[PATCH net-next 0/2] Allow disabling pause frames on panic

[PATCH net-next 0/2] Allow disabling pause frames on panic

[Florian Fainelli]

This patch set allows disabling pause frame generation upon encountering
a kernel panic. This has proven to be helpful in lab environments where
devices are still being worked on, will panic for various reasons, and
will occasionally take down the entire Ethernet switch they are attached
to.

Florian Fainelli (2):
  net: ethernet: Allow disabling pause on panic
  net: bcmgenet: Support calling set_pauseparam from panic context

 Documentation/ABI/testing/sysfs-class-net    | 16 ++++
 drivers/net/ethernet/broadcom/genet/bcmmii.c |  9 +-
 include/linux/netdevice.h                    |  1 +
 net/core/net-sysfs.c                         | 34 +++++++
 net/ethernet/Makefile                        |  3 +-
 net/ethernet/pause_panic.c                   | 95 ++++++++++++++++++++
 6 files changed, 154 insertions(+), 4 deletions(-)
 create mode 100644 net/ethernet/pause_panic.c

-- 
2.34.1

[PATCH net-next 1/2] net: ethernet: Allow disabling pause on panic

[Florian Fainelli]

Development devices on a lab network might be subject to kernel panics
and if they have pause frame generation enabled, once the kernel panics,
the Ethernet controller stops being serviced. This can create a flood of
pause frames that certain switches are unable to handle resulting a
completle paralysis of the network.

To accomodate for such situation introduce a
/sys/class/net/<device>/disable_pause_on_panic knob which will disable
Ethernet pause frame generation upon kernel panic.

Note that device driver wishing to make use of that feature need to be
mindful of the fact that ethtool_ops::set_pauseparam may now be called
from atomic context.

Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 Documentation/ABI/testing/sysfs-class-net | 16 ++++
 include/linux/netdevice.h                 |  1 +
 net/core/net-sysfs.c                      | 34 ++++++++
 net/ethernet/Makefile                     |  3 +-
 net/ethernet/pause_panic.c                | 95 +++++++++++++++++++++++
 5 files changed, 148 insertions(+), 1 deletion(-)
 create mode 100644 net/ethernet/pause_panic.c

diff --git a/Documentation/ABI/testing/sysfs-class-net b/Documentation/ABI/testing/sysfs-class-net
index ebf21beba846..f762ce439203 100644
--- a/Documentation/ABI/testing/sysfs-class-net
+++ b/Documentation/ABI/testing/sysfs-class-net
@@ -352,3 +352,19 @@ Description:
 		0  threaded mode disabled for this dev
 		1  threaded mode enabled for this dev
 		== ==================================
+
+What:		/sys/class/net/<iface>/disable_pause_on_panic
+Date:		Nov 2025
+KernelVersion:	6.20
+Contact:	netdev@vger.kernel.org
+Description:
+		Boolean value to control whether to disable pause frame
+		generation on panic. This is helpful in environments where
+		the link partner may incorrect respond to pause frames (e.g.:
+		improperly configured Ethernet switches)
+
+		Possible values:
+		== ==================================
+		0  threaded mode disabled for this dev
+		1  threaded mode enabled for this dev
+		== ==================================
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 9c1e5042c5e7..7af0944aada2 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2439,6 +2439,7 @@ struct net_device {
 	bool			proto_down;
 	bool			irq_affinity_auto;
 	bool			rx_cpu_rmap_auto;
+	bool			disable_pause_on_panic;
 
 	/* priv_flags_slow, ungrouped to save space */
 	unsigned long		see_all_hwtstamp_requests:1;
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index ca878525ad7c..c01dc3e200d8 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -770,6 +770,39 @@ static ssize_t threaded_store(struct device *dev,
 }
 static DEVICE_ATTR_RW(threaded);
 
+static ssize_t disable_pause_on_panic_show(struct device *dev,
+					    struct device_attribute *attr,
+					    char *buf)
+{
+	struct net_device *ndev = to_net_dev(dev);
+	ssize_t ret = -EINVAL;
+
+	rcu_read_lock();
+	if (dev_isalive(ndev))
+		ret = sysfs_emit(buf, fmt_dec, READ_ONCE(ndev->disable_pause_on_panic));
+	rcu_read_unlock();
+
+	return ret;
+}
+
+static int modify_disable_pause_on_panic(struct net_device *dev, unsigned long val)
+{
+	if (val != 0 && val != 1)
+		return -EINVAL;
+
+	WRITE_ONCE(dev->disable_pause_on_panic, val);
+
+	return 0;
+}
+
+static ssize_t disable_pause_on_panic_store(struct device *dev,
+					     struct device_attribute *attr,
+					     const char *buf, size_t len)
+{
+	return netdev_store(dev, attr, buf, len, modify_disable_pause_on_panic);
+}
+static DEVICE_ATTR_RW(disable_pause_on_panic);
+
 static struct attribute *net_class_attrs[] __ro_after_init = {
 	&dev_attr_netdev_group.attr,
 	&dev_attr_type.attr,
@@ -800,6 +833,7 @@ static struct attribute *net_class_attrs[] __ro_after_init = {
 	&dev_attr_carrier_up_count.attr,
 	&dev_attr_carrier_down_count.attr,
 	&dev_attr_threaded.attr,
+	&dev_attr_disable_pause_on_panic.attr,
 	NULL,
 };
 ATTRIBUTE_GROUPS(net_class);
diff --git a/net/ethernet/Makefile b/net/ethernet/Makefile
index e03eff94e0db..9b1f3ff8695a 100644
--- a/net/ethernet/Makefile
+++ b/net/ethernet/Makefile
@@ -3,4 +3,5 @@
 # Makefile for the Linux Ethernet layer.
 #
 
-obj-y					+= eth.o
+obj-y					+= eth.o \
+					   pause_panic.o
diff --git a/net/ethernet/pause_panic.c b/net/ethernet/pause_panic.c
new file mode 100644
index 000000000000..ed859b443b00
--- /dev/null
+++ b/net/ethernet/pause_panic.c
@@ -0,0 +1,95 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Ethernet pause disable on panic handler
+ *
+ * This module provides per-device control via sysfs to disable Ethernet flow
+ * control (pause frames) on individual Ethernet devices when the kernel panics.
+ * Each device can be configured via /sys/class/net/<device>/disable_pause_on_panic.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/panic_notifier.h>
+#include <linux/netdevice.h>
+#include <linux/ethtool.h>
+#include <linux/notifier.h>
+#include <linux/if_ether.h>
+#include <net/net_namespace.h>
+
+/*
+ * Disable pause/flow control on a single Ethernet device.
+ * This is called from panic context, so we cannot sleep.
+ * We try to call set_pauseparam, but if it would require sleeping,
+ * we skip the device rather than risk deadlock.
+ */
+static void disable_pause_on_device(struct net_device *dev)
+{
+	struct ethtool_pauseparam pause = { };
+	const struct ethtool_ops *ops;
+
+	/* Only proceed if this device has the flag enabled */
+	if (!READ_ONCE(dev->disable_pause_on_panic))
+		return;
+
+	ops = dev->ethtool_ops;
+	if (!ops || !ops->set_pauseparam)
+		return;
+
+	/* Prepare pause parameters to disable flow control */
+	pause.autoneg = 0;
+	pause.rx_pause = 0;
+	pause.tx_pause = 0;
+
+	/*
+	 * In panic context, we're in atomic context and cannot sleep.
+	 * We try to call set_pauseparam directly. If it would sleep,
+	 * that's a driver bug, but we proceed anyway since we're panicking.
+	 * The driver's set_pauseparam implementation should ideally handle
+	 * atomic context, but if it doesn't, we can't do much about it
+	 * during a panic.
+	 */
+	ops->set_pauseparam(dev, &pause);
+}
+
+/*
+ * Panic notifier to disable pause frames on all Ethernet devices.
+ * Called in atomic context during kernel panic.
+ */
+static int eth_pause_panic_handler(struct notifier_block *this,
+					unsigned long event, void *ptr)
+{
+	struct net_device *dev;
+
+	/*
+	 * Iterate over all network devices in the init namespace.
+	 * In panic context, we cannot acquire locks that might sleep,
+	 * so we use RCU iteration.
+	 * Each device will check its own disable_pause_on_panic flag.
+	 */
+	rcu_read_lock();
+	for_each_netdev_rcu(&init_net, dev) {
+		/* Reference count might not be available in panic */
+		if (!dev)
+			continue;
+
+		disable_pause_on_device(dev);
+	}
+	rcu_read_unlock();
+
+	return NOTIFY_DONE;
+}
+
+static struct notifier_block eth_pause_panic_notifier = {
+	.notifier_call = eth_pause_panic_handler,
+	.priority = INT_MAX, /* Run as late as possible */
+};
+
+static int __init eth_pause_panic_init(void)
+{
+	/* Register panic notifier */
+	atomic_notifier_chain_register(&panic_notifier_list,
+				       &eth_pause_panic_notifier);
+
+	return 0;
+}
+device_initcall(eth_pause_panic_init);
-- 
2.34.1

Re: [PATCH net-next 1/2] net: ethernet: Allow disabling pause on panic

[Andrew Lunn]

> +	/*
> +	 * In panic context, we're in atomic context and cannot sleep.
> +	 * We try to call set_pauseparam directly. If it would sleep,
> +	 * that's a driver bug, but we proceed anyway since we're panicking.
> +	 * The driver's set_pauseparam implementation should ideally handle
> +	 * atomic context, but if it doesn't, we can't do much about it
> +	 * during a panic.
> +	 */
> +	ops->set_pauseparam(dev, &pause);

I'm not sure i like that. Many driver writers get pause wrong. I've
been encouraging them to use phylink, since it does all the business
logic for them. There are around 18 drivers doing this. They are
likely to first get a splat from ASSERT_RTNL() and then hit a
mutex_lock()/unlock.

Could you take a look at phylink_ethtool_set_pauseparam(), and if we
are in a panic context, at minimum turn it into a NOP?

    Andrew

[PATCH net-next 2/2] net: bcmgenet: Support calling set_pauseparam from panic context

[Florian Fainelli]

Avoid making sleeping calls that would not be able to complete the MMIO
writes ignoring pause frame reception and generation at the Ethernet MAC
controller level.

Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 drivers/net/ethernet/broadcom/genet/bcmmii.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index 38f854b94a79..de7156b5ecf7 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -75,7 +75,8 @@ static void bcmgenet_mac_config(struct net_device *dev)
 	reg |= RGMII_LINK;
 	bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);
 
-	spin_lock_bh(&priv->reg_lock);
+	if (!panic_in_progress())
+		spin_lock_bh(&priv->reg_lock);
 	reg = bcmgenet_umac_readl(priv, UMAC_CMD);
 	reg &= ~((CMD_SPEED_MASK << CMD_SPEED_SHIFT) |
 		       CMD_HD_EN |
@@ -88,7 +89,8 @@ static void bcmgenet_mac_config(struct net_device *dev)
 		reg |= CMD_TX_EN | CMD_RX_EN;
 	}
 	bcmgenet_umac_writel(priv, reg, UMAC_CMD);
-	spin_unlock_bh(&priv->reg_lock);
+	if (!panic_in_progress())
+		spin_unlock_bh(&priv->reg_lock);
 
 	active = phy_init_eee(phydev, 0) >= 0;
 	bcmgenet_eee_enable_set(dev,
@@ -139,7 +141,8 @@ void bcmgenet_phy_pause_set(struct net_device *dev, bool rx, bool tx)
 	linkmode_mod_bit(ETHTOOL_LINK_MODE_Pause_BIT, phydev->advertising, rx);
 	linkmode_mod_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT, phydev->advertising,
 			 rx | tx);
-	phy_start_aneg(phydev);
+	if (!panic_in_progress())
+		phy_start_aneg(phydev);
 
 	mutex_lock(&phydev->lock);
 	if (phydev->link)
-- 
2.34.1

Re: [PATCH net-next 2/2] net: bcmgenet: Support calling set_pauseparam from panic context

[Andrew Lunn]

> @@ -139,7 +141,8 @@ void bcmgenet_phy_pause_set(struct net_device *dev, bool rx, bool tx)
>  	linkmode_mod_bit(ETHTOOL_LINK_MODE_Pause_BIT, phydev->advertising, rx);
>  	linkmode_mod_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT, phydev->advertising,
>  			 rx | tx);
> -	phy_start_aneg(phydev);
> +	if (!panic_in_progress())
> +		phy_start_aneg(phydev);


That does not look correct. If pause autoneg is off, there is no need
to trigger an autoneg.

This all looks pretty messy.

Maybe rather than overload set_pauseparams, maybe add a new ethtool
call to force pause off?

It looks like it would be something like:

struct bcmgenet_priv *priv = netdev_priv(dev);
u32 reg;

reg = bcmgenet_umac_readl(priv, UMAC_CMD);
reg &= ~(CMD_RX_PAUSE_IGNORE| CMD_TX_PAUSE_IGNORE);
bcmgenet_umac_writel(priv, reg, UMAC_CMD);

	Andrew

Re: [PATCH net-next 2/2] net: bcmgenet: Support calling set_pauseparam from panic context

[Florian Fainelli]

On 11/3/25 14:19, Andrew Lunn wrote:
>> @@ -139,7 +141,8 @@ void bcmgenet_phy_pause_set(struct net_device *dev, bool rx, bool tx)
>>   	linkmode_mod_bit(ETHTOOL_LINK_MODE_Pause_BIT, phydev->advertising, rx);
>>   	linkmode_mod_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT, phydev->advertising,
>>   			 rx | tx);
>> -	phy_start_aneg(phydev);
>> +	if (!panic_in_progress())
>> +		phy_start_aneg(phydev);
> 
> 
> That does not look correct. If pause autoneg is off, there is no need
> to trigger an autoneg.
> 
> This all looks pretty messy.

That is pre-existing code, so it would be a separate path in order to 
fix, though point taken.

> 
> Maybe rather than overload set_pauseparams, maybe add a new ethtool
> call to force pause off?

Yes, I like that idea, that way it is clear which drivers support 
disabling pause from a panic context.

> 
> It looks like it would be something like:
> 
> struct bcmgenet_priv *priv = netdev_priv(dev);
> u32 reg;
> 
> reg = bcmgenet_umac_readl(priv, UMAC_CMD);
> reg &= ~(CMD_RX_PAUSE_IGNORE| CMD_TX_PAUSE_IGNORE);
> bcmgenet_umac_writel(priv, reg, UMAC_CMD);

Yes, that is essentially what needs to be done.

Thanks!
-- 
Florian

Re: [PATCH net-next 2/2] net: bcmgenet: Support calling set_pauseparam from panic context

[Andrew Lunn]

On Mon, Nov 03, 2025 at 03:00:21PM -0800, Florian Fainelli wrote:
> On 11/3/25 14:19, Andrew Lunn wrote:
> > > @@ -139,7 +141,8 @@ void bcmgenet_phy_pause_set(struct net_device *dev, bool rx, bool tx)
> > >   	linkmode_mod_bit(ETHTOOL_LINK_MODE_Pause_BIT, phydev->advertising, rx);
> > >   	linkmode_mod_bit(ETHTOOL_LINK_MODE_Asym_Pause_BIT, phydev->advertising,
> > >   			 rx | tx);
> > > -	phy_start_aneg(phydev);
> > > +	if (!panic_in_progress())
> > > +		phy_start_aneg(phydev);
> > 
> > 
> > That does not look correct. If pause autoneg is off, there is no need
> > to trigger an autoneg.
> > 
> > This all looks pretty messy.
> 
> That is pre-existing code, so it would be a separate path in order to fix,
> though point taken.

Yes, i just noticed it in passing, a separate issue.

And by messy, i was meaning all the conditional locks. A new ethtool
op would avoid all that, and the new op is also really simple.

	Andrew

Re: [PATCH net-next 0/2] Allow disabling pause frames on panic

[Jakub Kicinski]

On Mon,  3 Nov 2025 11:46:29 -0800 Florian Fainelli wrote:
> This patch set allows disabling pause frame generation upon encountering
> a kernel panic. This has proven to be helpful in lab environments where
> devices are still being worked on, will panic for various reasons, and
> will occasionally take down the entire Ethernet switch they are attached
> to.

Could you explain in more detail? What does it mean that a pause frame
takes down an Ethernet switch?

Re: [PATCH net-next 0/2] Allow disabling pause frames on panic

[Florian Fainelli]

On 11/3/25 15:22, Jakub Kicinski wrote:
> On Mon,  3 Nov 2025 11:46:29 -0800 Florian Fainelli wrote:
>> This patch set allows disabling pause frame generation upon encountering
>> a kernel panic. This has proven to be helpful in lab environments where
>> devices are still being worked on, will panic for various reasons, and
>> will occasionally take down the entire Ethernet switch they are attached
>> to.
> 
> Could you explain in more detail? What does it mean that a pause frame
> takes down an Ethernet switch?

One of our devices crashed and kept on sending pause frames to its link 
partner which is an Ethernet router. Rather than continue to forward 
traffic between other LAN ports and Wi-Fi, that router just stopped 
doing that and the other devices were frozen. I don't have the exact 
model yet because this was on a different site/team but I will try to 
get that. This should obviously be treated as a router bug and its 
firmware should be updated, if there is an update available.

I have seen it happen a bunch of times at home as well with an unmanaged 
5-port TP-Link switch and a crashed laptop.
-- 
Florian