* [PATCH net-next 09/12] gpio: tc956x: add TC956x/QPS615 support
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: daniel, elder, mohd.anwar, a0987203069, alexandre.torgue, ast,
boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk, hkallweit1,
inochiama, john.fastabend, julianbraha, livelycarpet87,
matthew.gerlach, mcoquelin.stm32, me, prabhakar.mahadev-lad.rj,
richardcochran, rohan.g.thomas, sdf, siyanteng, weishangjuan,
wens, netdev, bpf, linux-arm-msm, devicetree, linux-gpio,
linux-stm32, linux-arm-kernel, linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
Toshiba TC956x is an Ethernet-AVB/TSN bridge and is essentially
a small and highly-specialized SoC. TC956x includes a GPIO block that
can be accessed, alongside several other peripherals, via two PCIe
endpoint functions. The PCIe function driver creates an auxiliary
device for the GPIO block, and that device gets bound to this auxiliary
device driver.
Co-developed-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
drivers/gpio/Kconfig | 11 ++
drivers/gpio/Makefile | 1 +
drivers/gpio/gpio-tc956x.c | 209 +++++++++++++++++++++++++++++++++++++
3 files changed, 221 insertions(+)
create mode 100644 drivers/gpio/gpio-tc956x.c
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 020e51e30317a..746cedea7e91d 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -1646,6 +1646,17 @@ config GPIO_TC3589X
This enables support for the GPIOs found on the TC3589X
I/O Expander.
+config GPIO_TC956X
+ tristate "Toshiba TC956X GPIO support"
+ depends on TOSHIBA_TC956X_PCI
+ default m if TOSHIBA_TC956X_PCI
+ help
+ This enables support for the GPIO controller embedded in the Toshiba
+ TC956X (and Qualcomm QPS615). This device connects to the host
+ via PCIe port, which is the upstream port on an internal PCIe
+ switch. On some platforms, a few of the GPIO lines are used to
+ manage external resets.
+
config GPIO_TIMBERDALE
bool "Support for timberdale GPIO IP"
depends on MFD_TIMBERDALE
diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
index b267598b517de..c3584e7cba9b4 100644
--- a/drivers/gpio/Makefile
+++ b/drivers/gpio/Makefile
@@ -178,6 +178,7 @@ obj-$(CONFIG_GPIO_SYSCON) += gpio-syscon.o
obj-$(CONFIG_GPIO_TANGIER) += gpio-tangier.o
obj-$(CONFIG_GPIO_TB10X) += gpio-tb10x.o
obj-$(CONFIG_GPIO_TC3589X) += gpio-tc3589x.o
+obj-$(CONFIG_GPIO_TC956X) += gpio-tc956x.o
obj-$(CONFIG_GPIO_TEGRA186) += gpio-tegra186.o
obj-$(CONFIG_GPIO_TEGRA) += gpio-tegra.o
obj-$(CONFIG_GPIO_THUNDERX) += gpio-thunderx.o
diff --git a/drivers/gpio/gpio-tc956x.c b/drivers/gpio/gpio-tc956x.c
new file mode 100644
index 0000000000000..12221d8f812d9
--- /dev/null
+++ b/drivers/gpio/gpio-tc956x.c
@@ -0,0 +1,209 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright (C) 2026 by RISCstar Solutions Corporation. All rights reserved.
+ */
+
+/*
+ * The Toshiba TC956X implements a PCIe Gen 3 switch that connects an
+ * upstream x4 port to two downstream PCIe x2 ports. It incorporates
+ * an internal endpoint on a internal PCIe port that implements two
+ * Synopsys XGMAC Ethernet interfaces.
+ *
+ * 35 GPIOs are also implemented by an embedded GPIO controller. Three
+ * registers control the first 32 GPIOs (other than 20 and 21, which are
+ * reserved). Three other registers control GPIOs 32 through 36. GPIOs
+ * 22-24, 27-28, 31, and 34 are treated as "input only".
+ *
+ * There is a TC956X PCI power controller driver that accesses the
+ * direction and output value registers for GPIOs 2 and 3. These
+ * GPIOs control the reset signal for the two downstream PCIe ports.
+ * Their values will never change during operation of this driver, and
+ * this driver reserves these two GPIOS.
+ */
+
+#include <linux/auxiliary_bus.h>
+#include <linux/dev_printk.h>
+#include <linux/gpio/driver.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+
+#define DRIVER_NAME "tc956x-gpio"
+
+#define TC956X_GPIO_COUNT 37 /* Number of GPIOs (20-21 reserved) */
+
+/* The GPIO offsets are relative to 0x1200 in TC956X SFR space */
+#define GPIO_IN0_OFFSET 0x00 /* Input value (0-31) */
+#define GPIO_EN0_OFFSET 0x08 /* 0: out; 1: in (0-31) */
+#define GPIO_OUT0_OFFSET 0x10 /* Output value (0-31) */
+
+#define GPIO_IN1_OFFSET 0x04 /* Input value (32-36) */
+#define GPIO_EN1_OFFSET 0x0c /* 0: out; 1: in (32-36) */
+#define GPIO_OUT1_OFFSET 0x14 /* Output value (32-36) */
+
+/*
+ * struct tc956x_gpio - Information related to the embedded GPIO controller
+ * @chip: GPIO chip structure
+ * @regmap: MMIO register map for SFR GPIO region access
+ * @input_only: Bitmap indicating which GPIOs are input-only
+ */
+struct tc956x_gpio {
+ struct gpio_chip chip;
+ struct regmap *regmap;
+ DECLARE_BITMAP(input_only, TC956X_GPIO_COUNT);
+};
+
+static int tc956x_gpio_get_direction(struct gpio_chip *gc, unsigned int offset)
+{
+ struct tc956x_gpio *gpio = gpiochip_get_data(gc);
+ u32 reg;
+ u32 val;
+
+ if (test_bit(offset, gpio->input_only))
+ return GPIO_LINE_DIRECTION_IN;
+
+ reg = offset < 32 ? GPIO_EN0_OFFSET : GPIO_EN1_OFFSET;
+
+ regmap_read(gpio->regmap, reg, &val);
+ if (val & BIT(offset % 32))
+ return GPIO_LINE_DIRECTION_IN;
+
+ return GPIO_LINE_DIRECTION_OUT;
+}
+
+static int tc956x_gpio_direction_input(struct gpio_chip *gc,
+ unsigned int offset)
+{
+ u32 reg = offset < 32 ? GPIO_EN0_OFFSET : GPIO_EN1_OFFSET;
+ struct tc956x_gpio *gpio = gpiochip_get_data(gc);
+ u32 mask = BIT(offset % 32);
+
+ return regmap_update_bits(gpio->regmap, reg, mask, mask);
+}
+
+static int tc956x_gpio_direction_output(struct gpio_chip *gc,
+ unsigned int offset, int value)
+{
+ struct tc956x_gpio *gpio = gpiochip_get_data(gc);
+ u32 vreg;
+ u32 dreg;
+ u32 mask;
+
+ if (test_bit(offset, gpio->input_only))
+ return -EINVAL;
+
+ if (offset < 32) {
+ vreg = GPIO_OUT0_OFFSET;
+ dreg = GPIO_EN0_OFFSET;
+ } else {
+ vreg = GPIO_OUT1_OFFSET;
+ dreg = GPIO_EN1_OFFSET;
+ }
+ mask = BIT(offset % 32);
+
+ /* Set output value first, then direction */
+ regmap_update_bits(gpio->regmap, vreg, mask, value ? mask : 0);
+
+ return regmap_update_bits(gpio->regmap, dreg, mask, 0);
+}
+
+static int tc956x_gpio_get(struct gpio_chip *gc, unsigned int offset)
+{
+ u32 reg = offset < 32 ? GPIO_IN0_OFFSET : GPIO_IN1_OFFSET;
+ struct tc956x_gpio *gpio = gpiochip_get_data(gc);
+ u32 val;
+
+ regmap_read(gpio->regmap, reg, &val);
+
+ return val & BIT(offset % 32) ? 1 : 0;
+}
+
+static int tc956x_gpio_set(struct gpio_chip *gc, unsigned int offset, int value)
+{
+ u32 reg = offset < 32 ? GPIO_OUT0_OFFSET : GPIO_OUT1_OFFSET;
+ struct tc956x_gpio *gpio = gpiochip_get_data(gc);
+ u32 mask = BIT(offset % 32);
+
+ return regmap_update_bits(gpio->regmap, reg, mask, value ? mask : 0);
+}
+
+static int tc956x_gpio_init_valid_mask(struct gpio_chip *gc,
+ unsigned long *valid_mask,
+ unsigned int ngpios)
+{
+ /*
+ * GPIOs 2 and 3 are used by the PCI power control driver, and
+ * we don't allow them to be used. GPIOs 20 and 21 are reserved
+ * (and not usable).
+ */
+ bitmap_fill(valid_mask, ngpios);
+ bitmap_clear(valid_mask, 2, 2);
+ bitmap_clear(valid_mask, 20, 2);
+
+ return 0;
+}
+
+static int tc956x_gpio_probe(struct auxiliary_device *adev,
+ const struct auxiliary_device_id *id)
+{
+ struct device *dev = &adev->dev;
+ struct tc956x_gpio *gpio;
+ struct gpio_chip *gc;
+
+ if (!dev->platform_data)
+ return -EINVAL;
+
+ gpio = devm_kzalloc(dev, sizeof(*gpio), GFP_KERNEL);
+ if (!gpio)
+ return -ENOMEM;
+ gpio->regmap = dev->platform_data;
+
+ /* Mark GPIOs 22, 23, 24, 27, 28, 31, and 34 as input only */
+ bitmap_set(gpio->input_only, 22, 3);
+ bitmap_set(gpio->input_only, 27, 2);
+ set_bit(31, gpio->input_only);
+ set_bit(34, gpio->input_only);
+
+ gc = &gpio->chip;
+
+ gc->label = DRIVER_NAME;
+ gc->parent = dev->parent;
+
+ gc->get_direction = tc956x_gpio_get_direction;
+ gc->direction_input = tc956x_gpio_direction_input;
+ gc->direction_output = tc956x_gpio_direction_output;
+ gc->get = tc956x_gpio_get;
+ gc->set = tc956x_gpio_set;
+ gc->init_valid_mask = tc956x_gpio_init_valid_mask;
+
+ gc->base = -1;
+ gc->ngpio = TC956X_GPIO_COUNT;
+ gc->can_sleep = false;
+
+ dev_set_drvdata(dev, gpio);
+
+ return devm_gpiochip_add_data(dev, gc, gpio);
+}
+
+static const struct auxiliary_device_id tc956x_gpio_ids[] = {
+ { .name = "tc956x_pci.tc9564-gpio", },
+ { }
+};
+MODULE_DEVICE_TABLE(auxiliary, tc956x_gpio_ids);
+
+static struct auxiliary_driver tc956x_gpio_driver = {
+ .name = DRIVER_NAME,
+ .probe = tc956x_gpio_probe,
+ .id_table = tc956x_gpio_ids,
+ .driver = {
+ .name = DRIVER_NAME,
+ .owner = THIS_MODULE,
+ .probe_type = PROBE_PREFER_ASYNCHRONOUS,
+ },
+};
+module_auxiliary_driver(tc956x_gpio_driver);
+
+MODULE_DESCRIPTION("Toshiba TC956X PCIe GPIO Driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("auxiliary:" DRIVER_NAME);
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 08/12] dt-bindings: net: toshiba,tc965x-dwmac: add TC956x Ethernet bridge
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: Daniel Thompson, elder, mohd.anwar, a0987203069, alexandre.torgue,
ast, boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk,
hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
From: Daniel Thompson <daniel@riscstar.com>
Add devicetree bindings for the Toshiba TC956x family of Ethernet-AVB/TSN
bridges.
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
.../bindings/net/toshiba,tc956x-dwmac.yaml | 111 ++++++++++++++++++
1 file changed, 111 insertions(+)
create mode 100644 Documentation/devicetree/bindings/net/toshiba,tc956x-dwmac.yaml
diff --git a/Documentation/devicetree/bindings/net/toshiba,tc956x-dwmac.yaml b/Documentation/devicetree/bindings/net/toshiba,tc956x-dwmac.yaml
new file mode 100644
index 0000000000000..d95d22a3761da
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/toshiba,tc956x-dwmac.yaml
@@ -0,0 +1,111 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/net/toshiba,tc956x-dwmac.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Toshiba TC956x Ethernet-AVB/TSN Controller
+
+maintainers:
+ - Alex Elder <elder@riscstar.com>
+ - Daniel Thompson <daniel@riscstar.com>
+
+description: |
+ This node provides properties for configuring the Ethernet PCI functions
+ that are attached to the internal downstream port of the TC956x's PCIe
+ switch.
+
+ TC956x are a family of Ethernet-AVB/TSN bridge chips that combine a PCIe
+ switch together with a number of Ethernet controllers. These bindings
+ cover only the Ethernet functions of these devices.
+
+allOf:
+ - $ref: /schemas/pci/pci-bus-common.yaml#
+ - $ref: /schemas/pci/pci-device.yaml#
+
+unevaluatedProperties: false
+
+properties:
+ compatible:
+ enum:
+ - pci1179,0220 # Toshiba TC9564 (a.k.a. Qualcomm QPS615)
+
+ "#gpio-cells":
+ const: 2
+
+ gpio-controller: true
+
+ # We can't allOf reference Ethernet-controller.yaml because we end up with
+ # contradictory $nodename rules (`ethernet@` versus `pci@`). Happily only a
+ # small number of the properties are useful on TC956x so we can just reference
+ # what we need.
+ phy-connection-type:
+ $ref: ethernet-controller.yaml#/properties/phy-connection-type
+
+ phy-handle:
+ $ref: ethernet-controller.yaml#/properties/phy-handle
+
+ phy-mode:
+ $ref: ethernet-controller.yaml#/properties/phy-mode
+
+ mdio:
+ $ref: snps,dwmac.yaml#/properties/mdio
+
+required:
+ - compatible
+ - reg
+
+examples:
+ - |
+ pcie {
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+ tc956x_emac0: pci@0,0 {
+ compatible = "pci1179,0220";
+ reg = <0x50000 0x0 0x0 0x0 0x0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+ device_type = "pci";
+ ranges;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+
+ phy-mode = "10gbase-r";
+ phy-handle = <&tc956x_emac0_phy>;
+
+ mdio {
+ compatible = "snps,dwmac-mdio";
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ tc956x_emac0_phy: ethernet-phy@1c {
+ compatible = "ethernet-phy-id311c.1c12";
+ reg = <0x1c>;
+ };
+ };
+ };
+ pci@0,1 {
+ compatible = "pci1179,0220";
+ reg = <0x50100 0x0 0x0 0x0 0x0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+ device_type = "pci";
+ ranges;
+
+ phy-mode = "sgmii";
+ phy-handle = <&tc956x_emac1_phy>;
+
+ mdio {
+ compatible = "snps,dwmac-mdio";
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ tc956x_emac1_phy: ethernet-phy@1c {
+ compatible = "ethernet-phy-id004d.d101";
+ reg = <0x1c>;
+ };
+ };
+ };
+ };
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 07/12] net: stmmac: dwxgmac2: export symbols for XGMAC 3.01a DMA
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: Daniel Thompson, elder, mohd.anwar, a0987203069, alexandre.torgue,
ast, boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk,
hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
From: Daniel Thompson <daniel@riscstar.com>
Toshiba TC956x is an Ethernet-AVB/TSN bridge and is essentially a
small-and-highly-specialised SoC. Ethernet on this chip is provided
by a DesignWare XGMAC.
One consequence of the SoC-like design is that the internal AXI bus
(used by the XGMAC for DMA) maps the PCI DMA space with a non-zero base
address. This requires a translation step (happily just simple addition)
to convert the PCI DMA address to the hardware DMA address.
This is pretty funky so rather than push that translation logic into
the core driver we intend to keep that logic inside the TC956x
platform code. In order to do that we need to export a few symbols
to allow us to override some of the DMA and descriptor op tables.
FWIW this approach to overriding the ops tables is similar to the
mechanism currently found in dwmac-loongson.c (with the exception
that we have also exported a couple of functions so we don't
have to replicate their content in the TC956x platform code).
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 7 +++++++
.../ethernet/stmicro/stmmac/dwxgmac2_core.c | 1 +
.../ethernet/stmicro/stmmac/dwxgmac2_descs.c | 1 +
.../net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 18 ++++++++++--------
4 files changed, 19 insertions(+), 8 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
index bcf59ad8a1939..8cecde1bef8a1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
@@ -468,4 +468,11 @@ extern const struct stmmac_dma_ops dwxgmac210_dma_ops;
extern const struct stmmac_dma_ops dwxgmac301_dma_ops;
extern const struct stmmac_desc_ops dwxgmac210_desc_ops;
+void dwxgmac2_dma_init_rx_chan(struct stmmac_priv *priv, void __iomem *ioaddr,
+ struct stmmac_dma_cfg *dma_cfg, dma_addr_t phy,
+ u32 chan);
+void dwxgmac2_dma_init_tx_chan(struct stmmac_priv *priv, void __iomem *ioaddr,
+ struct stmmac_dma_cfg *dma_cfg, dma_addr_t phy,
+ u32 chan);
+
#endif /* __STMMAC_DWXGMAC2_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
index f02b434bbd505..c9547dc6912a3 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
@@ -1556,6 +1556,7 @@ int dwxgmac2_setup(struct stmmac_priv *priv)
return 0;
}
+EXPORT_SYMBOL_GPL(dwxgmac2_setup);
int dwxlgmac2_setup(struct stmmac_priv *priv)
{
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
index b5f200a874840..cc67d8e1a920a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
@@ -368,3 +368,4 @@ const struct stmmac_desc_ops dwxgmac210_desc_ops = {
.set_vlan = dwxgmac2_set_vlan,
.set_tbs = dwxgmac2_set_tbs,
};
+EXPORT_SYMBOL_GPL(dwxgmac210_desc_ops);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
index dc2897e9931d1..ec365e66276f1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
@@ -62,10 +62,10 @@ static void dwxgmac2_dma_init_chan(struct stmmac_priv *priv,
writel(XGMAC_DMA_INT_DEFAULT_EN, ioaddr + XGMAC_DMA_CH_INT_EN(chan));
}
-static void dwxgmac2_dma_init_rx_chan(struct stmmac_priv *priv,
- void __iomem *ioaddr,
- struct stmmac_dma_cfg *dma_cfg,
- dma_addr_t phy, u32 chan)
+void dwxgmac2_dma_init_rx_chan(struct stmmac_priv *priv,
+ void __iomem *ioaddr,
+ struct stmmac_dma_cfg *dma_cfg,
+ dma_addr_t phy, u32 chan)
{
u32 rxpbl = dma_cfg->rxpbl ?: dma_cfg->pbl;
u32 value;
@@ -77,11 +77,11 @@ static void dwxgmac2_dma_init_rx_chan(struct stmmac_priv *priv,
writel(upper_32_bits(phy), ioaddr + XGMAC_DMA_CH_RxDESC_HADDR(chan));
writel(lower_32_bits(phy), ioaddr + XGMAC_DMA_CH_RxDESC_LADDR(chan));
}
+EXPORT_SYMBOL_GPL(dwxgmac2_dma_init_rx_chan);
-static void dwxgmac2_dma_init_tx_chan(struct stmmac_priv *priv,
- void __iomem *ioaddr,
- struct stmmac_dma_cfg *dma_cfg,
- dma_addr_t phy, u32 chan)
+void dwxgmac2_dma_init_tx_chan(struct stmmac_priv *priv, void __iomem *ioaddr,
+ struct stmmac_dma_cfg *dma_cfg, dma_addr_t phy,
+ u32 chan)
{
u32 txpbl = dma_cfg->txpbl ?: dma_cfg->pbl;
u32 value;
@@ -93,6 +93,7 @@ static void dwxgmac2_dma_init_tx_chan(struct stmmac_priv *priv,
writel(upper_32_bits(phy), ioaddr + XGMAC_DMA_CH_TxDESC_HADDR(chan));
writel(lower_32_bits(phy), ioaddr + XGMAC_DMA_CH_TxDESC_LADDR(chan));
}
+EXPORT_SYMBOL_GPL(dwxgmac2_dma_init_tx_chan);
static void dwxgmac2_dma_axi(void __iomem *ioaddr, struct stmmac_axi *axi)
{
@@ -671,3 +672,4 @@ const struct stmmac_dma_ops dwxgmac301_dma_ops = {
.enable_sph = dwxgmac2_enable_sph,
.enable_tbs = dwxgmac2_enable_tbs,
};
+EXPORT_SYMBOL_GPL(dwxgmac301_dma_ops);
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 06/12] net: stmmac: dwxgmac2: Add XGMAC 3.01a support
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: Daniel Thompson, elder, mohd.anwar, a0987203069, alexandre.torgue,
ast, boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk,
hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
From: Daniel Thompson <daniel@riscstar.com>
XGMAC 2.x and 3.x are architecturally very similar. That means that
for everything except one erratum we can simply use the XGMAC 2.x
callback functions in the stmmac_dma_ops structure.
Only the set_rx_ring_len callback is specific to XGMAC 3.01. It
limits the number of outstanding write requests that can be serviced
per DMA.
The other erratum addressed in this patch is simply a comment to
ensure that a feature that stmmac doesn't currently use is not enabled
without contemplating the errata.
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
.../net/ethernet/stmicro/stmmac/dwxgmac2.h | 3 ++
.../ethernet/stmicro/stmmac/dwxgmac2_dma.c | 52 +++++++++++++++++++
2 files changed, 55 insertions(+)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
index 9b0b5cc619556..bcf59ad8a1939 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
@@ -374,6 +374,8 @@
#define XGMAC_DMA_CH_RxDESC_TAIL_LPTR(x) (0x0000312c + (0x80 * (x)))
#define XGMAC_DMA_CH_TxDESC_RING_LEN(x) (0x00003130 + (0x80 * (x)))
#define XGMAC_DMA_CH_RxDESC_RING_LEN(x) (0x00003134 + (0x80 * (x)))
+#define XGMAC_OWRQ GENMASK(25, 24)
+#define XGMAC_RDRL GENMASK(15, 0)
#define XGMAC_DMA_CH_INT_EN(x) (0x00003138 + (0x80 * (x)))
#define XGMAC_NIE BIT(15)
#define XGMAC_AIE BIT(14)
@@ -463,6 +465,7 @@
extern const struct stmmac_ops dwxgmac210_ops;
extern const struct stmmac_ops dwxlgmac2_ops;
extern const struct stmmac_dma_ops dwxgmac210_dma_ops;
+extern const struct stmmac_dma_ops dwxgmac301_dma_ops;
extern const struct stmmac_desc_ops dwxgmac210_desc_ops;
#endif /* __STMMAC_DWXGMAC2_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
index a84601ac32153..dc2897e9931d1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
@@ -38,6 +38,14 @@ static void dwxgmac2_dma_init(void __iomem *ioaddr,
value = u32_replace_bits(value, XGMAC_INTM_MODE1,
XGMAC_INTM_MASK);
+ /*
+ * A friendly warning to future adventurers. If Descriptor Posted
+ * Write support, which is off by default, is ever enabled then be sure
+ * to make it optional. This is required by errata for at least XGMAC
+ * 3.01A... and the XGMAC 2.x and 3.x are architecturally similar so we
+ * use dwxgmac2 support for the 3.x family as well.
+ */
+
writel(value, ioaddr + XGMAC_DMA_MODE);
}
@@ -490,6 +498,20 @@ static void dwxgmac2_set_rx_ring_len(struct stmmac_priv *priv,
writel(len, ioaddr + XGMAC_DMA_CH_RxDESC_RING_LEN(chan));
}
+static void dwxgmac301_set_rx_ring_len(struct stmmac_priv *priv,
+ void __iomem *ioaddr, u32 len, u32 chan)
+{
+ u32 val = FIELD_PREP(XGMAC_RDRL, len);
+
+ /*
+ * Reduce the number of outstanding write requests to 3 (from default
+ * of 4). This is an errata workaround for XGMAC 3.01a.
+ */
+ val |= FIELD_PREP(XGMAC_OWRQ, 3);
+
+ writel(val, ioaddr + XGMAC_DMA_CH_RxDESC_RING_LEN(chan));
+}
+
static void dwxgmac2_set_tx_ring_len(struct stmmac_priv *priv,
void __iomem *ioaddr, u32 len, u32 chan)
{
@@ -619,3 +641,33 @@ const struct stmmac_dma_ops dwxgmac210_dma_ops = {
.enable_sph = dwxgmac2_enable_sph,
.enable_tbs = dwxgmac2_enable_tbs,
};
+
+const struct stmmac_dma_ops dwxgmac301_dma_ops = {
+ .reset = dwxgmac2_dma_reset,
+ .init = dwxgmac2_dma_init,
+ .init_chan = dwxgmac2_dma_init_chan,
+ .init_rx_chan = dwxgmac2_dma_init_rx_chan,
+ .init_tx_chan = dwxgmac2_dma_init_tx_chan,
+ .axi = dwxgmac2_dma_axi,
+ .dump_regs = dwxgmac2_dma_dump_regs,
+ .dma_rx_mode = dwxgmac2_dma_rx_mode,
+ .dma_tx_mode = dwxgmac2_dma_tx_mode,
+ .enable_dma_irq = dwxgmac2_enable_dma_irq,
+ .disable_dma_irq = dwxgmac2_disable_dma_irq,
+ .start_tx = dwxgmac2_dma_start_tx,
+ .stop_tx = dwxgmac2_dma_stop_tx,
+ .start_rx = dwxgmac2_dma_start_rx,
+ .stop_rx = dwxgmac2_dma_stop_rx,
+ .dma_interrupt = dwxgmac2_dma_interrupt,
+ .get_hw_feature = dwxgmac2_get_hw_feature,
+ .rx_watchdog = dwxgmac2_rx_watchdog,
+ .set_rx_ring_len = dwxgmac301_set_rx_ring_len,
+ .set_tx_ring_len = dwxgmac2_set_tx_ring_len,
+ .set_rx_tail_ptr = dwxgmac2_set_rx_tail_ptr,
+ .set_tx_tail_ptr = dwxgmac2_set_tx_tail_ptr,
+ .enable_tso = dwxgmac2_enable_tso,
+ .qmode = dwxgmac2_qmode,
+ .set_bfsize = dwxgmac2_set_bfsize,
+ .enable_sph = dwxgmac2_enable_sph,
+ .enable_tbs = dwxgmac2_enable_tbs,
+};
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 05/12] net: stmmac: dwxgmac2: Add multi MSI interrupt mode
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: Daniel Thompson, elder, mohd.anwar, a0987203069, alexandre.torgue,
ast, boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk,
hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
From: Daniel Thompson <daniel@riscstar.com>
Currently there are no XGMAC platforms integrated using the multi MSI
interrupt mode. In other words no existing driver sets both
DWMAC_CORE_XGMAC and STMMAC_FLAG_MULTI_MSI_EN.
In order to support systems that do enable both options (such as the
Toshiba TC9564 whose driver is currently being developed) we need to
add logic to the XGMAC DMA callbacks. Happily we can simply
replicate similar code from GMAC4. Let's do that!
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 2 ++
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 8 ++++++++
2 files changed, 10 insertions(+)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
index 51943705a2b03..9b0b5cc619556 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
@@ -320,6 +320,8 @@
/* DMA Registers */
#define XGMAC_DMA_MODE 0x00003000
#define XGMAC_SWR BIT(0)
+#define XGMAC_INTM_MASK GENMASK(13, 12)
+#define XGMAC_INTM_MODE1 0x1
#define XGMAC_DMA_SYSBUS_MODE 0x00003004
#define XGMAC_WR_OSR_LMT GENMASK(29, 24)
#define XGMAC_RD_OSR_LMT GENMASK(21, 16)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
index 03437f1cf3df3..a84601ac32153 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
@@ -31,6 +31,14 @@ static void dwxgmac2_dma_init(void __iomem *ioaddr,
value |= XGMAC_EAME;
writel(value, ioaddr + XGMAC_DMA_SYSBUS_MODE);
+
+ value = readl(ioaddr + XGMAC_DMA_MODE);
+
+ if (dma_cfg->multi_msi_en)
+ value = u32_replace_bits(value, XGMAC_INTM_MODE1,
+ XGMAC_INTM_MASK);
+
+ writel(value, ioaddr + XGMAC_DMA_MODE);
}
static void dwxgmac2_dma_init_chan(struct stmmac_priv *priv,
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 04/12] net: stmmac: dma: create a separate dma_device pointer
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: daniel, elder, mohd.anwar, a0987203069, alexandre.torgue, ast,
boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk, hkallweit1,
inochiama, john.fastabend, julianbraha, livelycarpet87,
matthew.gerlach, mcoquelin.stm32, me, prabhakar.mahadev-lad.rj,
richardcochran, rohan.g.thomas, sdf, siyanteng, weishangjuan,
wens, netdev, bpf, linux-arm-msm, devicetree, linux-gpio,
linux-stm32, linux-arm-kernel, linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
The Toshiba TC956x Ethernet bridge chip is an Ethernet AVN/TSN bridge
that is essentially a small but specialized SoC. It provides two XGMAC
Ethernet interfaces along with a number of internal IP blocks, some of
which are used by both eMACs.
The chip implements two internal PCIe functions, and one of these is
used to manage the common internal IPs. Both of the PCIe functions
use an auxiliary bus device to represent an XGMAC Ethernet interface.
Separating the PCIe function from the XGMAC IP this way helps in
managing the life cycle for various objects (common and per-MAC).
However this separation means that the MAC device is no longer the
proper device to use for DMA. To address this, we add support for
a second "DMA device" pointer in the stmmac_priv structure. The DMA
device pointer is used for all DMA operations, while the "normal"
device pointer is used for log messages, memory allocation, runtime
power management, and a few other things.
To set up the DMA device pointer, we add a new device structure pointer
to the plat_stmmacenet_data structure. If set, it will be assigned as
the (new) dma_device pointer field in the stmmac_priv structure. If
the plat_stmmacenet_data field is NULL, the "normal" device pointer is
assigned as the dma_device pointer instead (preserving existing behavior).
Signed-off-by: Alex Elder <elder@riscstar.com>
---
.../net/ethernet/stmicro/stmmac/chain_mode.c | 12 ++--
.../net/ethernet/stmicro/stmmac/ring_mode.c | 12 ++--
drivers/net/ethernet/stmicro/stmmac/stmmac.h | 1 +
.../net/ethernet/stmicro/stmmac/stmmac_main.c | 59 ++++++++++---------
.../net/ethernet/stmicro/stmmac/stmmac_xdp.c | 2 +-
include/linux/stmmac.h | 1 +
6 files changed, 46 insertions(+), 41 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
index fc04a23342cfc..331e6523ee018 100644
--- a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
@@ -34,10 +34,10 @@ static int jumbo_frm(struct stmmac_tx_queue *tx_q, struct sk_buff *skb,
buf_len = min_t(unsigned int, nopaged_len, bmax);
len = nopaged_len - buf_len;
- des2 = dma_map_single(priv->device, skb->data,
+ des2 = dma_map_single(priv->dma_device, skb->data,
buf_len, DMA_TO_DEVICE);
desc->des2 = cpu_to_le32(des2);
- if (dma_mapping_error(priv->device, des2))
+ if (dma_mapping_error(priv->dma_device, des2))
return -1;
tx_q->tx_skbuff_dma[entry].buf = des2;
tx_q->tx_skbuff_dma[entry].len = buf_len;
@@ -51,11 +51,11 @@ static int jumbo_frm(struct stmmac_tx_queue *tx_q, struct sk_buff *skb,
desc = tx_q->dma_tx + entry;
if (len > bmax) {
- des2 = dma_map_single(priv->device,
+ des2 = dma_map_single(priv->dma_device,
(skb->data + bmax * i),
bmax, DMA_TO_DEVICE);
desc->des2 = cpu_to_le32(des2);
- if (dma_mapping_error(priv->device, des2))
+ if (dma_mapping_error(priv->dma_device, des2))
return -1;
tx_q->tx_skbuff_dma[entry].buf = des2;
tx_q->tx_skbuff_dma[entry].len = bmax;
@@ -64,11 +64,11 @@ static int jumbo_frm(struct stmmac_tx_queue *tx_q, struct sk_buff *skb,
len -= bmax;
i++;
} else {
- des2 = dma_map_single(priv->device,
+ des2 = dma_map_single(priv->dma_device,
(skb->data + bmax * i), len,
DMA_TO_DEVICE);
desc->des2 = cpu_to_le32(des2);
- if (dma_mapping_error(priv->device, des2))
+ if (dma_mapping_error(priv->dma_device, des2))
return -1;
tx_q->tx_skbuff_dma[entry].buf = des2;
tx_q->tx_skbuff_dma[entry].len = len;
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
index 78fc6aa5bbe95..0d334c51fc1c2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
@@ -37,10 +37,10 @@ static int jumbo_frm(struct stmmac_tx_queue *tx_q, struct sk_buff *skb,
if (nopaged_len > BUF_SIZE_8KiB) {
- des2 = dma_map_single(priv->device, skb->data, bmax,
+ des2 = dma_map_single(priv->dma_device, skb->data, bmax,
DMA_TO_DEVICE);
desc->des2 = cpu_to_le32(des2);
- if (dma_mapping_error(priv->device, des2))
+ if (dma_mapping_error(priv->dma_device, des2))
return -1;
tx_q->tx_skbuff_dma[entry].buf = des2;
@@ -58,10 +58,10 @@ static int jumbo_frm(struct stmmac_tx_queue *tx_q, struct sk_buff *skb,
else
desc = tx_q->dma_tx + entry;
- des2 = dma_map_single(priv->device, skb->data + bmax, len,
+ des2 = dma_map_single(priv->dma_device, skb->data + bmax, len,
DMA_TO_DEVICE);
desc->des2 = cpu_to_le32(des2);
- if (dma_mapping_error(priv->device, des2))
+ if (dma_mapping_error(priv->dma_device, des2))
return -1;
tx_q->tx_skbuff_dma[entry].buf = des2;
tx_q->tx_skbuff_dma[entry].len = len;
@@ -72,10 +72,10 @@ static int jumbo_frm(struct stmmac_tx_queue *tx_q, struct sk_buff *skb,
STMMAC_RING_MODE, 1, !skb_is_nonlinear(skb),
skb->len);
} else {
- des2 = dma_map_single(priv->device, skb->data,
+ des2 = dma_map_single(priv->dma_device, skb->data,
nopaged_len, DMA_TO_DEVICE);
desc->des2 = cpu_to_le32(des2);
- if (dma_mapping_error(priv->device, des2))
+ if (dma_mapping_error(priv->dma_device, des2))
return -1;
tx_q->tx_skbuff_dma[entry].buf = des2;
tx_q->tx_skbuff_dma[entry].len = nopaged_len;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index 8ba8f03e1ce03..76c8551687998 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -278,6 +278,7 @@ struct stmmac_priv {
void __iomem *ioaddr;
struct net_device *dev;
struct device *device;
+ struct device *dma_device;
struct mac_device_info *hw;
int (*hwif_quirks)(struct stmmac_priv *priv);
struct mutex lock;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index ca68248dbc781..1104cf750295b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1730,12 +1730,12 @@ static void stmmac_free_tx_buffer(struct stmmac_priv *priv,
if (tx_q->tx_skbuff_dma[i].buf &&
tx_q->tx_skbuff_dma[i].buf_type != STMMAC_TXBUF_T_XDP_TX) {
if (tx_q->tx_skbuff_dma[i].map_as_page)
- dma_unmap_page(priv->device,
+ dma_unmap_page(priv->dma_device,
tx_q->tx_skbuff_dma[i].buf,
tx_q->tx_skbuff_dma[i].len,
DMA_TO_DEVICE);
else
- dma_unmap_single(priv->device,
+ dma_unmap_single(priv->dma_device,
tx_q->tx_skbuff_dma[i].buf,
tx_q->tx_skbuff_dma[i].len,
DMA_TO_DEVICE);
@@ -2166,7 +2166,7 @@ static void __free_dma_rx_desc_resources(struct stmmac_priv *priv,
size = stmmac_get_rx_desc_size(priv) * dma_conf->dma_rx_size;
- dma_free_coherent(priv->device, size, addr, rx_q->dma_rx_phy);
+ dma_free_coherent(priv->dma_device, size, addr, rx_q->dma_rx_phy);
if (xdp_rxq_info_is_reg(&rx_q->xdp_rxq))
xdp_rxq_info_unreg(&rx_q->xdp_rxq);
@@ -2214,7 +2214,7 @@ static void __free_dma_tx_desc_resources(struct stmmac_priv *priv,
size = stmmac_get_tx_desc_size(priv, tx_q) * dma_conf->dma_tx_size;
- dma_free_coherent(priv->device, size, addr, tx_q->dma_tx_phy);
+ dma_free_coherent(priv->dma_device, size, addr, tx_q->dma_tx_phy);
kfree(tx_q->tx_skbuff_dma);
kfree(tx_q->tx_skbuff);
@@ -2266,8 +2266,8 @@ static int __alloc_dma_rx_desc_resources(struct stmmac_priv *priv,
pp_params.flags = PP_FLAG_DMA_MAP | PP_FLAG_DMA_SYNC_DEV;
pp_params.pool_size = dma_conf->dma_rx_size;
pp_params.order = order_base_2(num_pages);
- pp_params.nid = dev_to_node(priv->device);
- pp_params.dev = priv->device;
+ pp_params.nid = dev_to_node(priv->dma_device);
+ pp_params.dev = priv->dma_device;
pp_params.dma_dir = xdp_prog ? DMA_BIDIRECTIONAL : DMA_FROM_DEVICE;
pp_params.offset = stmmac_rx_offset(priv);
pp_params.max_len = dma_conf->dma_buf_sz;
@@ -2290,7 +2290,7 @@ static int __alloc_dma_rx_desc_resources(struct stmmac_priv *priv,
size = stmmac_get_rx_desc_size(priv) * dma_conf->dma_rx_size;
- addr = dma_alloc_coherent(priv->device, size, &rx_q->dma_rx_phy,
+ addr = dma_alloc_coherent(priv->dma_device, size, &rx_q->dma_rx_phy,
GFP_KERNEL);
if (!addr)
return -ENOMEM;
@@ -2369,7 +2369,7 @@ static int __alloc_dma_tx_desc_resources(struct stmmac_priv *priv,
size = stmmac_get_tx_desc_size(priv, tx_q) * dma_conf->dma_tx_size;
- addr = dma_alloc_coherent(priv->device, size,
+ addr = dma_alloc_coherent(priv->dma_device, size,
&tx_q->dma_tx_phy, GFP_KERNEL);
if (!addr)
return -ENOMEM;
@@ -2898,12 +2898,12 @@ static int stmmac_tx_clean(struct stmmac_priv *priv, int budget, u32 queue,
if (likely(tx_q->tx_skbuff_dma[entry].buf &&
tx_q->tx_skbuff_dma[entry].buf_type != STMMAC_TXBUF_T_XDP_TX)) {
if (tx_q->tx_skbuff_dma[entry].map_as_page)
- dma_unmap_page(priv->device,
+ dma_unmap_page(priv->dma_device,
tx_q->tx_skbuff_dma[entry].buf,
tx_q->tx_skbuff_dma[entry].len,
DMA_TO_DEVICE);
else
- dma_unmap_single(priv->device,
+ dma_unmap_single(priv->dma_device,
tx_q->tx_skbuff_dma[entry].buf,
tx_q->tx_skbuff_dma[entry].len,
DMA_TO_DEVICE);
@@ -4569,9 +4569,9 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
first = desc;
/* first descriptor: fill Headers on Buf1 */
- des = dma_map_single(priv->device, skb->data, skb_headlen(skb),
+ des = dma_map_single(priv->dma_device, skb->data, skb_headlen(skb),
DMA_TO_DEVICE);
- if (dma_mapping_error(priv->device, des))
+ if (dma_mapping_error(priv->dma_device, des))
goto dma_map_err;
stmmac_set_desc_addr(priv, first, des);
@@ -4597,10 +4597,10 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
for (i = 0; i < nfrags; i++) {
const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
- des = skb_frag_dma_map(priv->device, frag, 0,
+ des = skb_frag_dma_map(priv->dma_device, frag, 0,
skb_frag_size(frag),
DMA_TO_DEVICE);
- if (dma_mapping_error(priv->device, des))
+ if (dma_mapping_error(priv->dma_device, des))
goto dma_map_err;
stmmac_tso_allocator(priv, des, skb_frag_size(frag),
@@ -4825,9 +4825,9 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
} else {
bool last_segment = (nfrags == 0);
- dma_addr = dma_map_single(priv->device, skb->data,
+ dma_addr = dma_map_single(priv->dma_device, skb->data,
nopaged_len, DMA_TO_DEVICE);
- if (dma_mapping_error(priv->device, dma_addr))
+ if (dma_mapping_error(priv->dma_device, dma_addr))
goto dma_map_err;
stmmac_set_tx_skb_dma_entry(tx_q, first_entry, dma_addr,
@@ -4876,9 +4876,9 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
desc = stmmac_get_tx_desc(priv, tx_q, entry);
- dma_addr = skb_frag_dma_map(priv->device, frag, 0, frag_size,
- DMA_TO_DEVICE);
- if (dma_mapping_error(priv->device, dma_addr))
+ dma_addr = skb_frag_dma_map(priv->dma_device, frag, 0,
+ frag_size, DMA_TO_DEVICE);
+ if (dma_mapping_error(priv->dma_device, dma_addr))
goto dma_map_err; /* should reuse desc w/o issues */
stmmac_set_tx_skb_dma_entry(tx_q, entry, dma_addr, frag_size,
@@ -5188,9 +5188,9 @@ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue,
tx_desc = stmmac_get_tx_desc(priv, tx_q, entry);
if (dma_map) {
- dma_addr = dma_map_single(priv->device, xdpf->data,
+ dma_addr = dma_map_single(priv->dma_device, xdpf->data,
xdpf->len, DMA_TO_DEVICE);
- if (dma_mapping_error(priv->device, dma_addr))
+ if (dma_mapping_error(priv->dma_device, dma_addr))
return STMMAC_XDP_CONSUMED;
buf_type = STMMAC_TXBUF_T_XDP_NDO;
@@ -5199,7 +5199,7 @@ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue,
dma_addr = page_pool_get_dma_addr(page) + sizeof(*xdpf) +
xdpf->headroom;
- dma_sync_single_for_device(priv->device, dma_addr,
+ dma_sync_single_for_device(priv->dma_device, dma_addr,
xdpf->len, DMA_BIDIRECTIONAL);
buf_type = STMMAC_TXBUF_T_XDP_TX;
@@ -5781,7 +5781,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
if (!skb) {
unsigned int pre_len, sync_len;
- dma_sync_single_for_cpu(priv->device, buf->addr,
+ dma_sync_single_for_cpu(priv->dma_device, buf->addr,
buf1_len, dma_dir);
net_prefetch(page_address(buf->page) +
buf->page_offset);
@@ -5860,7 +5860,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
skb_mark_for_recycle(skb);
buf->page = NULL;
} else if (buf1_len) {
- dma_sync_single_for_cpu(priv->device, buf->addr,
+ dma_sync_single_for_cpu(priv->dma_device, buf->addr,
buf1_len, dma_dir);
skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
buf->page, buf->page_offset, buf1_len,
@@ -5869,7 +5869,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
}
if (buf2_len) {
- dma_sync_single_for_cpu(priv->device, buf->sec_addr,
+ dma_sync_single_for_cpu(priv->dma_device, buf->sec_addr,
buf2_len, dma_dir);
skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
buf->sec_page, 0, buf2_len,
@@ -7810,6 +7810,7 @@ static int __stmmac_dvr_probe(struct device *device,
priv = netdev_priv(ndev);
priv->device = device;
+ priv->dma_device = plat_dat->dma_device ? : device;
priv->dev = ndev;
for (i = 0; i < MTL_MAX_RX_QUEUES; i++)
@@ -7938,8 +7939,9 @@ static int __stmmac_dvr_probe(struct device *device,
priv->dma_cap.host_dma_width = priv->dma_cap.addr64;
if (priv->dma_cap.host_dma_width) {
- ret = dma_set_mask_and_coherent(device,
- DMA_BIT_MASK(priv->dma_cap.host_dma_width));
+ u64 mask = DMA_BIT_MASK(priv->dma_cap.host_dma_width);
+
+ ret = dma_set_mask_and_coherent(priv->dma_device, mask);
if (!ret) {
dev_info(priv->device, "Using %d/%d bits DMA host/device width\n",
priv->dma_cap.host_dma_width, priv->dma_cap.addr64);
@@ -7951,7 +7953,8 @@ static int __stmmac_dvr_probe(struct device *device,
if (IS_ENABLED(CONFIG_ARCH_DMA_ADDR_T_64BIT))
priv->plat->dma_cfg->eame = true;
} else {
- ret = dma_set_mask_and_coherent(device, DMA_BIT_MASK(32));
+ ret = dma_set_mask_and_coherent(priv->dma_device,
+ DMA_BIT_MASK(32));
if (ret) {
dev_err(priv->device, "Failed to set DMA Mask\n");
goto error_hw_init;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c
index d7e4db7224b0c..7ba068f1ca88d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c
@@ -25,7 +25,7 @@ static int stmmac_xdp_enable_pool(struct stmmac_priv *priv,
if (frame_size < ETH_FRAME_LEN + VLAN_HLEN * 2)
return -EOPNOTSUPP;
- err = xsk_pool_dma_map(pool, priv->device, STMMAC_RX_DMA_ATTR);
+ err = xsk_pool_dma_map(pool, priv->dma_device, STMMAC_RX_DMA_ATTR);
if (err) {
netdev_err(priv->dev, "Failed to map xsk pool\n");
return err;
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
index 4430b967abdeb..02ae177d5c27d 100644
--- a/include/linux/stmmac.h
+++ b/include/linux/stmmac.h
@@ -245,6 +245,7 @@ struct plat_stmmacenet_data {
struct stmmac_mdio_bus_data *mdio_bus_data;
struct device_node *phy_node;
struct device_node *mdio_node;
+ struct device *dma_device;
struct stmmac_dma_cfg *dma_cfg;
struct stmmac_safety_feature_cfg *safety_feat_cfg;
int clk_csr;
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 03/12] net: pcs: pcs-xpcs: Preserve BMCR_ANENBLE during link up
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: Daniel Thompson, elder, mohd.anwar, a0987203069, alexandre.torgue,
ast, boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk,
hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
From: Daniel Thompson <daniel@riscstar.com>
Currently the XCPS found on Toshiba TC9564 (a.k.a. Qualcomm QPS615)
is unable to operate at 1000base-X and slower with a PHY connected
using SGMII/2500base-X (in our case a Qualcomm QCA8081). The link
negotiates speed correctly but the MAC can't get any packets out.
This attracted attention to the ANENABLE bit and we observed that the
bit is currently set during config and cleared during link up.
Preserving the bit during link up allows the system to work as expected.
Perhaps I lack the imagination but I couldn't come up with any reason
why keeping the ANENABLE bit set would break things for other XPCS
implementations. Let's ensure link up sets the bit for SGMII interfaces.
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
drivers/net/pcs/pcs-xpcs.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/pcs/pcs-xpcs.c b/drivers/net/pcs/pcs-xpcs.c
index b2c84b7e1e113..1d62d5b31c61c 100644
--- a/drivers/net/pcs/pcs-xpcs.c
+++ b/drivers/net/pcs/pcs-xpcs.c
@@ -1263,11 +1263,14 @@ static void xpcs_link_up_sgmii_1000basex(struct dw_xpcs *xpcs,
phy_interface_t interface,
int speed, int duplex)
{
+ u16 an_enable;
int ret;
if (neg_mode == PHYLINK_PCS_NEG_INBAND_ENABLED)
return;
+ an_enable = (interface == PHY_INTERFACE_MODE_SGMII ? BMCR_ANENABLE : 0);
+
if (interface == PHY_INTERFACE_MODE_1000BASEX) {
if (speed != SPEED_1000) {
dev_err(&xpcs->mdiodev->dev,
@@ -1283,7 +1286,7 @@ static void xpcs_link_up_sgmii_1000basex(struct dw_xpcs *xpcs,
}
ret = xpcs_write(xpcs, MDIO_MMD_VEND2, MII_BMCR,
- mii_bmcr_encode_fixed(speed, duplex));
+ mii_bmcr_encode_fixed(speed, duplex) | an_enable);
if (ret)
dev_err(&xpcs->mdiodev->dev, "%s: xpcs_write returned %pe\n",
__func__, ERR_PTR(ret));
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 02/12] net: pcs: pcs-xpcs: select operating mode for 10G-baseR capable PCS
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: Daniel Thompson, elder, mohd.anwar, a0987203069, alexandre.torgue,
ast, boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk,
hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
From: Daniel Thompson <daniel@riscstar.com>
Currently the XPCS found on Toshiba TC9564 (a.k.a. Qualcomm QPS615)
is unable to operate at 1000base-X and slower with a PHY connected
using SGMII/2500base-X (in our case a Qualcomm QCA8081).
The problem arises when the XPCS supports 10Gbase-R. That means that
the reset value of SR_XS_PCS_CTRL2:PCS_TYPE_SEL (0) is valid and this
suppresses the modal switching based on bit 13 of SR_PMA_CTRL1 or
SR_XS_PCS_CTRL1.
The reported XPCS dev ID on a TC9564 is exactly the same as every other
XPCS supported by the kernel so we can't use the dev ID to automatically
determine what operating mode to select. However we can use the feature
bits in SR_XS_PCS_STS2 to detect 10Gbase-R support.
Rather than introduce a quirk let's attempt to solve this generically by
setting SR_XS_PCS_CTRL2:PCS_TYPE_SEL to a reserved value when we detect
the right we detect the right combination of phy interface and XPCS
feature support.
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
drivers/net/pcs/pcs-xpcs.c | 38 ++++++++++++++++++++++++++++++++++++++
1 file changed, 38 insertions(+)
diff --git a/drivers/net/pcs/pcs-xpcs.c b/drivers/net/pcs/pcs-xpcs.c
index e69fa2f0a0e8d..b2c84b7e1e113 100644
--- a/drivers/net/pcs/pcs-xpcs.c
+++ b/drivers/net/pcs/pcs-xpcs.c
@@ -747,6 +747,40 @@ static void xpcs_pre_config(struct phylink_pcs *pcs, phy_interface_t interface)
xpcs->need_reset = false;
}
+static int xpcs_config_operating_mode(struct dw_xpcs *xpcs, int an_mode)
+{
+ int mdio_stat2, ret;
+
+ switch (an_mode) {
+ case DW_AN_C37_SGMII:
+ case DW_AN_C37_1000BASEX:
+ case DW_2500BASEX:
+ mdio_stat2 = xpcs_read(xpcs, MDIO_MMD_PCS, MDIO_STAT2);
+ if (mdio_stat2 < 0)
+ return mdio_stat2;
+
+ /*
+ * If this XPCS supports 10Gbase-R then it will be the default
+ * which prevents 1000base-X and slower from working correctly.
+ *
+ * Why are we writing MDIO_PCS_CTRL2_TYPE + 1? We want the modal
+ * behaviour that comes when we pick a reserved value. XPCS
+ * allocates extra bits to this field and allocates values from
+ * 15 down so MDIO_PCS_CTRL2_TYPE + 1 is the value likely to
+ * be allocated last (and hopefully never).
+ */
+ if (mdio_stat2 & MDIO_PCS_STAT2_10GBR) {
+ ret = xpcs_write(xpcs, MDIO_MMD_PCS, MDIO_CTRL2,
+ MDIO_PCS_CTRL2_TYPE + 1);
+ if (ret < 0)
+ return ret;
+ }
+ break;
+ }
+
+ return 0;
+}
+
static int xpcs_config_aneg_c37_sgmii(struct dw_xpcs *xpcs,
unsigned int neg_mode)
{
@@ -919,6 +953,10 @@ static int xpcs_do_config(struct dw_xpcs *xpcs, phy_interface_t interface,
if (!compat)
return -ENODEV;
+ ret = xpcs_config_operating_mode(xpcs, compat->an_mode);
+ if (ret < 0)
+ return ret;
+
if (xpcs->info.pma == WX_TXGBE_XPCS_PMA_10G_ID) {
/* Wangxun devices need backplane CL37 AN enabled for
* SGMII and 1000base-X
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 01/12] net: pcs: pcs-xpcs-regmap: support XPCS memory-mapped MDIO bus via regmap
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: Daniel Thompson, elder, mohd.anwar, a0987203069, alexandre.torgue,
ast, boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk,
hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
From: Daniel Thompson <daniel@riscstar.com>
In some DesignWare XPCS implementatons the memory-mapped MDIO bus is
allocated to a register window that does not align to a page boundary.
This makes iomapping the registers problematic.
For example the Toshiba TC9564 (a PCIe Ethernet-AVB/TSN bridge) provides
an "eMAC" subsystem with the XPCS base address cuddled up to XGMAC
registers.
Let's introduce helpers to allow the driver that owns the eMAC to register
an XPCS using is regmap for the memory-mapped MDIO bus.
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
drivers/net/pcs/Makefile | 4 +-
drivers/net/pcs/pcs-xpcs-regmap.c | 203 ++++++++++++++++++++++++++++
include/linux/pcs/pcs-xpcs-regmap.h | 20 +++
3 files changed, 225 insertions(+), 2 deletions(-)
create mode 100644 drivers/net/pcs/pcs-xpcs-regmap.c
create mode 100644 include/linux/pcs/pcs-xpcs-regmap.h
diff --git a/drivers/net/pcs/Makefile b/drivers/net/pcs/Makefile
index 4f7920618b900..565f1b63fce0b 100644
--- a/drivers/net/pcs/Makefile
+++ b/drivers/net/pcs/Makefile
@@ -1,8 +1,8 @@
# SPDX-License-Identifier: GPL-2.0
# Makefile for Linux PCS drivers
-pcs_xpcs-$(CONFIG_PCS_XPCS) := pcs-xpcs.o pcs-xpcs-plat.o \
- pcs-xpcs-nxp.o pcs-xpcs-wx.o
+pcs_xpcs-$(CONFIG_PCS_XPCS) := pcs-xpcs.o pcs-xpcs-nxp.o pcs-xpcs-regmap.o \
+ pcs-xpcs-plat.o pcs-xpcs-wx.o
obj-$(CONFIG_PCS_XPCS) += pcs_xpcs.o
obj-$(CONFIG_PCS_LYNX) += pcs-lynx.o
diff --git a/drivers/net/pcs/pcs-xpcs-regmap.c b/drivers/net/pcs/pcs-xpcs-regmap.c
new file mode 100644
index 0000000000000..20a54a3605951
--- /dev/null
+++ b/drivers/net/pcs/pcs-xpcs-regmap.c
@@ -0,0 +1,203 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Synopsys DesignWare XPCS regmap helpers
+ *
+ * Copyright (C) 2026 RISCstar Solutions.
+ * Copyright (C) 2024 Serge Semin
+ */
+
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/mdio.h>
+#include <linux/pcs/pcs-xpcs.h>
+#include <linux/pcs/pcs-xpcs-regmap.h>
+#include <linux/regmap.h>
+
+#include "pcs-xpcs.h"
+
+/* Page select register for the indirect MMIO CSRs access */
+#define DW_VR_CSR_VIEWPORT 0xff
+
+struct dw_xpcs_regmap {
+ struct device *dev;
+ struct mii_bus *bus;
+ struct regmap *regmap;
+ bool reg_indir;
+};
+
+static ptrdiff_t xpcs_regmap_addr_format(int dev, int reg)
+{
+ return FIELD_PREP(0x1f0000, dev) | FIELD_PREP(0xffff, reg);
+}
+
+static u16 xpcs_regmap_addr_page(ptrdiff_t csr)
+{
+ return FIELD_GET(0x1fff00, csr);
+}
+
+static ptrdiff_t xpcs_regmap_addr_offset(ptrdiff_t csr)
+{
+ return FIELD_GET(0xff, csr);
+}
+
+static int xpcs_regmap_read_reg_indirect(struct dw_xpcs_regmap *pxpcs, int dev,
+ int reg)
+{
+ ptrdiff_t csr, ofs;
+ unsigned int val;
+ u16 page;
+ int res;
+
+ csr = xpcs_regmap_addr_format(dev, reg);
+ page = xpcs_regmap_addr_page(csr);
+ ofs = xpcs_regmap_addr_offset(csr);
+
+ res = regmap_write(pxpcs->regmap, DW_VR_CSR_VIEWPORT, page);
+ if (res < 0)
+ return res;
+
+ res = regmap_read(pxpcs->regmap, ofs, &val);
+ if (res < 0)
+ return res;
+
+ return val & 0xffff;
+}
+
+static int xpcs_regmap_write_reg_indirect(struct dw_xpcs_regmap *pxpcs, int dev,
+ int reg, u16 val)
+{
+ ptrdiff_t csr, ofs;
+ u16 page;
+ int res;
+
+ csr = xpcs_regmap_addr_format(dev, reg);
+ page = xpcs_regmap_addr_page(csr);
+ ofs = xpcs_regmap_addr_offset(csr);
+
+ res = regmap_write(pxpcs->regmap, DW_VR_CSR_VIEWPORT, page);
+ if (res < 0)
+ return res;
+
+ return regmap_write(pxpcs->regmap, ofs, val);
+}
+
+static int xpcs_regmap_read_reg_direct(struct dw_xpcs_regmap *pxpcs, int dev,
+ int reg)
+{
+ unsigned int val;
+ ptrdiff_t csr;
+ int res;
+
+ csr = xpcs_regmap_addr_format(dev, reg);
+ res = regmap_read(pxpcs->regmap, csr, &val);
+ if (res < 0)
+ return res;
+
+ return val & 0xffff;
+}
+
+static int xpcs_regmap_write_reg_direct(struct dw_xpcs_regmap *pxpcs, int dev,
+ int reg, u16 val)
+{
+ ptrdiff_t csr = xpcs_regmap_addr_format(dev, reg);
+
+ return regmap_write(pxpcs->regmap, csr, val);
+}
+
+static int xpcs_regmap_read_c22(struct mii_bus *bus, int addr, int reg)
+{
+ struct dw_xpcs_regmap *pxpcs = bus->priv;
+
+ if (addr != 0)
+ return -ENODEV;
+
+ if (pxpcs->reg_indir)
+ return xpcs_regmap_read_reg_indirect(pxpcs, MDIO_MMD_VEND2, reg);
+ else
+ return xpcs_regmap_read_reg_direct(pxpcs, MDIO_MMD_VEND2, reg);
+}
+
+static int xpcs_regmap_write_c22(struct mii_bus *bus, int addr, int reg, u16 val)
+{
+ struct dw_xpcs_regmap *pxpcs = bus->priv;
+
+ if (addr != 0)
+ return -ENODEV;
+
+ if (pxpcs->reg_indir)
+ return xpcs_regmap_write_reg_indirect(pxpcs, MDIO_MMD_VEND2, reg, val);
+ else
+ return xpcs_regmap_write_reg_direct(pxpcs, MDIO_MMD_VEND2, reg, val);
+}
+
+static int xpcs_regmap_read_c45(struct mii_bus *bus, int addr, int dev, int reg)
+{
+ struct dw_xpcs_regmap *pxpcs = bus->priv;
+
+ if (addr != 0)
+ return -ENODEV;
+
+ if (pxpcs->reg_indir)
+ return xpcs_regmap_read_reg_indirect(pxpcs, dev, reg);
+ else
+ return xpcs_regmap_read_reg_direct(pxpcs, dev, reg);
+}
+
+static int xpcs_regmap_write_c45(struct mii_bus *bus, int addr, int dev,
+ int reg, u16 val)
+{
+ struct dw_xpcs_regmap *pxpcs = bus->priv;
+
+ if (addr != 0)
+ return -ENODEV;
+
+ if (pxpcs->reg_indir)
+ return xpcs_regmap_write_reg_indirect(pxpcs, dev, reg, val);
+ else
+ return xpcs_regmap_write_reg_direct(pxpcs, dev, reg, val);
+}
+
+struct dw_xpcs *devm_xpcs_regmap_register(struct device *dev,
+ const struct xpcs_regmap_config *config)
+{
+ static atomic_t id = ATOMIC_INIT(-1);
+ struct dw_xpcs_regmap *pxpcs;
+ int ret;
+
+ pxpcs = devm_kzalloc(dev, sizeof(*pxpcs), GFP_KERNEL);
+ if (!pxpcs)
+ return ERR_PTR(-ENOMEM);
+
+ pxpcs->dev = dev;
+ pxpcs->regmap = config->regmap;
+ pxpcs->reg_indir = config->reg_indir;
+
+ pxpcs->bus = devm_mdiobus_alloc_size(dev, 0);
+ if (!pxpcs->bus)
+ return ERR_PTR(-ENOMEM);
+
+ pxpcs->bus->name = "DW XPCS MCI/APB3";
+ pxpcs->bus->read = xpcs_regmap_read_c22;
+ pxpcs->bus->write = xpcs_regmap_write_c22;
+ pxpcs->bus->read_c45 = xpcs_regmap_read_c45;
+ pxpcs->bus->write_c45 = xpcs_regmap_write_c45;
+ pxpcs->bus->phy_mask = ~0;
+ pxpcs->bus->parent = dev;
+ pxpcs->bus->priv = pxpcs;
+
+ snprintf(pxpcs->bus->id, MII_BUS_ID_SIZE,
+ "dwxpcs-%x", atomic_inc_return(&id));
+
+ /* MDIO-bus here serves as just a back-end engine abstracting out
+ * the MDIO and MCI/APB3 IO interfaces utilized for the DW XPCS CSRs
+ * access.
+ */
+ ret = devm_mdiobus_register(dev, pxpcs->bus);
+ if (ret) {
+ dev_err(dev, "Failed to create MDIO bus\n");
+ return ERR_PTR(ret);
+ }
+
+ return xpcs_create_mdiodev(pxpcs->bus, 0);
+}
+EXPORT_SYMBOL_GPL(devm_xpcs_regmap_register);
diff --git a/include/linux/pcs/pcs-xpcs-regmap.h b/include/linux/pcs/pcs-xpcs-regmap.h
new file mode 100644
index 0000000000000..19c99d4160365
--- /dev/null
+++ b/include/linux/pcs/pcs-xpcs-regmap.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#ifndef __LINUX_PCS_XPCS_REGMAP_H
+#define __LINUX_PCS_XPCS_REGMAP_H
+
+#include <linux/types.h>
+
+struct device;
+struct regmap;
+struct dw_xpcs;
+
+struct xpcs_regmap_config {
+ struct regmap *regmap;
+ bool reg_indir;
+};
+
+struct dw_xpcs *devm_xpcs_regmap_register(
+ struct device *dev, const struct xpcs_regmap_config *config);
+
+#endif /* __LINUX_PCS_XPCS_REGMAP_H */
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 00/12] net: enable TC956x support
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: daniel, elder, mohd.anwar, a0987203069, alexandre.torgue, ast,
boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk, hkallweit1,
inochiama, john.fastabend, julianbraha, livelycarpet87,
matthew.gerlach, mcoquelin.stm32, me, prabhakar.mahadev-lad.rj,
richardcochran, rohan.g.thomas, sdf, siyanteng, weishangjuan,
wens, netdev, bpf, linux-arm-msm, devicetree, linux-gpio,
linux-stm32, linux-arm-kernel, linux-kernel
This series introduces stmmac driver support for the Toshiba TC9564
(also known as Qualcomm QPS615). This is an Ethernet-AVB/TSN bridge IC
that provides a high-speed connection between a host SoC and Ethernet
devices on a network. It incorporates a PCIe switch, and implements
two 10 Gbps capable Ethernet MACs (along with other IP blocks), and
is essentially a small and highly-specialized SoC. The TC9564 is a
member of a family of similar chips, and the driver code uses "tc956x"
to reflect this.
TC956x chips incorporate a PCIe gen 3 switch, with one upstream and
three downstream ports. Its PCIe functionality is already supported
upstream, including a power control driver that performs some early
configuration of the PCI ports ("pci-pwrctrl-tc9563.c").
One of the PCIe switch's downstream ports has an internal PCIe endpoint,
which implements two PCIe functions, each of which has an Ethernet MAC
(eMAC) subsystem. The eMAC is composed of a Synopsis Designware XGMAC
combined with an XPCS and PMA. Each MAC is capable of operating at
10M/100M/1G/2.5G/5Gps and 10Gps. The initial target platform is the
Qualcomm RB3gen2, which supports a 10Gbps Marvell PHY on port A, and
a 2.5Gbps Qualcomm PHY on port B. (The Marvell PHY is not populated on
all RB3gen2 boards, and only 2.5 Gbps support is included initially.)
TC956x chips also implement several other blocks of functionality,
including a GPIO controller, interrupt controllers (MSIGEN), I2C
and SPI, a UART, and an Arm Cortex M3 CPU with 128KB SRAM. The GPIO
interface exposes several lines to manage external resets. The
interrupt controllers are used internally by the MAC functions. The
UART, SPI, microcontroller, and SRAM are currently unused.
----------------------------------
| Host |
------+...+----------+........+---
|i2c| | PCIe |
----------------+...+----------+........+------
| TC956x |I2C| |upstream| |
| ----- --+--------+--- |
| ----- ------ ------- | PCIe switch | |
| |SPI| |GPIO| |reset| | | |
| ----- ------ |clock| | DS3 DS2 DS1 | |
| ------- ---++--++--++-- |
| ----- ------ downstream// \\ \\ | downstream
| |MCU| |SRAM| /==========/ \\ \===== PCIe port 1
| ----- ------ //PCIe port 3 \\ |
| || \======= downstream
| ----+-----------++-----------+---- | PCIe port 2
| | M | internal PCIe endpoint | M | |
| | S |------------------------| S | ------ |
| | I | PCIe | | PCIe | I | |UART| |
| | G |function 0| |function 1| G | ------ |
| | E |----++----| |----++----| E | |
| | N | eMAC 0 | | eMAC 1 | N | |
--------+.......+------+.....+-----------------
|USXGMII| |SGMII|
--+.......+-- --+.....+--
| ARQ113C | | QEP8121 |
| PHY | | PHY |
------------- -----------
The primary objective for this series is to support the Ethernet
functionality provided by the TC956x. The code providing this
support has been structured into three distinct modules.
- A driver for the GPIO controller
- Code enabling the TC956x-specific eMAC/MSIGEN hardware
- A "chip" driver, associated with the PCIe functions
The GPIO driver is implemented separately because in some hardware
configurations, these GPIO lines are used to manage resets for
external Ethernet PHYs. We describe these PHYs via devicetree,
where the GPIO-based reset signals are defined using phandles.
The code for the eMAC/MSIGEN consists of a new source file that
populates hardware-specific details about the two MACs, and integrates
with the existing stmmac driver. This also required implementing some
enhancements to the core stmmac driver, described further below.
To manage the common functionality (including configuring address
translation and controlling internal reset and clock signals), a
"chip" driver is implemented. This chip driver is associated with
the PCIe function *itself*, not the eMAC associated with the function.
The driver binds to the internal PCI functions 0 and 1, and creates
a shared data structure describing the common chip elements the two
driver instances share. Three auxiliary bus devices are created to
represent the GPIO controller and the two Synopsys MAC controllers.
The driver instance for PCIe function 0 has responsibility for
controlling the common chip functionality--creating the GPIO
controller auxiliary device, configuring address translation
between PCIe address space and internal addresses, and controlling
clocks and resets. It creates a data structure--shared via its
platform data pointer with PCIe function 1--to represent shared
"chip" information. In addition, PCIe function 0 creates an
auxiliary device to represent its attached eMAC. It allocates
IRQs and maps BAR address ranges for use by the stmmac driver,
passing them in a structure via the auxiliary device's platform
data.
PCIe function 1 defers probing until after PCIe function 0 has
created the shared data structure. After that its only job is
to set up IRQs and mapped memory and create the eMAC1 auxiliary
device.
The version of the Synopsys MAC IP is 3.01, which is largely compatible
with version 2.20. The core stmmac driver required several changes to
enable support for the TC956x.
- A change to dwxgmac2 support changes the interrupt mode when
multi_msi_en is enabled.
- While most support for version 3.01 simply uses the 2.20 code,
an erratum related to the RX ring length is implemented for
3.01 DMA operations.
- Having the PCIe device be separate from an auxiliarly device
implementing the eMAC required allowing a distinct DMA device
to be maintained for an stmmac interface.
In addition:
- A new source file provides memory-mapped access to XPCS using
regmap. The alignment of the TC956x MDIO registers aren't
suitable for using simple MMIO.
- Two additional XPCS changes are implemented that provides
support for the XPCS as implemented in the TC956x.
This series is available here:
https://github.com/riscstar/linux/tree/tc956x/stmmac-v1
-Alex (and Daniel)
Alex Elder (3):
net: stmmac: dma: create a separate dma_device pointer
gpio: tc956x: add TC956x/QPS615 support
misc: tc956x_pci: add TC956x/QPS615 support
Daniel Thompson (9):
net: pcs: pcs-xpcs-regmap: support XPCS memory-mapped MDIO bus via
regmap
net: pcs: pcs-xpcs: select operating mode for 10G-baseR capable PCS
net: pcs: pcs-xpcs: Preserve BMCR_ANENBLE during link up
net: stmmac: dwxgmac2: Add multi MSI interrupt mode
net: stmmac: dwxgmac2: Add XGMAC 3.01a support
net: stmmac: dwxgmac2: export symbols for XGMAC 3.01a DMA
dt-bindings: net: toshiba,tc965x-dwmac: add TC956x Ethernet bridge
net: stmmac: tc956x: add TC956x/QPS615 support
arm64: dts: qcom: qcs6490-rb3gen2: enable TC9564 with a single QCS8081
phy
.../bindings/net/toshiba,tc956x-dwmac.yaml | 111 +++
arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts | 45 +-
drivers/gpio/Kconfig | 11 +
drivers/gpio/Makefile | 1 +
drivers/gpio/gpio-tc956x.c | 209 +++++
drivers/misc/Kconfig | 10 +
drivers/misc/Makefile | 1 +
drivers/misc/tc956x_pci.c | 667 +++++++++++++++
drivers/net/ethernet/stmicro/stmmac/Kconfig | 13 +
drivers/net/ethernet/stmicro/stmmac/Makefile | 2 +
.../net/ethernet/stmicro/stmmac/chain_mode.c | 12 +-
.../ethernet/stmicro/stmmac/dwmac-tc956x.c | 791 ++++++++++++++++++
.../net/ethernet/stmicro/stmmac/dwxgmac2.h | 12 +
.../ethernet/stmicro/stmmac/dwxgmac2_core.c | 1 +
.../ethernet/stmicro/stmmac/dwxgmac2_descs.c | 1 +
.../ethernet/stmicro/stmmac/dwxgmac2_dma.c | 78 +-
.../net/ethernet/stmicro/stmmac/ring_mode.c | 12 +-
drivers/net/ethernet/stmicro/stmmac/stmmac.h | 1 +
.../net/ethernet/stmicro/stmmac/stmmac_main.c | 59 +-
.../net/ethernet/stmicro/stmmac/stmmac_xdp.c | 2 +-
drivers/net/pcs/Makefile | 4 +-
drivers/net/pcs/pcs-xpcs-regmap.c | 203 +++++
drivers/net/pcs/pcs-xpcs.c | 43 +-
include/linux/pcs/pcs-xpcs-regmap.h | 20 +
include/linux/stmmac.h | 1 +
include/soc/toshiba/tc956x-dwmac.h | 84 ++
26 files changed, 2341 insertions(+), 53 deletions(-)
create mode 100644 Documentation/devicetree/bindings/net/toshiba,tc956x-dwmac.yaml
create mode 100644 drivers/gpio/gpio-tc956x.c
create mode 100644 drivers/misc/tc956x_pci.c
create mode 100644 drivers/net/ethernet/stmicro/stmmac/dwmac-tc956x.c
create mode 100644 drivers/net/pcs/pcs-xpcs-regmap.c
create mode 100644 include/linux/pcs/pcs-xpcs-regmap.h
create mode 100644 include/soc/toshiba/tc956x-dwmac.h
base-commit: 254f49634ee16a731174d2ae34bc50bd5f45e731
--
2.51.0
^ permalink raw reply
* [PATCH net-next 3/3] net: selftests: add getsockopt_iter regression tests
From: Breno Leitao @ 2026-05-01 15:52 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Stefano Garzarella, Shuah Khan, sdf.kernel
Cc: netdev, linux-kernel, virtualization, linux-kselftest,
Breno Leitao, kernel-team
In-Reply-To: <20260501-getsock_one-v1-0-810ce23ea70e@debian.org>
Add a single kselftest covering the proto_ops getsockopt_iter
conversions for AF_NETLINK and AF_VSOCK, using one fixture per protocol:
netlink:
NETLINK_PKTINFO covers the flag-style int path (exact size, oversize
clamp, undersize -EINVAL); NETLINK_LIST_MEMBERSHIPS covers the
size-discovery path that always reports the required buffer length back
via optlen, even when the user buffer is too small to receive any group
bits.
vsock:
SO_VM_SOCKETS_BUFFER_SIZE covers the u64 path (exact size, oversize
clamp, undersize -EINVAL).
Each fixture also exercises an unknown optname and a bogus level so
the returned-length / errno semantics preserved by the sockopt_t
conversion are pinned down.
Signed-off-by: Breno Leitao <leitao@debian.org>
---
tools/testing/selftests/net/Makefile | 1 +
tools/testing/selftests/net/getsockopt_iter.c | 213 ++++++++++++++++++++++++++
2 files changed, 214 insertions(+)
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index a275ed5840265..baa30287cf222 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -176,6 +176,7 @@ TEST_GEN_PROGS := \
bind_timewait \
bind_wildcard \
epoll_busy_poll \
+ getsockopt_iter \
icmp_rfc4884 \
ipv6_fragmentation \
proc_net_pktgen \
diff --git a/tools/testing/selftests/net/getsockopt_iter.c b/tools/testing/selftests/net/getsockopt_iter.c
new file mode 100644
index 0000000000000..179f9e84926fd
--- /dev/null
+++ b/tools/testing/selftests/net/getsockopt_iter.c
@@ -0,0 +1,213 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Quick test for getsockopt{_iter} tests.
+ *
+ * Each fixture targets one converted protocol and pins down the
+ * returned-length / errno semantics across buffer-size variations,
+ * an unknown optname and a bogus level.
+ *
+ * - netlink: NETLINK_PKTINFO covers the flag-style int path; the
+ * NETLINK_LIST_MEMBERSHIPS cases cover the size-discovery path
+ * that always reports the required buffer length back via optlen,
+ * even when the user buffer is too small to receive any group bits.
+ * - vsock: SO_VM_SOCKETS_BUFFER_SIZE covers the u64 path.
+ *
+ * Author: Breno Leitao <leitao@debian.org>
+ */
+
+#include <errno.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <linux/netlink.h>
+#include <linux/rtnetlink.h>
+#include <linux/vm_sockets.h>
+#include <sys/socket.h>
+#include "kselftest_harness.h"
+
+#ifndef AF_VSOCK
+#define AF_VSOCK 40
+#endif
+
+/* ---------- netlink ---------- */
+
+FIXTURE(netlink)
+{
+ int fd;
+};
+
+FIXTURE_SETUP(netlink)
+{
+ int group = RTNLGRP_LINK;
+
+ self->fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
+ if (self->fd < 0)
+ SKIP(return, "AF_NETLINK socket: %s", strerror(errno));
+
+ /* Joining a multicast group grows nlk->ngroups so the
+ * NETLINK_LIST_MEMBERSHIPS path has a non-zero size to report.
+ */
+ if (setsockopt(self->fd, SOL_NETLINK, NETLINK_ADD_MEMBERSHIP,
+ &group, sizeof(group)) < 0)
+ SKIP(return, "NETLINK_ADD_MEMBERSHIP: %s", strerror(errno));
+}
+
+FIXTURE_TEARDOWN(netlink)
+{
+ if (self->fd >= 0)
+ close(self->fd);
+}
+
+TEST_F(netlink, pktinfo_exact)
+{
+ int val = -1;
+ socklen_t optlen = sizeof(val);
+
+ ASSERT_EQ(0, getsockopt(self->fd, SOL_NETLINK, NETLINK_PKTINFO,
+ &val, &optlen));
+ ASSERT_EQ(sizeof(int), optlen);
+ ASSERT_TRUE(val == 0 || val == 1);
+}
+
+TEST_F(netlink, pktinfo_oversize_clamped)
+{
+ char buf[16] = {};
+ socklen_t optlen = sizeof(buf);
+
+ ASSERT_EQ(0, getsockopt(self->fd, SOL_NETLINK, NETLINK_PKTINFO,
+ buf, &optlen));
+ ASSERT_EQ(sizeof(int), optlen);
+}
+
+TEST_F(netlink, pktinfo_undersize)
+{
+ char buf[2] = {};
+ socklen_t optlen = sizeof(buf);
+
+ ASSERT_EQ(-1, getsockopt(self->fd, SOL_NETLINK, NETLINK_PKTINFO,
+ buf, &optlen));
+ ASSERT_EQ(EINVAL, errno);
+}
+
+TEST_F(netlink, list_memberships_size_discovery)
+{
+ socklen_t optlen = 0;
+ char dummy;
+
+ ASSERT_EQ(0, getsockopt(self->fd, SOL_NETLINK,
+ NETLINK_LIST_MEMBERSHIPS,
+ &dummy, &optlen));
+ ASSERT_GT(optlen, 0);
+ ASSERT_EQ(0, optlen % sizeof(__u32));
+}
+
+TEST_F(netlink, list_memberships_full_read)
+{
+ __u32 buf[64] = {};
+ socklen_t optlen = sizeof(buf);
+
+ ASSERT_EQ(0, getsockopt(self->fd, SOL_NETLINK,
+ NETLINK_LIST_MEMBERSHIPS,
+ buf, &optlen));
+ ASSERT_GT(optlen, 0);
+ ASSERT_LE(optlen, sizeof(buf));
+ ASSERT_EQ(0, optlen % sizeof(__u32));
+}
+
+TEST_F(netlink, bad_level)
+{
+ int val;
+ socklen_t optlen = sizeof(val);
+
+ ASSERT_EQ(-1, getsockopt(self->fd, SOL_SOCKET + 1, NETLINK_PKTINFO,
+ &val, &optlen));
+ ASSERT_EQ(ENOPROTOOPT, errno);
+}
+
+TEST_F(netlink, bad_optname)
+{
+ int val;
+ socklen_t optlen = sizeof(val);
+
+ ASSERT_EQ(-1, getsockopt(self->fd, SOL_NETLINK, 0x7fff,
+ &val, &optlen));
+ ASSERT_EQ(ENOPROTOOPT, errno);
+}
+
+/* ---------- vsock ---------- */
+
+FIXTURE(vsock)
+{
+ int fd;
+};
+
+FIXTURE_SETUP(vsock)
+{
+ self->fd = socket(AF_VSOCK, SOCK_STREAM, 0);
+ if (self->fd < 0)
+ SKIP(return, "AF_VSOCK socket: %s", strerror(errno));
+}
+
+FIXTURE_TEARDOWN(vsock)
+{
+ if (self->fd >= 0)
+ close(self->fd);
+}
+
+TEST_F(vsock, buffer_size_exact)
+{
+ uint64_t val = 0;
+ socklen_t optlen = sizeof(val);
+
+ ASSERT_EQ(0, getsockopt(self->fd, AF_VSOCK,
+ SO_VM_SOCKETS_BUFFER_SIZE,
+ &val, &optlen));
+ ASSERT_EQ(sizeof(uint64_t), optlen);
+ ASSERT_GT(val, 0);
+}
+
+TEST_F(vsock, buffer_size_oversize_clamped)
+{
+ char buf[16] = {};
+ socklen_t optlen = sizeof(buf);
+
+ ASSERT_EQ(0, getsockopt(self->fd, AF_VSOCK,
+ SO_VM_SOCKETS_BUFFER_SIZE,
+ buf, &optlen));
+ ASSERT_EQ(sizeof(uint64_t), optlen);
+}
+
+TEST_F(vsock, buffer_size_undersize)
+{
+ char buf[4] = {};
+ socklen_t optlen = sizeof(buf);
+
+ ASSERT_EQ(-1, getsockopt(self->fd, AF_VSOCK,
+ SO_VM_SOCKETS_BUFFER_SIZE,
+ buf, &optlen));
+ ASSERT_EQ(EINVAL, errno);
+}
+
+TEST_F(vsock, bad_level)
+{
+ uint64_t val;
+ socklen_t optlen = sizeof(val);
+
+ ASSERT_EQ(-1, getsockopt(self->fd, SOL_SOCKET + 1,
+ SO_VM_SOCKETS_BUFFER_SIZE,
+ &val, &optlen));
+ ASSERT_EQ(ENOPROTOOPT, errno);
+}
+
+TEST_F(vsock, bad_optname)
+{
+ uint64_t val;
+ socklen_t optlen = sizeof(val);
+
+ ASSERT_EQ(-1, getsockopt(self->fd, AF_VSOCK, 0x7fff,
+ &val, &optlen));
+ ASSERT_EQ(ENOPROTOOPT, errno);
+}
+
+TEST_HARNESS_MAIN
--
2.52.0
^ permalink raw reply related
* [PATCH net-next 2/3] vsock: convert to getsockopt_iter
From: Breno Leitao @ 2026-05-01 15:52 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Stefano Garzarella, Shuah Khan, sdf.kernel
Cc: netdev, linux-kernel, virtualization, linux-kselftest,
Breno Leitao, kernel-team
In-Reply-To: <20260501-getsock_one-v1-0-810ce23ea70e@debian.org>
Convert AF_VSOCK's getsockopt implementation to use the new
getsockopt_iter callback with sockopt_t. The single
vsock_connectible_getsockopt() callback is shared by both
vsock_stream_ops and vsock_seqpacket_ops, so both proto_ops are
updated to use .getsockopt_iter.
Key changes:
- Replace (char __user *optval, int __user *optlen) with sockopt_t *opt
- Use opt->optlen for buffer length (input) and returned size (output)
- Use copy_to_iter() instead of put_user()/copy_to_user()
Signed-off-by: Breno Leitao <leitao@debian.org>
---
net/vmw_vsock/af_vsock.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 44037b066a5ff..d4a97eeb596e6 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -155,6 +155,7 @@
#include <linux/random.h>
#include <linux/skbuff.h>
#include <linux/smp.h>
+#include <linux/uio.h>
#include <linux/socket.h>
#include <linux/stddef.h>
#include <linux/sysctl.h>
@@ -2091,8 +2092,7 @@ static int vsock_connectible_setsockopt(struct socket *sock,
static int vsock_connectible_getsockopt(struct socket *sock,
int level, int optname,
- char __user *optval,
- int __user *optlen)
+ sockopt_t *opt)
{
struct sock *sk = sock->sk;
struct vsock_sock *vsk = vsock_sk(sk);
@@ -2110,8 +2110,7 @@ static int vsock_connectible_getsockopt(struct socket *sock,
if (level != AF_VSOCK)
return -ENOPROTOOPT;
- if (get_user(len, optlen))
- return -EFAULT;
+ len = opt->optlen;
memset(&v, 0, sizeof(v));
@@ -2142,11 +2141,10 @@ static int vsock_connectible_getsockopt(struct socket *sock,
return -EINVAL;
if (len > lv)
len = lv;
- if (copy_to_user(optval, &v, len))
+ if (copy_to_iter(&v, len, &opt->iter_out) != len)
return -EFAULT;
- if (put_user(len, optlen))
- return -EFAULT;
+ opt->optlen = len;
return 0;
}
@@ -2631,7 +2629,7 @@ static const struct proto_ops vsock_stream_ops = {
.listen = vsock_listen,
.shutdown = vsock_shutdown,
.setsockopt = vsock_connectible_setsockopt,
- .getsockopt = vsock_connectible_getsockopt,
+ .getsockopt_iter = vsock_connectible_getsockopt,
.sendmsg = vsock_connectible_sendmsg,
.recvmsg = vsock_connectible_recvmsg,
.mmap = sock_no_mmap,
@@ -2653,7 +2651,7 @@ static const struct proto_ops vsock_seqpacket_ops = {
.listen = vsock_listen,
.shutdown = vsock_shutdown,
.setsockopt = vsock_connectible_setsockopt,
- .getsockopt = vsock_connectible_getsockopt,
+ .getsockopt_iter = vsock_connectible_getsockopt,
.sendmsg = vsock_connectible_sendmsg,
.recvmsg = vsock_connectible_recvmsg,
.mmap = sock_no_mmap,
--
2.52.0
^ permalink raw reply related
* [PATCH net-next 1/3] netlink: convert to getsockopt_iter
From: Breno Leitao @ 2026-05-01 15:52 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Stefano Garzarella, Shuah Khan, sdf.kernel
Cc: netdev, linux-kernel, virtualization, linux-kselftest,
Breno Leitao, kernel-team
In-Reply-To: <20260501-getsock_one-v1-0-810ce23ea70e@debian.org>
Convert AF_NETLINK's getsockopt implementation to use the new
getsockopt_iter callback with sockopt_t.
Key changes:
- Replace (char __user *optval, int __user *optlen) with sockopt_t *opt
- Use opt->optlen for buffer length (input) and returned size (output)
- Use copy_to_iter() instead of put_user()/copy_to_user()
- For NETLINK_LIST_MEMBERSHIPS: walk the groups bitmap and emit each
u32 sequentially via copy_to_iter(), then set opt->optlen to the
total size required (ALIGN(BITS_TO_BYTES(ngroups), sizeof(u32))).
The wrapper writes opt->optlen back to userspace even on partial
failure, preserving the existing API that lets userspace discover
the needed allocation size.
Signed-off-by: Breno Leitao <leitao@debian.org>
---
net/netlink/af_netlink.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 2aeb0680807d6..db3be485b4804 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -39,6 +39,7 @@
#include <linux/fs.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
+#include <linux/uio.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/rtnetlink.h>
@@ -1716,18 +1717,18 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
}
static int netlink_getsockopt(struct socket *sock, int level, int optname,
- char __user *optval, int __user *optlen)
+ sockopt_t *opt)
{
struct sock *sk = sock->sk;
struct netlink_sock *nlk = nlk_sk(sk);
unsigned int flag;
int len, val;
+ u32 group;
if (level != SOL_NETLINK)
return -ENOPROTOOPT;
- if (get_user(len, optlen))
- return -EFAULT;
+ len = opt->optlen;
if (len < 0)
return -EINVAL;
@@ -1751,14 +1752,14 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
idx = pos / sizeof(unsigned long);
shift = (pos % sizeof(unsigned long)) * 8;
- if (put_user((u32)(nlk->groups[idx] >> shift),
- (u32 __user *)(optval + pos))) {
+ group = (u32)(nlk->groups[idx] >> shift);
+ if (copy_to_iter(&group, sizeof(u32),
+ &opt->iter_out) != sizeof(u32)) {
err = -EFAULT;
break;
}
}
- if (put_user(ALIGN(BITS_TO_BYTES(nlk->ngroups), sizeof(u32)), optlen))
- err = -EFAULT;
+ opt->optlen = ALIGN(BITS_TO_BYTES(nlk->ngroups), sizeof(u32));
netlink_unlock_table();
return err;
}
@@ -1784,8 +1785,8 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
len = sizeof(int);
val = test_bit(flag, &nlk->flags);
- if (put_user(len, optlen) ||
- copy_to_user(optval, &val, len))
+ opt->optlen = len;
+ if (copy_to_iter(&val, len, &opt->iter_out) != len)
return -EFAULT;
return 0;
@@ -2813,7 +2814,7 @@ static const struct proto_ops netlink_ops = {
.listen = sock_no_listen,
.shutdown = sock_no_shutdown,
.setsockopt = netlink_setsockopt,
- .getsockopt = netlink_getsockopt,
+ .getsockopt_iter = netlink_getsockopt,
.sendmsg = netlink_sendmsg,
.recvmsg = netlink_recvmsg,
.mmap = sock_no_mmap,
--
2.52.0
^ permalink raw reply related
* [PATCH net-next 0/3] net: Convert AF_NETLINK and AF_VSOCK to getsockopt_iter API
From: Breno Leitao @ 2026-05-01 15:52 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Stefano Garzarella, Shuah Khan, sdf.kernel
Cc: netdev, linux-kernel, virtualization, linux-kselftest,
Breno Leitao, kernel-team
Continue the work to convert protocols to the new getsockopt_iter API.
Convert AF_NETLINK and AF_VSOCK getsockopt implementations to the new
sockopt_t/getsockopt_iter API, and add kselftests that verify the size
and errno semantics are preserved across the conversion.
I chose these two socket families because they are probably one of the
most used protocols,, ensuring that any potential bugs will be
discovered and reported quickly.
The selftest was added as suggested by Stanislav Fomichev in [1].
Link: https://lore.kernel.org/all/adkSnyihmD1Atfcf@devvm17672.vll0.facebook.com/ [1]
Signed-off-by: Breno Leitao <leitao@debian.org>
---
Breno Leitao (3):
netlink: convert to getsockopt_iter
vsock: convert to getsockopt_iter
net: selftests: add getsockopt_iter regression tests
net/netlink/af_netlink.c | 21 +--
net/vmw_vsock/af_vsock.c | 16 +-
tools/testing/selftests/net/Makefile | 1 +
tools/testing/selftests/net/getsockopt_iter.c | 213 ++++++++++++++++++++++++++
4 files changed, 232 insertions(+), 19 deletions(-)
---
base-commit: edf4bee4215a173c0534d1851d7523d827149f9e
change-id: 20260501-getsock_one-a62758a9ba25
prerequisite-change-id: 20260501-getsock_iter_first-87f6a74c24e0:v1
Best regards,
--
Breno Leitao <leitao@debian.org>
^ permalink raw reply
* Re: [PATCH] selftests: mptcp: add test for IPv6 subflow SLAB placement
From: Matthieu Baerts @ 2026-05-01 15:45 UTC (permalink / raw)
To: Vastargazing, martineau
Cc: mptcp, netdev, linux-kselftest, shuah, stable, Florian Westphal
In-Reply-To: <20260501151454.211598-1-vebohr@gmail.com>
Hi Vastargazing,
(+cc Florian who did a similar review on netfilter ML)
On 01/05/2026 17:14, Vastargazing wrote:
> Add mptcp_v6_initcall.sh to verify that MPTCP IPv6 subflow child
> sockets are allocated from the TCPv6 SLAB cache, not the kmalloc-4k
> fallback.
>
> tcpv6_prot_override must copy tcpv6_prot after proto_register(&tcpv6_prot)
> populates tcpv6_prot.slab. If the copy runs too early, override.slab
> stays NULL (frozen by __ro_after_init) and subflow children fall back
> to kmalloc-4k. This lacks SLAB_TYPESAFE_BY_RCU, allowing lockless
> ehash lookups in __inet_lookup_established to read freed memory.
>
> The test exercises the IPv6 accept path via MPTCP connections between
> two network namespaces, then checks that the TCPv6 slab active object
> count grew. On a fixed kernel, the delta is ~2 * NR_CONNS (one subflow
> per side per connection); on a broken kernel, it stays near zero because
> children land in kmalloc-4k instead.
>
> Topology: two netns connected via veth pair with /64 ULA addresses;
> NR_CONNS parallel short-lived MPTCP connections are established and held
> open long enough to sample /proc/slabinfo. The test skips if
> CONFIG_MPTCP_IPV6 is absent (checked via kallsyms) or /proc/slabinfo is
> unreadable.
>
> Verified on Ubuntu 6.17 kernel predating the fix: TAP "not ok 1 ...
> TCPv6 slab gains MPTCPv6 subflow children" with delta=0. On kernels
> with the fix, delta is well above the threshold of NR_CONNS/2.
Thank you for adding this new test, and for having validated
9b55b253907e ("mptcp: fix slab-use-after-free in
__inet_lookup_established").
(...)
My following review comments are very similar to the ones shared by
Florian for another on the Netfilter ML.
> diff --git a/tools/testing/selftests/net/mptcp/mptcp_v6_initcall.sh b/tools/testing/selftests/net/mptcp/mptcp_v6_initcall.sh
> new file mode 100644
This should say '755', else you get
# Warning: file mptcp_v6_initcall.sh is not executable
(Plus our CI will not validate that test.)
Me too, I'm not sure whether we should add regression tests for
regression tests sake. Else we'll also quickly accumulate thousands of
such scripts and test run time will explode. Globally, we prefer adding
a new subtest instead of a full test.
Here, you are validating an issue in the init code, that is very
unlikely to change. If a test was needed during the submission of the
original fix, I would have suggested adding a quick test in our
packetdrill repo instead:
https://github.com/multipath-tcp/packetdrill
An existing packetdrill test could be modified to check the slabs in v4
and v6, but I'm still not convinced it is worth it.
Cheers,
Matt
--
Sponsored by the NGI0 Core fund.
^ permalink raw reply
* Re: [RFC PATCH 1/2] net: af_unix: Useful handling of LSM denials on SCM_RIGHTS
From: Jori Koolstra @ 2026-05-01 15:34 UTC (permalink / raw)
To: Kuniyuki Iwashima
Cc: Alexander Viro, Christian Brauner, Jan Kara, Eric Dumazet,
Paolo Abeni, Willem de Bruijn, David S . Miller, Jakub Kicinski,
Jens Axboe, Kees Cook, Simon Horman, Andy Lutomirski, Will Drewry,
Jeff Layton, Oleg Nesterov, Andrei Vagin, Pavel Tikhomirov,
Mateusz Guzik, Joel Granados, Charlie Mirabile, Aleksa Sarai,
linux-fsdevel, linux-kernel, netdev, io-uring
In-Reply-To: <CAAVpQUBKeN2KtRkRAFr8sYJM1_-rbkdjsujau5fAyaiP_dO6FA@mail.gmail.com>
> Op 30-04-2026 04:04 CEST schreef Kuniyuki Iwashima <kuniyu@google.com>:
>
>
> On Tue, Apr 28, 2026 at 10:51 AM Jori Koolstra <jkoolstra@xs4all.nl> wrote:
> >
> > Right now if some LSM such as Smack denies an AF_UNIX socket peer to
> > receive an SCM_RIGHTS fd the SCM_RIGHTS fd array will be cut short at
> > that point, and MSG_CTRUNC is set on return of recvmsg(). This is
> > highly problematic behaviour, because it leaves the receiver
> > wondering what happened. As per man page MSG_CTRUNC is supposed to
> > indicate that the control buffer was sized too short, but suddenly
> > a permission error might result in the exact same flag being set.
> > Moreover, the receiver has no chance to determine how many fds got
> > originally sent and how many were suppressed.[1]
> >
> > Add two MSG_* flags:
>
> Since we only have 5 bits remaining for future extension,
> we need to consider the use case a bit more carefully.
>
Right. Since it wasn't a lot of work I implemented it exactly as the request
was made from userspace, and then discuss it from there. By the way, I suppose
nothing can be done about that small flag space?
>
> > - MSG_RIGHTS_DENIAL is set whenever any file is rejected by the LSM
> > during recvmsg() of SCM_RIGHTS fds.
>
> Is this really needed ?
>
> Even if the fd array is truncated, the application will traverse
> the array anyway since it has some fds already installed (to
> clean up in case of MSG_CTRUNC ?).
>
> Then, it will find the -EPERM entry.
>
> I assume no one uses MSG_RIGHTS_DENIAL without
> MSG_RIGHTS_FILTER.
>
I guess that is a fair assumption to make. We can certainly do without
MSG_RIGHTS_DENIAL if saving flags is important. I also suggested that
we may see whether we can make MSG_RIGHTS_FILTER the default behavior.
In the mean time I've found grep.app, and it turns out the answer is no.
Apparently almost no one checks even for the truncation flag (mostly 1 fd
is passed and then it is check the cmsg lenght). But cpython has this for
instance:
/* Close all descriptors coming from SCM_RIGHTS, so they don't leak. */
for (cmsgh = ((msg.msg_controllen > 0) ? CMSG_FIRSTHDR(&msg) : NULL);
cmsgh != NULL; cmsgh = CMSG_NXTHDR(&msg, cmsgh)) {
cmsg_status = get_cmsg_data_len(&msg, cmsgh, &cmsgdatalen);
if (cmsg_status < 0)
break;
if (cmsgh->cmsg_level == SOL_SOCKET &&
cmsgh->cmsg_type == SCM_RIGHTS) {
size_t numfds;
int *fdp;
numfds = cmsgdatalen / sizeof(int);
fdp = (int *)CMSG_DATA(cmsgh);
while (numfds-- > 0)
close(*fdp++);
}
if (cmsg_status != 0)
break;
}
>
> > - If MSG_RIGHTS_FILTER is passed as a flag to recvmsg(), the SCM_RIGHTS
>
> Does this flag need per-recvmsg() granularity ?
>
Perhaps not. What would be the alternative? A fcntl option for the socket fd?
> If the application does not welcome the truncated fd array,
> it would have passed MSG_RIGHTS_FILTER to every
> recvmsg(), no ?
>
Correct.
Thanks,
Jori.
^ permalink raw reply
* Re: [PATCH] amd-xgbe: fix PTP addend overflow causing frozen clock
From: Simon Horman @ 2026-05-01 15:32 UTC (permalink / raw)
To: gfuchedgi
Cc: Raju Rangoju, Prashanth Kumar K R, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Richard Cochran,
netdev, linux-kernel
In-Reply-To: <20260429-fix-xgbe-ptp-addend-v1-1-fca5b0ca5e62@gmail.com>
On Wed, Apr 29, 2026 at 02:54:14PM -0700, Gregory Fuchedgi via B4 Relay wrote:
> From: Gregory Fuchedgi <gfuchedgi@gmail.com>
>
> XGBE_PTP_ACT_CLK_FREQ and XGBE_V2_PTP_ACT_CLK_FREQ were 10x too
> large (500MHz/1GHz instead of 50MHz/100MHz), causing the computed
> addend to overflow the 32-bit tstamp_addend. In the general case
> this would result in the clock advancing at the wrong rate. For v2
> (PCI), ptpclk_rate is hardcoded to 125MHz, so the addend formula
> (ACT_CLK_FREQ << 32) / ptpclk_rate yields exactly 8 * 2^32, and
> when stored to the 32-bit tstamp_addend the value is zero. With
> addend = 0 the hardware accumulator never overflows and the PTP
> clock is fully stopped. For v1 (platform), ptpclk_rate is read from
> ACPI/DT so the exact overflow behavior depends on the
> firmware-reported frequency.
>
> Define the constants as NSEC_PER_SEC / SSINC so the relationship is
> explicit and cannot drift out of sync.
>
> Fixes: fbd47be098b5 ("amd-xgbe: add hardware PTP timestamping support")
> Tested-by: Gregory Fuchedgi <gfuchedgi@gmail.com>
> Signed-off-by: Gregory Fuchedgi <gfuchedgi@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
There is an AI generated review of this patch available on sashiko.dev.
While I do believe the issues flagged there warrant investigation
as possible follow-up, I do not think they should delay progress
of this patch.
^ permalink raw reply
* Re: [PATCH iproute2-next 0/5] netshaper: Extend netshaper support
From: Stephen Hemminger @ 2026-05-01 15:17 UTC (permalink / raw)
To: Mohsin Bashir; +Cc: netdev, dsahern, pabeni, kuba, ernis
In-Reply-To: <20260501011611.3533573-1-mohsin.bashr@gmail.com>
On Thu, 30 Apr 2026 18:16:06 -0700
Mohsin Bashir <mohsin.bashr@gmail.com> wrote:
> From: Mohsin Bashir <hmohsin@meta.com>
>
> This series extends the netshaper CLI with missing parameter support
> and adds the group command for building scheduling hierarchies.
>
> The existing netshaper tool only supports setting bw-max on individual
> shapers. This series adds the remaining shaper attributes (bw-min,
> weight, priority) needed for TX scheduling, and introduces the
> group command which ties leaf shapers to a parent node in a single
> operation.
>
> Mohsin Bashir (5):
> netshaper: Extract parse_scope() and parse_rate() helpers
> netshaper: Add bw-min and weight parameter support
> netshaper: Extend show output with parent, bw-min and weight
> netshaper: Make handle id optional for node scope
> netshaper: Add group command for creating scheduling hierarchies
>
> netshaper/netshaper.c | 398 ++++++++++++++++++++++++++++++++++--------
> 1 file changed, 324 insertions(+), 74 deletions(-)
>
AI review liked the patch but found a JSON break
As always there are some noise things here.
Like the suggestion about noreturn attribute.
Subject: Re: [PATCH iproute2] netshaper: Add group command and parameter support
On Thu, 30 Apr 2026, Mohsin Bashir wrote:
> This series adds netshaper support for scheduling hierarchies, bw-min/weight
> parameters, and improved output formatting.
Overall the patches look good and follow most iproute2 conventions properly.
I especially appreciate that all new code correctly uses strcmp() instead of
matches() for argument parsing.
However, there are a few minor issues that should be addressed:
> @@ -47,55 +54,98 @@ static const char *net_shaper_scope_names[NET_SHAPER_SCOPE_MAX + 1] = {
> static void print_netshaper_attrs(struct nlmsghdr *answer)
> [...]
> + printf("\n");
> }
The raw printf("\n") at the end of print_netshaper_attrs() breaks JSON output.
All output should use the print_XXX() helpers to maintain proper JSON formatting.
This should be:
print_nl();
or handled by the print functions themselves. The print helpers ensure that
JSON output remains valid when the -j flag is used.
> @@ -103,13 +153,14 @@ static int do_cmd(int argc, char **argv, int cmd)
> [...]
> while (argc > 0) {
> if (strcmp(*argv, "dev") == 0) {
> NEXT_ARG();
> ifindex = ll_name_to_index(*argv);
In do_cmd(), the return value of ll_name_to_index() is not properly validated.
When the device doesn't exist, this function returns 0. The code should check:
ifindex = ll_name_to_index(*argv);
if (ifindex == 0) {
fprintf(stderr, "Device \"%s\" not found\n", *argv);
return -1;
}
This validation is correctly done in do_group() but missing in do_cmd().
> @@ -31,13 +31,20 @@ static void usage(void)
> {
> fprintf(stderr,
> "Usage: netshaper [ OPTIONS ] { COMMAND | help }\n"
The usage() function should be marked with __attribute__((noreturn)) as per
iproute2 coding conventions:
static void usage(void) __attribute__((noreturn));
static void usage(void)
{
...
exit(-1);
}
This helps the compiler with optimization and static analysis.
These are all minor issues in an otherwise well-structured patch series.
The code properly uses designated initializers, validates input with
appropriate helpers, and follows the error handling patterns correctly.
With these small fixes, the series would be ready for inclusion.
Best regards
^ permalink raw reply
* [PATCH] selftests: mptcp: add test for IPv6 subflow SLAB placement
From: Vastargazing @ 2026-05-01 15:14 UTC (permalink / raw)
To: matttbe, martineau
Cc: mptcp, netdev, linux-kselftest, shuah, Vastargazing, stable
Add mptcp_v6_initcall.sh to verify that MPTCP IPv6 subflow child
sockets are allocated from the TCPv6 SLAB cache, not the kmalloc-4k
fallback.
tcpv6_prot_override must copy tcpv6_prot after proto_register(&tcpv6_prot)
populates tcpv6_prot.slab. If the copy runs too early, override.slab
stays NULL (frozen by __ro_after_init) and subflow children fall back
to kmalloc-4k. This lacks SLAB_TYPESAFE_BY_RCU, allowing lockless
ehash lookups in __inet_lookup_established to read freed memory.
The test exercises the IPv6 accept path via MPTCP connections between
two network namespaces, then checks that the TCPv6 slab active object
count grew. On a fixed kernel, the delta is ~2 * NR_CONNS (one subflow
per side per connection); on a broken kernel, it stays near zero because
children land in kmalloc-4k instead.
Topology: two netns connected via veth pair with /64 ULA addresses;
NR_CONNS parallel short-lived MPTCP connections are established and held
open long enough to sample /proc/slabinfo. The test skips if
CONFIG_MPTCP_IPV6 is absent (checked via kallsyms) or /proc/slabinfo is
unreadable.
Verified on Ubuntu 6.17 kernel predating the fix: TAP "not ok 1 ...
TCPv6 slab gains MPTCPv6 subflow children" with delta=0. On kernels
with the fix, delta is well above the threshold of NR_CONNS/2.
Fixes: b19bc2945b40 ("mptcp: implement delegated actions")
Cc: stable@vger.kernel.org
Signed-off-by: Vastargazing <vebohr@gmail.com>
---
tools/testing/selftests/net/mptcp/Makefile | 1 +
.../selftests/net/mptcp/mptcp_v6_initcall.sh | 140 ++++++++++++++++++
2 files changed, 141 insertions(+)
create mode 100644 tools/testing/selftests/net/mptcp/mptcp_v6_initcall.sh
diff --git a/tools/testing/selftests/net/mptcp/Makefile b/tools/testing/selftests/net/mptcp/Makefile
index 22ba0da2adb8..c9f329441490 100644
--- a/tools/testing/selftests/net/mptcp/Makefile
+++ b/tools/testing/selftests/net/mptcp/Makefile
@@ -14,6 +14,7 @@ TEST_PROGS := \
mptcp_connect_splice.sh \
mptcp_join.sh \
mptcp_sockopt.sh \
+ mptcp_v6_initcall.sh \
pm_netlink.sh \
simult_flows.sh \
userspace_pm.sh \
diff --git a/tools/testing/selftests/net/mptcp/mptcp_v6_initcall.sh b/tools/testing/selftests/net/mptcp/mptcp_v6_initcall.sh
new file mode 100644
index 000000000000..c55fc74b5ffb
--- /dev/null
+++ b/tools/testing/selftests/net/mptcp/mptcp_v6_initcall.sh
@@ -0,0 +1,140 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Verify that MPTCP IPv6 subflow child sockets are allocated from the
+# TCPv6 slab cache.
+#
+# tcpv6_prot_override is initialised by copying tcpv6_prot, which is only
+# safe after proto_register(&tcpv6_prot) has populated tcpv6_prot.slab.
+# If the override copy runs too early during init, override.slab stays
+# NULL and __ro_after_init freezes that. Subflow child sockets then fall
+# back to kmalloc (kmalloc-4k for a TCPv6 sock), which lacks
+# SLAB_TYPESAFE_BY_RCU; lockless ehash lookups in __inet_lookup_established
+# can read freed memory.
+#
+# This test exercises the IPv6 accept path, which goes through the
+# override proto, and then asserts that the live TCPv6 slab population
+# grew. On a kernel where the override slab is NULL the delta is ~0,
+# because the children land in kmalloc-4k instead.
+
+#shellcheck disable=SC2086
+
+. "$(dirname "${0}")/mptcp_lib.sh"
+
+ns1=""
+ns2=""
+ret=0
+
+NR_CONNS=20
+TIMEOUT_POLL=30
+TIMEOUT_TEST=$((TIMEOUT_POLL * 2 + 1))
+PORT_BASE=20000
+
+# This function is used in the cleanup trap
+#shellcheck disable=SC2317,SC2329
+cleanup()
+{
+ for ns in "${ns1}" "${ns2}"; do
+ [ -n "${ns}" ] || continue
+ ip netns pids "${ns}" | xargs --no-run-if-empty kill -SIGKILL &>/dev/null
+ done
+ mptcp_lib_ns_exit "${ns1}" "${ns2}"
+}
+
+mptcp_lib_check_mptcp
+mptcp_lib_check_tools ip ss
+
+if ! mptcp_lib_kallsyms_has "tcpv6_prot_override$"; then
+ mptcp_lib_pr_skip "CONFIG_MPTCP_IPV6 not available"
+ exit ${KSFT_SKIP}
+fi
+
+if ! [ -r /proc/slabinfo ]; then
+ mptcp_lib_pr_skip "/proc/slabinfo not readable"
+ exit ${KSFT_SKIP}
+fi
+
+if ! awk '/^TCPv6 / { found = 1 } END { exit !found }' /proc/slabinfo; then
+ mptcp_lib_pr_skip "TCPv6 slab cache not present"
+ exit ${KSFT_SKIP}
+fi
+
+trap cleanup EXIT
+mptcp_lib_ns_init ns1 ns2
+
+ip -n "${ns1}" link add eth1 type veth peer name eth1 netns "${ns2}"
+ip -n "${ns1}" link set eth1 up
+ip -n "${ns1}" -6 addr add fc00::1/64 dev eth1 nodad
+ip -n "${ns2}" link set eth1 up
+ip -n "${ns2}" -6 addr add fc00::2/64 dev eth1 nodad
+
+# Wait for DAD-less addresses to settle
+ip -n "${ns1}" -6 route get fc00::2 >/dev/null 2>&1 || sleep 0.1
+
+get_tcpv6_active()
+{
+ awk '/^TCPv6 / { print $2 }' /proc/slabinfo
+}
+
+before=$(get_tcpv6_active)
+
+for i in $(seq 1 ${NR_CONNS}); do
+ echo "a" |
+ timeout ${TIMEOUT_TEST} \
+ ip netns exec "${ns2}" \
+ ./mptcp_connect -6 -p $((PORT_BASE + i)) -l \
+ -t ${TIMEOUT_POLL} -w ${TIMEOUT_POLL} \
+ :: >/dev/null 2>&1 &
+done
+
+# wait_local_port_listen() only checks one port. Walk every port so we
+# do not start the connectors before all listeners are ready.
+for i in $(seq 1 ${NR_CONNS}); do
+ mptcp_lib_wait_local_port_listen "${ns2}" $((PORT_BASE + i))
+done
+
+for i in $(seq 1 ${NR_CONNS}); do
+ echo "b" |
+ timeout ${TIMEOUT_TEST} \
+ ip netns exec "${ns1}" \
+ ./mptcp_connect -6 -p $((PORT_BASE + i)) \
+ -t ${TIMEOUT_POLL} -w ${TIMEOUT_POLL} \
+ fc00::2 >/dev/null 2>&1 &
+done
+
+# Wait for the accept side to materialise child sockets. ss reports the
+# number of established TCP connections in ns2 owned by mptcp_connect.
+established=0
+for _ in $(seq 20); do
+ established=$(ip netns exec "${ns2}" ss -H -t -6 state established 2>/dev/null | wc -l)
+ [ "${established}" -ge "${NR_CONNS}" ] && break
+ sleep 1
+done
+
+after=$(get_tcpv6_active)
+delta=$(( after - before ))
+
+# Conservative threshold: NR_CONNS connections (each producing at least
+# a server-side accepted child) must leave a clearly observable footprint
+# in the TCPv6 slab. On a regressed kernel, override.slab == NULL routes
+# every child into kmalloc-4k and the TCPv6 delta stays near zero.
+threshold=$(( NR_CONNS / 2 ))
+
+msg="TCPv6 slab gains MPTCPv6 subflow children"
+mptcp_lib_print_title "${msg}"
+if [ "${established}" -lt "${NR_CONNS}" ]; then
+ mptcp_lib_pr_fail "only ${established}/${NR_CONNS} connections established"
+ mptcp_lib_result_fail "${msg}"
+ ret=${KSFT_FAIL}
+elif [ "${delta}" -ge "${threshold}" ]; then
+ mptcp_lib_pr_ok "delta=${delta}"
+ mptcp_lib_result_pass "${msg}"
+else
+ mptcp_lib_pr_fail "delta=${delta} below ${threshold}:" \
+ "subflow children likely in kmalloc fallback"
+ mptcp_lib_result_fail "${msg}"
+ ret=${KSFT_FAIL}
+fi
+
+mptcp_lib_result_print_all_tap
+exit ${ret}
--
2.51.0
^ permalink raw reply related
* Re: [PATCH v2 iproute2-next] utils: add fflush_monitor() helper
From: Stephen Hemminger @ 2026-05-01 15:10 UTC (permalink / raw)
To: David Ahern
Cc: Eric Dumazet, David S . Miller, Jakub Kicinski, Paolo Abeni,
netdev, eric.dumazet
In-Reply-To: <6e00eaa5-a4d7-45dd-9d90-fb319b76c9fa@kernel.org>
On Thu, 30 Apr 2026 09:35:08 -0600
David Ahern <dsahern@kernel.org> wrote:
> On 4/27/26 2:19 AM, Eric Dumazet wrote:
> > Some fflush() calls only make sense for monitor programs.
> >
> > For other cases, forcing a flush is expensive.
> >
> > After this patch, ip, tc and ss are correctly buffering most of their
> > output when redirected to a file.
> >
> > Signed-off-by: Eric Dumazet <edumazet@google.com>
> > ---
> > include/utils.h | 7 +++++++
> > ip/ipaddress.c | 12 +++++++-----
> > ip/iplink.c | 4 ++--
> > ip/ipmonitor.c | 1 +
> > ip/ipmptcp.c | 10 +++++-----
> > ip/ipneigh.c | 4 ++--
> > ip/ipnetconf.c | 2 +-
> > ip/ipnetns.c | 2 +-
> > ip/ipnexthop.c | 12 ++++++------
> > ip/iproute.c | 4 ++--
> > ip/iprule.c | 2 +-
> > ip/iptoken.c | 2 +-
> > ip/tcp_metrics.c | 2 +-
> > lib/utils.c | 1 +
> > misc/ss.c | 3 ++-
> > tc/tc_class.c | 2 +-
> > tc/tc_filter.c | 2 +-
> > tc/tc_monitor.c | 1 +
> > tc/tc_qdisc.c | 2 +-
> > 19 files changed, 44 insertions(+), 31 deletions(-)
> >
>
> no longer applies after merging main to next.
>
I put the other version in iproute2 since wanted to test and it
did not depend on any later kernel changes
^ permalink raw reply
* [PATCH 1/1] ovpn: tcp - defer TX from softirq to workqueue
From: Dao Zhong Ma @ 2026-05-01 14:54 UTC (permalink / raw)
To: linux-kernel, netdev, antonio
Cc: sd, andrew+netdev, davem, edumazet, kuba, pabeni, Dao Zhong Ma
In-Reply-To: <20260501145425.757147-1-cz1346219@gmail.com>
ovpn_tcp_send_skb() holds sk->sk_lock.slock while performing the full TCP
send in softirq context. This can hold the spinlock for a long time
(large skb), blocking lock_sock() users. This can starve the RCU GP
kthread and trigger RCU stalls warnings and hung tasks.
Defer the TCP send operation to process context:
- In interrupt context, only enqueue the skb under the spinlock
schedule tcp_tx_work.
- In process context, dequeue and flush the send queue under lock_sock()
This reduces the softirq critical section to a short duration, allowing
lock_sock() users to make progress and preventing RCU stalls.
Signed-off-by: Dao Zhong Ma <cz1346219@gmail.com>
---
drivers/net/ovpn/tcp.c | 80 +++++++++++++++++++++++++++++++-----------
1 file changed, 59 insertions(+), 21 deletions(-)
diff --git a/drivers/net/ovpn/tcp.c b/drivers/net/ovpn/tcp.c
index 65054cc84be5..d75ad0c22a30 100644
--- a/drivers/net/ovpn/tcp.c
+++ b/drivers/net/ovpn/tcp.c
@@ -6,6 +6,7 @@
* Author: Antonio Quartulli <antonio@openvpn.net>
*/
+#include <linux/interrupt.h>
#include <linux/skbuff.h>
#include <net/hotdata.h>
#include <net/inet_common.h>
@@ -312,6 +313,40 @@ static void ovpn_tcp_send_sock(struct ovpn_peer *peer, struct sock *sk)
peer->tcp.tx_in_progress = false;
}
+/* Caller must hold sk->sk_lock.slock. */
+static bool ovpn_tcp_queue_skb(struct ovpn_peer *peer, struct sk_buff *skb)
+{
+ if (skb_queue_len(&peer->tcp.out_queue) >=
+ READ_ONCE(net_hotdata.max_backlog)) {
+ dev_dstats_tx_dropped(peer->ovpn->dev);
+ kfree_skb(skb);
+ return false;
+ }
+
+ __skb_queue_tail(&peer->tcp.out_queue, skb);
+ return true;
+}
+
+/* Caller must hold sk->sk_lock.slock and own the socket. */
+static void ovpn_tcp_tx_flush(struct ovpn_peer *peer, struct sock *sk)
+{
+ struct sk_buff *skb;
+
+ if (peer->tcp.out_msg.skb)
+ ovpn_tcp_send_sock(peer, sk);
+
+ while (!peer->tcp.out_msg.skb) {
+ skb = __skb_dequeue(&peer->tcp.out_queue);
+ if (!skb)
+ break;
+
+ peer->tcp.out_msg.skb = skb;
+ peer->tcp.out_msg.len = skb->len;
+ peer->tcp.out_msg.offset = 0;
+ ovpn_tcp_send_sock(peer, sk);
+ }
+}
+
void ovpn_tcp_tx_work(struct work_struct *work)
{
struct ovpn_socket *sock;
@@ -320,7 +355,7 @@ void ovpn_tcp_tx_work(struct work_struct *work)
lock_sock(sock->sk);
if (sock->peer)
- ovpn_tcp_send_sock(sock->peer, sock->sk);
+ ovpn_tcp_tx_flush(sock->peer, sock->sk);
release_sock(sock->sk);
}
@@ -345,32 +380,38 @@ static void ovpn_tcp_send_sock_skb(struct ovpn_peer *peer, struct sock *sk,
void ovpn_tcp_send_skb(struct ovpn_peer *peer, struct sock *sk,
struct sk_buff *skb)
{
+ struct ovpn_socket *sock;
u16 len = skb->len;
+ bool queued;
*(__be16 *)__skb_push(skb, sizeof(u16)) = htons(len);
- spin_lock_nested(&sk->sk_lock.slock, OVPN_TCP_DEPTH_NESTING);
- if (sock_owned_by_user(sk)) {
- if (skb_queue_len(&peer->tcp.out_queue) >=
- READ_ONCE(net_hotdata.max_backlog)) {
- dev_dstats_tx_dropped(peer->ovpn->dev);
- kfree_skb(skb);
- goto unlock;
- }
- __skb_queue_tail(&peer->tcp.out_queue, skb);
- } else {
- ovpn_tcp_send_sock_skb(peer, sk, skb);
+ if (unlikely(in_interrupt())) {
+ spin_lock_nested(&sk->sk_lock.slock, OVPN_TCP_DEPTH_NESTING);
+ queued = ovpn_tcp_queue_skb(peer, skb);
+ spin_unlock(&sk->sk_lock.slock);
+ if (!queued)
+ return;
+
+ rcu_read_lock();
+ sock = rcu_dereference_sk_user_data(sk);
+ if (sock)
+ schedule_work(&sock->tcp_tx_work);
+ rcu_read_unlock();
+ return;
}
-unlock:
- spin_unlock(&sk->sk_lock.slock);
+
+ lock_sock_nested(sk, OVPN_TCP_DEPTH_NESTING);
+ queued = ovpn_tcp_queue_skb(peer, skb);
+ if (queued)
+ ovpn_tcp_tx_flush(peer, sk);
+ release_sock(sk);
}
static void ovpn_tcp_release(struct sock *sk)
{
- struct sk_buff_head queue;
struct ovpn_socket *sock;
struct ovpn_peer *peer;
- struct sk_buff *skb;
rcu_read_lock();
sock = rcu_dereference_sk_user_data(sk);
@@ -390,11 +431,7 @@ static void ovpn_tcp_release(struct sock *sk)
}
rcu_read_unlock();
- __skb_queue_head_init(&queue);
- skb_queue_splice_init(&peer->tcp.out_queue, &queue);
-
- while ((skb = __skb_dequeue(&queue)))
- ovpn_tcp_send_sock_skb(peer, sk, skb);
+ ovpn_tcp_tx_flush(peer, sk);
peer->tcp.sk_cb.prot->release_cb(sk);
ovpn_peer_put(peer);
@@ -653,3 +690,4 @@ void __init ovpn_tcp_init(void)
&inet6_stream_ops);
#endif
}
+
--
2.54.0
^ permalink raw reply related
* [PATCH 0/1] ovpn: tcp - defer TX from softirq to workqueue
From: Dao Zhong Ma @ 2026-05-01 14:54 UTC (permalink / raw)
To: linux-kernel, netdev, antonio
Cc: sd, andrew+netdev, davem, edumazet, kuba, pabeni, Dao Zhong Ma
Hi,
I observed system hangs when using OpenVPN across suspend/resume
under heavy network load.
The issue can be reproduced with:
1. Establish an OpenVPN connection
2. Generate traffic with iperf3
3. Add CPU/memory pressure with stress-ng
4. Suspend and resume the system
After resume, the system may become unresponsive. SysRq output shows
tasks spinning on sk->sk_lock.slock, and RCU stall warnings are
observed.
Kernel logs and stack traces:
kernel: watchdog: BUG: soft lockup - CPU#4 stuck for 22s! [stress-ng-cpu:11506]
kernel: CPU#4 Utilization every 4000ms during lockup:
kernel: #1: 0% system, 100% softirq, 1% hardirq, 0% idle
kernel: #2: 0% system, 100% softirq, 0% hardirq, 0% idle
kernel: #3: 0% system, 100% softirq, 1% hardirq, 0% idle
kernel: #4: 0% system, 100% softirq, 0% hardirq, 0% idle
kernel: #5: 0% system, 100% softirq, 0% hardirq, 0% idle
kernel: CPU: 4 UID: 1000 PID: 11506 Comm: stress-ng-cpu Tainted: G U 7.0.2-2-cachyos #1 PREEMPT 136cb9373f01c1def72b1b5def9dd1fcc7884035
kernel: Tainted: [U]=USER
kernel: Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP05, BIOS 03.18 01/08/2026
kernel: RIP: 0010:native_queued_spin_lock_slowpath+0x5a/0x260
kernel: Code: 08 0f 92 c0 b9 ff 00 ff ff 23 0f 89 c2 c1 e2 08 09 ca 81 fa 00 01 00 00 73 5a 85 c9 74 0e 66 90 80 3f 00 74 07 f3 90 80 3f 00 <75> f9 66 c7 07 01 00 65 48 ff 05 3f c6 d8 01 5b 41 5e 41 5f 5d e9
kernel: RSP: 0000:ffffcf548d9bb758 EFLAGS: 00000202
kernel: RAX: 0000000000000000 RBX: ffff8ec75f9f4d48 RCX: 0000000000000001
kernel: RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffff8ec75f9f4d48
kernel: RBP: 0000000000000000 R08: 0000000000000000 R09: ffff8ec8547abd80
kernel: R10: 0000000000000020 R11: 0000000000000020 R12: ffff8ec75f9f4c00
kernel: R13: ffff8ec862d9d400 R14: ffff8ec753ade400 R15: ffff8ec771548800
kernel: FS: 00007f9b4fcd0b00(0000) GS:ffff8eccfe99c000(0000) knlGS:0000000000000000
kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kernel: CR2: 00007ffb7e1f8e38 CR3: 0000000166ced000 CR4: 0000000000f50ef0
kernel: PKRU: 55555554
kernel: Call Trace:
kernel: <TASK>
kernel: _raw_spin_lock+0x2a/0x40
kernel: ovpn_tcp_send_skb+0x4c/0x130 [ovpn 03847a96bef64ed5cc535ef1935e53bb388bcced]
kernel: ovpn_encrypt_post+0x95/0x1f0 [ovpn 03847a96bef64ed5cc535ef1935e53bb388bcced]
kernel: ovpn_send+0x15f/0x230 [ovpn 03847a96bef64ed5cc535ef1935e53bb388bcced]
kernel: ovpn_net_xmit+0x30f/0x560 [ovpn 03847a96bef64ed5cc535ef1935e53bb388bcced]
kernel: dev_hard_start_xmit+0x93/0x140
kernel: __dev_queue_xmit+0x99b/0xa80
kernel: ? __dev_queue_xmit+0x6f/0xa80
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: ? nf_hook_slow+0x4b/0xd0
kernel: ? __pfx_ip_finish_output+0x10/0x10
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: ? nf_hook+0x9c/0xb0
kernel: ip_finish_output2+0x189/0x320
kernel: dst_output+0x99/0xd0
kernel: __ip_queue_xmit+0x209/0x350
kernel: __tcp_transmit_skb+0x4cb/0xba0
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: ? __alloc_skb+0x2b6/0x340
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: ? skb_split+0x5f/0x3c0
kernel: tcp_write_xmit+0xad3/0x1a50
kernel: ? __pfx_tcp_write_timer+0x10/0x10
kernel: tcp_send_loss_probe+0x94/0x2b0
kernel: ? __pfx_tcp_write_timer+0x10/0x10
kernel: tcp_write_timer+0x67/0xb0
kernel: __run_timer_base+0x33d/0x500
kernel: tmigr_handle_remote+0x3da/0x3e0
kernel: run_timer_softirq.cold+0x47/0x394
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: ? __pfx_tick_nohz_handler+0x10/0x10
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: ? ktime_get+0x48/0xa0
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: ? clockevents_program_event+0xaa/0xf0
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: irq_exit_rcu+0x1ad/0x290
kernel: sysvec_apic_timer_interrupt+0x33/0x80
kernel: asm_sysvec_apic_timer_interrupt+0x1a/0x20
kernel: RIP: 0033:0x559fc1ece66f
kernel: Code: 44 89 c8 c0 e8 03 44 31 c0 83 e0 01 66 41 d1 e8 f7 d8 66 25 08 84 44 31 c0 45 89 c8 41 c0 e8 04 41 31 c0 41 83 e0 01 41 f7 d8 <66> 41 81 e0 08 84 66 d1 e8 41 31 c0 44 89 c8 c0 e8 05 44 31 c0 83
kernel: RSP: 002b:00007ffe1344e860 EFLAGS: 00000297
kernel: RAX: 00000000ffff5912 RBX: 000000000000000a RCX: 00007ffe1344ebcb
kernel: RDX: 00007ffe1344ea27 RSI: 00007ffe1344ec60 RDI: 0000559fc318d450
kernel: RBP: 00007ffe1344edf0 R08: 00000000ffffffff R09: 00000000000000b4
kernel: R10: 0000559fc333b3e0 R11: 0000000000000000 R12: 00007f9b4fcc6258
kernel: R13: 0000000000000000 R14: 0000559fc316ed00 R15: 0000559fc3337e00
kernel: </TASK>
Dao Zhong Ma (1):
ovpn: tcp - defer TX from softirq to workqueue to avoid RCU stalls
drivers/net/ovpn/tcp.c | 80 +++++++++++++++++++++++++++++++-----------
1 file changed, 59 insertions(+), 21 deletions(-)
--
2.54.0
^ permalink raw reply
* Re: [PATCH net-next] net: tls: reshuffle the device ops check
From: Simon Horman @ 2026-05-01 15:02 UTC (permalink / raw)
To: Jakub Kicinski
Cc: davem, netdev, edumazet, pabeni, andrew+netdev, john.fastabend,
sd
In-Reply-To: <20260429213001.1908235-1-kuba@kernel.org>
On Wed, Apr 29, 2026 at 02:30:01PM -0700, Jakub Kicinski wrote:
> We try to validate during registration that the netdev
> has ops if it has features. This is currently somewhat sillily
> written because we have a dereference before a NULL check
> on the ops struct. Straighten this out.
>
> No functional change intended other than saving ourselves
> the very theoretical crash with a bad driver.
>
> Note that we check earlier in the function that either ops
> or TLS features are set for the device in question.
>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
^ permalink raw reply
* [PATCH 6/6] NFSD: Convert nfsd_export_shutdown() to sunrpc_cache_destroy_net()
From: Chuck Lever @ 2026-05-01 14:51 UTC (permalink / raw)
To: Misbah Anjum N, Jeff Layton, NeilBrown, Olga Kornievskaia,
Dai Ngo, Tom Talpey, Trond Myklebust, Anna Schumaker,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Yang Erkun
Cc: linux-nfs, linux-kernel, netdev, Chuck Lever
In-Reply-To: <20260501-cache-uaf-fix-v1-0-a49928bf4817@oracle.com>
From: Chuck Lever <chuck.lever@oracle.com>
The earlier conversion to the shared sunrpc cache workqueue left
nfsd_export_shutdown() open-coding the unregister + drain + destroy
sequence to amortize a single rcu_barrier()+flush across both
caches. That micro-optimization runs only on namespace teardown
and module unload, neither of which is performance-sensitive.
Switch both caches to sunrpc_cache_destroy_net() so that the
canonical teardown idiom is applied uniformly. A future change to
the per-cache release callback that requires the cache_detail to
remain valid through the drain remains correct without per-call-site
auditing.
With the last external caller of sunrpc_cache_drain() gone, drop
the symbol export and the public declaration, and mark the
function static so the compiler can inline it into
sunrpc_cache_destroy_net().
Assisted-by: Claude:claude-opus-4-7[1m]
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
fs/nfsd/export.c | 8 ++------
include/linux/sunrpc/cache.h | 1 -
net/sunrpc/cache.c | 7 ++-----
3 files changed, 4 insertions(+), 12 deletions(-)
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 3c4340e743fa..c19f8e8c4f9e 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -2250,12 +2250,8 @@ nfsd_export_shutdown(struct net *net)
dprintk("nfsd: shutting down export module (net: %x).\n", net->ns.inum);
- cache_unregister_net(nn->svc_expkey_cache, net);
- cache_unregister_net(nn->svc_export_cache, net);
- /* One drain covers both caches' deferred release work. */
- sunrpc_cache_drain();
- cache_destroy_net(nn->svc_expkey_cache, net);
- cache_destroy_net(nn->svc_export_cache, net);
+ sunrpc_cache_destroy_net(nn->svc_expkey_cache, net);
+ sunrpc_cache_destroy_net(nn->svc_export_cache, net);
svcauth_unix_purge(net);
dprintk("nfsd: export shutdown complete (net: %x).\n", net->ns.inum);
diff --git a/include/linux/sunrpc/cache.h b/include/linux/sunrpc/cache.h
index 84802438a5fc..22c18eeb5a97 100644
--- a/include/linux/sunrpc/cache.h
+++ b/include/linux/sunrpc/cache.h
@@ -238,7 +238,6 @@ extern void cache_flush(void);
extern void cache_purge(struct cache_detail *detail);
#define NEVER (0x7FFFFFFF)
extern void sunrpc_cache_queue_release(struct rcu_work *rwork);
-extern void sunrpc_cache_drain(void);
extern int cache_register_net(struct cache_detail *cd, struct net *net);
extern void cache_unregister_net(struct cache_detail *cd, struct net *net);
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index be7a0c8c416e..62ce334104d9 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1737,18 +1737,15 @@ void sunrpc_cache_queue_release(struct rcu_work *rwork)
}
EXPORT_SYMBOL_GPL(sunrpc_cache_queue_release);
-/**
- * sunrpc_cache_drain - drain pending cache release work
- *
+/*
* Wait for outstanding RCU callbacks to enqueue their release
* work, then flush that work to completion.
*/
-void sunrpc_cache_drain(void)
+static void sunrpc_cache_drain(void)
{
rcu_barrier();
flush_workqueue(sunrpc_cache_wq);
}
-EXPORT_SYMBOL_GPL(sunrpc_cache_drain);
/**
* sunrpc_cache_destroy_net - quiesce and tear down a per-net cache
--
2.53.0
^ permalink raw reply related
* [PATCH 5/6] SUNRPC: Hold cd->net for the lifetime of cache files
From: Chuck Lever @ 2026-05-01 14:51 UTC (permalink / raw)
To: Misbah Anjum N, Jeff Layton, NeilBrown, Olga Kornievskaia,
Dai Ngo, Tom Talpey, Trond Myklebust, Anna Schumaker,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Yang Erkun
Cc: linux-nfs, linux-kernel, netdev, Chuck Lever
In-Reply-To: <20260501-cache-uaf-fix-v1-0-a49928bf4817@oracle.com>
From: Chuck Lever <chuck.lever@oracle.com>
Each per-net sunrpc cache exposes three files under
/proc/net/rpc/<cachename>/: content, channel, and flush.
Their open helpers (content_open, cache_open, open_flush) take a
reference on cd->owner via try_module_get() but no reference on
cd->net. When the network namespace exits, cache_unregister_net()
followed by cache_destroy_net() free cd->hash_table and cd
synchronously without RCU deferral. Any subsequent operation on
the still-open file dereferences the freed cache_detail.
The fault produced by sosreport on aarch64 and ppc64le shows the
typical signature: cache_check_rcu() faults reading h->flags off
a garbage cache_head pointer that came from __cache_seq_start()
walking a freed cd->hash_table. Commit e7fcf179b82d ("NFSD: Hold
net reference for the lifetime of /proc/fs/nfs/exports fd") closed
this hole only for the /proc/fs/nfs/exports file, which has its own
open path; the sunrpc cache files were left exposed.
Take a get_net(cd->net) in content_open(), cache_open(), and
open_flush() once the open has otherwise succeeded, and a matching
put_net() at the tail of each release helper. Holding the net
reference for the open file lifetime prevents the namespace from
exiting while a cache fd is open, which in turn prevents
cache_destroy_net() from running and freeing cd from under the
reader.
put_net() can drop the last namespace reference, in which case
__put_net() queues net_cleanup_work on netns_wq. That work runs
ops_undo_list() on another CPU, which invokes sunrpc_exit_net()
and frees cd via cache_destroy_net(). The release helper must
not dereference cd after put_net(): cache_release(),
content_release(), and release_flush() therefore capture
cd->owner and cd->net into local variables before calling
put_net(net) and module_put(owner).
Reported-by: Misbah Anjum N <misanjum@linux.ibm.com>
Closes: https://lore.kernel.org/linux-nfs/8cf80f450085ac17164e8fa1391e9635@linux.ibm.com/
Fixes: 1b10f0b603c0 ("SUNRPC: no need get cache ref when protected by rcu")
Assisted-by: Claude:claude-opus-4-7[1m]
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
net/sunrpc/cache.c | 22 +++++++++++++++++++---
1 file changed, 19 insertions(+), 3 deletions(-)
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 733bcd3daa46..be7a0c8c416e 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1037,6 +1037,7 @@ static int cache_open(struct inode *inode, struct file *filp,
if (filp->f_mode & FMODE_WRITE)
atomic_inc(&cd->writers);
filp->private_data = rp;
+ get_net(cd->net);
return 0;
}
@@ -1044,6 +1045,8 @@ static int cache_release(struct inode *inode, struct file *filp,
struct cache_detail *cd)
{
struct cache_reader *rp = filp->private_data;
+ struct module *owner;
+ struct net *net;
if (rp) {
struct cache_request *rq = NULL;
@@ -1080,7 +1083,10 @@ static int cache_release(struct inode *inode, struct file *filp,
atomic_dec(&cd->writers);
cd->last_close = seconds_since_boot();
}
- module_put(cd->owner);
+ owner = cd->owner;
+ net = cd->net;
+ put_net(net);
+ module_put(owner);
return 0;
}
@@ -1466,14 +1472,19 @@ static int content_open(struct inode *inode, struct file *file,
seq = file->private_data;
seq->private = cd;
+ get_net(cd->net);
return 0;
}
static int content_release(struct inode *inode, struct file *file,
struct cache_detail *cd)
{
+ struct module *owner = cd->owner;
+ struct net *net = cd->net;
int ret = seq_release(inode, file);
- module_put(cd->owner);
+
+ put_net(net);
+ module_put(owner);
return ret;
}
@@ -1482,13 +1493,18 @@ static int open_flush(struct inode *inode, struct file *file,
{
if (!cd || !try_module_get(cd->owner))
return -EACCES;
+ get_net(cd->net);
return nonseekable_open(inode, file);
}
static int release_flush(struct inode *inode, struct file *file,
struct cache_detail *cd)
{
- module_put(cd->owner);
+ struct module *owner = cd->owner;
+ struct net *net = cd->net;
+
+ put_net(net);
+ module_put(owner);
return 0;
}
--
2.53.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox