet count
+ * @rx_good_bytes: Received good byte count (64-bit)
+ * @rx_bad_bytes: Received bad byte count (64-bit)
+ * @tx_good_bytes: Transmitted good byte count (64-bit)
+ */
+struct mxl862xx_rmon_port_cnt {
+ __le32 port_type; /* enum mxl862xx_port_type */
+ __le16 port_id;
+ __le16 sub_if_id_group;
+ u8 pce_bypass;
+ __le32 rx_extended_vlan_discard_pkts;
+ __le32 mtu_exceed_discard_pkts;
+ __le32 tx_under_size_good_pkts;
+ __le32 tx_oversize_good_pkts;
+ __le32 rx_good_pkts;
+ __le32 rx_unicast_pkts;
+ __le32 rx_broadcast_pkts;
+ __le32 rx_multicast_pkts;
+ __le32 rx_fcserror_pkts;
+ __le32 rx_under_size_good_pkts;
+ __le32 rx_oversize_good_pkts;
+ __le32 rx_under_size_error_pkts;
+ __le32 rx_good_pause_pkts;
+ __le32 rx_oversize_error_pkts;
+ __le32 rx_align_error_pkts;
+ __le32 rx_filtered_pkts;
+ __le32 rx64byte_pkts;
+ __le32 rx127byte_pkts;
+ __le32 rx255byte_pkts;
+ __le32 rx511byte_pkts;
+ __le32 rx1023byte_pkts;
+ __le32 rx_max_byte_pkts;
+ __le32 tx_good_pkts;
+ __le32 tx_unicast_pkts;
+ __le32 tx_broadcast_pkts;
+ __le32 tx_multicast_pkts;
+ __le32 tx_single_coll_count;
+ __le32 tx_mult_coll_count;
+ __le32 tx_late_coll_count;
+ __le32 tx_excess_coll_count;
+ __le32 tx_coll_count;
+ __le32 tx_pause_count;
+ __le32 tx64byte_pkts;
+ __le32 tx127byte_pkts;
+ __le32 tx255byte_pkts;
+ __le32 tx511byte_pkts;
+ __le32 tx1023byte_pkts;
+ __le32 tx_max_byte_pkts;
+ __le32 tx_dropped_pkts;
+ __le32 tx_acm_dropped_pkts;
+ __le32 rx_dropped_pkts;
+ __le64 rx_good_bytes;
+ __le64 rx_bad_bytes;
+ __le64 tx_good_bytes;
+} __packed;
+
+/* XPCS interface mode, MXL862XX_XPCS_*_INTERFACE field values */
+#define MXL862XX_XPCS_IF_SGMII 0
+#define MXL862XX_XPCS_IF_1000BASEX 1
+#define MXL862XX_XPCS_IF_2500BASEX 2
+#define MXL862XX_XPCS_IF_USXGMII 3 /* single or quad */
+#define MXL862XX_XPCS_IF_10GBASER 4
+#define MXL862XX_XPCS_IF_10GKR 5 /* 10GBASE-KR */
+#define MXL862XX_XPCS_IF_5GBASER 6
+#define MXL862XX_XPCS_IF_QSGMII 7
+
+/* PCS negotiation mode, MXL862XX_XPCS_CFG_NEG_MODE field values */
+#define MXL862XX_XPCS_NEG_NONE 0 /* no inband negotiation */
+#define MXL862XX_XPCS_NEG_INBAND_AN_OFF 1 /* inband, AN disabled */
+#define MXL862XX_XPCS_NEG_INBAND_AN_ON 2 /* inband, AN enabled */
+
+/*
+ * PCS protocol role, MXL862XX_XPCS_CFG_ROLE field value. Selects the role
+ * the XPCS plays in protocols with an asymmetric AN code word (Cisco SGMII
+ * / QSGMII / USXGMII), driving VR_MII_AN_CTRL.TX_CONFIG: MAC means the
+ * local end receives the partner's AN word, PHY means it sources one.
+ * Ignored for symmetric protocols (1000BASE-X, 2500BASE-X, 10GBASE-R/KR).
+ */
+#define MXL862XX_XPCS_ROLE_MAC 0 /* local end is MAC side */
+#define MXL862XX_XPCS_ROLE_PHY 1 /* local end is PHY side */
+
+/* USXGMII lane mode, MXL862XX_XPCS_*_USX_LANE_MODE field values */
+#define MXL862XX_XPCS_USX_SINGLE 0 /* single USXGMII lane */
+#define MXL862XX_XPCS_USX_QUAD 1 /* quad USXGMII, 4 ports/lane */
+
+/**
+ * union mxl862xx_xpcs_an_word - XPCS AN code word, tagged by interface mode
+ * @cl37: 16-bit base-page word exchanged over the CL37 hardware AN path
+ * (SR_MII_AN_ADV on write, SR_MII_LP_BABL on read). Carries the
+ * 802.3 CL37 base page for 1000BASE-X/2500BASE-X and the Cisco
+ * SGMII config word for SGMII/QSGMII.
+ * @usx: USXGMII 16-bit AN code word, MDIO_USXGMII_* layout
+ * @cl73: CL73 48-bit base page (10GBASE-KR), three 16-bit registers per
+ * 802.3 Annex 28C
+ * @cl73.adv1: CL73 SR_AN_ADV1 / SR_AN_LP_ABL1
+ * @cl73.adv2: CL73 SR_AN_ADV2 / SR_AN_LP_ABL2
+ * @cl73.adv3: CL73 SR_AN_ADV3 / SR_AN_LP_ABL3
+ *
+ * The host picks the right member based on the interface field of the
+ * surrounding struct (and, for the asymmetric protocols, on the role).
+ */
+union mxl862xx_xpcs_an_word {
+ __le16 cl37;
+ __le16 usx;
+ struct {
+ __le16 adv1;
+ __le16 adv2;
+ __le16 adv3;
+ } cl73;
+} __packed;
+
+/* PCS duplex mode, MXL862XX_XPCS_*_DUPLEX field values */
+#define MXL862XX_XPCS_DUPLEX_HALF 0
+#define MXL862XX_XPCS_DUPLEX_FULL 1
+
+/**
+ * enum mxl862xx_xpcs_loopback_mode - XPCS loopback mode
+ * @MXL862XX_XPCS_LB_DISABLE: disable all loopback
+ * @MXL862XX_XPCS_LB_PCS_SERIAL: PCS TX-to-RX serial loopback
+ * @MXL862XX_XPCS_LB_PCS_PARALLEL: PCS RX-to-TX parallel loopback
+ * @MXL862XX_XPCS_LB_PMA_SERIAL: PMA TX-to-RX serial loopback
+ * @MXL862XX_XPCS_LB_PMA_PARALLEL: PMA RX-to-TX parallel loopback
+ */
+enum mxl862xx_xpcs_loopback_mode {
+ MXL862XX_XPCS_LB_DISABLE = 0,
+ MXL862XX_XPCS_LB_PCS_SERIAL = 1,
+ MXL862XX_XPCS_LB_PCS_PARALLEL = 2,
+ MXL862XX_XPCS_LB_PMA_SERIAL = 3,
+ MXL862XX_XPCS_LB_PMA_PARALLEL = 4,
+};
+
+/* Fields of mxl862xx_xpcs_pcs_cfg.mode */
+#define MXL862XX_XPCS_CFG_PORT_ID GENMASK(1, 0)
+#define MXL862XX_XPCS_CFG_INTERFACE GENMASK(7, 2)
+#define MXL862XX_XPCS_CFG_NEG_MODE GENMASK(9, 8)
+#define MXL862XX_XPCS_CFG_PERMIT_PAUSE BIT(10)
+#define MXL862XX_XPCS_CFG_USX_LANE_MODE GENMASK(12, 11)
+#define MXL862XX_XPCS_CFG_ROLE BIT(13)
+#define MXL862XX_XPCS_CFG_USX_SUBPORT GENMASK(15, 14)
+
+/**
+ * struct mxl862xx_xpcs_pcs_cfg - PCS configuration parameters
+ * @mode: Packed interface and negotiation parameters, see
+ * MXL862XX_XPCS_CFG_*. port_id is the XPCS port index (0-3);
+ * interface is the PCS interface mode (MXL862XX_XPCS_IF_*);
+ * neg_mode is the negotiation mode (MXL862XX_XPCS_NEG_*);
+ * permit_pause allows pause to MAC; usx_lane_mode is the USXGMII
+ * lane mode (MXL862XX_XPCS_USX_*); role is the protocol role
+ * (MXL862XX_XPCS_ROLE_*); usx_subport is the sub-port (0-3) within
+ * the XPCS -- despite the name it also identifies the QSGMII
+ * sub-port -- used by the firmware to set MAC pause per sub-port
+ * and ignored for the XPCS-wide bringup, which is idempotent across
+ * slots.
+ * @advertising: AN code word the local end transmits. The active union
+ * member is selected by the interface field (and, for the
+ * asymmetric protocols, by role). Ignored when the local end
+ * does not transmit an AN word (role=MAC for SGMII/QSGMII/
+ * USXGMII, 10GBASE-R, 5GBASE-R) or when neg_mode is not
+ * INBAND_AN_ON. Pass all-zero to keep the firmware default
+ * advertisement.
+ * @result: Firmware result. >0 means the host must follow with an AN
+ * restart, 0 means no host follow-up is needed, <0 is an errno.
+ */
+struct mxl862xx_xpcs_pcs_cfg {
+ __le16 mode;
+ union mxl862xx_xpcs_an_word advertising;
+ __le16 result;
+} __packed;
+
+/* Fields of mxl862xx_xpcs_pcs_state.mode */
+#define MXL862XX_XPCS_ST_PORT_ID GENMASK(1, 0)
+#define MXL862XX_XPCS_ST_INTERFACE GENMASK(7, 2)
+#define MXL862XX_XPCS_ST_USX_LANE_MODE GENMASK(9, 8)
+#define MXL862XX_XPCS_ST_USX_SUBPORT GENMASK(11, 10)
+#define MXL862XX_XPCS_ST_LINK BIT(12)
+#define MXL862XX_XPCS_ST_AN_COMPLETE BIT(13)
+#define MXL862XX_XPCS_ST_DUPLEX BIT(14)
+#define MXL862XX_XPCS_ST_PCS_FAULT BIT(15)
+#define MXL862XX_XPCS_ST_PAUSE GENMASK(17, 16)
+#define MXL862XX_XPCS_ST_LP_EEE_CAP BIT(18)
+#define MXL862XX_XPCS_ST_LP_EEE_CS_CAP BIT(19)
+
+/**
+ * struct mxl862xx_xpcs_pcs_state - PCS link state
+ * @mode: Packed input parameters and firmware status, see
+ * MXL862XX_XPCS_ST_*. The host writes port_id (XPCS port index 0-3),
+ * interface (MXL862XX_XPCS_IF_*), usx_lane_mode
+ * (MXL862XX_XPCS_USX_*) and usx_subport (0-3); the firmware fills in
+ * link, an_complete, duplex (MXL862XX_XPCS_DUPLEX_*), pcs_fault,
+ * pause (bit 0 symmetric, bit 1 asymmetric), lp_eee_cap and
+ * lp_eee_cs_cap.
+ * @speed: Resolved speed in Mbit/s (output)
+ * @lpa: Link partner ability word (output). Same union as
+ * &union mxl862xx_xpcs_an_word; the host picks the member based on
+ * the interface field.
+ */
+struct mxl862xx_xpcs_pcs_state {
+ __le32 mode;
+ __le16 speed; /* Mbit/s */
+ union mxl862xx_xpcs_an_word lpa;
+} __packed;
+
+/**
+ * struct mxl862xx_xpcs_pcs_disable - PCS disable parameters
+ * @port_id: XPCS port index
+ * @__pad: padding
+ * @result: Firmware result. 0 on success, <0 on error.
+ *
+ * Asserts IDDQ + PHY + XPCS resets to power down the SERDES when the
+ * port is admin-down or no module is plugged in. The next PCS config
+ * implicitly powers it back up and reprograms the desired interface.
+ */
+struct mxl862xx_xpcs_pcs_disable {
+ u8 port_id;
+ u8 __pad;
+ __le16 result;
+} __packed;
+
+/* Fields of mxl862xx_xpcs_an_restart.mode */
+#define MXL862XX_XPCS_ANR_PORT_ID GENMASK(1, 0)
+#define MXL862XX_XPCS_ANR_INTERFACE GENMASK(7, 2)
+#define MXL862XX_XPCS_ANR_USX_LANE_MODE GENMASK(9, 8)
+#define MXL862XX_XPCS_ANR_USX_SUBPORT GENMASK(11, 10)
+
+/**
+ * struct mxl862xx_xpcs_an_restart - AN restart parameters
+ * @mode: Packed input parameters, see MXL862XX_XPCS_ANR_*. port_id is the
+ * XPCS port index (0-3); interface is the PCS interface mode
+ * (MXL862XX_XPCS_IF_*); usx_lane_mode is the USX lane mode
+ * (MXL862XX_XPCS_USX_*); usx_subport (0-3) selects the lane whose
+ * AN is restarted for QSGMII and QUSXGMII and is ignored by
+ * single-lane modes.
+ * @result: Firmware result. 0 on success, <0 on error.
+ *
+ * Restarts auto-negotiation on a single sub-port of the XPCS. The
+ * SERDES must already be configured.
+ */
+struct mxl862xx_xpcs_an_restart {
+ __le16 mode;
+ __le16 result;
+} __packed;
+
+/* Fields of mxl862xx_xpcs_pcs_link_up.mode */
+#define MXL862XX_XPCS_LU_PORT_ID GENMASK(1, 0)
+#define MXL862XX_XPCS_LU_INTERFACE GENMASK(7, 2)
+#define MXL862XX_XPCS_LU_DUPLEX BIT(8)
+#define MXL862XX_XPCS_LU_USX_LANE_MODE GENMASK(10, 9)
+#define MXL862XX_XPCS_LU_USX_SUBPORT GENMASK(12, 11)
+
+/**
+ * struct mxl862xx_xpcs_pcs_link_up - PCS link-up parameters
+ * @mode: Packed input parameters, see MXL862XX_XPCS_LU_*. port_id is the
+ * XPCS port index (0-3); interface is the PCS interface mode
+ * (MXL862XX_XPCS_IF_*); duplex is the duplex mode
+ * (MXL862XX_XPCS_DUPLEX_*); usx_lane_mode is the USX lane mode
+ * (USXGMII only, ignored otherwise, MXL862XX_XPCS_USX_*);
+ * usx_subport (0-3) selects the sub-port for QUSXGMII and QSGMII
+ * (despite the name) and is ignored otherwise.
+ * @speed: Resolved speed in Mbit/s
+ * @result: Firmware result. 0 on success, <0 is errno.
+ *
+ * Called once per link-up event after the host has resolved the
+ * line-side speed/duplex (from the PHY's read_status, from a preceding
+ * PCS get-state, or from a fixed-link description).
+ */
+struct mxl862xx_xpcs_pcs_link_up {
+ __le16 mode;
+ __le16 speed; /* Mbit/s */
+ __le16 result;
+} __packed;
+
+#endif /* __MXL862XX_API_H */
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c
index e05ad52..fb5fbe5 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx.c
@@ -1497,11 +1497,14 @@ static int mxl862xx_port_fdb_del(struct dsa_switch *ds, int port,
return ret;
}
+#define MXL862XX_MAC_TABLE_WALK_LIMIT 16384
+
static int mxl862xx_port_fdb_dump(struct dsa_switch *ds, int port,
dsa_fdb_dump_cb_t *cb, void *data)
{
struct mxl862xx_mac_table_read param = { .initial = 1 };
struct mxl862xx_priv *priv = ds->priv;
+ unsigned long count = 0;
u32 entry_port_id;
int ret;
@@ -1513,6 +1516,23 @@ static int mxl862xx_port_fdb_dump(struct dsa_switch *ds, int port,
if (param.last)
break;
+ /* The exact MAC table capacity is not part of the public
+ * driver API. Use a conservative read limit: 16k is well
+ * above any documented table size for this family, while a
+ * device that never sets last (or keeps answering with
+ * entries for other ports, which never reach the callback)
+ * would otherwise keep us walking forever with RTNL held.
+ * Checked after the "last" test so that a correctly ended
+ * walk of a full table is not rejected.
+ */
+ if (count++ >= MXL862XX_MAC_TABLE_WALK_LIMIT) {
+ dev_err(ds->dev,
+ "FDB dump walk exceeded %d reads, aborting
+",
+ MXL862XX_MAC_TABLE_WALK_LIMIT);
+ return -EIO;
+ }
+
entry_port_id = le32_to_cpu(param.port_id);
if (entry_port_id == port) {
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.h b/drivers/net/dsa/mxl862xx/mxl862xx.h
new file mode 100644
index 0000000..432a5f3
--- /dev/null
+++ b/drivers/net/dsa/mxl862xx/mxl862xx.h
@@ -0,0 +1,343 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef __MXL862XX_H
+#define __MXL862XX_H
+
+#include <asm/byteorder.h>
+#include <linux/mdio.h>
+#include <linux/workqueue.h>
+#include <net/dsa.h>
+
+struct mxl862xx_priv;
+
+#define MXL862XX_MAX_PORTS 17
+#define MXL862XX_FIRST_SERDES_PORT 9
+#define MXL862XX_SERDES_SLOTS 4
+
+#define MXL862XX_DEFAULT_BRIDGE 0
+#define MXL862XX_MAX_BRIDGES 48
+#define MXL862XX_MAX_BRIDGE_PORTS 128
+#define MXL862XX_TOTAL_EVLAN_ENTRIES 1024
+#define MXL862XX_TOTAL_VF_ENTRIES 1024
+
+/* Number of __le16 words in a firmware portmap (128-bit bitmap). */
+#define MXL862XX_FW_PORTMAP_WORDS (MXL862XX_MAX_BRIDGE_PORTS / 16)
+
+/**
+ * mxl862xx_fw_portmap_set_bit - set a single port bit in a firmware portmap
+ * @map: firmware portmap array (MXL862XX_FW_PORTMAP_WORDS entries)
+ * @port: port index (0..MXL862XX_MAX_BRIDGE_PORTS-1)
+ */
+static inline void mxl862xx_fw_portmap_set_bit(__le16 *map, int port)
+{
+ map[port / 16] |= cpu_to_le16(BIT(port % 16));
+}
+
+/**
+ * mxl862xx_fw_portmap_clear_bit - clear a single port bit in a firmware portmap
+ * @map: firmware portmap array (MXL862XX_FW_PORTMAP_WORDS entries)
+ * @port: port index (0..MXL862XX_MAX_BRIDGE_PORTS-1)
+ */
+static inline void mxl862xx_fw_portmap_clear_bit(__le16 *map, int port)
+{
+ map[port / 16] &= ~cpu_to_le16(BIT(port % 16));
+}
+
+/**
+ * mxl862xx_fw_portmap_is_empty - check whether a firmware portmap has no
+ * bits set
+ * @map: firmware portmap array (MXL862XX_FW_PORTMAP_WORDS entries)
+ *
+ * Return: true if every word in @map is zero.
+ */
+static inline bool mxl862xx_fw_portmap_is_empty(const __le16 *map)
+{
+ int i;
+
+ for (i = 0; i < MXL862XX_FW_PORTMAP_WORDS; i++)
+ if (map[i])
+ return false;
+ return true;
+}
+
+/**
+ * struct mxl862xx_vf_vid - Per-VID entry within a VLAN Filter block
+ * @list: Linked into &mxl862xx_vf_block.vids
+ * @vid: VLAN ID
+ * @index: Entry index within the VLAN Filter HW block
+ * @untagged: Strip tag on egress for this VID (drives EVLAN tag-stripping)
+ */
+struct mxl862xx_vf_vid {
+ struct list_head list;
+ u16 vid;
+ u16 index;
+ bool untagged;
+};
+
+/**
+ * struct mxl862xx_vf_block - Per-port VLAN Filter block
+ * @allocated: Whether the HW block has been allocated via VLANFILTER_ALLOC
+ * @block_id: HW VLAN Filter block ID from VLANFILTER_ALLOC
+ * @block_size: Total entries allocated in this block
+ * @active_count: Number of ALLOW entries at indices [0, active_count).
+ * The bridge port config sends max(active_count, 1) as
+ * block_size to narrow the HW scan window.
+ * discard_unmatched_tagged handles frames outside this range.
+ * @vids: List of &mxl862xx_vf_vid entries programmed in this block
+ */
+struct mxl862xx_vf_block {
+ bool allocated;
+ u16 block_id;
+ u16 block_size;
+ u16 active_count;
+ struct list_head vids;
+};
+
+/**
+ * struct mxl862xx_evlan_block - Per-port per-direction extended VLAN block
+ * @allocated: Whether the HW block has been allocated via EXTENDEDVLAN_ALLOC.
+ * Guards alloc/free idempotency--the block_id is only valid
+ * while allocated is true.
+ * @in_use: Whether the EVLAN engine should be enabled for this block
+ * on the bridge port (sent as the enable flag in
+ * set_bridge_port). Can be false while allocated is still
+ * true -- e.g. when all egress VIDs are removed (idx == 0 in
+ * evlan_program_egress) the block stays allocated for
+ * potential reuse, but the engine is disabled so an empty
+ * rule set does not discard all traffic.
+ * @block_id: HW block ID from EXTENDEDVLAN_ALLOC
+ * @block_size: Total entries allocated
+ * @n_active: Number of HW entries currently written. The bridge port
+ * config sends this as the egress scan window, so entries
+ * beyond n_active are never scanned. Always equals
+ * block_size for ingress blocks (fixed catchall rules).
+ */
+struct mxl862xx_evlan_block {
+ bool allocated;
+ bool in_use;
+ u16 block_id;
+ u16 block_size;
+ u16 n_active;
+};
+
+/**
+ * struct mxl862xx_port_stats - 64-bit accumulated hardware port statistics
+ * @rx_packets: total received packets
+ * @tx_packets: total transmitted packets
+ * @rx_bytes: total received bytes
+ * @tx_bytes: total transmitted bytes
+ * @rx_errors: total receive errors
+ * @tx_errors: total transmit errors
+ * @rx_dropped: total received packets dropped
+ * @tx_dropped: total transmitted packets dropped
+ * @multicast: total received multicast packets
+ * @collisions: total transmit collisions
+ * @rx_length_errors: received length errors (undersize + oversize)
+ * @rx_crc_errors: received FCS errors
+ * @rx_frame_errors: received alignment errors
+ * @prev_rx_good_pkts: previous snapshot of rx good packet counter
+ * @prev_tx_good_pkts: previous snapshot of tx good packet counter
+ * @prev_rx_good_bytes: previous snapshot of rx good byte counter
+ * @prev_tx_good_bytes: previous snapshot of tx good byte counter
+ * @prev_rx_fcserror_pkts: previous snapshot of rx FCS error counter
+ * @prev_rx_under_size_error_pkts: previous snapshot of rx undersize
+ * error counter
+ * @prev_rx_oversize_error_pkts: previous snapshot of rx oversize
+ * error counter
+ * @prev_rx_align_error_pkts: previous snapshot of rx alignment
+ * error counter
+ * @prev_tx_dropped_pkts: previous snapshot of tx dropped counter
+ * @prev_rx_dropped_pkts: previous snapshot of rx dropped counter
+ * @prev_rx_evlan_discard_pkts: previous snapshot of extended VLAN
+ * discard counter
+ * @prev_mtu_exceed_discard_pkts: previous snapshot of MTU exceed
+ * discard counter
+ * @prev_tx_acm_dropped_pkts: previous snapshot of tx ACM dropped
+ * counter
+ * @prev_rx_multicast_pkts: previous snapshot of rx multicast counter
+ * @prev_tx_coll_count: previous snapshot of tx collision counter
+ *
+ * The firmware RMON counters are 32-bit free-running (64-bit for byte
+ * counters). This structure holds 64-bit accumulators alongside the
+ * previous raw snapshot so that deltas can be computed across polls,
+ * handling 32-bit wrap correctly via unsigned subtraction.
+ */
+struct mxl862xx_port_stats {
+ u64 rx_packets;
+ u64 tx_packets;
+ u64 rx_bytes;
+ u64 tx_bytes;
+ u64 rx_errors;
+ u64 tx_errors;
+ u64 rx_dropped;
+ u64 tx_dropped;
+ u64 multicast;
+ u64 collisions;
+ u64 rx_length_errors;
+ u64 rx_crc_errors;
+ u64 rx_frame_errors;
+ u32 prev_rx_good_pkts;
+ u32 prev_tx_good_pkts;
+ u64 prev_rx_good_bytes;
+ u64 prev_tx_good_bytes;
+ u32 prev_rx_fcserror_pkts;
+ u32 prev_rx_under_size_error_pkts;
+ u32 prev_rx_oversize_error_pkts;
+ u32 prev_rx_align_error_pkts;
+ u32 prev_tx_dropped_pkts;
+ u32 prev_rx_dropped_pkts;
+ u32 prev_rx_evlan_discard_pkts;
+ u32 prev_mtu_exceed_discard_pkts;
+ u32 prev_tx_acm_dropped_pkts;
+ u32 prev_rx_multicast_pkts;
+ u32 prev_tx_coll_count;
+};
+
+/**
+ * struct mxl862xx_port - per-port state tracked by the driver
+ * @priv: back-pointer to switch private data; needed by
+ * deferred work handlers to access ds and priv
+ * @fid: firmware FID for the permanent single-port bridge;
+ * kept alive for the lifetime of the port so traffic is
+ * never forwarded while the port is unbridged
+ * @flood_block: bitmask of firmware meter indices that are currently
+ * rate-limiting flood traffic on this port (zero-rate
+ * meters used to block flooding)
+ * @learning: true when address learning is enabled on this port
+ * @setup_done: set at end of port_setup, cleared at start of
+ * port_teardown; guards deferred work against
+ * acting on torn-down state
+ * @pvid: port VLAN ID (native VLAN) assigned to untagged traffic
+ * @vlan_filtering: true when VLAN filtering is enabled on this port
+ * @vf: per-port VLAN Filter block state
+ * @ingress_evlan: ingress extended VLAN block state
+ * @egress_evlan: egress extended VLAN block state
+ * @host_flood_uc: desired host unicast flood state (true = flood);
+ * updated atomically by port_set_host_flood, consumed
+ * by the deferred host_flood_work
+ * @host_flood_mc: desired host multicast flood state (true = flood)
+ * @host_flood_work: deferred work for applying host flood changes;
+ * port_set_host_flood runs in atomic context (under
+ * netif_addr_lock) so firmware calls must be deferred.
+ * The worker acquires rtnl_lock() to serialize with
+ * DSA callbacks and checks @setup_done to avoid
+ * acting on torn-down ports.
+ * @stats: 64-bit accumulated hardware statistics; updated
+ * periodically by the stats polling work
+ * @stats_lock: protects accumulator reads in .get_stats64 against
+ * concurrent updates from the polling work
+ */
+struct mxl862xx_port {
+ struct mxl862xx_priv *priv;
+ u16 fid;
+ unsigned long flood_block;
+ bool learning;
+ bool setup_done;
+ u16 pvid;
+ bool vlan_filtering;
+ struct mxl862xx_vf_block vf;
+ struct mxl862xx_evlan_block ingress_evlan;
+ struct mxl862xx_evlan_block egress_evlan;
+ bool host_flood_uc;
+ bool host_flood_mc;
+ struct work_struct host_flood_work;
+ struct mxl862xx_port_stats stats;
+ spinlock_t stats_lock; /* protects stats accumulators */
+};
+
+/**
+ * struct mxl862xx_pcs - link SerDes interfaces to bridge ports
+ * @pcs: &struct phylink_pcs instance
+ * @priv: pointer to &struct mxl862xx_priv
+ * @serdes_id: SerDes instance index (0 or 1)
+ * @slot: slot within the SerDes (0-3 for QSGMII/QUSXGMII, 0 otherwise)
+ * @interface: cached PHY interface, last value passed to pcs_config().
+ * %PHY_INTERFACE_MODE_NA before the first successful
+ * pcs_config(). Used by pcs_an_restart() to populate the
+ * firmware command and by pcs_disable() to skip the
+ * firmware power-down for shared (QSGMII/QUSXGMII) modes.
+ */
+struct mxl862xx_pcs {
+ struct phylink_pcs pcs;
+ struct mxl862xx_priv *priv;
+ int serdes_id;
+ int slot;
+ phy_interface_t interface;
+};
+
+/**
+ * struct mxl862xx_fw_version - firmware version for comparison and display
+ * @major: firmware major version
+ * @minor: firmware minor version
+ * @revision: firmware revision number
+ */
+struct mxl862xx_fw_version {
+ u8 major;
+ u8 minor;
+ u16 revision;
+};
+
+#define MXL862XX_FW_VER(maj, min, rev) \
+ (((u32)(maj) << 24) | ((u32)(min) << 16) | (rev))
+#define MXL862XX_FW_VER_MIN(priv, maj, min, rev) \
+ (MXL862XX_FW_VER((priv)->fw_version.major, (priv)->fw_version.minor, \
+ (priv)->fw_version.revision) >= \
+ MXL862XX_FW_VER(maj, min, rev))
+
+/* Bit indices for struct mxl862xx_priv::flags */
+#define MXL862XX_FLAG_CRC_ERR 0
+#define MXL862XX_FLAG_WORK_STOPPED 1
+
+/**
+ * struct mxl862xx_priv - driver private data for an MxL862xx switch
+ * @ds: pointer to the DSA switch instance
+ * @mdiodev: MDIO device used to communicate with the switch firmware
+ * @crc_err_work: deferred work for shutting down all ports on MDIO CRC
+ * errors
+ * @flags: atomic status flags; %MXL862XX_FLAG_CRC_ERR is set
+ * before CRC-triggered shutdown and cleared after;
+ * %MXL862XX_FLAG_WORK_STOPPED is set before cancelling
+ * stats_work to prevent rescheduling during teardown
+ * @drop_meter: index of the single shared zero-rate firmware meter
+ * used to unconditionally drop traffic (used to block
+ * flooding)
+ * @fw_version: cached firmware version, populated at probe and
+ * compared with MXL862XX_FW_VER_MIN()
+ * @serdes_ports: SerDes interfaces incl. sub-interfaces in case of
+ * 10G_QXGMII or QSGMII
+ * @serdes_refcount: per-XPCS count of sub-ports enabled by phylink;
+ * pcs_disable powers an XPCS down when the count
+ * reaches zero. Protected by @serdes_lock.
+ * @serdes_lock: serializes the @serdes_refcount transitions with
+ * the XPCS power-down so a sibling sub-port enable
+ * cannot race a power-down to zero
+ * @ports: per-port state, indexed by switch port number
+ * @bridges: maps DSA bridge number to firmware bridge ID;
+ * zero means no firmware bridge allocated for that
+ * DSA bridge number. Indexed by dsa_bridge.num
+ * (0 .. ds->max_num_bridges).
+ * @evlan_ingress_size: per-port ingress Extended VLAN block size
+ * @evlan_egress_size: per-port egress Extended VLAN block size
+ * @vf_block_size: per-port VLAN Filter block size
+ * @stats_work: periodic work item that polls RMON hardware counters
+ * and accumulates them into 64-bit per-port stats
+ */
+struct mxl862xx_priv {
+ struct dsa_switch *ds;
+ struct mdio_device *mdiodev;
+ struct work_struct crc_err_work;
+ unsigned long flags;
+ u16 drop_meter;
+ struct mxl862xx_fw_version fw_version;
+ struct mxl862xx_pcs serdes_ports[8];
+ int serdes_refcount[2];
+ struct mutex serdes_lock;
+ struct mxl862xx_port ports[MXL862XX_MAX_PORTS];
+ u16 bridges[MXL862XX_MAX_BRIDGES + 1];
+ u16 evlan_ingress_size;
+ u16 evlan_egress_size;
+ u16 vf_block_size;
+ struct delayed_work stats_work;
+};
+
+#endif /* __MXL862XX_H */
--
2.39.5 (Apple Git-154)
^ permalink raw reply related [flat|nested] 25+ messages in thread
* [PATCH net v2 2/2] net: dsa: mxl862xx: validate the bridge id returned by BRIDGE_ALLOC
[not found] <20261023204006.24923-1-memoriaru@foxmail.com>
2026-10-23 20:40 ` [PATCH net v2 1/2] net: dsa: mxl862xx: bound FDB dump walk with a read limit memoriaru
@ 2026-10-23 20:40 ` memoriaru
1 sibling, 0 replies; 25+ messages in thread
From: memoriaru @ 2026-10-23 20:40 UTC (permalink / raw)
To: netdev; +Cc: daniel, andrew, olteanv, johan, kuba
From: Zhang Hewei <memoriaru@foxmail.com>
mxl862xx_allocate_bridge() only checks the transport status and
returns the firmware-supplied bridge id verbatim. Three protocol
violations slip through:
- id 0 is reserved ("not used for historic reasons") and doubles as
the "not allocated" value in priv->bridges[] and priv->ports[].fid,
so a port or bridge configured with it looks unallocated: later
joins allocate again and FDB/MDB lookups fail with -ENOENT. It also
collides with MXL862XX_DEFAULT_BRIDGE (the CPU port), merging the
port's filtering domain with the CPU port's.
- the API documents INVALID_HANDLE for failed allocations without
defining its value; the MaxLinear GSW API uses 0xffff, so reject
that value as well.
- duplicate ids collapse the FID isolation of two domains: FDB and
MDB entries are matched by FID, VID and MAC, so deleting an entry
in one domain can remove an entry belonging to the other.
Firmware that follows the API never returns these values; the checks
only guard against firmware that breaks it.
Fixes: 340bdf984613c4a9 ("net: dsa: mxl862xx: implement bridge offloading")
Signed-off-by: Zhang Hewei <memoriaru@foxmail.com>
---
drivers/net/dsa/mxl862xx/mxl862xx.c | 37 ++++++++++++++++++++++++++++-
1 file changed, 36 insertions(+), 1 deletion(-)
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c
index fb5fbe5..a432709 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx.c
@@ -584,16 +584,51 @@ static int mxl862xx_vf_alloc(struct mxl862xx_priv *priv,
return mxl862xx_vf_entry_discard(priv, vf->block_id, 0);
}
+/* Firmware bridge ids are stored in priv->bridges[] (bridged ports)
+ * and priv->ports[].fid (standalone ports, which also allocate one),
+ * so a fresh allocation must not collide with either.
+ */
+static bool mxl862xx_bridge_id_in_use(struct mxl862xx_priv *priv, u16 id)
+{
+ int i;
+
+ for (i = 0; i <= MXL862XX_MAX_BRIDGES; i++)
+ if (priv->bridges[i] == id)
+ return true;
+
+ for (i = 0; i < MXL862XX_MAX_PORTS; i++)
+ if (priv->ports[i].fid == id)
+ return true;
+
+ return false;
+}
+
static int mxl862xx_allocate_bridge(struct mxl862xx_priv *priv)
{
struct mxl862xx_bridge_alloc br_alloc = {};
+ u16 id;
int ret;
ret = MXL862XX_API_READ(priv, MXL862XX_BRIDGE_ALLOC, br_alloc);
if (ret)
return ret;
- return le16_to_cpu(br_alloc.bridge_id);
+ id = le16_to_cpu(br_alloc.bridge_id);
+
+ /* The API reserves id 0 ("not used for historic reasons"), which
+ * also doubles as the "not allocated" value in priv->bridges[]
+ * and priv->ports[].fid, and collides with
+ * MXL862XX_DEFAULT_BRIDGE (the CPU port). It documents
+ * INVALID_HANDLE for failed allocations without defining its
+ * value; the MaxLinear GSW API uses 0xffff, so reject that too.
+ * A duplicate id would collapse the FID isolation of two domains
+ * (FDB and MDB entries are matched by FID, VID and MAC).
+ * Firmware that follows the API never returns these values.
+ */
+ if (!id || id == 0xffff || mxl862xx_bridge_id_in_use(priv, id))
+ return -EIO;
+
+ return id;
}
static void mxl862xx_free_bridge(struct dsa_switch *ds,
--
2.39.5 (Apple Git-154)
^ permalink raw reply related [flat|nested] 25+ messages in thread
* Re: [PATCH net v2 0/2] net: dsa: mxl862xx: bound FDB dump walk and validate BRIDGE_ALLOC ids
2026-10-23 20:40 ` [PATCH net v2 0/2] net: dsa: mxl862xx: bound FDB dump walk and validate BRIDGE_ALLOC ids memoriaru
@ 2026-10-23 20:44 ` netdev-bot+sinfo
2026-10-23 21:03 ` memoriaru
2026-10-29 11:25 ` [PATCH net v3 " memoriaru
[not found] ` <20261029112528.56652-1-memoriaru@foxmail.com>
2 siblings, 1 reply; 25+ messages in thread
From: netdev-bot+sinfo @ 2026-10-23 20:44 UTC (permalink / raw)
To: memoriaru; +Cc: netdev, daniel, andrew, olteanv, johan, kuba
Hi!
This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:
- How the issue was discovered, e.g. hit in production, hit during
development, syzbot report, manual code inspection, LLM or static
analysis tool scan.
- Whether the issue was actually triggered, or is only theoretical
(e.g. found by code inspection). If it was triggered please include
the symptoms, like the stack trace or error messages.
Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.
The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [PATCH net v2 0/2] net: dsa: mxl862xx: bound FDB dump walk and validate BRIDGE_ALLOC ids
2026-10-23 20:44 ` netdev-bot+sinfo
@ 2026-10-23 21:03 ` memoriaru
2026-10-28 22:44 ` Jakub Kicinski
0 siblings, 1 reply; 25+ messages in thread
From: memoriaru @ 2026-10-23 21:03 UTC (permalink / raw)
To: netdev
From: Zhang Hewei <memoriaru@foxmail.com>
Hi,
Same context as the v1 thread, replying here for the v2 series:
Discovery: manual code inspection, while auditing this driver's
handling of device-controlled responses (the MAC table walk and the
BRIDGE_ALLOC reply).
Trigger status: the unbounded-walk mechanism was reproduced in-kernel
-- a self-contained module carrying the verbatim loop shape of
mxl862xx_port_fdb_dump() (device transport stubbed) built against the
official Ubuntu 6.8.0-71 headers and run under QEMU (TCG, unmodified
official vmlinuz) never terminated on its own (100M iterations logged;
a real table holds 4-16k entries). The reproduction is automated in
Docker and needs no special hardware. I do not have access to mxl862xx
hardware, so this exercises the driver-side loop logic, not a real
device.
The BRIDGE_ALLOC validation is logic-level: the driver consumed the
firmware-supplied id with only a transport status check, so the
reserved id 0 (which doubles as the "not allocated" sentinel and the
CPU-port bridge) was accepted verbatim. Whether compliant firmware can
be made to return such values is unknown without hardware; the checks
guard against firmware that breaks the API.
The v2 diffs themselves are small and mechanical and have not been
compile-tested against a full kernel tree (no hardware here); the
reproduction module compiles and runs on the official kernel.
Thanks,
Zhang Hewei
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [PATCH net v2 0/2] net: dsa: mxl862xx: bound FDB dump walk and validate BRIDGE_ALLOC ids
2026-10-23 21:03 ` memoriaru
@ 2026-10-28 22:44 ` Jakub Kicinski
0 siblings, 0 replies; 25+ messages in thread
From: Jakub Kicinski @ 2026-10-28 22:44 UTC (permalink / raw)
To: memoriaru; +Cc: netdev
On Sat, 24 Oct 2026 05:03:22 +0800 memoriaru@foxmail.com wrote:
> Same context as the v1 thread, replying here for the v2 series:
Please add the relevant stuff to the cover letter when reposting.
The v2 did not apply so respin will be needed.
Also - please make sure you add appropriate people to CC on the cover
letter as well.
--
pw-bot: cr
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH net v3 0/2] net: dsa: mxl862xx: bound FDB dump walk and validate BRIDGE_ALLOC ids
2026-10-23 20:40 ` [PATCH net v2 0/2] net: dsa: mxl862xx: bound FDB dump walk and validate BRIDGE_ALLOC ids memoriaru
2026-10-23 20:44 ` netdev-bot+sinfo
@ 2026-10-29 11:25 ` memoriaru
[not found] ` <20261029112528.56652-1-memoriaru@foxmail.com>
2 siblings, 0 replies; 25+ messages in thread
From: memoriaru @ 2026-10-29 11:25 UTC (permalink / raw)
To: netdev; +Cc: daniel, andrew, f.fainelli, olteanv, johan, kuba, pabeni
From: Zhang Hewei <memoriaru@foxmail.com>
Hello,
v3 of the two mxl862xx robustness fixes, rebased onto the current
net tree as requested.
The v2 series did not apply because it still carried full copies of
mxl862xx-api.h and mxl862xx.h (the driver pre-dating the upstream
restructure into mxl862xx-host.c / mxl862xx-phylink.c). Both fixes
are now re-ported onto the restructured driver; no driver files are
created or renamed by this series anymore, the two patches only
touch drivers/net/dsa/mxl862xx/mxl862xx.c.
The bugs themselves are unchanged in the restructured code:
mxl862xx_port_fdb_dump() still walks the MAC table in a while(true)
loop whose only exit is the device-controlled "last" flag, and
mxl862xx_allocate_bridge() still returns the firmware-supplied
bridge id without validating it.
v1: https://lore.kernel.org/netdev/tencent_5A7AEC56CDB23A83120519D0C074B592C706@qq.com/
v2: https://lore.kernel.org/netdev/tencent_6030CC520C02054D1B2925AEEF6FA92DC30A@qq.com/
Changes since v2:
- rebase onto net (fa503935c2d6): re-ported the FDB dump read limit
to the restructured mxl862xx_port_fdb_dump() (the while(true) +
"last" exit is unchanged, the limit check and its comment moved
verbatim); re-ported the BRIDGE_ALLOC validation to the
restructured mxl862xx_allocate_bridge() (unchanged logic)
- dropped the mxl862xx-api.h / mxl862xx.h file creations that v2
carried: both files exist upstream since the restructure, so the
series is now two pure fixes to drivers/net/dsa/mxl862xx/mxl862xx.c
Changes since v1:
- the walk limit is now checked after the "last" test: the walk
needs one read more than the number of entries it reports, so
checking before it rejected a correctly ended walk of a full table
- macro name, error message and comments say "conservative read
limit" instead of "table capacity", which the exact value is not
- the "growing kernel memory without bound" wording is gone:
entries whose port id does not match never reach the callback,
which is exactly why the walk needs its own bound (the netlink
dump skb never fills)
- BRIDGE_ALLOC validation now also rejects 0xffff (INVALID_HANDLE is
documented but never defined; the MaxLinear GSW API uses 0xffff)
and ids already in use, closing the duplicate-FID collapse
- Fixes: tags added (both issues come from the bridge offloading
commit), self Reported-by trailers dropped
Base-commit: fa503935c2d6603856dafff0a0852631ab6e9503
Cc: Daniel Golle <daniel@makrotopia.org> (driver author)
Cc: Andrew Lunn <andrew@lunn.ch>
Cc: Florian Fainelli <f.fainelli@gmail.com>
Cc: Vladimir Oltean <olteanv@gmail.com>
Cc: Johan Hovold <johan@kernel.org>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: netdev@vger.kernel.org
Zhang Hewei (2):
net: dsa: mxl862xx: bound FDB dump walk with a read limit
net: dsa: mxl862xx: validate the bridge id returned by BRIDGE_ALLOC
drivers/net/dsa/mxl862xx/mxl862xx.c | 59 ++++++++++++++++++++++++++---
1 file changed, 56 insertions(+), 3 deletions(-)
--
2.39.5 (Apple Git-154)
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH net v3 1/2] net: dsa: mxl862xx: bound FDB dump walk with a read limit
[not found] ` <20261029112528.56652-1-memoriaru@foxmail.com>
@ 2026-10-29 11:25 ` memoriaru
2026-10-29 11:30 ` netdev-bot+sinfo
2026-10-30 11:28 ` netdev-bot+sashiko
2026-10-29 11:25 ` [PATCH net v3 2/2] net: dsa: mxl862xx: validate the bridge id returned by BRIDGE_ALLOC memoriaru
1 sibling, 2 replies; 25+ messages in thread
From: memoriaru @ 2026-10-29 11:25 UTC (permalink / raw)
To: netdev; +Cc: daniel, andrew, f.fainelli, olteanv, johan, kuba, pabeni
From: Zhang Hewei <memoriaru@foxmail.com>
mxl862xx_port_fdb_dump() walks the MAC table in a while (true) loop
whose only exit is the device-controlled "last" flag. Entries whose
port id does not match the dumped port are skipped without invoking
the DSA callback, so the netlink dump buffer never fills either: a
device (or its firmware) that keeps answering with entries for other
ports and never sets last keeps the driver walking forever with RTNL
held.
The exact MAC table capacity is not part of the public driver API.
Use a conservative read limit (16k, well above any documented table
size for this family) and return -EIO when it is exceeded. The limit
is checked after the "last" test so that a correctly ended walk of a
full table is not rejected: the walk needs one read more than the
number of entries it reports.
Fixes: 340bdf984613c4a9 ("net: dsa: mxl862xx: implement bridge offloading")
Signed-off-by: Zhang Hewei <memoriaru@foxmail.com>
---
drivers/net/dsa/mxl862xx/mxl862xx.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c
index e05ad52cd..37e8c18f1 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx.c
@@ -30,6 +30,11 @@
*/
#define MXL862XX_STATS_POLL_INTERVAL (2 * HZ)
+/* Conservative bound for the MAC table read loop: the exact capacity is
+ * not part of the public driver API (see mxl862xx_port_fdb_dump()).
+ */
+#define MXL862XX_MAC_TABLE_WALK_LIMIT 16384
+
struct mxl862xx_mib_desc {
unsigned int size;
unsigned int offset;
@@ -1503,6 +1508,7 @@ static int mxl862xx_port_fdb_dump(struct dsa_switch *ds, int port,
struct mxl862xx_mac_table_read param = { .initial = 1 };
struct mxl862xx_priv *priv = ds->priv;
u32 entry_port_id;
+ int count = 0;
int ret;
while (true) {
@@ -1513,6 +1519,22 @@ static int mxl862xx_port_fdb_dump(struct dsa_switch *ds, int port,
if (param.last)
break;
+ /* The exact MAC table capacity is not part of the public
+ * driver API. Use a conservative read limit: 16k is well
+ * above any documented table size for this family, while a
+ * device that never sets last (or keeps answering with
+ * entries for other ports, which never reach the callback)
+ * would otherwise keep us walking forever with RTNL held.
+ * Checked after the "last" test so that a correctly ended
+ * walk of a full table is not rejected.
+ */
+ if (count++ >= MXL862XX_MAC_TABLE_WALK_LIMIT) {
+ dev_err(ds->dev,
+ "FDB dump walk exceeded %d reads, aborting\n",
+ MXL862XX_MAC_TABLE_WALK_LIMIT);
+ return -EIO;
+ }
+
entry_port_id = le32_to_cpu(param.port_id);
if (entry_port_id == port) {
--
2.39.5 (Apple Git-154)
^ permalink raw reply related [flat|nested] 25+ messages in thread
* [PATCH net v3 2/2] net: dsa: mxl862xx: validate the bridge id returned by BRIDGE_ALLOC
[not found] ` <20261029112528.56652-1-memoriaru@foxmail.com>
2026-10-29 11:25 ` [PATCH net v3 1/2] net: dsa: mxl862xx: bound FDB dump walk with a read limit memoriaru
@ 2026-10-29 11:25 ` memoriaru
2026-10-30 11:28 ` netdev-bot+sashiko
1 sibling, 1 reply; 25+ messages in thread
From: memoriaru @ 2026-10-29 11:25 UTC (permalink / raw)
To: netdev; +Cc: daniel, andrew, f.fainelli, olteanv, johan, kuba, pabeni
From: Zhang Hewei <memoriaru@foxmail.com>
mxl862xx_allocate_bridge() only checks the transport status and
returns the firmware-supplied bridge id verbatim. Three protocol
violations slip through:
- id 0 is reserved ("not used for historic reasons") and doubles as
the "not allocated" value in priv->bridges[] and priv->ports[].fid,
so a port or bridge configured with it looks unallocated: later
joins allocate again and FDB/MDB lookups fail with -ENOENT. It also
collides with MXL862XX_DEFAULT_BRIDGE (the CPU port), merging the
port's filtering domain with the CPU port's.
- the API documents INVALID_HANDLE for failed allocations without
defining its value; the MaxLinear GSW API uses 0xffff, so reject
that value as well.
- duplicate ids collapse the FID isolation of two domains: FDB and
MDB entries are matched by FID, VID and MAC, so deleting an entry
in one domain can remove an entry belonging to the other.
Firmware that follows the API never returns these values; the checks
only guard against firmware that breaks it.
Fixes: 340bdf984613c4a9 ("net: dsa: mxl862xx: implement bridge offloading")
Signed-off-by: Zhang Hewei <memoriaru@foxmail.com>
---
drivers/net/dsa/mxl862xx/mxl862xx.c | 37 ++++++++++++++++++++++++++++-
1 file changed, 36 insertions(+), 1 deletion(-)
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c
index 37e8c18f1..d8d58f280 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx.c
@@ -589,16 +589,51 @@ static int mxl862xx_vf_alloc(struct mxl862xx_priv *priv,
return mxl862xx_vf_entry_discard(priv, vf->block_id, 0);
}
+/* Firmware bridge ids are stored in priv->bridges[] (bridged ports)
+ * and priv->ports[].fid (standalone ports, which also allocate one),
+ * so a fresh allocation must not collide with either.
+ */
+static bool mxl862xx_bridge_id_in_use(struct mxl862xx_priv *priv, u16 id)
+{
+ int i;
+
+ for (i = 0; i <= MXL862XX_MAX_BRIDGES; i++)
+ if (priv->bridges[i] == id)
+ return true;
+
+ for (i = 0; i < MXL862XX_MAX_PORTS; i++)
+ if (priv->ports[i].fid == id)
+ return true;
+
+ return false;
+}
+
static int mxl862xx_allocate_bridge(struct mxl862xx_priv *priv)
{
struct mxl862xx_bridge_alloc br_alloc = {};
+ u16 id;
int ret;
ret = MXL862XX_API_READ(priv, MXL862XX_BRIDGE_ALLOC, br_alloc);
if (ret)
return ret;
- return le16_to_cpu(br_alloc.bridge_id);
+ id = le16_to_cpu(br_alloc.bridge_id);
+
+ /* The API reserves id 0 ("not used for historic reasons"), which
+ * also doubles as the "not allocated" value in priv->bridges[]
+ * and priv->ports[].fid, and collides with
+ * MXL862XX_DEFAULT_BRIDGE (the CPU port). It documents
+ * INVALID_HANDLE for failed allocations without defining its
+ * value; the MaxLinear GSW API uses 0xffff, so reject that too.
+ * A duplicate id would collapse the FID isolation of two domains
+ * (FDB and MDB entries are matched by FID, VID and MAC).
+ * Firmware that follows the API never returns these values.
+ */
+ if (!id || id == 0xffff || mxl862xx_bridge_id_in_use(priv, id))
+ return -EIO;
+
+ return id;
}
static void mxl862xx_free_bridge(struct dsa_switch *ds,
--
2.39.5 (Apple Git-154)
^ permalink raw reply related [flat|nested] 25+ messages in thread
* Re: [PATCH net v3 1/2] net: dsa: mxl862xx: bound FDB dump walk with a read limit
2026-10-29 11:25 ` [PATCH net v3 1/2] net: dsa: mxl862xx: bound FDB dump walk with a read limit memoriaru
@ 2026-10-29 11:30 ` netdev-bot+sinfo
2026-10-30 3:33 ` memoriaru
2026-10-30 11:28 ` netdev-bot+sashiko
1 sibling, 1 reply; 25+ messages in thread
From: netdev-bot+sinfo @ 2026-10-29 11:30 UTC (permalink / raw)
To: memoriaru
Cc: netdev, daniel, andrew, f.fainelli, olteanv, johan, kuba, pabeni
Hi!
This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:
- How the issue was discovered, e.g. hit in production, hit during
development, syzbot report, manual code inspection, LLM or static
analysis tool scan.
- Whether the issue was actually triggered, or is only theoretical
(e.g. found by code inspection). If it was triggered please include
the symptoms, like the stack trace or error messages.
Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.
The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [PATCH net v3 1/2] net: dsa: mxl862xx: bound FDB dump walk with a read limit
2026-10-29 11:30 ` netdev-bot+sinfo
@ 2026-10-30 3:33 ` memoriaru
2026-10-30 22:24 ` Jakub Kicinski
0 siblings, 1 reply; 25+ messages in thread
From: memoriaru @ 2026-10-30 3:33 UTC (permalink / raw)
To: netdev
From: Zhang Hewei <memoriaru@foxmail.com>
Hi,
Adding the requested information:
How discovered: manual code inspection. We were auditing the
mxl862xx driver's handling of device-controlled API responses
(firmware as an untrusted party): both spots keep consuming or
trusting values that the firmware alone controls -- the MAC table
walk's only exit is the device-set "last" flag, and the returned
bridge id is never checked against the values the API documents
as reserved.
Triggered: no, theoretical. We have no MxL862xx hardware in hand,
so neither issue was exercised on a real device. The FDB dump loop
and the missing bridge_id checks were verified by code inspection
against the GSW API documentation (id 0 reserved, INVALID_HANDLE
documented but undefined -- 0xffff in the MaxLinear GSW API). No
symptoms to report.
Best,
Zhang Hewei
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [PATCH net v3 1/2] net: dsa: mxl862xx: bound FDB dump walk with a read limit
2026-10-29 11:25 ` [PATCH net v3 1/2] net: dsa: mxl862xx: bound FDB dump walk with a read limit memoriaru
2026-10-29 11:30 ` netdev-bot+sinfo
@ 2026-10-30 11:28 ` netdev-bot+sashiko
1 sibling, 0 replies; 25+ messages in thread
From: netdev-bot+sashiko @ 2026-10-30 11:28 UTC (permalink / raw)
To: memoriaru
Cc: netdev, daniel, andrew, f.fainelli, olteanv, johan, kuba, pabeni
Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider.
Critical: 0 · High: 0 · Medium: 1 · Low: 0 (1)
If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).
- [Medium] The patch says it stops mxl862xx_port_fdb_dump() from "walking
forever with RTNL held".
Pre-existing issues:
- [Low] The kernel-doc for struct mxl862xx_mac_table_read
(drivers/net/dsa/mxl862xx/mxl862xx-api.h:120) says "@last: Indicates…
--
I found two possible regressions in this patch.
1. (Medium) The 16384-read cap is finite, but each read is a full mailbox exchange done under RTNL. rtnl_fdb_dump() ignores the -EIO, so the long walk is repeated once for every user port.
2. (Low, pre-existing) The kernel-doc for @last says the last=1 response carries an entry, but the code throws that response away. The new comment follows the code's reading.
The draft reply:
net: dsa: mxl862xx: bound FDB dump walk with a read limit
This patch caps the MAC table walk in mxl862xx_port_fdb_dump() at
MXL862XX_MAC_TABLE_WALK_LIMIT (16384) reads. Past that limit it returns
-EIO, so a device that never sets the last flag can no longer keep the
loop running forever with RTNL held. The limit is checked after the last
test so that a correctly ended walk of a full table is not rejected.
> diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c
> index e05ad52cd297e..37e8c18f14f33 100644
> --- a/drivers/net/dsa/mxl862xx/mxl862xx.c
> +++ b/drivers/net/dsa/mxl862xx/mxl862xx.c
[ ... ]
> @@ -1513,6 +1519,22 @@ static int mxl862xx_port_fdb_dump(struct dsa_switch *ds, int port,
> if (param.last)
> break;
>
> + /* The exact MAC table capacity is not part of the public
> + * driver API. Use a conservative read limit: 16k is well
> + * above any documented table size for this family, while a
> + * device that never sets last (or keeps answering with
> + * entries for other ports, which never reach the callback)
> + * would otherwise keep us walking forever with RTNL held.
> + * Checked after the "last" test so that a correctly ended
> + * walk of a full table is not rejected.
> + */
[Severity: Low]
This is a pre-existing issue and was not introduced by this patch. The
new comment does rely on it, though.
The kernel-doc for struct mxl862xx_mac_table_read in mxl862xx-api.h
says:
* @last: Indicates that the read operation returned last entry
Read literally, the response with last=1 still carries a valid final
entry. mxl862xx_port_fdb_dump() breaks on param.last before it looks at
port_id, mac or tci, so that payload is thrown away.
The new comment and the commit message ("the walk needs one read more
than the number of entries it reports") assume that the last=1 response
is an empty end marker.
Which reading matches the firmware? If the kernel-doc is right, every
dump drops one entry and the placement of the limit check is off by one.
If the code is right, could the kernel-doc be updated to say that last=1
means no valid entry was returned?
> + if (count++ >= MXL862XX_MAC_TABLE_WALK_LIMIT) {
> + dev_err(ds->dev,
> + "FDB dump walk exceeded %d reads, aborting\n",
> + MXL862XX_MAC_TABLE_WALK_LIMIT);
> + return -EIO;
> + }
> +
[Severity: Medium]
Does this limit really keep the RTNL hold time bounded in practice for a
device that never sets last?
Each iteration is a full MXL862XX_MAC_TABLEENTRYREAD mailbox exchange
in mxl862xx_api_wrap(). The 53-byte struct mxl862xx_mac_table_read
moves 27 data words plus a CRC word, so after the first iteration one
read costs roughly:
mxl862xx_api_wrap()
mxl862xx_busy_wait()
mxl862xx_rst_data() /* 2 writes, busy-wait, 2 reads */
CRC word write
mxl862xx_send_cmd() /* 2 writes, busy-wait, 2 reads */
mxl862xx_reg_read() x 28
That is about 40 Clause-45 accesses and three busy-waits per read. At a
typical 2.5 MHz MDC this is about 2-3 ms per read, or roughly 30-50
seconds per port before the -EIO fires.
mxl862xx_busy_wait() also allows up to 500 ms per wait:
return readx_poll_timeout(mxl862xx_ctrl_read, priv, val,
!(val & CTRL_BUSY_MASK), 15, 500000);
So a device that holds its busy bit could stretch the bounded walk much
further.
The -EIO also does not seem to end the dump. rtnl_fdb_dump() only stops
on -EMSGSIZE:
if (dev->netdev_ops->ndo_fdb_dump)
err = dev->netdev_ops->ndo_fdb_dump(skb, cb, dev, NULL,
&fidx);
else
err = ndo_dflt_fdb_dump(skb, cb, dev, NULL, &fidx);
if (err == -EMSGSIZE)
break;
Each DSA user port goes through dsa_user_fdb_dump()->dsa_port_fdb_dump()
->mxl862xx_port_fdb_dump() on its own, and the failure is not latched.
One bridge fdb show would then run the user port count times 16384 reads
under RTNL, with one dev_err per port that is not rate-limited.
Userspace gets a silently truncated list rather than an error. Each new
dump or -EMSGSIZE continuation starts again with initial=1 and a fresh
budget.
RTM_GETNEIGH's dumpit is registered without RTNL_FLAG_DUMP_UNLOCKED, so
an unprivileged local user can trigger this repeatedly. Other RTNL users
are blocked meanwhile, including mxl862xx_crc_err_work_fn() and
mxl862xx_host_flood_work_fn().
The commit message does not explain where 16k comes from. Would a
jiffies-based deadline, a bound tied to the real table capacity, or
latching the failure so that other ports and later dumps fail fast work
better here?
> entry_port_id = le32_to_cpu(param.port_id);
>
> if (entry_port_id == port) {
--
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/tencent_1AD6B5B7C296D319F828A281A2A65B95D609%40qq.com
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [PATCH net v3 2/2] net: dsa: mxl862xx: validate the bridge id returned by BRIDGE_ALLOC
2026-10-29 11:25 ` [PATCH net v3 2/2] net: dsa: mxl862xx: validate the bridge id returned by BRIDGE_ALLOC memoriaru
@ 2026-10-30 11:28 ` netdev-bot+sashiko
2026-10-31 2:43 ` memoriaru
0 siblings, 1 reply; 25+ messages in thread
From: netdev-bot+sashiko @ 2026-10-30 11:28 UTC (permalink / raw)
To: memoriaru
Cc: netdev, daniel, andrew, f.fainelli, olteanv, johan, kuba, pabeni
Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider.
Critical: 0 · High: 0 · Medium: 1 · Low: 0
If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).
- [Medium] In mxl862xx_allocate_bridge()
(drivers/net/dsa/mxl862xx/mxl862xx.c), a positive firmware command…
--
net: dsa: mxl862xx: validate the bridge id returned by BRIDGE_ALLOC
This patch makes mxl862xx_allocate_bridge() reject a firmware-supplied
bridge id that is 0, is 0xffff, or is already in use in priv->bridges[]
or priv->ports[].fid. It guards against firmware that does not follow the
API and would otherwise break FID isolation between domains.
> diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c
> index 37e8c18f14f33..d8d58f280d358 100644
> --- a/drivers/net/dsa/mxl862xx/mxl862xx.c
> +++ b/drivers/net/dsa/mxl862xx/mxl862xx.c
[ ... ]
> static int mxl862xx_allocate_bridge(struct mxl862xx_priv *priv)
> {
> struct mxl862xx_bridge_alloc br_alloc = {};
> + u16 id;
> int ret;
>
> ret = MXL862XX_API_READ(priv, MXL862XX_BRIDGE_ALLOC, br_alloc);
> if (ret)
> return ret;
[Severity: Medium]
Can a positive firmware result get past all of the new checks here?
The transport layer decodes the firmware result as a signed 11-bit value
in mxl862xx_crc6_verify():
*result = sign_extend32((len_ret & LEN_RET_LEN_MASK) |
((ctrl & CTRL_CRC_FLAG) >> 4), 10);
The kernel-doc for mxl862xx_issue_cmd() says it returns a "firmware result
value (>= 0) on success". mxl862xx_send_cmd() only remaps negative values,
and mxl862xx_api_wrap() returns cmd_ret after a successful read. So a
CRC-valid status from 1 to 1023 comes back unchanged from
MXL862XX_API_READ().
In that case, if (ret) return ret; returns the status itself before
br_alloc.bridge_id is examined. Both callers only check for ret < 0:
mxl862xx_port_bridge_join():
ret = mxl862xx_allocate_bridge(priv);
if (ret < 0)
return ret;
priv->bridges[bridge.num] = ret;
mxl862xx_port_setup():
ret = mxl862xx_allocate_bridge(priv);
if (ret < 0) {
...
}
priv->ports[port].fid = ret;
If the firmware returns a status of 1 while FID 1 is already stored in
priv->bridges[] or priv->ports[].fid, wouldn't 1 be recorded as a newly
allocated FID without ever going through mxl862xx_bridge_id_in_use()? The
firmware bridge actually allocated in br_alloc.bridge_id would also be
leaked.
That looks like the same duplicate-FID problem the patch is meant to
close, caused by the same kind of non-conforming firmware.
Would it make sense to also treat a positive status as an error before
validating the payload id, for example:
if (ret < 0)
return ret;
if (ret)
return -EIO;
>
> - return le16_to_cpu(br_alloc.bridge_id);
> + id = le16_to_cpu(br_alloc.bridge_id);
> +
[ ... ]
> + if (!id || id == 0xffff || mxl862xx_bridge_id_in_use(priv, id))
> + return -EIO;
> +
> + return id;
> }
--
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/tencent_1AD6B5B7C296D319F828A281A2A65B95D609%40qq.com
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [PATCH net v3 1/2] net: dsa: mxl862xx: bound FDB dump walk with a read limit
2026-10-30 3:33 ` memoriaru
@ 2026-10-30 22:24 ` Jakub Kicinski
0 siblings, 0 replies; 25+ messages in thread
From: Jakub Kicinski @ 2026-10-30 22:24 UTC (permalink / raw)
To: memoriaru; +Cc: netdev
On Fri, 30 Oct 2026 11:33:12 +0800 memoriaru@foxmail.com wrote:
> How discovered: manual code inspection. We were auditing the
> mxl862xx driver's handling of device-controlled API responses
> (firmware as an untrusted party):
Why are you "auditing mxl862xx driver for handling of device-controlled
API responses"? This is an SoC driver AFAIU, if someone loaded untrusted
FW into the SoC the game is over before it started..
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [PATCH net v3 2/2] net: dsa: mxl862xx: validate the bridge id returned by BRIDGE_ALLOC
2026-10-30 11:28 ` netdev-bot+sashiko
@ 2026-10-31 2:43 ` memoriaru
0 siblings, 0 replies; 25+ messages in thread
From: memoriaru @ 2026-10-31 2:43 UTC (permalink / raw)
To: netdev
From: Zhang Hewei <memoriaru@foxmail.com>
Confirmed -- the analysis is correct. MXL862XX_API_READ() returns the
firmware result value on success, and a CRC-valid result of 1..1023
comes back as a positive value that passes the `if (ret)` guard,
skipping the bridge_id validation entirely; the callers then store that
positive status in priv->bridges[] because they only test ret < 0.
The same return-value pattern exists at the other ALLOC-style call
sites (QOS_METERALLOC, EXTENDEDVLAN_ALLOC, VLANFILTER_ALLOC).
Planned fix for v4: treat the transport result and the payload id
separately --
if (ret < 0)
return ret;
if (ret > 0) /* firmware reported a non-zero result code */
return -EIO;
and keep the 0/0xffff/in-use validation of br_alloc.bridge_id on the
ret == 0 path. I will cross-check the firmware result-code semantics
against the GSW API documentation before posting v4. The sibling
ALLOC call sites can be cleaned up in the same series if that is
preferred.
pw-bot: cr
Best,
Zhang Hewei
^ permalink raw reply [flat|nested] 25+ messages in thread
* [PATCH net v4 0/3] net: dsa: mxl862xx: bound FDB dump walk and validate BRIDGE_ALLOC ids
@ 2026-10-31 8:18 memoriaru
2026-10-31 8:25 ` netdev-bot+sinfo
0 siblings, 1 reply; 25+ messages in thread
From: memoriaru @ 2026-10-31 8:18 UTC (permalink / raw)
To: netdev; +Cc: daniel, andrew, f.fainelli, olteanv, johan, kuba, pabeni
From: Zhang Hewei <memoriaru@foxmail.com>
Hello,
v4 of the mxl862xx robustness fixes, rebased onto the current net tree
and extended after the sashiko review of v3.
The v2 series did not apply because it carried full copies of
mxl862xx-api.h and mxl862xx.h predating the upstream restructure into
mxl862xx-host.c / mxl862xx-phylink.c; v3 re-ported the two fixes onto
the restructured driver. This version adds a third patch for the
firmware-result handling that the sashiko review of v3 flagged.
New in v4 (patch 3): MXL862XX_API_READ() returns the firmware result
value (>= 0) on success rather than an errno, so a CRC-valid firmware
status of 1..1023 comes back as a positive value that passes
"if (ret)" guards. The ALLOC-style call sites (QOS_METERALLOC,
EXTENDEDVLAN_ALLOC, VLANFILTER_ALLOC) tested the result with
"if (ret) return ret;" and could hand a positive firmware status to
callers that only check ret < 0. Patch 2 additionally splits the
transport result from the payload id inside
mxl862xx_allocate_bridge() so the bridge_id contract checks
(0 / 0xffff / in-use) run on the ret == 0 path only. The firmware
result-code semantics will be cross-checked against the GSW API
documentation; a follow-up can extend the same split to the remaining
API_READ call sites if that is preferred.
v1: https://lore.kernel.org/netdev/tencent_5A7AEC56CDB23A83120519D0C074B592C706@qq.com/
v2: https://lore.kernel.org/netdev/tencent_6030CC520C02054D1B2925AEEF6FA92DC30A@qq.com/
v3: https://lore.kernel.org/netdev/tencent_A40150C474B4D2DDBAEA56D8B20F03130506@qq.com/
Changes since v3:
- patch 2: split transport status from the payload id in
mxl862xx_allocate_bridge() (sashiko review: a positive firmware
status passed "if (ret)" and was stored in priv->bridges[] by
callers testing only ret < 0)
- new patch 3: same split at the QOS_METERALLOC / EXTENDEDVLAN_ALLOC /
VLANFILTER_ALLOC call sites
- rebased onto net (cb284914e); no functional change to patch 1
Changes since v2:
- re-ported both fixes onto the restructured driver; dropped the
mxl862xx-api.h / mxl862xx.h file creations
Changes since v1:
- walk limit checked after the "last" test; "conservative read limit"
wording; BRIDGE_ALLOC validation extended to 0xffff and in-use ids;
Fixes: tags added, self Reported-by dropped
Base-commit: cb284914e749388eef402938bdb3115fe1f6d337
Cc: Daniel Golle <daniel@makrotopia.org> (driver author)
Cc: Andrew Lunn <andrew@lunn.ch>
Cc: Florian Fainelli <f.fainelli@gmail.com>
Cc: Vladimir Oltean <olteanv@gmail.com>
Cc: Johan Hovold <johan@kernel.org>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: netdev@vger.kernel.org
Zhang Hewei (3):
net: dsa: mxl862xx: bound FDB dump walk with a read limit
net: dsa: mxl862xx: validate the bridge id returned by BRIDGE_ALLOC
net: dsa: mxl862xx: do not leak firmware result values at ALLOC call sites
drivers/net/dsa/mxl862xx/mxl862xx.c | 81 +++++++++++++++++++++++---
1 file changed, 78 insertions(+), 3 deletions(-)
--
2.39.5 (Apple Git-154)
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [PATCH net v4 0/3] net: dsa: mxl862xx: bound FDB dump walk and validate BRIDGE_ALLOC ids
2026-10-31 8:18 [PATCH net v4 0/3] net: dsa: mxl862xx: bound FDB dump walk and validate BRIDGE_ALLOC ids memoriaru
@ 2026-10-31 8:25 ` netdev-bot+sinfo
2026-10-31 8:41 ` memoriaru
0 siblings, 1 reply; 25+ messages in thread
From: netdev-bot+sinfo @ 2026-10-31 8:25 UTC (permalink / raw)
To: memoriaru
Cc: netdev, daniel, andrew, f.fainelli, olteanv, johan, kuba, pabeni
Hi!
This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:
- How the issue was discovered, e.g. hit in production, hit during
development, syzbot report, manual code inspection, LLM or static
analysis tool scan.
- Whether the issue was actually triggered, or is only theoretical
(e.g. found by code inspection). If it was triggered please include
the symptoms, like the stack trace or error messages.
Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.
The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: [PATCH net v4 0/3] net: dsa: mxl862xx: bound FDB dump walk and validate BRIDGE_ALLOC ids
2026-10-31 8:25 ` netdev-bot+sinfo
@ 2026-10-31 8:41 ` memoriaru
0 siblings, 0 replies; 25+ messages in thread
From: memoriaru @ 2026-10-31 8:41 UTC (permalink / raw)
To: netdev
From: Zhang Hewei <memoriaru@foxmail.com>
Hi,
Adding the requested information:
How discovered: manual code inspection. We were auditing the
mxl862xx driver's handling of device-controlled API responses
(firmware as a misbehaving party rather than an adversarial one):
the MAC table walk's only exit is the device-set "last" flag, the
returned bridge id is never checked against the values the API
documents as reserved, and the ALLOC-style API_READ call sites
conflate the firmware result value with an errno. Patch 2's
transport/payload split and patch 3 were refined after the sashiko
review of v3 flagged the positive-result path (an LLM review finding,
verified against the driver source).
Triggered: no, theoretical. We have no MxL862xx hardware in hand,
so none of the three issues was exercised on a real device. The FDB
dump loop, the bridge_id gaps, and the firmware-result conflation
were verified by code inspection against the GSW API documentation
(id 0 reserved, INVALID_HANDLE documented but undefined -- 0xffff in
the MaxLinear GSW API). No symptoms to report.
Best,
Zhang Hewei
^ permalink raw reply [flat|nested] 25+ messages in thread
end of thread, other threads:[~2026-10-31 8:42 UTC | newest]
Thread overview: 25+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-31 8:18 [PATCH net v4 0/3] net: dsa: mxl862xx: bound FDB dump walk and validate BRIDGE_ALLOC ids memoriaru
2026-10-31 8:25 ` netdev-bot+sinfo
2026-10-31 8:41 ` memoriaru
[not found] <20261023204006.24923-1-memoriaru@foxmail.com>
2026-10-23 20:40 ` [PATCH net v2 1/2] net: dsa: mxl862xx: bound FDB dump walk with a read limit memoriaru
2026-10-23 20:40 ` [PATCH net v2 2/2] net: dsa: mxl862xx: validate the bridge id returned by BRIDGE_ALLOC memoriaru
[not found] <20261022200434.80182-1-memoriaru@foxmail.com>
2026-10-22 20:04 ` [PATCH net 1/2] net: dsa: mxl862xx: bound FDB dump walk by table capacity memoriaru
2026-10-22 20:07 ` netdev-bot+sinfo
2026-10-22 20:14 ` memoriaru
2026-10-23 20:21 ` netdev-bot+sashiko
2026-10-23 20:32 ` memoriaru
2026-10-22 20:04 ` [PATCH net 2/2] net: dsa: mxl862xx: reject bridge_id 0 from BRIDGE_ALLOC memoriaru
2026-10-23 20:21 ` netdev-bot+sashiko
2026-10-23 20:40 ` [PATCH net v2 0/2] net: dsa: mxl862xx: bound FDB dump walk and validate BRIDGE_ALLOC ids memoriaru
2026-10-23 20:44 ` netdev-bot+sinfo
2026-10-23 21:03 ` memoriaru
2026-10-28 22:44 ` Jakub Kicinski
2026-10-29 11:25 ` [PATCH net v3 " memoriaru
[not found] ` <20261029112528.56652-1-memoriaru@foxmail.com>
2026-10-29 11:25 ` [PATCH net v3 1/2] net: dsa: mxl862xx: bound FDB dump walk with a read limit memoriaru
2026-10-29 11:30 ` netdev-bot+sinfo
2026-10-30 3:33 ` memoriaru
2026-10-30 22:24 ` Jakub Kicinski
2026-10-30 11:28 ` netdev-bot+sashiko
2026-10-29 11:25 ` [PATCH net v3 2/2] net: dsa: mxl862xx: validate the bridge id returned by BRIDGE_ALLOC memoriaru
2026-10-30 11:28 ` netdev-bot+sashiko
2026-10-31 2:43 ` memoriaru
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox