* [PATCH net-next 12/12] arm64: dts: qcom: qcs6490-rb3gen2: enable TC9564 with a single QCS8081 phy
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: Daniel Thompson, elder, mohd.anwar, a0987203069, alexandre.torgue,
ast, boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk,
hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
From: Daniel Thompson <daniel@riscstar.com>
The QCS6490 RB3Gen2 includes a Toshiba TC9564 (a.k.a. Qualcomm QPS615).
TC9564 is an twin Ethernet-AVB/TSN bridge with an integrated PCIe switch.
There are multiple builds of RB3Gen2 with components included/excluded.
That means whether or not there is a phy attached to eMAC0 depends on
the exact board. However all versions include a TC9564 combined with a
single QCS8081 attached to eMAC1.
Add properties to the existing PCI nodes to describe how the TC9564 and
QCS8081 are connected to each other (and to the host SoC).
(Note: "pci1179,0220" is documented in the "net/toshiba,tc956x-dwmac.yaml"
binding, but checkpatch.pl doesn't recognize that.)
Co-developed-by: Alex Elder <elder@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
---
arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts | 45 +++++++++++++++++++-
1 file changed, 44 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts b/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts
index e393ccf1884af..72c89aa7a2e43 100644
--- a/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts
+++ b/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts
@@ -308,6 +308,16 @@ vdd_ntn_1p8: regulator-vdd-ntn-1p8 {
regulator-enable-ramp-delay = <10000>;
};
+ qep_1p8: regulator-qep-1p8 {
+ compatible = "regulator-fixed";
+ regulator-name = "qep_1p8";
+ gpio = <&pm7325_gpios 8 GPIO_ACTIVE_HIGH>;
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ enable-active-high;
+ regulator-always-on;
+ };
+
wcn6750-pmu {
compatible = "qcom,wcn6750-pmu";
pinctrl-0 = <&bt_en>;
@@ -937,20 +947,46 @@ pcie@3,0 {
ranges;
bus-range = <0x5 0xff>;
- pci@0,0 {
+ tc956x_emac0: pci@0,0 {
+ compatible = "pci1179,0220";
reg = <0x50000 0x0 0x0 0x0 0x0>;
#address-cells = <3>;
#size-cells = <2>;
device_type = "pci";
ranges;
+
+ gpio-controller;
+ #gpio-cells = <2>;
};
pci@0,1 {
+ compatible = "pci1179,0220";
reg = <0x50100 0x0 0x0 0x0 0x0>;
#address-cells = <3>;
#size-cells = <2>;
device_type = "pci";
ranges;
+
+ phy-mode = "sgmii";
+ phy-handle = <&tc956x_emac1_phy>;
+
+ mdio {
+ compatible = "snps,dwmac-mdio";
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ tc956x_emac1_phy: ethernet-phy@1c {
+ compatible = "ethernet-phy-id004d.d101";
+ reg = <0x1c>;
+ reset-gpios = <&tc956x_emac0 1 GPIO_ACTIVE_LOW>;
+ reset-assert-us = <20>;
+ reset-deassert-us = <20>;
+
+ pinctrl-names = "default";
+ pinctrl-0 = <&qep_irq_pin>;
+ interrupts-extended = <&tlmm 101 IRQ_TYPE_EDGE_FALLING>;
+ };
+ };
};
};
};
@@ -1524,6 +1560,13 @@ usb_hub_reset_state: usb-hub-reset-state {
drive-strength = <2>;
bias-disable;
};
+
+ qep_irq_pin: qep-irq-state {
+ pins = "gpio101";
+ function = "gpio";
+ drive-strength = <2>;
+ bias-disable;
+ };
};
&lpass_audiocc {
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 11/12] misc: tc956x_pci: add TC956x/QPS615 support
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: daniel, elder, mohd.anwar, a0987203069, alexandre.torgue, ast,
boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk, hkallweit1,
inochiama, john.fastabend, julianbraha, livelycarpet87,
matthew.gerlach, mcoquelin.stm32, me, prabhakar.mahadev-lad.rj,
richardcochran, rohan.g.thomas, sdf, siyanteng, weishangjuan,
wens, netdev, bpf, linux-arm-msm, devicetree, linux-gpio,
linux-stm32, linux-arm-kernel, linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
The Toshiba TC956x is an Ethernet AVB/TSN bridge, and is
essentially a small and highly-specialized SoC. It implements
a number of internal functions, including a GPIO controller,
control registers managing internal reset and clock control
signals, a PCIe switch and internal endpoint, and mapping
hardware that translates between PCIe and internal addressing.
The internal PCIe endpoint implements two PCIe functions, each of
which has an attached eMAC. Each of these eMACs is represented as
two separate devices: a PCIe function; and the eMAC. The PCIe
function driver serves as the primary driver, creating other
associated devices using the auxiliary bus.
PCIe function 0 is responsible for managing common features on
the TC956x chip. It initializes a "chip" data structure that
keeps track of common information, and makes that available via
its platform_data pointer to its PCIe function 1 peer. It also
configures the address mapping hardware, and sets up an auxiliary
device for the GPIO controller.
As probing concludes, an auxiliary device is created to represent
the eMAC functionality attached to the PCIe function. A block
of information is set up to be shared with the auxiliary device.
It provides the IRQ to be used by the MAC device, as well as a
some memory-mapped I/O pointers and a few other bits of information
about the chip. This information is supplied via the auxiliary
device's platform_data pointer.
Co-developed-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
drivers/misc/Kconfig | 10 +
drivers/misc/Makefile | 1 +
drivers/misc/tc956x_pci.c | 667 ++++++++++++++++++++++++++++++++++++++
3 files changed, 678 insertions(+)
create mode 100644 drivers/misc/tc956x_pci.c
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 00683bf06258f..d021f37129e27 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -644,6 +644,16 @@ config MCHP_LAN966X_PCI
- lan966x-miim (MDIO_MSCC_MIIM)
- lan966x-switch (LAN966X_SWITCH)
+config TOSHIBA_TC956X_PCI
+ tristate "Toshiba TC956X PCI function support"
+ depends on PCI
+ select AUXILIARY_BUS
+ help
+ This enables support for the two PCI functions implemented by
+ the embedded PCIe endpoint in the Toshiba TC956X. This driver
+ creates auxiliary devices and requires drivers for these devices
+ to function.
+
source "drivers/misc/c2port/Kconfig"
source "drivers/misc/eeprom/Kconfig"
source "drivers/misc/cb710/Kconfig"
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index b32a2597d2467..644d508338382 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -75,3 +75,4 @@ obj-$(CONFIG_MCHP_LAN966X_PCI) += lan966x-pci.o
obj-y += keba/
obj-y += amd-sbi/
obj-$(CONFIG_MISC_RP1) += rp1/
+obj-$(CONFIG_TOSHIBA_TC956X_PCI) += tc956x_pci.o
diff --git a/drivers/misc/tc956x_pci.c b/drivers/misc/tc956x_pci.c
new file mode 100644
index 0000000000000..741a0ae0d3afb
--- /dev/null
+++ b/drivers/misc/tc956x_pci.c
@@ -0,0 +1,667 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright (C) 2026 by RISCstar Solutions Corporation. All rights reserved.
+ */
+
+/*
+ * The Toshiba TC956X implements a PCIe Gen 3 switch that connects an
+ * upstream x4 port to three downstream PCIe ports--two external ones
+ * and an internal one which implements an internal PCIe endpoint. The
+ * endpoint implements two PCIe functions, each having a Synopsys XGMAC
+ * Ethernet interface.
+ *
+ * The TC956X implements other functionality, including an embedded
+ * MCU, a UART, a GPIO controller, internal resets and clocks, and
+ * interrupt handling. These features are separate from (and in some
+ * cases used by) both Ethernet XGMACs. Each Ethernet MAC must be
+ * attached to a working PHY for it to be functional, and for this
+ * reason either of them (or both!) might not be usable/used.
+ *
+ * To support the non-XGMAC functionality on the TC956X regardless of
+ * the presence of either Ethernet PHY, the Ethernet functions are
+ * treated as two parts: a PCIe function; and a Synopsys XGMAC component.
+ * The PCIe function has access to the BARs used by the XGMAC, and maps
+ * them for use. Each XGMAP is treated as an auxiliary sub-device of
+ * its (parent) PCIe function, and is probed and bound separate from it.
+ *
+ * This PCI driver binds to the Toshiba TC956X (physical) PCI function
+ * (VID 0x1179, DID 0x0220). There are two of these present on the
+ * TC956X SoC. This driver maps the PCI BARs and performs other initial
+ * setup, then creates auxiliary devices.
+ *
+ * Embedded PCI function 0 manages non-MAC functionality. This includes
+ * creating and registering the GPIO auxiliary device (if necessary), as
+ * well as asserting and deasserting internal reset signals and enabling
+ * and disabling internal clocks.
+ *
+ * Both PCI functions create auxiliary devices to implement an Ethernet
+ * XGMAC. A block of data (struct tc956x_dwmac_data) is shared using
+ * the auxiliary device's platform data with the stmmac driver that
+ * binds to the XGMAC auxiliary device. This includes a number of
+ * pointers to memory regions used by the stmmac driver.
+ */
+
+#include <linux/auxiliary_bus.h>
+#include <linux/compiler_types.h>
+#include <linux/device.h>
+#include <linux/dev_printk.h>
+#include <linux/init.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/pci.h>
+#include <linux/property.h>
+#include <linux/regmap.h>
+#include <linux/types.h>
+
+#include <soc/toshiba/tc956x-dwmac.h>
+
+#define DRIVER_NAME TC956X_PCIE_DRIVER_NAME
+
+#define GPIO_DEVICE_NAME "tc9564-gpio"
+
+#define PCI_DEVICE_ID_TOSHIBA_TC956X 0x0220
+
+/* PCI BAR assignments */
+#define PCI_BAR_BRIDGE_CONFIG 0 /* For TAMAP */
+#define PCI_BAR_SFR 4 /* For all other features */
+
+/* Chip and revision ID register */
+#define NCID_OFFSET 0x0000
+#define NCID_REV_ID_MASK GENMASK(7, 0)
+
+/* Reset and clock register offsets. MAC resets and clocks are controlled
+ * by bits in register 0 for MAC0, register 1 for MAC1. Other non-MAC
+ * resets and clocks (whose IDs are defined here) are controlled by bits
+ * in register 0.
+ *
+ * These are relative to the base of the clock/reset regmap.
+ */
+#define RSTCTRL0_OFFSET 0x0008
+#define RSTCTRL1_OFFSET 0x0010
+#define CLKCTRL0_OFFSET 0x0004
+#define CLKCTRL1_OFFSET 0x000c
+
+enum reset_id {
+ RESET_MCU = 0,
+ RESET_MCU1 = 1,
+ RESET_MSIGEN = 18,
+ RESET_INTC = 4,
+ RESET_UART0 = 16,
+};
+
+enum clock_id {
+ CLOCK_MCU = 0,
+ CLOCK_SRAM = 13,
+ CLOCK_MSIGEN = 18,
+ CLOCK_PLL = 24,
+ CLOCK_SGMII = 25,
+ CLOCK_REFCLK = 26,
+ CLOCK_INTC = 4,
+ CLOCK_UART0 = 16,
+};
+
+/*
+ * The TAMAP function has four AXI translation tables each with eight
+ * 4-byte registers. The Ethernet MAC accesses PCI resources through
+ * addressses based at TC956X_SLV00_SRC_ADDR, and the first translation
+ * table converts those to PCIe address space starting based at 0x0.
+ * We don't use the other three available TAMAC tables.
+ */
+#define ATR_AXI4_SLV0_OFFSET 0x0800
+#define AXI4_TABLE_ENTRY_COUNT 4
+#define AXI4_ENTRY_BASE(id) ((id) * AXI4_TABLE_STRIDE)
+#define AXI4_TABLE_STRIDE 0x20
+
+/* Address translation space parameters used for entry 0 */
+#define SLV00_ATR_SIZE 35 /* 2^36 (64 gigabytes) */
+/* TC956X_SLV00_SRC_ADDR is the source address, defined in the common header */
+#define SLV00_TRSL_ADDR 0x0000000000000000ULL
+
+/* Translation entry registers, fields, and values used */
+#define SRC_ADDR_LO_OFFSET 0x0000
+#define ATR_IMPL BIT(0) /* 1 = enabled */
+#define ATR_SIZE_MASK GENMASK(6, 1) /* size 2^(ATR + 1) */
+#define SRC_ADDR_HI_OFFSET 0x0004
+#define TRSL_ADDR_LO_OFFSET 0x0008
+#define TRSL_ADDR_HI_OFFSET 0x000c
+#define TRSL_PARAM_OFFSET 0x0010
+#define TRSL_ID_MASK GENMASK(3, 0)
+#define TRSL_ID_PCIE_TX_RX 0
+#define TRSL_PARAM_MASK GENMASK(27, 16)
+
+/*
+ * The TC956X implements an "SFR" address space, which provides access
+ * to *all* internal IP block registers, both MAC and non-MAC. This
+ * space is also accessible via an I2C interface used by the PCI pwrctl
+ * driver (in "pci-pwrctrl-tc9563.c"), though that driver accesses the
+ * range in a very limited way. For the MAC functions we divide up the
+ * range, providing specific addresses needed by the stmmac driver.
+ */
+#define EMAC_CTL_OFFSET(_mac_id) ((_mac_id) ? 0x1074 : 0x1070)
+#define MSIGEN_OFFSET(_mac_id) ((_mac_id) ? 0xf100 : 0xf000)
+#define DWMAC_OFFSET(_mac_id) ((_mac_id) ? 0x48000 : 0x40000)
+
+/*
+ * struct tc956x_chip - Common information related to the TC956X chip
+ * @dev: Device structure for function 0
+ * @sfr: Mapped SFR regions (BAR 4, one per PCI function)
+ * @bridge_config: Regmap used for bridge configuration (BAR 0)
+ * @reset_clock_regmap: Regmap used for resets and clocks
+ * @rev_id: Chip revision ID (for quirks)
+ */
+struct tc956x_chip {
+ struct device *dev;
+ void __iomem *sfr[2];
+ void __iomem *bridge_config;
+ struct regmap *reset_clock_regmap;
+ u8 rev_id;
+};
+
+static const struct regmap_config gpio_regmap_config = {
+ .name = "tc956x-gpio",
+ .reg_bits = 32,
+ .reg_stride = 4,
+ .reg_base = 0x1200, /* Register GPIOI0 */
+ .val_bits = 32,
+ .max_register = 0x1214, /* Register GPIOO1 */
+};
+
+static const struct regmap_config reset_clock_regmap_config = {
+ .name = "tc956x-clk-reset",
+ .reg_bits = 32,
+ .reg_stride = 4,
+ .reg_base = 0x1000, /* Register NCTLSTS */
+ .val_bits = 32,
+ .max_register = 0x1010, /* Register NRSTCTRL1 */
+};
+
+/* Common clock/reset register update function (also used for MACs) */
+void tc956x_reset_clock_set(const struct tc956x_chip *chip, bool reset,
+ bool reg0, bool set, u8 bit)
+{
+ u32 mask = BIT(bit);
+ u32 offset;
+
+ if (reset)
+ offset = reg0 ? RSTCTRL0_OFFSET : RSTCTRL1_OFFSET;
+ else
+ offset = reg0 ? CLKCTRL0_OFFSET : CLKCTRL1_OFFSET;
+
+ /* Note: no need to check for errors on read/write for MMIO regmap */
+ (void)regmap_update_bits(chip->reset_clock_regmap, offset, mask,
+ set ? mask : 0);
+}
+EXPORT_SYMBOL_GPL(tc956x_reset_clock_set);
+
+static inline void chip_reset_assert(const struct tc956x_chip *chip,
+ enum reset_id id)
+{
+ tc956x_reset_clock_set(chip, true, true, true, (u8)id);
+}
+
+static inline void chip_reset_deassert(const struct tc956x_chip *chip,
+ enum reset_id id)
+{
+ tc956x_reset_clock_set(chip, true, true, false, (u8)id);
+}
+
+static inline void chip_clock_enable(const struct tc956x_chip *chip,
+ enum clock_id id)
+{
+ tc956x_reset_clock_set(chip, false, true, true, (u8)id);
+}
+
+static inline void chip_clock_disable(const struct tc956x_chip *chip,
+ enum clock_id id)
+{
+ tc956x_reset_clock_set(chip, false, true, false, (u8)id);
+}
+
+static void adev_release(struct device *dev)
+{
+ struct auxiliary_device *adev = to_auxiliary_dev(dev);
+
+ of_node_put(adev->dev.of_node);
+ kfree(adev);
+}
+
+static void adev_remove(void *data)
+{
+ struct auxiliary_device *adev = data;
+
+ auxiliary_device_delete(adev);
+ auxiliary_device_uninit(adev);
+}
+
+static int adev_device_add(struct device *dev, const char *name, u32 id,
+ void *platform_data)
+{
+ struct auxiliary_device *adev;
+ int ret;
+
+ adev = kzalloc_obj(*adev);
+ if (!adev)
+ return -ENOMEM;
+
+ adev->id = id;
+ adev->name = name;
+ adev->dev.parent = dev;
+ adev->dev.platform_data = platform_data;
+ adev->dev.release = adev_release;
+ device_set_of_node_from_dev(&adev->dev, dev);
+
+ ret = auxiliary_device_init(adev);
+ if (ret) {
+ of_node_put(adev->dev.of_node);
+ kfree(adev);
+ return ret;
+ }
+
+ ret = auxiliary_device_add(adev);
+ if (ret) {
+ auxiliary_device_uninit(adev);
+ return ret;
+ }
+
+ return devm_add_action_or_reset(dev, adev_remove, adev);
+}
+
+/* The embedded GPIO controller has an auxiliary device driver */
+static int chip_gpio_adev_add(struct tc956x_chip *chip)
+{
+ struct device *dev = chip->dev;
+ struct regmap *regmap;
+
+ /* If needed, PCIe function 0 implements the GPIO controller. */
+ if (!device_property_present(dev, "gpio-controller"))
+ return 0;
+
+ regmap = devm_regmap_init_mmio(dev, chip->sfr[0], &gpio_regmap_config);
+ if (IS_ERR(regmap))
+ return PTR_ERR(regmap);
+
+ return adev_device_add(dev, GPIO_DEVICE_NAME, 0, regmap);
+}
+
+/* The two embedded XGMAC controllers have an auxiliary device driver */
+static int function_xgmac_adev_add(struct pci_dev *pdev,
+ struct tc956x_chip *chip,
+ unsigned int msigen_irq)
+{
+ u8 mac_id = PCI_FUNC(pdev->devfn);
+ struct device *dev = &pdev->dev;
+ struct tc956x_dwmac_data *data;
+ void __iomem *sfr;
+ int ret;
+
+ if (mac_id > 1)
+ return -EINVAL;
+ sfr = chip->sfr[mac_id];
+
+ data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
+ if (!data)
+ return -ENOMEM;
+
+ data->chip = chip;
+ data->msigen = sfr + MSIGEN_OFFSET(mac_id);
+ data->msigen_irq = msigen_irq;
+ data->emac = sfr + DWMAC_OFFSET(mac_id);
+ data->emac_ctl = sfr + EMAC_CTL_OFFSET(mac_id);
+ data->rev_id = chip->rev_id;
+ data->mac_id = mac_id;
+
+ ret = adev_device_add(dev, TC956X_XGMAC_DEV_NAME, mac_id, data);
+ if (ret)
+ return ret;
+
+ return 0;
+}
+
+static int chip_reset_clock_init(struct tc956x_chip *chip)
+{
+ void __iomem *base = chip->sfr[0];
+ struct device *dev = chip->dev;
+ struct regmap *regmap;
+
+ regmap = devm_regmap_init_mmio(dev, base, &reset_clock_regmap_config);
+ if (IS_ERR(regmap))
+ return PTR_ERR(regmap);
+ chip->reset_clock_regmap = regmap;
+
+ return 0;
+}
+
+static int chip_tamap_init(struct tc956x_chip *chip, struct pci_dev *pdev)
+{
+ void __iomem *base;
+
+ base = pcim_iomap_region(pdev, PCI_BAR_BRIDGE_CONFIG, DRIVER_NAME);
+ if (IS_ERR(base))
+ return PTR_ERR(base);
+
+ chip->bridge_config = base + ATR_AXI4_SLV0_OFFSET;
+
+ return 0;
+}
+
+/**
+ * chip_tamap_config() - Configure the table address map registers
+ * @chip: The TC956X chip pointer
+ *
+ * Populate the registers used to translate AXI bus accesses to PCI TLPs.
+ * TC956X_SLV00_SRC_ADDR defines the base address of the AXI address range.
+ * AXI addresses are translated to the PCIe address range, whose base address
+ * is defined by SLV00_TRSL_ADDR (which is 0x0).
+ */
+static void chip_tamap_config(struct tc956x_chip *chip)
+{
+ void __iomem *table_base = chip->bridge_config;
+ void __iomem *entry_base;
+ u32 trsl_param_val;
+ u32 atr_size_val;
+ u32 val;
+ u32 i;
+
+ /*
+ * The lower bits of the source address must be zero, because the
+ * SRC_ADDR_LO register encodes the address translation space size
+ * and "implmented" bit there. The size field defines the size of
+ * the translation space (2^(ATR_SIZE + 1)). The minimum size is
+ * 4096 bytes, so ATR_SIZE value must be 11 or more.
+ */
+ BUILD_BUG_ON(!!u32_get_bits(lower_32_bits(TC956X_SLV00_SRC_ADDR),
+ ATR_SIZE_MASK));
+ BUILD_BUG_ON(TC956X_SLV00_SRC_ADDR & ATR_IMPL);
+ BUILD_BUG_ON(SLV00_ATR_SIZE < 11);
+
+ /*
+ * We only use the first AXI4 slave TAMAC table:
+ * EDMA address region: 0x10 0000 0000 - 0x1f ffff ffff
+ * is translated to: 0x00 0000 0000 - 0x0f ffff ffff
+ */
+ entry_base = table_base + AXI4_ENTRY_BASE(0);
+
+ atr_size_val = u32_encode_bits(SLV00_ATR_SIZE, ATR_SIZE_MASK);
+ atr_size_val |= ATR_IMPL;
+ val = lower_32_bits(TC956X_SLV00_SRC_ADDR) | atr_size_val;
+ writel(val, entry_base + SRC_ADDR_LO_OFFSET);
+
+ val = upper_32_bits(TC956X_SLV00_SRC_ADDR);
+ writel(val, entry_base + SRC_ADDR_HI_OFFSET);
+
+ val = lower_32_bits(SLV00_TRSL_ADDR);
+ writel(val, entry_base + TRSL_ADDR_LO_OFFSET);
+
+ val = upper_32_bits(SLV00_TRSL_ADDR);
+ writel(val, entry_base + TRSL_ADDR_HI_OFFSET);
+
+ /* This TRSL_PARAM value is assigned for all four TAMAC tables */
+ trsl_param_val = u32_encode_bits(TRSL_ID_PCIE_TX_RX, TRSL_ID_MASK);
+
+ writel(trsl_param_val, entry_base + TRSL_PARAM_OFFSET);
+
+ /* Set all other unused entries to default values (no translation) */
+ for (i = 1; i < AXI4_TABLE_ENTRY_COUNT; i++) {
+ entry_base = table_base + AXI4_ENTRY_BASE(i);
+
+ writel(0x0, entry_base + SRC_ADDR_LO_OFFSET);
+ writel(0x0, entry_base + SRC_ADDR_HI_OFFSET);
+ writel(0x0, entry_base + TRSL_ADDR_LO_OFFSET);
+ writel(0x0, entry_base + TRSL_ADDR_HI_OFFSET);
+ writel(trsl_param_val, entry_base + TRSL_PARAM_OFFSET);
+ }
+}
+
+static void chip_msigen_enable(struct tc956x_chip *chip)
+{
+ chip_clock_enable(chip, CLOCK_MSIGEN);
+ chip_reset_deassert(chip, RESET_MSIGEN);
+}
+
+static void chip_msigen_disable(struct tc956x_chip *chip)
+{
+ chip_reset_assert(chip, RESET_MSIGEN);
+ chip_clock_disable(chip, CLOCK_MSIGEN);
+}
+
+static void chip_init_state(struct tc956x_chip *chip)
+{
+ /* The only IP block we currently use is MSIGEN */
+ chip_reset_assert(chip, RESET_MCU);
+ chip_reset_assert(chip, RESET_MCU1);
+ chip_reset_assert(chip, RESET_INTC);
+ chip_reset_assert(chip, RESET_UART0);
+ chip_clock_disable(chip, CLOCK_MCU);
+ chip_clock_disable(chip, CLOCK_SRAM);
+ chip_clock_disable(chip, CLOCK_PLL);
+ chip_clock_disable(chip, CLOCK_SGMII);
+ chip_clock_disable(chip, CLOCK_REFCLK);
+ chip_clock_disable(chip, CLOCK_INTC);
+ chip_clock_disable(chip, CLOCK_UART0);
+
+ /* Start with MSIGEN in reset with its clock disabled */
+ chip_msigen_disable(chip);
+}
+
+static void chip_link_del(void *data)
+{
+ struct device_link *link = data;
+
+ device_link_del(link);
+}
+
+/*
+ * Function 0 will allocate the chip structure that is shared by both
+ * functions. Once it has allocated the structure it assigns it as
+ * the PCI device platform data. Function 1 can access the shared
+ * chip structure by looking up the function 0 device to use its
+ * platform data..
+ *
+ * Returns a chip structure pointer, or a pointer-coded error.
+ */
+static struct tc956x_chip *chip_get(struct pci_dev *pdev)
+{
+ unsigned int devfn = pdev->devfn;
+ struct device *dev = &pdev->dev;
+ struct tc956x_chip *chip;
+ struct device_link *link;
+ struct pci_dev *peer;
+ int ret;
+
+ /* Function 0 just allocates the chip structure */
+ if (!PCI_FUNC(devfn)) {
+ chip = devm_kzalloc(dev, sizeof(*chip), GFP_KERNEL);
+ if (!chip)
+ return ERR_PTR(-ENOMEM);
+
+ /*
+ * The function whose device pointer matches the chip's
+ * device pointer manages common resources (like MSIGEN).
+ */
+ chip->dev = dev;
+
+ return chip;
+ }
+
+ /* Function 1 has to get the chip structure from function 0 */
+ peer = pci_get_slot(pdev->bus, PCI_DEVFN(PCI_SLOT(devfn), 0));
+ if (!peer)
+ return ERR_PTR(-ENXIO);
+
+ /* If function 0 hasn't set up the chip yet, try again later */
+ chip = dev_get_platdata(&peer->dev);
+ if (!chip)
+ return ERR_PTR(-EPROBE_DEFER);
+
+ /* Mark function 1's device as dependent on function 0 */
+ link = device_link_add(dev, &peer->dev, DL_FLAG_STATELESS);
+ if (!link)
+ return ERR_PTR(-ENODEV);
+
+ ret = devm_add_action_or_reset(&peer->dev, chip_link_del, link);
+ if (ret)
+ return ERR_PTR(ret);
+
+ return chip;
+}
+
+static int chip_init(struct tc956x_chip *chip, struct pci_dev *pdev)
+{
+ u32 id = PCI_FUNC(pdev->devfn) ? 1 : 0;
+ u32 val;
+ int ret;
+
+ /* Both chips need to map their SFR region */
+ chip->sfr[id] = pcim_iomap_region(pdev, PCI_BAR_SFR, DRIVER_NAME);
+ if (IS_ERR(chip->sfr[id]))
+ return PTR_ERR(chip->sfr[id]);
+
+ /* Function 0 handles common initialization */
+ if (id)
+ return 0;
+
+ ret = chip_tamap_init(chip, pdev);
+ if (ret)
+ return ret;
+
+ ret = chip_reset_clock_init(chip);
+ if (ret)
+ return ret;
+
+ chip_init_state(chip);
+
+ ret = chip_gpio_adev_add(chip);
+ if (ret)
+ return ret;
+
+ /* Get the revision ID */
+ val = readl(chip->sfr[0] + NCID_OFFSET);
+ chip->rev_id = u32_get_bits(val, NCID_REV_ID_MASK);
+
+ chip_tamap_config(chip);
+ chip_msigen_enable(chip);
+
+ return 0;
+}
+
+static int
+tc956x_function_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+{
+ struct device *dev = &pdev->dev;
+ struct tc956x_chip *chip;
+ unsigned int msigen_irq;
+ int ret;
+
+ /* Despite being a PCI device, we require devicetree */
+ if (!dev->of_node)
+ return -EINVAL;
+
+ ret = pcim_enable_device(pdev);
+ if (ret)
+ return ret;
+
+ pci_set_master(pdev);
+
+ /* Function 1 gets -EPROBE_DEFER until function 0 sets platform data */
+ chip = chip_get(pdev);
+ if (IS_ERR(chip))
+ return dev_err_probe(dev, PTR_ERR(chip), "failed to get chip\n");
+
+ /* We called pcim_enable_device() so this will be freed automatically */
+ ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_MSI);
+ if (ret < 1)
+ return dev_err_probe(dev, ret ? : -EIO,
+ "failed to allocate IRQ vectors\n");
+
+ ret = pci_irq_vector(pdev, 0);
+ if (ret < 1)
+ return dev_err_probe(dev, ret ? : -EIO, "failed to get IRQ\n");
+ msigen_irq = ret;
+
+ ret = chip_init(chip, pdev);
+ if (ret)
+ return dev_err_probe(dev, ret, "failed to initialize chip\n");
+
+ /* We're ready; the other function can now probe */
+ dev->platform_data = chip;
+
+ ret = function_xgmac_adev_add(pdev, chip, msigen_irq);
+ if (ret)
+ return dev_err_probe(dev, ret, "failed to add xgmap device\n");
+
+ return 0;
+}
+
+static void tc956x_function_remove(struct pci_dev *pdev)
+{
+ struct tc956x_chip *chip = dev_get_platdata(&pdev->dev);
+
+ pci_clear_master(pdev);
+
+ if (&pdev->dev == chip->dev)
+ chip_msigen_disable(chip);
+}
+
+static const struct pci_device_id tc956x_function_id_table[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA, PCI_DEVICE_ID_TOSHIBA_TC956X), },
+ { },
+};
+MODULE_DEVICE_TABLE(pci, tc956x_function_id_table);
+
+static int tc956x_chip_suspend_noirq(struct device *dev)
+{
+ struct tc956x_chip *chip = dev_get_platdata(dev);
+ struct pci_dev *pdev = to_pci_dev(dev);
+
+ if (dev == chip->dev)
+ chip_msigen_disable(chip);
+
+ /* It seems most callers ignore the return value here */
+ pci_save_state(pdev);
+ pci_wake_from_d3(pdev, true);
+
+ return 0;
+}
+
+static int tc956x_chip_resume_noirq(struct device *dev)
+{
+ struct tc956x_chip *chip = dev_get_platdata(dev);
+ struct pci_dev *pdev = to_pci_dev(dev);
+
+ pci_wake_from_d3(pdev, false);
+ pci_set_power_state(pdev, PCI_D0);
+ pci_restore_state(pdev);
+
+ if (dev != chip->dev)
+ return 0;
+
+ /* Reconfigure tamap tables following suspend */
+ chip_tamap_config(chip);
+
+ chip_msigen_enable(chip);
+
+ return 0;
+}
+
+static DEFINE_NOIRQ_DEV_PM_OPS(tc956x_chip_pm_ops,
+ tc956x_chip_suspend_noirq,
+ tc956x_chip_resume_noirq);
+
+static struct pci_driver tc956x_function_driver = {
+ .name = DRIVER_NAME,
+ .id_table = tc956x_function_id_table,
+ .probe = tc956x_function_probe,
+ .remove = tc956x_function_remove,
+ .driver = {
+ .name = DRIVER_NAME,
+ .owner = THIS_MODULE,
+ .pm = pm_sleep_ptr(&tc956x_chip_pm_ops),
+ },
+};
+
+module_pci_driver(tc956x_function_driver);
+
+MODULE_DESCRIPTION("Toshiba TC956X PCIe Embedded Function Driver");
+MODULE_LICENSE("GPL");
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 10/12] net: stmmac: tc956x: add TC956x/QPS615 support
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: Daniel Thompson, elder, mohd.anwar, a0987203069, alexandre.torgue,
ast, boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk,
hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
From: Daniel Thompson <daniel@riscstar.com>
Toshiba TC956x is an Ethernet AVB/TSN bridge and is essentially a
small and highly-specialized SoC. TC956x includes an "eMAC" subsystem
that can be accessed, along with several other peripherals, via two
PCIe endpoint functions. There is a main driver for the endpoint that
decomposes things and creates auxiliary bus devices to model the SoC.
The eMAC consists of a Designware XGMAC, XPCS and PMA. Each eMAC is
supported by an MSIGEN that bridges TC956x level interrupts to PCIe
MSIs.
Add a driver for the eMAC/MSIGEN combination.
Co-developed-by: Alex Elder <elder@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
---
drivers/net/ethernet/stmicro/stmmac/Kconfig | 13 +
drivers/net/ethernet/stmicro/stmmac/Makefile | 2 +
.../ethernet/stmicro/stmmac/dwmac-tc956x.c | 791 ++++++++++++++++++
include/soc/toshiba/tc956x-dwmac.h | 84 ++
4 files changed, 890 insertions(+)
create mode 100644 drivers/net/ethernet/stmicro/stmmac/dwmac-tc956x.c
create mode 100644 include/soc/toshiba/tc956x-dwmac.h
diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig
index e3dd5adda5aca..66bcfaccbe21f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -404,6 +404,19 @@ config DWMAC_MOTORCOMM
This enables glue driver for Motorcomm DWMAC-based PCI Ethernet
controllers. Currently only YT6801 is supported.
+config DWMAC_TC956X
+ tristate "Toshiba TC956X DWMAC support"
+ depends on PCI
+ depends on COMMON_CLK
+ depends on TOSHIBA_TC956X_PCI
+ default m if TOSHIBA_TC956X_PCI
+ help
+ This selects the Toshiba TC956X (and Qualcomm QPS615) support in the
+ stmmac driver.
+
+ This provides support for the ethernet controllers found on these
+ devices.
+
config STMMAC_PCI
tristate "STMMAC PCI bus support"
depends on PCI
diff --git a/drivers/net/ethernet/stmicro/stmmac/Makefile b/drivers/net/ethernet/stmicro/stmmac/Makefile
index a1cea2f57252e..e8e7f95dbe3e8 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Makefile
+++ b/drivers/net/ethernet/stmicro/stmmac/Makefile
@@ -51,4 +51,6 @@ obj-$(CONFIG_STMMAC_PCI) += stmmac-pci.o
obj-$(CONFIG_DWMAC_INTEL) += dwmac-intel.o
obj-$(CONFIG_DWMAC_LOONGSON) += dwmac-loongson.o
obj-$(CONFIG_DWMAC_MOTORCOMM) += dwmac-motorcomm.o
+obj-$(CONFIG_TC956X_PCI) += tc956x-pci.o
+obj-$(CONFIG_DWMAC_TC956X) += dwmac-tc956x.o
stmmac-pci-objs:= stmmac_pci.o
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-tc956x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-tc956x.c
new file mode 100644
index 0000000000000..27ff83dd3bd9e
--- /dev/null
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-tc956x.c
@@ -0,0 +1,791 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright (C) 2026 by RISCstar Solutions Corporation. All rights reserved.
+ *
+ * Derived from code having the following copyrights:
+ * Copyright (C) 2011-2012 Vayavya Labs Pvt Ltd
+ * Copyright (C) 2025 Toshiba Electronic Devices & Storage Corporation
+ */
+
+#include <linux/auxiliary_bus.h>
+#include <linux/bitops.h>
+#include <linux/iopoll.h>
+#include <linux/irqdomain.h>
+#include <linux/irqchip/chained_irq.h>
+#include <linux/pcs/pcs-xpcs-regmap.h>
+#include <linux/pcs/pcs-xpcs.h>
+#include <linux/phy.h>
+#include <linux/regmap.h>
+#include <linux/stmmac.h>
+#include <linux/types.h>
+#include <linux/units.h>
+
+#include <soc/toshiba/tc956x-dwmac.h>
+
+#include "common.h"
+#include "dwxgmac2.h"
+#include "stmmac.h"
+
+#define DRIVER_NAME "dwmac-tc956x"
+
+#define TC956X_PTP_CLOCK_RATE (250 * HZ_PER_MHZ)
+
+#define TC956X_RX_FIFO_KB 46 /* Shared by all RX queues */
+#define TC956X_TX_FIFO_KB 46 /* Shared by all TX queues */
+
+/* Fields and values for the EMACTL registers */
+#define EMAC_SP_SEL_MASK GENMASK(3, 0)
+#define SP_SEL_SGMII_2500M 4
+#define SP_SEL_SGMII_1000M 5
+#define SP_SEL_SGMII_100M 6
+#define SP_SEL_SGMII_10M 7
+#define EMAC_PHY_INF_SEL_MASK GENMASK(5, 4)
+#define PCS_CLK_PHY 1 /* Clock from PHY */
+#define EMAC_INV_SGM_SIG_DET BIT(6) /* 1 = polarity inverted */
+#define EMAC_LPIHWCLKEN BIT(8) /* 1 = low power mode */
+#define EMAC_INIT_DONE BIT(21)
+
+/* MSIGEN Registers */
+#define MSI_OUT_EN_OFFSET 0x0000
+#define MSI_MASK_CLR_OFFSET 0x000c
+#define MSI_MASK_VALUE BIT(0)
+#define MSI_INT_STS_OFFSET 0x0010
+
+enum msigen_hwirq {
+ HWIRQ_LPI = 0,
+ HWIRQ_PMT = 1,
+ HWIRQ_EVENT = 2,
+ HWIRQ_TX0 = 3,
+ HWIRQ_RX0 = 11,
+ HWIRQ_XPCS = 19,
+ HWIRQ_PHY = 20,
+ HWIRQ_PFMAILBOX = 21,
+ HWIRQ_MSIREQ_PLS = 24
+};
+
+#define HWIRQ_COUNT 25
+
+/* Offset to the XPCS memory block, relative to the EMAC address range */
+#define DWMAC_XPCS_OFFSET 0x3a00
+
+/* Offset to the PMATOP memory block, relative to the EMAC address range */
+#define DWMAC_PMATOP_OFFSET 0x4000
+
+#define PMA_CML_GL_PM_CFG0 0x01b8
+
+/*
+ * Five sets three registers must be configured for PMA. The HWT_REFCLK
+ * registers are each separated by 0x14 bytes. The Common0 configuration
+ * registers are separated by 0x8 bytes.
+ */
+#define PMA_REG_COUNT 5
+
+#define PMA_HWT_REFCK_R_EN 0x1080
+#define PMA_HWT_REFCK_TERM_EN 0x1090
+#define PMA_HWT_REFCK_STRIDE 0x0014
+
+#define PMA_COMM_CFG_0_1 0x1888
+#define PMA_COMM_CFG_0_1_STRIDE 0x0008
+
+/* PMA_COMM_CFG_0_1 fields (WRITE_MASK is a field name) */
+#define COMM_CFG_WRITE_MASK_MASK GENMASK(16, 9)
+#define WRITE_MASK_VALUE 0xf7 /* Power-on value */
+#define COMM_CFG_ENABLE BIT(8)
+#define COMM_CFG_WRITE_DATA_MASK GENMASK(7, 0)
+#define WRITE_DATA_VALUE 0x04 /* Power-on value */
+
+/**
+ * struct tc956x_data - Toshiba-specific platform data
+ * @dev: Device pointer
+ * @irq_domain: MSIGEN IRQ domain
+ * @auxbus_data: Pointer to data passed from the parent device
+ * @plat: Pointer to our stmmac platform data
+ * @dma_cfg: DMA config buffer used by plat_stmmacenet_data
+ * @mdio_bus_data: MDIO bus data used by plat_stmmacenet_data
+ * @axi: AXI data used by plat_stmmacenet_data
+ * @desc: DMA descriptor data used by mac_device_info
+ * @dma: DMA operations data used by mac_device_info
+ */
+struct tc956x_data {
+ struct device *dev;
+ struct irq_domain *irq_domain;
+ struct tc956x_dwmac_data *auxbus_data;
+ struct plat_stmmacenet_data *plat;
+
+ /* These three fields are used by the plat_stmmacenet_data structure */
+ struct stmmac_dma_cfg dma_cfg;
+ struct stmmac_mdio_bus_data mdio_bus_data;
+ struct stmmac_axi axi;
+
+ /* These two fields are used by the mac_device_info structure */
+ struct stmmac_desc_ops desc;
+ struct stmmac_dma_ops dma;
+};
+
+struct tc956x_mac_speed {
+ phy_interface_t phy_interface;
+ int speed;
+ u32 sp_sel;
+};
+
+static struct tc956x_mac_speed mac_speed[] = {
+ { PHY_INTERFACE_MODE_2500BASEX, SPEED_2500, SP_SEL_SGMII_2500M, },
+ { PHY_INTERFACE_MODE_SGMII, SPEED_2500, SP_SEL_SGMII_2500M, },
+ { PHY_INTERFACE_MODE_SGMII, SPEED_1000, SP_SEL_SGMII_1000M, },
+ { PHY_INTERFACE_MODE_SGMII, SPEED_100, SP_SEL_SGMII_100M, },
+ { PHY_INTERFACE_MODE_SGMII, SPEED_10, SP_SEL_SGMII_10M, },
+};
+
+/* TC956x uses indirect addressing so this need only describe a 1KiB range */
+static const struct regmap_config xpcs_regmap_config = {
+ .reg_bits = 32,
+ .val_bits = 32,
+ .reg_base = 0x00, /* Minimum XPCS reg offset */
+ .max_register = 0xff, /* Register DW_VR_CSR_VIEWPORT */
+ .reg_shift = REGMAP_UPSHIFT(2),
+};
+
+static void tc956x_msigen_irq_handler(struct irq_desc *desc)
+{
+ struct irq_domain *irq_domain = irq_desc_get_handler_data(desc);
+ struct irq_chip *chip = irq_desc_get_chip(desc);
+ struct irq_chip_generic *gc;
+ unsigned long status;
+ unsigned int hwirq;
+
+ gc = irq_get_domain_generic_chip(irq_domain, 0);
+
+ chained_irq_enter(chip, desc);
+
+ status = irq_reg_readl(gc, MSI_INT_STS_OFFSET);
+ for_each_set_bit(hwirq, &status, HWIRQ_COUNT)
+ generic_handle_domain_irq(irq_domain, hwirq);
+
+ /*
+ * Clear the MSI flag. Most interrupts within TC956X are level-high
+ * type. If any interrupts are still asserted then clearing this flag
+ * will cause the (edge-triggered) MSI to be regenerated.
+ */
+ irq_reg_writel(gc, MSI_MASK_VALUE, MSI_MASK_CLR_OFFSET);
+
+ chained_irq_exit(chip, desc);
+}
+
+static int tc956x_msigen_irq_chip_init(struct irq_chip_generic *gc)
+{
+ struct tc956x_data *td = gc->domain->host_data;
+
+ gc->reg_base = td->auxbus_data->msigen;
+ gc->chip_types[0].regs.mask = MSI_OUT_EN_OFFSET;
+ gc->chip_types[0].chip.irq_mask = irq_gc_mask_clr_bit;
+ gc->chip_types[0].chip.irq_unmask = irq_gc_mask_set_bit;
+
+ /* Disable all interrupts */
+ irq_reg_writel(gc, 0, MSI_OUT_EN_OFFSET);
+
+ return 0;
+}
+
+static void tc956x_msigen_irq_chip_exit(struct irq_chip_generic *gc)
+{
+ irq_reg_writel(gc, 0, MSI_OUT_EN_OFFSET);
+}
+
+static int tc956x_msigen_irq_domain_init(struct irq_domain *irq_domain)
+{
+ struct tc956x_data *td = irq_domain->host_data;
+
+ irq_set_chained_handler_and_data(td->auxbus_data->msigen_irq,
+ tc956x_msigen_irq_handler,
+ irq_domain);
+
+ return 0;
+}
+
+static void tc956x_msigen_irq_domain_exit(struct irq_domain *irq_domain)
+{
+ struct tc956x_data *td = irq_domain->host_data;
+
+ irq_set_chained_handler_and_data(td->auxbus_data->msigen_irq,
+ NULL, NULL);
+}
+
+/* We have one IRQ chip instance with 25 IRQs in its domain */
+static struct irq_domain *
+tc956x_msigen_irq_domain_instantiate(struct tc956x_data *td)
+{
+ struct irq_domain_chip_generic_info dgc_info;
+ struct irq_domain_info info;
+
+ dgc_info.name = "tc956x-msigen";
+ dgc_info.handler = handle_level_irq;
+ dgc_info.irqs_per_chip = HWIRQ_COUNT;
+ dgc_info.num_ct = 1;
+ dgc_info.init = tc956x_msigen_irq_chip_init;
+ dgc_info.exit = tc956x_msigen_irq_chip_exit;
+
+ info.domain_flags = IRQ_DOMAIN_FLAG_DESTROY_GC;
+ info.size = HWIRQ_COUNT;
+ info.hwirq_max = HWIRQ_COUNT;
+ info.ops = &irq_generic_chip_ops;
+ info.host_data = td;
+ info.dgc_info = &dgc_info;
+ info.init = tc956x_msigen_irq_domain_init;
+ info.exit = tc956x_msigen_irq_domain_exit;
+
+ return devm_irq_domain_instantiate(td->dev, &info);
+}
+
+/**
+ * tc956x_pma_init() - Initialize PMA
+ * @td: bsp_priv pointer
+ *
+ * Initialize (or re-initialize) the PMA, configure the clocks and wait for the
+ * eMAC to be ready.
+ */
+static void tc956x_pma_init(struct tc956x_data *td)
+{
+ const struct tc956x_chip *chip = td->auxbus_data->chip;
+ void __iomem *emac_ctl = td->auxbus_data->emac_ctl;
+ u32 id = td->auxbus_data->mac_id;
+ void __iomem *pmatop;
+ u32 val;
+ u32 i;
+
+ /*
+ * When we re-initialize the PMA then the reset will already have
+ * been deasserted. We must make sure the PMA reset is asserted before
+ * we change the clock settings.
+ */
+ tc956x_reset_assert(chip, id, MAC_RESET_PMA);
+
+ pmatop = td->auxbus_data->emac + DWMAC_PMATOP_OFFSET;
+
+ /* Power on CML buffer (0 = normal mode, 1 = power down) */
+ writel(0, pmatop + PMA_CML_GL_PM_CFG0);
+
+ /* This value switches clock from C0_REFCK to CLK_REF_I */
+ val = u32_encode_bits(WRITE_MASK_VALUE, COMM_CFG_WRITE_MASK_MASK);
+ val |= COMM_CFG_ENABLE;
+ val |= u32_encode_bits(WRITE_DATA_VALUE, COMM_CFG_WRITE_DATA_MASK);
+
+ for (i = 0; i < PMA_REG_COUNT; i++) {
+ u32 offset = i * PMA_HWT_REFCK_STRIDE;
+
+ /* Disable C0_REFCK and 100 ohm termination */
+ writel(0, pmatop + PMA_HWT_REFCK_R_EN + offset);
+ writel(0, pmatop + PMA_HWT_REFCK_TERM_EN + offset);
+
+ /* Switch clock from C0_REFCK to CLK_REF_I */
+ offset = i * PMA_COMM_CFG_0_1_STRIDE;
+ writel(val, pmatop + PMA_COMM_CFG_0_1 + offset);
+ }
+
+ tc956x_reset_deassert(chip, id, MAC_RESET_PMA);
+
+ WARN_ON(readl_poll_timeout(emac_ctl, val, val & EMAC_INIT_DONE, 50, 1000000));
+}
+
+static int tc956x_mac_speed_select(struct tc956x_data *td, int speed)
+{
+ phy_interface_t phy_interface = td->plat->phy_interface;
+ struct net_device *netdev;
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(mac_speed); i++) {
+ if (mac_speed[i].speed != speed)
+ continue;
+
+ if (mac_speed[i].phy_interface == phy_interface)
+ return mac_speed[i].sp_sel;
+ }
+ netdev = dev_get_drvdata(td->dev);
+ netdev_err(netdev, "%s/%d unsupported\n",
+ phy_modes(phy_interface), speed);
+
+ return -EOPNOTSUPP;
+}
+
+static int tc956x_mac_configure(struct tc956x_data *td, int speed)
+{
+ void __iomem *emac_ctl = td->auxbus_data->emac_ctl;
+ int sp_sel;
+ u32 val;
+
+ sp_sel = tc956x_mac_speed_select(td, speed);
+ if (sp_sel < 0)
+ return sp_sel;
+
+ val = readl(emac_ctl);
+ val |= EMAC_LPIHWCLKEN;
+ val &= ~EMAC_INV_SGM_SIG_DET;
+ val = u32_replace_bits(val, PCS_CLK_PHY, EMAC_PHY_INF_SEL_MASK);
+ val = u32_replace_bits(val, sp_sel, EMAC_SP_SEL_MASK);
+ writel(val, emac_ctl);
+
+ return 0;
+}
+
+static int tc956x_mac_enable(struct tc956x_data *td)
+{
+ const struct tc956x_chip *chip = td->auxbus_data->chip;
+ struct plat_stmmacenet_data *plat = td->plat;
+ u32 id = td->auxbus_data->mac_id;
+ int ret;
+
+ tc956x_clock_enable(chip, id, MAC_CLOCK_TX);
+ tc956x_clock_enable(chip, id, MAC_CLOCK_RX);
+ tc956x_clock_enable(chip, id, MAC_CLOCK_ALL);
+ if (id)
+ tc956x_clock_enable(chip, id, MAC_CLOCK_RMII);
+
+ /* Set the speed related registers */
+ ret = tc956x_mac_configure(td, plat->max_speed);
+ if (ret)
+ return ret;
+
+ tc956x_reset_deassert(chip, id, MAC_RESET_MAC);
+ tc956x_pma_init(td);
+ tc956x_reset_deassert(chip, id, MAC_RESET_XPCS);
+
+ return 0;
+}
+
+static void tc956x_mac_disable(struct tc956x_data *td)
+{
+ const struct tc956x_chip *chip = td->auxbus_data->chip;
+ u32 id = td->auxbus_data->mac_id;
+
+ tc956x_reset_assert(chip, id, MAC_RESET_MAC);
+ tc956x_reset_assert(chip, id, MAC_RESET_PMA);
+ tc956x_reset_assert(chip, id, MAC_RESET_XPCS);
+
+ tc956x_clock_disable(chip, id, MAC_CLOCK_ALL);
+ tc956x_clock_disable(chip, id, MAC_CLOCK_RX);
+ tc956x_clock_disable(chip, id, MAC_CLOCK_TX);
+ if (id)
+ tc956x_clock_disable(chip, id, MAC_CLOCK_RMII);
+}
+
+static void tc956x_mac_init_state(struct tc956x_data *td)
+{
+ const struct tc956x_chip *chip = td->auxbus_data->chip;
+ u32 id = td->auxbus_data->mac_id;
+
+ tc956x_clock_disable(chip, id, MAC_CLOCK_125M);
+ tc956x_clock_disable(chip, id, MAC_CLOCK_312_5M);
+
+ tc956x_mac_disable(td);
+}
+
+/*
+ * Override method for dwxgmac301_dma_ops->init_rx_chan
+ *
+ * This differs from the dwxgmac301_dma_ops->init_rx_chan by translating the DMA
+ * address for TC956x internal bus. The window that provides DMA access to PCI
+ * is linearly mapped at 0x10_0000_0000.
+ */
+static void tc956x_dma_init_rx_chan(struct stmmac_priv *priv,
+ void __iomem *ioaddr,
+ struct stmmac_dma_cfg *dma_cfg,
+ dma_addr_t phy, u32 chan)
+{
+ dma_addr_t translated = phy + TC956X_SLV00_SRC_ADDR;
+
+ dwxgmac2_dma_init_rx_chan(priv, ioaddr, dma_cfg, phy, chan);
+
+ writel(upper_32_bits(translated),
+ ioaddr + XGMAC_DMA_CH_RxDESC_HADDR(chan));
+ writel(lower_32_bits(translated),
+ ioaddr + XGMAC_DMA_CH_RxDESC_LADDR(chan));
+}
+
+/* Override method for dwxgmac301_dma_ops->init_tx_chan */
+static void tc956x_dma_init_tx_chan(struct stmmac_priv *priv,
+ void __iomem *ioaddr,
+ struct stmmac_dma_cfg *dma_cfg,
+ dma_addr_t phy, u32 chan)
+{
+ dma_addr_t translated = phy + TC956X_SLV00_SRC_ADDR;
+
+ dwxgmac2_dma_init_tx_chan(priv, ioaddr, dma_cfg, phy, chan);
+
+ writel(upper_32_bits(translated),
+ ioaddr + XGMAC_DMA_CH_TxDESC_HADDR(chan));
+ writel(lower_32_bits(translated),
+ ioaddr + XGMAC_DMA_CH_TxDESC_LADDR(chan));
+}
+
+/* Override method for dwxgmac210_desc_ops->set_addr */
+static void tc956x_desc_set_addr(struct dma_desc *p, dma_addr_t addr)
+{
+ dma_addr_t translated = addr + TC956X_SLV00_SRC_ADDR;
+
+ p->des0 = cpu_to_le32(lower_32_bits(translated));
+ p->des1 = cpu_to_le32(upper_32_bits(translated));
+}
+
+/* Override method for dwxgmac210_desc_ops->set_sec_addr */
+static void tc956x_desc_set_sec_addr(struct dma_desc *p, dma_addr_t addr,
+ bool is_valid)
+{
+ dma_addr_t translated = addr + TC956X_SLV00_SRC_ADDR;
+
+ p->des2 = cpu_to_le32(lower_32_bits(translated));
+ p->des3 = cpu_to_le32(upper_32_bits(translated));
+}
+
+/*
+ * Use mac_setup to apply the override methods above.
+ *
+ * The memory for the modified ops structures is pre-allocated as part of
+ * struct tc956x_data.
+ */
+static int tc956x_mac_setup(void *apriv, struct mac_device_info *mac)
+{
+ struct stmmac_priv *priv = apriv;
+ struct stmmac_desc_ops *desc;
+ struct stmmac_dma_ops *dma;
+ struct tc956x_data *td;
+
+ td = priv->plat->bsp_priv;
+
+ /* dwxgmac301_dma_ops needs extending to provide DMA address translation */
+ dma = &td->dma;
+ *dma = dwxgmac301_dma_ops;
+ dma->init_rx_chan = tc956x_dma_init_rx_chan;
+ dma->init_tx_chan = tc956x_dma_init_tx_chan;
+ mac->dma = dma;
+
+ /* dwxgmac210_desc_ops also needs extending for the same reason */
+ desc = &td->desc;
+ *desc = dwxgmac210_desc_ops;
+ desc->set_addr = tc956x_desc_set_addr;
+ desc->set_sec_addr = tc956x_desc_set_sec_addr;
+ mac->desc = desc;
+
+ priv->hw = mac;
+
+ return dwxgmac2_setup(priv);
+}
+
+static int tc956x_pcs_init(struct stmmac_priv *priv)
+{
+ struct xpcs_regmap_config xpcs_regmap_cfg;
+ void __iomem *emac = priv->ioaddr;
+ struct regmap *xpcs_regmap;
+ void __iomem *xpcs_addr;
+ struct dw_xpcs *xpcs;
+
+ xpcs_addr = emac + DWMAC_XPCS_OFFSET;
+ xpcs_regmap = devm_regmap_init_mmio(priv->device, xpcs_addr,
+ &xpcs_regmap_config);
+ if (IS_ERR(xpcs_regmap))
+ return PTR_ERR(xpcs_regmap);
+
+ xpcs_regmap_cfg.regmap = xpcs_regmap;
+ xpcs_regmap_cfg.reg_indir = true;
+
+ xpcs = devm_xpcs_regmap_register(priv->device, &xpcs_regmap_cfg);
+ if (IS_ERR(xpcs))
+ return PTR_ERR(xpcs);
+
+ xpcs_config_eee_mult_fact(xpcs, priv->plat->mult_fact_100ns);
+ priv->hw->phylink_pcs = xpcs_to_phylink_pcs(xpcs);
+
+ return 0;
+}
+
+static struct phylink_pcs *tc956x_select_pcs(struct stmmac_priv *priv,
+ phy_interface_t interface)
+{
+ return priv->hw->phylink_pcs;
+}
+
+static void tc956x_fix_mac_speed(void *bsp_priv, phy_interface_t interface,
+ int speed, unsigned int mode)
+{
+ struct tc956x_data *td = bsp_priv;
+
+ tc956x_mac_configure(td, speed);
+ tc956x_pma_init(td);
+}
+
+static int tc956x_dwmac_suspend(struct device *dev, void *bsp_priv)
+{
+ struct tc956x_data *td = bsp_priv;
+
+ tc956x_mac_disable(td);
+
+ return 0;
+}
+
+static int tc956x_dwmac_resume(struct device *dev, void *bsp_priv)
+{
+ struct tc956x_data *td = bsp_priv;
+
+ return tc956x_mac_enable(td);
+}
+
+/* Called by tc956x_dwmac_probe(); return errors with dev_err_probe() */
+static int tc956x_dwmac_parse_dt(struct tc956x_data *td)
+{
+ struct device_node *mdio_node;
+ struct device *dev = td->dev;
+ struct device_node *np;
+
+ np = dev_of_node(dev);
+ if (!np)
+ return dev_err_probe(dev, -EINVAL, "no devicetree node\n");
+
+ /* Find the MDIO bus */
+ for_each_child_of_node(np, mdio_node) {
+ if (of_device_is_compatible(mdio_node,
+ "snps,dwmac-mdio"))
+ break;
+ }
+
+ /* Pass the MDIO bus (if there is one) to the core driver */
+ if (mdio_node) {
+ td->plat->mdio_node = mdio_node;
+ td->plat->mdio_bus_data->needs_reset = true;
+ }
+
+ return 0;
+}
+
+static int tc956x_lookup_max_speed(phy_interface_t phy_interface)
+{
+ switch (phy_interface) {
+ case PHY_INTERFACE_MODE_SGMII:
+ case PHY_INTERFACE_MODE_2500BASEX:
+ return SPEED_2500;
+
+ default:
+ return -EOPNOTSUPP;
+ }
+}
+
+/* Called by tc956x_dwmac_probe(); return errors with dev_err_probe() */
+static int tc956x_plat_dat_init(struct tc956x_data *td)
+{
+ struct plat_stmmacenet_data *plat;
+ phy_interface_t phy_interface;
+ struct device *dev = td->dev;
+ struct stmmac_axi *axi;
+ u32 speed;
+ int ret;
+ u32 i;
+
+ phy_interface = device_get_phy_mode(dev);
+ if (phy_interface < 0)
+ return -ENODEV;
+
+ /* The platform structure is allocated with devm_kzalloc() */
+ plat = stmmac_plat_dat_alloc(dev);
+ if (!plat)
+ return -ENOMEM;
+
+ ret = tc956x_lookup_max_speed(phy_interface);
+ if (ret < 0)
+ return dev_err_probe(dev, ret, "unsupported phy speed\n");
+ speed = ret;
+
+ plat->core_type = DWMAC_CORE_XGMAC;
+ plat->bus_id = td->auxbus_data->mac_id;
+ plat->phy_interface = phy_interface;
+ plat->mdio_bus_data = &td->mdio_bus_data;
+ /* Parent PCI device is used for DMA */
+ plat->dma_device = dev->parent;
+ plat->dma_cfg = &td->dma_cfg;
+ plat->dma_cfg->pbl = 32;
+ plat->dma_cfg->pblx8 = true;
+
+ /*
+ * Our MAC clock rate is fixed at 125 MHz. For XGMAC, clk_csr 0
+ * represents "divide by 62" and gets the best rate under 2.5 MHz.
+ */
+ plat->clk_csr = 0; /* MDC clock = clk_csr_i / 62 */
+ plat->force_sf_dma_mode = 1;
+ plat->max_speed = speed;
+ plat->unicast_filter_entries = 32;
+
+ /*
+ * TC956x has 8 RX queues but we observe significantly reduced RX
+ * bandwidth if we don't have at least 8k FIFO space per queue, so
+ * by default we avoid using all the queues.
+ */
+ plat->rx_queues_to_use = 4;
+
+ /*
+ * TX956x has 8 TX queues but only #0 to #3 work for general IP traffic.
+ * For now we will limit the driver to only these queues.
+ */
+ plat->tx_queues_to_use = 4;
+
+ /*
+ * Oversized FIFOs result in reduced performance in bandwidth tests.
+ * Limit them to 8KiB per queue, or the total available.
+ */
+ plat->tx_fifo_size =
+ min(TC956X_TX_FIFO_KB, 8 * plat->tx_queues_to_use) * SZ_1K;
+ plat->rx_fifo_size =
+ min(TC956X_RX_FIFO_KB, 8 * plat->rx_queues_to_use) * SZ_1K;
+ plat->host_dma_width = 36;
+
+ plat->rx_sched_algorithm = MTL_RX_ALGORITHM_SP;
+ plat->tx_sched_algorithm = MTL_TX_ALGORITHM_WRR;
+
+ /* Default RX chan is set to queue index (0..rx_queues_to_use-1) */
+ for (i = 0; i < plat->rx_queues_to_use; i++)
+ plat->rx_queues_cfg[i].mode_to_use = MTL_QUEUE_DCB;
+
+ for (i = 0; i < plat->tx_queues_to_use; i++) {
+ plat->tx_queues_cfg[i].weight = 12;
+ plat->tx_queues_cfg[i].mode_to_use = MTL_QUEUE_DCB;
+
+ /* Only queues 5-8 support time-based scheduling on TC956X */
+ if (i >= 5)
+ plat->tx_queues_cfg[i].tbs_en = 1;
+ }
+
+ plat->fix_mac_speed = tc956x_fix_mac_speed;
+ plat->suspend = tc956x_dwmac_suspend;
+ plat->resume = tc956x_dwmac_resume;
+ plat->mac_setup = tc956x_mac_setup;
+ plat->pcs_init = tc956x_pcs_init;
+ plat->select_pcs = tc956x_select_pcs;
+
+ plat->bsp_priv = td;
+ plat->clk_ptp_rate = TC956X_PTP_CLOCK_RATE;
+
+ /* AXI Configuration */
+ axi = &td->axi;
+ axi->axi_lpi_en = 1;
+ axi->axi_wr_osr_lmt = 31;
+ axi->axi_rd_osr_lmt = 31;
+ /* All sizes (2^2..2^8) are supported */
+ axi->axi_blen_regval = DMA_AXI_BLEN_MASK;
+ plat->axi = axi;
+
+ plat->mac_port_sel_speed = speed;
+ plat->flags = STMMAC_FLAG_MULTI_MSI_EN | STMMAC_FLAG_TSO_EN;
+
+ td->plat = plat;
+
+ return 0;
+}
+
+/*
+ * The domain was created with IRQ_DOMAIN_FLAG_DESTROY_GC, so any mapped IRQs
+ * will be disposed when the domain is removed (when the device is destroyed).
+ */
+static int tc956x_stmmac_resources_init(struct tc956x_data *td,
+ struct stmmac_resources *res)
+{
+ struct irq_domain *irq_domain = td->irq_domain;
+ u32 i;
+
+ res->irq = irq_create_mapping(irq_domain, HWIRQ_EVENT);
+ if (!res->irq)
+ return -EINVAL;
+
+ for (i = 0; i < td->plat->tx_queues_to_use; i++) {
+ res->tx_irq[i] = irq_create_mapping(irq_domain, HWIRQ_TX0 + i);
+ if (!res->tx_irq[i])
+ return -EINVAL;
+ }
+
+ for (i = 0; i < td->plat->rx_queues_to_use; i++) {
+ res->rx_irq[i] = irq_create_mapping(irq_domain, HWIRQ_RX0 + i);
+ if (!res->tx_irq[i])
+ return -EINVAL;
+ }
+
+ res->addr = td->auxbus_data->emac;
+
+ return 0;
+}
+
+static int tc956x_dwmac_probe(struct auxiliary_device *adev,
+ const struct auxiliary_device_id *id)
+{
+ struct stmmac_resources res = { };
+ struct device *dev = &adev->dev;
+ struct tc956x_data *td;
+ int ret;
+
+ td = devm_kzalloc(dev, sizeof(*td), GFP_KERNEL);
+ if (!td)
+ return -ENOMEM;
+
+ td->dev = dev;
+ td->auxbus_data = dev_get_platdata(dev);
+ if (!td->auxbus_data)
+ return dev_err_probe(dev, -EINVAL, "no platform data\n");
+
+ ret = tc956x_plat_dat_init(td);
+ if (ret)
+ return ret;
+
+ ret = tc956x_dwmac_parse_dt(td);
+ if (ret)
+ return ret;
+
+ td->irq_domain = tc956x_msigen_irq_domain_instantiate(td);
+ if (IS_ERR(td->irq_domain))
+ return dev_err_probe(dev, PTR_ERR(td->irq_domain),
+ "failed to instantiate IRQ domain\n");
+
+ /* Put the MAC in a known initial state */
+ tc956x_mac_init_state(td);
+
+ ret = tc956x_stmmac_resources_init(td, &res);
+ if (ret)
+ return dev_err_probe(dev, ret,
+ "failed to initialize stmmac resources\n");
+
+ ret = tc956x_mac_enable(td);
+ if (ret)
+ return dev_err_probe(dev, ret, "failed to enable MAC\n");
+
+ ret = stmmac_dvr_probe(dev, td->plat, &res);
+ if (ret)
+ return dev_err_probe(dev, ret, "failed stmmac probe\n");
+
+ return 0;
+}
+
+static void tc956x_dwmac_remove(struct auxiliary_device *adev)
+{
+ struct device *dev = &adev->dev;
+ struct net_device *ndev = dev_get_drvdata(dev);
+ struct stmmac_priv *priv = netdev_priv(ndev);
+ struct tc956x_data *td = priv->plat->bsp_priv;
+
+ stmmac_dvr_remove(dev);
+ tc956x_mac_disable(td);
+}
+
+static const struct auxiliary_device_id tc956x_dwmac_ids[] = {
+ { .name = TC956X_PCIE_DRIVER_NAME "." TC956X_XGMAC_DEV_NAME, },
+ { },
+};
+MODULE_DEVICE_TABLE(auxiliary, tc956x_dwmac_ids);
+
+static struct auxiliary_driver tc956x_dwmac_driver = {
+ .name = DRIVER_NAME,
+ .probe = tc956x_dwmac_probe,
+ .remove = tc956x_dwmac_remove,
+ .id_table = tc956x_dwmac_ids,
+ .driver = {
+ .name = DRIVER_NAME,
+ .pm = &stmmac_simple_pm_ops,
+ .owner = THIS_MODULE,
+ },
+};
+module_auxiliary_driver(tc956x_dwmac_driver);
+
+MODULE_DESCRIPTION("Toshiba TC956x PCIe Ethernet Network Driver");
+MODULE_LICENSE("GPL");
diff --git a/include/soc/toshiba/tc956x-dwmac.h b/include/soc/toshiba/tc956x-dwmac.h
new file mode 100644
index 0000000000000..5ca39cf764be9
--- /dev/null
+++ b/include/soc/toshiba/tc956x-dwmac.h
@@ -0,0 +1,84 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+/*
+ * Copyright (C) 2026 by RISCstar Solutions Corporation. All rights reserved.
+ */
+
+#ifndef __TOSHIBA_TC956X_DWMAC_H__
+#define __TOSHIBA_TC956X_DWMAC_H__
+
+#include <linux/compiler_types.h>
+#include <linux/types.h>
+
+#define TC956X_PCIE_DRIVER_NAME "tc956x_pci"
+
+#define TC956X_XGMAC_DEV_NAME "dwmac-tc956x"
+
+/* Starting address of the space translated by the PCIe endpoint bridge */
+#define TC956X_SLV00_SRC_ADDR 0x0000001000000000ULL
+
+enum tc956x_reset_id {
+ MAC_RESET_MAC = 7,
+ MAC_RESET_PMA = 30,
+ MAC_RESET_XPCS = 31,
+};
+
+enum tc956x_clock_id {
+ MAC_CLOCK_TX = 7,
+ MAC_CLOCK_RX = 14,
+ MAC_CLOCK_ALL = 31,
+ MAC_CLOCK_125M = 29,
+ MAC_CLOCK_312_5M = 30,
+ MAC_CLOCK_RMII = 15, /* eMAC 1 only */
+};
+
+/**
+ * struct tc956x_dwmac_data - Structure passed to stmmac auxiliary devices.
+ * @chip: Context pointer needed for reset and clock operations
+ * @emac: I/O mapped address used by eMAC
+ * @emac_ctl: I/O mapped address used for eMAC control
+ * @msigen: I/O mapped address used by MSIGEN
+ * @msigen_irq: IRQ number used by MSIGEN
+ * @rev_id: Chip revision ID (for quirks)
+ * @mac_id: Unique device ID (0 or 1)
+ *
+ * This structure is passed via platform data to the stmmac auxiliary devices.
+ */
+struct tc956x_dwmac_data {
+ const struct tc956x_chip *chip;
+ void __iomem *emac;
+ void __iomem *emac_ctl;
+ void __iomem *msigen;
+ unsigned int msigen_irq;
+ u8 rev_id;
+ u8 mac_id;
+};
+
+extern void tc956x_reset_clock_set(const struct tc956x_chip *chip, bool reset,
+ bool reg0, bool set, u8 bit);
+
+static inline void tc956x_reset_assert(const struct tc956x_chip *chip,
+ u8 mac_id, enum tc956x_reset_id id)
+{
+ tc956x_reset_clock_set(chip, true, !mac_id, true, (u8)id);
+}
+
+static inline void tc956x_reset_deassert(const struct tc956x_chip *chip,
+ u8 mac_id, enum tc956x_reset_id id)
+{
+ tc956x_reset_clock_set(chip, true, !mac_id, false, (u8)id);
+}
+
+static inline void tc956x_clock_enable(const struct tc956x_chip *chip,
+ u8 mac_id, enum tc956x_clock_id id)
+{
+ tc956x_reset_clock_set(chip, false, !mac_id, true, (u8)id);
+}
+
+static inline void tc956x_clock_disable(const struct tc956x_chip *chip,
+ u8 mac_id, enum tc956x_clock_id id)
+{
+ tc956x_reset_clock_set(chip, false, !mac_id, false, (u8)id);
+}
+
+#endif /* __TOSHIBA_TC956X_DWMAC_H__*/
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 09/12] gpio: tc956x: add TC956x/QPS615 support
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: daniel, elder, mohd.anwar, a0987203069, alexandre.torgue, ast,
boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk, hkallweit1,
inochiama, john.fastabend, julianbraha, livelycarpet87,
matthew.gerlach, mcoquelin.stm32, me, prabhakar.mahadev-lad.rj,
richardcochran, rohan.g.thomas, sdf, siyanteng, weishangjuan,
wens, netdev, bpf, linux-arm-msm, devicetree, linux-gpio,
linux-stm32, linux-arm-kernel, linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
Toshiba TC956x is an Ethernet-AVB/TSN bridge and is essentially
a small and highly-specialized SoC. TC956x includes a GPIO block that
can be accessed, alongside several other peripherals, via two PCIe
endpoint functions. The PCIe function driver creates an auxiliary
device for the GPIO block, and that device gets bound to this auxiliary
device driver.
Co-developed-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
drivers/gpio/Kconfig | 11 ++
drivers/gpio/Makefile | 1 +
drivers/gpio/gpio-tc956x.c | 209 +++++++++++++++++++++++++++++++++++++
3 files changed, 221 insertions(+)
create mode 100644 drivers/gpio/gpio-tc956x.c
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 020e51e30317a..746cedea7e91d 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -1646,6 +1646,17 @@ config GPIO_TC3589X
This enables support for the GPIOs found on the TC3589X
I/O Expander.
+config GPIO_TC956X
+ tristate "Toshiba TC956X GPIO support"
+ depends on TOSHIBA_TC956X_PCI
+ default m if TOSHIBA_TC956X_PCI
+ help
+ This enables support for the GPIO controller embedded in the Toshiba
+ TC956X (and Qualcomm QPS615). This device connects to the host
+ via PCIe port, which is the upstream port on an internal PCIe
+ switch. On some platforms, a few of the GPIO lines are used to
+ manage external resets.
+
config GPIO_TIMBERDALE
bool "Support for timberdale GPIO IP"
depends on MFD_TIMBERDALE
diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
index b267598b517de..c3584e7cba9b4 100644
--- a/drivers/gpio/Makefile
+++ b/drivers/gpio/Makefile
@@ -178,6 +178,7 @@ obj-$(CONFIG_GPIO_SYSCON) += gpio-syscon.o
obj-$(CONFIG_GPIO_TANGIER) += gpio-tangier.o
obj-$(CONFIG_GPIO_TB10X) += gpio-tb10x.o
obj-$(CONFIG_GPIO_TC3589X) += gpio-tc3589x.o
+obj-$(CONFIG_GPIO_TC956X) += gpio-tc956x.o
obj-$(CONFIG_GPIO_TEGRA186) += gpio-tegra186.o
obj-$(CONFIG_GPIO_TEGRA) += gpio-tegra.o
obj-$(CONFIG_GPIO_THUNDERX) += gpio-thunderx.o
diff --git a/drivers/gpio/gpio-tc956x.c b/drivers/gpio/gpio-tc956x.c
new file mode 100644
index 0000000000000..12221d8f812d9
--- /dev/null
+++ b/drivers/gpio/gpio-tc956x.c
@@ -0,0 +1,209 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright (C) 2026 by RISCstar Solutions Corporation. All rights reserved.
+ */
+
+/*
+ * The Toshiba TC956X implements a PCIe Gen 3 switch that connects an
+ * upstream x4 port to two downstream PCIe x2 ports. It incorporates
+ * an internal endpoint on a internal PCIe port that implements two
+ * Synopsys XGMAC Ethernet interfaces.
+ *
+ * 35 GPIOs are also implemented by an embedded GPIO controller. Three
+ * registers control the first 32 GPIOs (other than 20 and 21, which are
+ * reserved). Three other registers control GPIOs 32 through 36. GPIOs
+ * 22-24, 27-28, 31, and 34 are treated as "input only".
+ *
+ * There is a TC956X PCI power controller driver that accesses the
+ * direction and output value registers for GPIOs 2 and 3. These
+ * GPIOs control the reset signal for the two downstream PCIe ports.
+ * Their values will never change during operation of this driver, and
+ * this driver reserves these two GPIOS.
+ */
+
+#include <linux/auxiliary_bus.h>
+#include <linux/dev_printk.h>
+#include <linux/gpio/driver.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+
+#define DRIVER_NAME "tc956x-gpio"
+
+#define TC956X_GPIO_COUNT 37 /* Number of GPIOs (20-21 reserved) */
+
+/* The GPIO offsets are relative to 0x1200 in TC956X SFR space */
+#define GPIO_IN0_OFFSET 0x00 /* Input value (0-31) */
+#define GPIO_EN0_OFFSET 0x08 /* 0: out; 1: in (0-31) */
+#define GPIO_OUT0_OFFSET 0x10 /* Output value (0-31) */
+
+#define GPIO_IN1_OFFSET 0x04 /* Input value (32-36) */
+#define GPIO_EN1_OFFSET 0x0c /* 0: out; 1: in (32-36) */
+#define GPIO_OUT1_OFFSET 0x14 /* Output value (32-36) */
+
+/*
+ * struct tc956x_gpio - Information related to the embedded GPIO controller
+ * @chip: GPIO chip structure
+ * @regmap: MMIO register map for SFR GPIO region access
+ * @input_only: Bitmap indicating which GPIOs are input-only
+ */
+struct tc956x_gpio {
+ struct gpio_chip chip;
+ struct regmap *regmap;
+ DECLARE_BITMAP(input_only, TC956X_GPIO_COUNT);
+};
+
+static int tc956x_gpio_get_direction(struct gpio_chip *gc, unsigned int offset)
+{
+ struct tc956x_gpio *gpio = gpiochip_get_data(gc);
+ u32 reg;
+ u32 val;
+
+ if (test_bit(offset, gpio->input_only))
+ return GPIO_LINE_DIRECTION_IN;
+
+ reg = offset < 32 ? GPIO_EN0_OFFSET : GPIO_EN1_OFFSET;
+
+ regmap_read(gpio->regmap, reg, &val);
+ if (val & BIT(offset % 32))
+ return GPIO_LINE_DIRECTION_IN;
+
+ return GPIO_LINE_DIRECTION_OUT;
+}
+
+static int tc956x_gpio_direction_input(struct gpio_chip *gc,
+ unsigned int offset)
+{
+ u32 reg = offset < 32 ? GPIO_EN0_OFFSET : GPIO_EN1_OFFSET;
+ struct tc956x_gpio *gpio = gpiochip_get_data(gc);
+ u32 mask = BIT(offset % 32);
+
+ return regmap_update_bits(gpio->regmap, reg, mask, mask);
+}
+
+static int tc956x_gpio_direction_output(struct gpio_chip *gc,
+ unsigned int offset, int value)
+{
+ struct tc956x_gpio *gpio = gpiochip_get_data(gc);
+ u32 vreg;
+ u32 dreg;
+ u32 mask;
+
+ if (test_bit(offset, gpio->input_only))
+ return -EINVAL;
+
+ if (offset < 32) {
+ vreg = GPIO_OUT0_OFFSET;
+ dreg = GPIO_EN0_OFFSET;
+ } else {
+ vreg = GPIO_OUT1_OFFSET;
+ dreg = GPIO_EN1_OFFSET;
+ }
+ mask = BIT(offset % 32);
+
+ /* Set output value first, then direction */
+ regmap_update_bits(gpio->regmap, vreg, mask, value ? mask : 0);
+
+ return regmap_update_bits(gpio->regmap, dreg, mask, 0);
+}
+
+static int tc956x_gpio_get(struct gpio_chip *gc, unsigned int offset)
+{
+ u32 reg = offset < 32 ? GPIO_IN0_OFFSET : GPIO_IN1_OFFSET;
+ struct tc956x_gpio *gpio = gpiochip_get_data(gc);
+ u32 val;
+
+ regmap_read(gpio->regmap, reg, &val);
+
+ return val & BIT(offset % 32) ? 1 : 0;
+}
+
+static int tc956x_gpio_set(struct gpio_chip *gc, unsigned int offset, int value)
+{
+ u32 reg = offset < 32 ? GPIO_OUT0_OFFSET : GPIO_OUT1_OFFSET;
+ struct tc956x_gpio *gpio = gpiochip_get_data(gc);
+ u32 mask = BIT(offset % 32);
+
+ return regmap_update_bits(gpio->regmap, reg, mask, value ? mask : 0);
+}
+
+static int tc956x_gpio_init_valid_mask(struct gpio_chip *gc,
+ unsigned long *valid_mask,
+ unsigned int ngpios)
+{
+ /*
+ * GPIOs 2 and 3 are used by the PCI power control driver, and
+ * we don't allow them to be used. GPIOs 20 and 21 are reserved
+ * (and not usable).
+ */
+ bitmap_fill(valid_mask, ngpios);
+ bitmap_clear(valid_mask, 2, 2);
+ bitmap_clear(valid_mask, 20, 2);
+
+ return 0;
+}
+
+static int tc956x_gpio_probe(struct auxiliary_device *adev,
+ const struct auxiliary_device_id *id)
+{
+ struct device *dev = &adev->dev;
+ struct tc956x_gpio *gpio;
+ struct gpio_chip *gc;
+
+ if (!dev->platform_data)
+ return -EINVAL;
+
+ gpio = devm_kzalloc(dev, sizeof(*gpio), GFP_KERNEL);
+ if (!gpio)
+ return -ENOMEM;
+ gpio->regmap = dev->platform_data;
+
+ /* Mark GPIOs 22, 23, 24, 27, 28, 31, and 34 as input only */
+ bitmap_set(gpio->input_only, 22, 3);
+ bitmap_set(gpio->input_only, 27, 2);
+ set_bit(31, gpio->input_only);
+ set_bit(34, gpio->input_only);
+
+ gc = &gpio->chip;
+
+ gc->label = DRIVER_NAME;
+ gc->parent = dev->parent;
+
+ gc->get_direction = tc956x_gpio_get_direction;
+ gc->direction_input = tc956x_gpio_direction_input;
+ gc->direction_output = tc956x_gpio_direction_output;
+ gc->get = tc956x_gpio_get;
+ gc->set = tc956x_gpio_set;
+ gc->init_valid_mask = tc956x_gpio_init_valid_mask;
+
+ gc->base = -1;
+ gc->ngpio = TC956X_GPIO_COUNT;
+ gc->can_sleep = false;
+
+ dev_set_drvdata(dev, gpio);
+
+ return devm_gpiochip_add_data(dev, gc, gpio);
+}
+
+static const struct auxiliary_device_id tc956x_gpio_ids[] = {
+ { .name = "tc956x_pci.tc9564-gpio", },
+ { }
+};
+MODULE_DEVICE_TABLE(auxiliary, tc956x_gpio_ids);
+
+static struct auxiliary_driver tc956x_gpio_driver = {
+ .name = DRIVER_NAME,
+ .probe = tc956x_gpio_probe,
+ .id_table = tc956x_gpio_ids,
+ .driver = {
+ .name = DRIVER_NAME,
+ .owner = THIS_MODULE,
+ .probe_type = PROBE_PREFER_ASYNCHRONOUS,
+ },
+};
+module_auxiliary_driver(tc956x_gpio_driver);
+
+MODULE_DESCRIPTION("Toshiba TC956X PCIe GPIO Driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("auxiliary:" DRIVER_NAME);
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 08/12] dt-bindings: net: toshiba,tc965x-dwmac: add TC956x Ethernet bridge
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: Daniel Thompson, elder, mohd.anwar, a0987203069, alexandre.torgue,
ast, boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk,
hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
From: Daniel Thompson <daniel@riscstar.com>
Add devicetree bindings for the Toshiba TC956x family of Ethernet-AVB/TSN
bridges.
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
.../bindings/net/toshiba,tc956x-dwmac.yaml | 111 ++++++++++++++++++
1 file changed, 111 insertions(+)
create mode 100644 Documentation/devicetree/bindings/net/toshiba,tc956x-dwmac.yaml
diff --git a/Documentation/devicetree/bindings/net/toshiba,tc956x-dwmac.yaml b/Documentation/devicetree/bindings/net/toshiba,tc956x-dwmac.yaml
new file mode 100644
index 0000000000000..d95d22a3761da
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/toshiba,tc956x-dwmac.yaml
@@ -0,0 +1,111 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/net/toshiba,tc956x-dwmac.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Toshiba TC956x Ethernet-AVB/TSN Controller
+
+maintainers:
+ - Alex Elder <elder@riscstar.com>
+ - Daniel Thompson <daniel@riscstar.com>
+
+description: |
+ This node provides properties for configuring the Ethernet PCI functions
+ that are attached to the internal downstream port of the TC956x's PCIe
+ switch.
+
+ TC956x are a family of Ethernet-AVB/TSN bridge chips that combine a PCIe
+ switch together with a number of Ethernet controllers. These bindings
+ cover only the Ethernet functions of these devices.
+
+allOf:
+ - $ref: /schemas/pci/pci-bus-common.yaml#
+ - $ref: /schemas/pci/pci-device.yaml#
+
+unevaluatedProperties: false
+
+properties:
+ compatible:
+ enum:
+ - pci1179,0220 # Toshiba TC9564 (a.k.a. Qualcomm QPS615)
+
+ "#gpio-cells":
+ const: 2
+
+ gpio-controller: true
+
+ # We can't allOf reference Ethernet-controller.yaml because we end up with
+ # contradictory $nodename rules (`ethernet@` versus `pci@`). Happily only a
+ # small number of the properties are useful on TC956x so we can just reference
+ # what we need.
+ phy-connection-type:
+ $ref: ethernet-controller.yaml#/properties/phy-connection-type
+
+ phy-handle:
+ $ref: ethernet-controller.yaml#/properties/phy-handle
+
+ phy-mode:
+ $ref: ethernet-controller.yaml#/properties/phy-mode
+
+ mdio:
+ $ref: snps,dwmac.yaml#/properties/mdio
+
+required:
+ - compatible
+ - reg
+
+examples:
+ - |
+ pcie {
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+ tc956x_emac0: pci@0,0 {
+ compatible = "pci1179,0220";
+ reg = <0x50000 0x0 0x0 0x0 0x0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+ device_type = "pci";
+ ranges;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+
+ phy-mode = "10gbase-r";
+ phy-handle = <&tc956x_emac0_phy>;
+
+ mdio {
+ compatible = "snps,dwmac-mdio";
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ tc956x_emac0_phy: ethernet-phy@1c {
+ compatible = "ethernet-phy-id311c.1c12";
+ reg = <0x1c>;
+ };
+ };
+ };
+ pci@0,1 {
+ compatible = "pci1179,0220";
+ reg = <0x50100 0x0 0x0 0x0 0x0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+ device_type = "pci";
+ ranges;
+
+ phy-mode = "sgmii";
+ phy-handle = <&tc956x_emac1_phy>;
+
+ mdio {
+ compatible = "snps,dwmac-mdio";
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ tc956x_emac1_phy: ethernet-phy@1c {
+ compatible = "ethernet-phy-id004d.d101";
+ reg = <0x1c>;
+ };
+ };
+ };
+ };
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 07/12] net: stmmac: dwxgmac2: export symbols for XGMAC 3.01a DMA
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: Daniel Thompson, elder, mohd.anwar, a0987203069, alexandre.torgue,
ast, boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk,
hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
From: Daniel Thompson <daniel@riscstar.com>
Toshiba TC956x is an Ethernet-AVB/TSN bridge and is essentially a
small-and-highly-specialised SoC. Ethernet on this chip is provided
by a DesignWare XGMAC.
One consequence of the SoC-like design is that the internal AXI bus
(used by the XGMAC for DMA) maps the PCI DMA space with a non-zero base
address. This requires a translation step (happily just simple addition)
to convert the PCI DMA address to the hardware DMA address.
This is pretty funky so rather than push that translation logic into
the core driver we intend to keep that logic inside the TC956x
platform code. In order to do that we need to export a few symbols
to allow us to override some of the DMA and descriptor op tables.
FWIW this approach to overriding the ops tables is similar to the
mechanism currently found in dwmac-loongson.c (with the exception
that we have also exported a couple of functions so we don't
have to replicate their content in the TC956x platform code).
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 7 +++++++
.../ethernet/stmicro/stmmac/dwxgmac2_core.c | 1 +
.../ethernet/stmicro/stmmac/dwxgmac2_descs.c | 1 +
.../net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 18 ++++++++++--------
4 files changed, 19 insertions(+), 8 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
index bcf59ad8a1939..8cecde1bef8a1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
@@ -468,4 +468,11 @@ extern const struct stmmac_dma_ops dwxgmac210_dma_ops;
extern const struct stmmac_dma_ops dwxgmac301_dma_ops;
extern const struct stmmac_desc_ops dwxgmac210_desc_ops;
+void dwxgmac2_dma_init_rx_chan(struct stmmac_priv *priv, void __iomem *ioaddr,
+ struct stmmac_dma_cfg *dma_cfg, dma_addr_t phy,
+ u32 chan);
+void dwxgmac2_dma_init_tx_chan(struct stmmac_priv *priv, void __iomem *ioaddr,
+ struct stmmac_dma_cfg *dma_cfg, dma_addr_t phy,
+ u32 chan);
+
#endif /* __STMMAC_DWXGMAC2_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
index f02b434bbd505..c9547dc6912a3 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
@@ -1556,6 +1556,7 @@ int dwxgmac2_setup(struct stmmac_priv *priv)
return 0;
}
+EXPORT_SYMBOL_GPL(dwxgmac2_setup);
int dwxlgmac2_setup(struct stmmac_priv *priv)
{
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
index b5f200a874840..cc67d8e1a920a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
@@ -368,3 +368,4 @@ const struct stmmac_desc_ops dwxgmac210_desc_ops = {
.set_vlan = dwxgmac2_set_vlan,
.set_tbs = dwxgmac2_set_tbs,
};
+EXPORT_SYMBOL_GPL(dwxgmac210_desc_ops);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
index dc2897e9931d1..ec365e66276f1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
@@ -62,10 +62,10 @@ static void dwxgmac2_dma_init_chan(struct stmmac_priv *priv,
writel(XGMAC_DMA_INT_DEFAULT_EN, ioaddr + XGMAC_DMA_CH_INT_EN(chan));
}
-static void dwxgmac2_dma_init_rx_chan(struct stmmac_priv *priv,
- void __iomem *ioaddr,
- struct stmmac_dma_cfg *dma_cfg,
- dma_addr_t phy, u32 chan)
+void dwxgmac2_dma_init_rx_chan(struct stmmac_priv *priv,
+ void __iomem *ioaddr,
+ struct stmmac_dma_cfg *dma_cfg,
+ dma_addr_t phy, u32 chan)
{
u32 rxpbl = dma_cfg->rxpbl ?: dma_cfg->pbl;
u32 value;
@@ -77,11 +77,11 @@ static void dwxgmac2_dma_init_rx_chan(struct stmmac_priv *priv,
writel(upper_32_bits(phy), ioaddr + XGMAC_DMA_CH_RxDESC_HADDR(chan));
writel(lower_32_bits(phy), ioaddr + XGMAC_DMA_CH_RxDESC_LADDR(chan));
}
+EXPORT_SYMBOL_GPL(dwxgmac2_dma_init_rx_chan);
-static void dwxgmac2_dma_init_tx_chan(struct stmmac_priv *priv,
- void __iomem *ioaddr,
- struct stmmac_dma_cfg *dma_cfg,
- dma_addr_t phy, u32 chan)
+void dwxgmac2_dma_init_tx_chan(struct stmmac_priv *priv, void __iomem *ioaddr,
+ struct stmmac_dma_cfg *dma_cfg, dma_addr_t phy,
+ u32 chan)
{
u32 txpbl = dma_cfg->txpbl ?: dma_cfg->pbl;
u32 value;
@@ -93,6 +93,7 @@ static void dwxgmac2_dma_init_tx_chan(struct stmmac_priv *priv,
writel(upper_32_bits(phy), ioaddr + XGMAC_DMA_CH_TxDESC_HADDR(chan));
writel(lower_32_bits(phy), ioaddr + XGMAC_DMA_CH_TxDESC_LADDR(chan));
}
+EXPORT_SYMBOL_GPL(dwxgmac2_dma_init_tx_chan);
static void dwxgmac2_dma_axi(void __iomem *ioaddr, struct stmmac_axi *axi)
{
@@ -671,3 +672,4 @@ const struct stmmac_dma_ops dwxgmac301_dma_ops = {
.enable_sph = dwxgmac2_enable_sph,
.enable_tbs = dwxgmac2_enable_tbs,
};
+EXPORT_SYMBOL_GPL(dwxgmac301_dma_ops);
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 06/12] net: stmmac: dwxgmac2: Add XGMAC 3.01a support
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: Daniel Thompson, elder, mohd.anwar, a0987203069, alexandre.torgue,
ast, boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk,
hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
From: Daniel Thompson <daniel@riscstar.com>
XGMAC 2.x and 3.x are architecturally very similar. That means that
for everything except one erratum we can simply use the XGMAC 2.x
callback functions in the stmmac_dma_ops structure.
Only the set_rx_ring_len callback is specific to XGMAC 3.01. It
limits the number of outstanding write requests that can be serviced
per DMA.
The other erratum addressed in this patch is simply a comment to
ensure that a feature that stmmac doesn't currently use is not enabled
without contemplating the errata.
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
.../net/ethernet/stmicro/stmmac/dwxgmac2.h | 3 ++
.../ethernet/stmicro/stmmac/dwxgmac2_dma.c | 52 +++++++++++++++++++
2 files changed, 55 insertions(+)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
index 9b0b5cc619556..bcf59ad8a1939 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
@@ -374,6 +374,8 @@
#define XGMAC_DMA_CH_RxDESC_TAIL_LPTR(x) (0x0000312c + (0x80 * (x)))
#define XGMAC_DMA_CH_TxDESC_RING_LEN(x) (0x00003130 + (0x80 * (x)))
#define XGMAC_DMA_CH_RxDESC_RING_LEN(x) (0x00003134 + (0x80 * (x)))
+#define XGMAC_OWRQ GENMASK(25, 24)
+#define XGMAC_RDRL GENMASK(15, 0)
#define XGMAC_DMA_CH_INT_EN(x) (0x00003138 + (0x80 * (x)))
#define XGMAC_NIE BIT(15)
#define XGMAC_AIE BIT(14)
@@ -463,6 +465,7 @@
extern const struct stmmac_ops dwxgmac210_ops;
extern const struct stmmac_ops dwxlgmac2_ops;
extern const struct stmmac_dma_ops dwxgmac210_dma_ops;
+extern const struct stmmac_dma_ops dwxgmac301_dma_ops;
extern const struct stmmac_desc_ops dwxgmac210_desc_ops;
#endif /* __STMMAC_DWXGMAC2_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
index a84601ac32153..dc2897e9931d1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
@@ -38,6 +38,14 @@ static void dwxgmac2_dma_init(void __iomem *ioaddr,
value = u32_replace_bits(value, XGMAC_INTM_MODE1,
XGMAC_INTM_MASK);
+ /*
+ * A friendly warning to future adventurers. If Descriptor Posted
+ * Write support, which is off by default, is ever enabled then be sure
+ * to make it optional. This is required by errata for at least XGMAC
+ * 3.01A... and the XGMAC 2.x and 3.x are architecturally similar so we
+ * use dwxgmac2 support for the 3.x family as well.
+ */
+
writel(value, ioaddr + XGMAC_DMA_MODE);
}
@@ -490,6 +498,20 @@ static void dwxgmac2_set_rx_ring_len(struct stmmac_priv *priv,
writel(len, ioaddr + XGMAC_DMA_CH_RxDESC_RING_LEN(chan));
}
+static void dwxgmac301_set_rx_ring_len(struct stmmac_priv *priv,
+ void __iomem *ioaddr, u32 len, u32 chan)
+{
+ u32 val = FIELD_PREP(XGMAC_RDRL, len);
+
+ /*
+ * Reduce the number of outstanding write requests to 3 (from default
+ * of 4). This is an errata workaround for XGMAC 3.01a.
+ */
+ val |= FIELD_PREP(XGMAC_OWRQ, 3);
+
+ writel(val, ioaddr + XGMAC_DMA_CH_RxDESC_RING_LEN(chan));
+}
+
static void dwxgmac2_set_tx_ring_len(struct stmmac_priv *priv,
void __iomem *ioaddr, u32 len, u32 chan)
{
@@ -619,3 +641,33 @@ const struct stmmac_dma_ops dwxgmac210_dma_ops = {
.enable_sph = dwxgmac2_enable_sph,
.enable_tbs = dwxgmac2_enable_tbs,
};
+
+const struct stmmac_dma_ops dwxgmac301_dma_ops = {
+ .reset = dwxgmac2_dma_reset,
+ .init = dwxgmac2_dma_init,
+ .init_chan = dwxgmac2_dma_init_chan,
+ .init_rx_chan = dwxgmac2_dma_init_rx_chan,
+ .init_tx_chan = dwxgmac2_dma_init_tx_chan,
+ .axi = dwxgmac2_dma_axi,
+ .dump_regs = dwxgmac2_dma_dump_regs,
+ .dma_rx_mode = dwxgmac2_dma_rx_mode,
+ .dma_tx_mode = dwxgmac2_dma_tx_mode,
+ .enable_dma_irq = dwxgmac2_enable_dma_irq,
+ .disable_dma_irq = dwxgmac2_disable_dma_irq,
+ .start_tx = dwxgmac2_dma_start_tx,
+ .stop_tx = dwxgmac2_dma_stop_tx,
+ .start_rx = dwxgmac2_dma_start_rx,
+ .stop_rx = dwxgmac2_dma_stop_rx,
+ .dma_interrupt = dwxgmac2_dma_interrupt,
+ .get_hw_feature = dwxgmac2_get_hw_feature,
+ .rx_watchdog = dwxgmac2_rx_watchdog,
+ .set_rx_ring_len = dwxgmac301_set_rx_ring_len,
+ .set_tx_ring_len = dwxgmac2_set_tx_ring_len,
+ .set_rx_tail_ptr = dwxgmac2_set_rx_tail_ptr,
+ .set_tx_tail_ptr = dwxgmac2_set_tx_tail_ptr,
+ .enable_tso = dwxgmac2_enable_tso,
+ .qmode = dwxgmac2_qmode,
+ .set_bfsize = dwxgmac2_set_bfsize,
+ .enable_sph = dwxgmac2_enable_sph,
+ .enable_tbs = dwxgmac2_enable_tbs,
+};
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 05/12] net: stmmac: dwxgmac2: Add multi MSI interrupt mode
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: Daniel Thompson, elder, mohd.anwar, a0987203069, alexandre.torgue,
ast, boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk,
hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
From: Daniel Thompson <daniel@riscstar.com>
Currently there are no XGMAC platforms integrated using the multi MSI
interrupt mode. In other words no existing driver sets both
DWMAC_CORE_XGMAC and STMMAC_FLAG_MULTI_MSI_EN.
In order to support systems that do enable both options (such as the
Toshiba TC9564 whose driver is currently being developed) we need to
add logic to the XGMAC DMA callbacks. Happily we can simply
replicate similar code from GMAC4. Let's do that!
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 2 ++
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 8 ++++++++
2 files changed, 10 insertions(+)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
index 51943705a2b03..9b0b5cc619556 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
@@ -320,6 +320,8 @@
/* DMA Registers */
#define XGMAC_DMA_MODE 0x00003000
#define XGMAC_SWR BIT(0)
+#define XGMAC_INTM_MASK GENMASK(13, 12)
+#define XGMAC_INTM_MODE1 0x1
#define XGMAC_DMA_SYSBUS_MODE 0x00003004
#define XGMAC_WR_OSR_LMT GENMASK(29, 24)
#define XGMAC_RD_OSR_LMT GENMASK(21, 16)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
index 03437f1cf3df3..a84601ac32153 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
@@ -31,6 +31,14 @@ static void dwxgmac2_dma_init(void __iomem *ioaddr,
value |= XGMAC_EAME;
writel(value, ioaddr + XGMAC_DMA_SYSBUS_MODE);
+
+ value = readl(ioaddr + XGMAC_DMA_MODE);
+
+ if (dma_cfg->multi_msi_en)
+ value = u32_replace_bits(value, XGMAC_INTM_MODE1,
+ XGMAC_INTM_MASK);
+
+ writel(value, ioaddr + XGMAC_DMA_MODE);
}
static void dwxgmac2_dma_init_chan(struct stmmac_priv *priv,
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 04/12] net: stmmac: dma: create a separate dma_device pointer
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: daniel, elder, mohd.anwar, a0987203069, alexandre.torgue, ast,
boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk, hkallweit1,
inochiama, john.fastabend, julianbraha, livelycarpet87,
matthew.gerlach, mcoquelin.stm32, me, prabhakar.mahadev-lad.rj,
richardcochran, rohan.g.thomas, sdf, siyanteng, weishangjuan,
wens, netdev, bpf, linux-arm-msm, devicetree, linux-gpio,
linux-stm32, linux-arm-kernel, linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
The Toshiba TC956x Ethernet bridge chip is an Ethernet AVN/TSN bridge
that is essentially a small but specialized SoC. It provides two XGMAC
Ethernet interfaces along with a number of internal IP blocks, some of
which are used by both eMACs.
The chip implements two internal PCIe functions, and one of these is
used to manage the common internal IPs. Both of the PCIe functions
use an auxiliary bus device to represent an XGMAC Ethernet interface.
Separating the PCIe function from the XGMAC IP this way helps in
managing the life cycle for various objects (common and per-MAC).
However this separation means that the MAC device is no longer the
proper device to use for DMA. To address this, we add support for
a second "DMA device" pointer in the stmmac_priv structure. The DMA
device pointer is used for all DMA operations, while the "normal"
device pointer is used for log messages, memory allocation, runtime
power management, and a few other things.
To set up the DMA device pointer, we add a new device structure pointer
to the plat_stmmacenet_data structure. If set, it will be assigned as
the (new) dma_device pointer field in the stmmac_priv structure. If
the plat_stmmacenet_data field is NULL, the "normal" device pointer is
assigned as the dma_device pointer instead (preserving existing behavior).
Signed-off-by: Alex Elder <elder@riscstar.com>
---
.../net/ethernet/stmicro/stmmac/chain_mode.c | 12 ++--
.../net/ethernet/stmicro/stmmac/ring_mode.c | 12 ++--
drivers/net/ethernet/stmicro/stmmac/stmmac.h | 1 +
.../net/ethernet/stmicro/stmmac/stmmac_main.c | 59 ++++++++++---------
.../net/ethernet/stmicro/stmmac/stmmac_xdp.c | 2 +-
include/linux/stmmac.h | 1 +
6 files changed, 46 insertions(+), 41 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
index fc04a23342cfc..331e6523ee018 100644
--- a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
@@ -34,10 +34,10 @@ static int jumbo_frm(struct stmmac_tx_queue *tx_q, struct sk_buff *skb,
buf_len = min_t(unsigned int, nopaged_len, bmax);
len = nopaged_len - buf_len;
- des2 = dma_map_single(priv->device, skb->data,
+ des2 = dma_map_single(priv->dma_device, skb->data,
buf_len, DMA_TO_DEVICE);
desc->des2 = cpu_to_le32(des2);
- if (dma_mapping_error(priv->device, des2))
+ if (dma_mapping_error(priv->dma_device, des2))
return -1;
tx_q->tx_skbuff_dma[entry].buf = des2;
tx_q->tx_skbuff_dma[entry].len = buf_len;
@@ -51,11 +51,11 @@ static int jumbo_frm(struct stmmac_tx_queue *tx_q, struct sk_buff *skb,
desc = tx_q->dma_tx + entry;
if (len > bmax) {
- des2 = dma_map_single(priv->device,
+ des2 = dma_map_single(priv->dma_device,
(skb->data + bmax * i),
bmax, DMA_TO_DEVICE);
desc->des2 = cpu_to_le32(des2);
- if (dma_mapping_error(priv->device, des2))
+ if (dma_mapping_error(priv->dma_device, des2))
return -1;
tx_q->tx_skbuff_dma[entry].buf = des2;
tx_q->tx_skbuff_dma[entry].len = bmax;
@@ -64,11 +64,11 @@ static int jumbo_frm(struct stmmac_tx_queue *tx_q, struct sk_buff *skb,
len -= bmax;
i++;
} else {
- des2 = dma_map_single(priv->device,
+ des2 = dma_map_single(priv->dma_device,
(skb->data + bmax * i), len,
DMA_TO_DEVICE);
desc->des2 = cpu_to_le32(des2);
- if (dma_mapping_error(priv->device, des2))
+ if (dma_mapping_error(priv->dma_device, des2))
return -1;
tx_q->tx_skbuff_dma[entry].buf = des2;
tx_q->tx_skbuff_dma[entry].len = len;
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
index 78fc6aa5bbe95..0d334c51fc1c2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
@@ -37,10 +37,10 @@ static int jumbo_frm(struct stmmac_tx_queue *tx_q, struct sk_buff *skb,
if (nopaged_len > BUF_SIZE_8KiB) {
- des2 = dma_map_single(priv->device, skb->data, bmax,
+ des2 = dma_map_single(priv->dma_device, skb->data, bmax,
DMA_TO_DEVICE);
desc->des2 = cpu_to_le32(des2);
- if (dma_mapping_error(priv->device, des2))
+ if (dma_mapping_error(priv->dma_device, des2))
return -1;
tx_q->tx_skbuff_dma[entry].buf = des2;
@@ -58,10 +58,10 @@ static int jumbo_frm(struct stmmac_tx_queue *tx_q, struct sk_buff *skb,
else
desc = tx_q->dma_tx + entry;
- des2 = dma_map_single(priv->device, skb->data + bmax, len,
+ des2 = dma_map_single(priv->dma_device, skb->data + bmax, len,
DMA_TO_DEVICE);
desc->des2 = cpu_to_le32(des2);
- if (dma_mapping_error(priv->device, des2))
+ if (dma_mapping_error(priv->dma_device, des2))
return -1;
tx_q->tx_skbuff_dma[entry].buf = des2;
tx_q->tx_skbuff_dma[entry].len = len;
@@ -72,10 +72,10 @@ static int jumbo_frm(struct stmmac_tx_queue *tx_q, struct sk_buff *skb,
STMMAC_RING_MODE, 1, !skb_is_nonlinear(skb),
skb->len);
} else {
- des2 = dma_map_single(priv->device, skb->data,
+ des2 = dma_map_single(priv->dma_device, skb->data,
nopaged_len, DMA_TO_DEVICE);
desc->des2 = cpu_to_le32(des2);
- if (dma_mapping_error(priv->device, des2))
+ if (dma_mapping_error(priv->dma_device, des2))
return -1;
tx_q->tx_skbuff_dma[entry].buf = des2;
tx_q->tx_skbuff_dma[entry].len = nopaged_len;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index 8ba8f03e1ce03..76c8551687998 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -278,6 +278,7 @@ struct stmmac_priv {
void __iomem *ioaddr;
struct net_device *dev;
struct device *device;
+ struct device *dma_device;
struct mac_device_info *hw;
int (*hwif_quirks)(struct stmmac_priv *priv);
struct mutex lock;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index ca68248dbc781..1104cf750295b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1730,12 +1730,12 @@ static void stmmac_free_tx_buffer(struct stmmac_priv *priv,
if (tx_q->tx_skbuff_dma[i].buf &&
tx_q->tx_skbuff_dma[i].buf_type != STMMAC_TXBUF_T_XDP_TX) {
if (tx_q->tx_skbuff_dma[i].map_as_page)
- dma_unmap_page(priv->device,
+ dma_unmap_page(priv->dma_device,
tx_q->tx_skbuff_dma[i].buf,
tx_q->tx_skbuff_dma[i].len,
DMA_TO_DEVICE);
else
- dma_unmap_single(priv->device,
+ dma_unmap_single(priv->dma_device,
tx_q->tx_skbuff_dma[i].buf,
tx_q->tx_skbuff_dma[i].len,
DMA_TO_DEVICE);
@@ -2166,7 +2166,7 @@ static void __free_dma_rx_desc_resources(struct stmmac_priv *priv,
size = stmmac_get_rx_desc_size(priv) * dma_conf->dma_rx_size;
- dma_free_coherent(priv->device, size, addr, rx_q->dma_rx_phy);
+ dma_free_coherent(priv->dma_device, size, addr, rx_q->dma_rx_phy);
if (xdp_rxq_info_is_reg(&rx_q->xdp_rxq))
xdp_rxq_info_unreg(&rx_q->xdp_rxq);
@@ -2214,7 +2214,7 @@ static void __free_dma_tx_desc_resources(struct stmmac_priv *priv,
size = stmmac_get_tx_desc_size(priv, tx_q) * dma_conf->dma_tx_size;
- dma_free_coherent(priv->device, size, addr, tx_q->dma_tx_phy);
+ dma_free_coherent(priv->dma_device, size, addr, tx_q->dma_tx_phy);
kfree(tx_q->tx_skbuff_dma);
kfree(tx_q->tx_skbuff);
@@ -2266,8 +2266,8 @@ static int __alloc_dma_rx_desc_resources(struct stmmac_priv *priv,
pp_params.flags = PP_FLAG_DMA_MAP | PP_FLAG_DMA_SYNC_DEV;
pp_params.pool_size = dma_conf->dma_rx_size;
pp_params.order = order_base_2(num_pages);
- pp_params.nid = dev_to_node(priv->device);
- pp_params.dev = priv->device;
+ pp_params.nid = dev_to_node(priv->dma_device);
+ pp_params.dev = priv->dma_device;
pp_params.dma_dir = xdp_prog ? DMA_BIDIRECTIONAL : DMA_FROM_DEVICE;
pp_params.offset = stmmac_rx_offset(priv);
pp_params.max_len = dma_conf->dma_buf_sz;
@@ -2290,7 +2290,7 @@ static int __alloc_dma_rx_desc_resources(struct stmmac_priv *priv,
size = stmmac_get_rx_desc_size(priv) * dma_conf->dma_rx_size;
- addr = dma_alloc_coherent(priv->device, size, &rx_q->dma_rx_phy,
+ addr = dma_alloc_coherent(priv->dma_device, size, &rx_q->dma_rx_phy,
GFP_KERNEL);
if (!addr)
return -ENOMEM;
@@ -2369,7 +2369,7 @@ static int __alloc_dma_tx_desc_resources(struct stmmac_priv *priv,
size = stmmac_get_tx_desc_size(priv, tx_q) * dma_conf->dma_tx_size;
- addr = dma_alloc_coherent(priv->device, size,
+ addr = dma_alloc_coherent(priv->dma_device, size,
&tx_q->dma_tx_phy, GFP_KERNEL);
if (!addr)
return -ENOMEM;
@@ -2898,12 +2898,12 @@ static int stmmac_tx_clean(struct stmmac_priv *priv, int budget, u32 queue,
if (likely(tx_q->tx_skbuff_dma[entry].buf &&
tx_q->tx_skbuff_dma[entry].buf_type != STMMAC_TXBUF_T_XDP_TX)) {
if (tx_q->tx_skbuff_dma[entry].map_as_page)
- dma_unmap_page(priv->device,
+ dma_unmap_page(priv->dma_device,
tx_q->tx_skbuff_dma[entry].buf,
tx_q->tx_skbuff_dma[entry].len,
DMA_TO_DEVICE);
else
- dma_unmap_single(priv->device,
+ dma_unmap_single(priv->dma_device,
tx_q->tx_skbuff_dma[entry].buf,
tx_q->tx_skbuff_dma[entry].len,
DMA_TO_DEVICE);
@@ -4569,9 +4569,9 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
first = desc;
/* first descriptor: fill Headers on Buf1 */
- des = dma_map_single(priv->device, skb->data, skb_headlen(skb),
+ des = dma_map_single(priv->dma_device, skb->data, skb_headlen(skb),
DMA_TO_DEVICE);
- if (dma_mapping_error(priv->device, des))
+ if (dma_mapping_error(priv->dma_device, des))
goto dma_map_err;
stmmac_set_desc_addr(priv, first, des);
@@ -4597,10 +4597,10 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
for (i = 0; i < nfrags; i++) {
const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
- des = skb_frag_dma_map(priv->device, frag, 0,
+ des = skb_frag_dma_map(priv->dma_device, frag, 0,
skb_frag_size(frag),
DMA_TO_DEVICE);
- if (dma_mapping_error(priv->device, des))
+ if (dma_mapping_error(priv->dma_device, des))
goto dma_map_err;
stmmac_tso_allocator(priv, des, skb_frag_size(frag),
@@ -4825,9 +4825,9 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
} else {
bool last_segment = (nfrags == 0);
- dma_addr = dma_map_single(priv->device, skb->data,
+ dma_addr = dma_map_single(priv->dma_device, skb->data,
nopaged_len, DMA_TO_DEVICE);
- if (dma_mapping_error(priv->device, dma_addr))
+ if (dma_mapping_error(priv->dma_device, dma_addr))
goto dma_map_err;
stmmac_set_tx_skb_dma_entry(tx_q, first_entry, dma_addr,
@@ -4876,9 +4876,9 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
desc = stmmac_get_tx_desc(priv, tx_q, entry);
- dma_addr = skb_frag_dma_map(priv->device, frag, 0, frag_size,
- DMA_TO_DEVICE);
- if (dma_mapping_error(priv->device, dma_addr))
+ dma_addr = skb_frag_dma_map(priv->dma_device, frag, 0,
+ frag_size, DMA_TO_DEVICE);
+ if (dma_mapping_error(priv->dma_device, dma_addr))
goto dma_map_err; /* should reuse desc w/o issues */
stmmac_set_tx_skb_dma_entry(tx_q, entry, dma_addr, frag_size,
@@ -5188,9 +5188,9 @@ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue,
tx_desc = stmmac_get_tx_desc(priv, tx_q, entry);
if (dma_map) {
- dma_addr = dma_map_single(priv->device, xdpf->data,
+ dma_addr = dma_map_single(priv->dma_device, xdpf->data,
xdpf->len, DMA_TO_DEVICE);
- if (dma_mapping_error(priv->device, dma_addr))
+ if (dma_mapping_error(priv->dma_device, dma_addr))
return STMMAC_XDP_CONSUMED;
buf_type = STMMAC_TXBUF_T_XDP_NDO;
@@ -5199,7 +5199,7 @@ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue,
dma_addr = page_pool_get_dma_addr(page) + sizeof(*xdpf) +
xdpf->headroom;
- dma_sync_single_for_device(priv->device, dma_addr,
+ dma_sync_single_for_device(priv->dma_device, dma_addr,
xdpf->len, DMA_BIDIRECTIONAL);
buf_type = STMMAC_TXBUF_T_XDP_TX;
@@ -5781,7 +5781,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
if (!skb) {
unsigned int pre_len, sync_len;
- dma_sync_single_for_cpu(priv->device, buf->addr,
+ dma_sync_single_for_cpu(priv->dma_device, buf->addr,
buf1_len, dma_dir);
net_prefetch(page_address(buf->page) +
buf->page_offset);
@@ -5860,7 +5860,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
skb_mark_for_recycle(skb);
buf->page = NULL;
} else if (buf1_len) {
- dma_sync_single_for_cpu(priv->device, buf->addr,
+ dma_sync_single_for_cpu(priv->dma_device, buf->addr,
buf1_len, dma_dir);
skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
buf->page, buf->page_offset, buf1_len,
@@ -5869,7 +5869,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
}
if (buf2_len) {
- dma_sync_single_for_cpu(priv->device, buf->sec_addr,
+ dma_sync_single_for_cpu(priv->dma_device, buf->sec_addr,
buf2_len, dma_dir);
skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
buf->sec_page, 0, buf2_len,
@@ -7810,6 +7810,7 @@ static int __stmmac_dvr_probe(struct device *device,
priv = netdev_priv(ndev);
priv->device = device;
+ priv->dma_device = plat_dat->dma_device ? : device;
priv->dev = ndev;
for (i = 0; i < MTL_MAX_RX_QUEUES; i++)
@@ -7938,8 +7939,9 @@ static int __stmmac_dvr_probe(struct device *device,
priv->dma_cap.host_dma_width = priv->dma_cap.addr64;
if (priv->dma_cap.host_dma_width) {
- ret = dma_set_mask_and_coherent(device,
- DMA_BIT_MASK(priv->dma_cap.host_dma_width));
+ u64 mask = DMA_BIT_MASK(priv->dma_cap.host_dma_width);
+
+ ret = dma_set_mask_and_coherent(priv->dma_device, mask);
if (!ret) {
dev_info(priv->device, "Using %d/%d bits DMA host/device width\n",
priv->dma_cap.host_dma_width, priv->dma_cap.addr64);
@@ -7951,7 +7953,8 @@ static int __stmmac_dvr_probe(struct device *device,
if (IS_ENABLED(CONFIG_ARCH_DMA_ADDR_T_64BIT))
priv->plat->dma_cfg->eame = true;
} else {
- ret = dma_set_mask_and_coherent(device, DMA_BIT_MASK(32));
+ ret = dma_set_mask_and_coherent(priv->dma_device,
+ DMA_BIT_MASK(32));
if (ret) {
dev_err(priv->device, "Failed to set DMA Mask\n");
goto error_hw_init;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c
index d7e4db7224b0c..7ba068f1ca88d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c
@@ -25,7 +25,7 @@ static int stmmac_xdp_enable_pool(struct stmmac_priv *priv,
if (frame_size < ETH_FRAME_LEN + VLAN_HLEN * 2)
return -EOPNOTSUPP;
- err = xsk_pool_dma_map(pool, priv->device, STMMAC_RX_DMA_ATTR);
+ err = xsk_pool_dma_map(pool, priv->dma_device, STMMAC_RX_DMA_ATTR);
if (err) {
netdev_err(priv->dev, "Failed to map xsk pool\n");
return err;
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
index 4430b967abdeb..02ae177d5c27d 100644
--- a/include/linux/stmmac.h
+++ b/include/linux/stmmac.h
@@ -245,6 +245,7 @@ struct plat_stmmacenet_data {
struct stmmac_mdio_bus_data *mdio_bus_data;
struct device_node *phy_node;
struct device_node *mdio_node;
+ struct device *dma_device;
struct stmmac_dma_cfg *dma_cfg;
struct stmmac_safety_feature_cfg *safety_feat_cfg;
int clk_csr;
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 03/12] net: pcs: pcs-xpcs: Preserve BMCR_ANENBLE during link up
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: Daniel Thompson, elder, mohd.anwar, a0987203069, alexandre.torgue,
ast, boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk,
hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
From: Daniel Thompson <daniel@riscstar.com>
Currently the XCPS found on Toshiba TC9564 (a.k.a. Qualcomm QPS615)
is unable to operate at 1000base-X and slower with a PHY connected
using SGMII/2500base-X (in our case a Qualcomm QCA8081). The link
negotiates speed correctly but the MAC can't get any packets out.
This attracted attention to the ANENABLE bit and we observed that the
bit is currently set during config and cleared during link up.
Preserving the bit during link up allows the system to work as expected.
Perhaps I lack the imagination but I couldn't come up with any reason
why keeping the ANENABLE bit set would break things for other XPCS
implementations. Let's ensure link up sets the bit for SGMII interfaces.
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
drivers/net/pcs/pcs-xpcs.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/pcs/pcs-xpcs.c b/drivers/net/pcs/pcs-xpcs.c
index b2c84b7e1e113..1d62d5b31c61c 100644
--- a/drivers/net/pcs/pcs-xpcs.c
+++ b/drivers/net/pcs/pcs-xpcs.c
@@ -1263,11 +1263,14 @@ static void xpcs_link_up_sgmii_1000basex(struct dw_xpcs *xpcs,
phy_interface_t interface,
int speed, int duplex)
{
+ u16 an_enable;
int ret;
if (neg_mode == PHYLINK_PCS_NEG_INBAND_ENABLED)
return;
+ an_enable = (interface == PHY_INTERFACE_MODE_SGMII ? BMCR_ANENABLE : 0);
+
if (interface == PHY_INTERFACE_MODE_1000BASEX) {
if (speed != SPEED_1000) {
dev_err(&xpcs->mdiodev->dev,
@@ -1283,7 +1286,7 @@ static void xpcs_link_up_sgmii_1000basex(struct dw_xpcs *xpcs,
}
ret = xpcs_write(xpcs, MDIO_MMD_VEND2, MII_BMCR,
- mii_bmcr_encode_fixed(speed, duplex));
+ mii_bmcr_encode_fixed(speed, duplex) | an_enable);
if (ret)
dev_err(&xpcs->mdiodev->dev, "%s: xpcs_write returned %pe\n",
__func__, ERR_PTR(ret));
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 02/12] net: pcs: pcs-xpcs: select operating mode for 10G-baseR capable PCS
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: Daniel Thompson, elder, mohd.anwar, a0987203069, alexandre.torgue,
ast, boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk,
hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
From: Daniel Thompson <daniel@riscstar.com>
Currently the XPCS found on Toshiba TC9564 (a.k.a. Qualcomm QPS615)
is unable to operate at 1000base-X and slower with a PHY connected
using SGMII/2500base-X (in our case a Qualcomm QCA8081).
The problem arises when the XPCS supports 10Gbase-R. That means that
the reset value of SR_XS_PCS_CTRL2:PCS_TYPE_SEL (0) is valid and this
suppresses the modal switching based on bit 13 of SR_PMA_CTRL1 or
SR_XS_PCS_CTRL1.
The reported XPCS dev ID on a TC9564 is exactly the same as every other
XPCS supported by the kernel so we can't use the dev ID to automatically
determine what operating mode to select. However we can use the feature
bits in SR_XS_PCS_STS2 to detect 10Gbase-R support.
Rather than introduce a quirk let's attempt to solve this generically by
setting SR_XS_PCS_CTRL2:PCS_TYPE_SEL to a reserved value when we detect
the right we detect the right combination of phy interface and XPCS
feature support.
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
drivers/net/pcs/pcs-xpcs.c | 38 ++++++++++++++++++++++++++++++++++++++
1 file changed, 38 insertions(+)
diff --git a/drivers/net/pcs/pcs-xpcs.c b/drivers/net/pcs/pcs-xpcs.c
index e69fa2f0a0e8d..b2c84b7e1e113 100644
--- a/drivers/net/pcs/pcs-xpcs.c
+++ b/drivers/net/pcs/pcs-xpcs.c
@@ -747,6 +747,40 @@ static void xpcs_pre_config(struct phylink_pcs *pcs, phy_interface_t interface)
xpcs->need_reset = false;
}
+static int xpcs_config_operating_mode(struct dw_xpcs *xpcs, int an_mode)
+{
+ int mdio_stat2, ret;
+
+ switch (an_mode) {
+ case DW_AN_C37_SGMII:
+ case DW_AN_C37_1000BASEX:
+ case DW_2500BASEX:
+ mdio_stat2 = xpcs_read(xpcs, MDIO_MMD_PCS, MDIO_STAT2);
+ if (mdio_stat2 < 0)
+ return mdio_stat2;
+
+ /*
+ * If this XPCS supports 10Gbase-R then it will be the default
+ * which prevents 1000base-X and slower from working correctly.
+ *
+ * Why are we writing MDIO_PCS_CTRL2_TYPE + 1? We want the modal
+ * behaviour that comes when we pick a reserved value. XPCS
+ * allocates extra bits to this field and allocates values from
+ * 15 down so MDIO_PCS_CTRL2_TYPE + 1 is the value likely to
+ * be allocated last (and hopefully never).
+ */
+ if (mdio_stat2 & MDIO_PCS_STAT2_10GBR) {
+ ret = xpcs_write(xpcs, MDIO_MMD_PCS, MDIO_CTRL2,
+ MDIO_PCS_CTRL2_TYPE + 1);
+ if (ret < 0)
+ return ret;
+ }
+ break;
+ }
+
+ return 0;
+}
+
static int xpcs_config_aneg_c37_sgmii(struct dw_xpcs *xpcs,
unsigned int neg_mode)
{
@@ -919,6 +953,10 @@ static int xpcs_do_config(struct dw_xpcs *xpcs, phy_interface_t interface,
if (!compat)
return -ENODEV;
+ ret = xpcs_config_operating_mode(xpcs, compat->an_mode);
+ if (ret < 0)
+ return ret;
+
if (xpcs->info.pma == WX_TXGBE_XPCS_PMA_10G_ID) {
/* Wangxun devices need backplane CL37 AN enabled for
* SGMII and 1000base-X
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 01/12] net: pcs: pcs-xpcs-regmap: support XPCS memory-mapped MDIO bus via regmap
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: Daniel Thompson, elder, mohd.anwar, a0987203069, alexandre.torgue,
ast, boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk,
hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <20260501155421.3329862-1-elder@riscstar.com>
From: Daniel Thompson <daniel@riscstar.com>
In some DesignWare XPCS implementatons the memory-mapped MDIO bus is
allocated to a register window that does not align to a page boundary.
This makes iomapping the registers problematic.
For example the Toshiba TC9564 (a PCIe Ethernet-AVB/TSN bridge) provides
an "eMAC" subsystem with the XPCS base address cuddled up to XGMAC
registers.
Let's introduce helpers to allow the driver that owns the eMAC to register
an XPCS using is regmap for the memory-mapped MDIO bus.
Signed-off-by: Daniel Thompson <daniel@riscstar.com>
Signed-off-by: Alex Elder <elder@riscstar.com>
---
drivers/net/pcs/Makefile | 4 +-
drivers/net/pcs/pcs-xpcs-regmap.c | 203 ++++++++++++++++++++++++++++
include/linux/pcs/pcs-xpcs-regmap.h | 20 +++
3 files changed, 225 insertions(+), 2 deletions(-)
create mode 100644 drivers/net/pcs/pcs-xpcs-regmap.c
create mode 100644 include/linux/pcs/pcs-xpcs-regmap.h
diff --git a/drivers/net/pcs/Makefile b/drivers/net/pcs/Makefile
index 4f7920618b900..565f1b63fce0b 100644
--- a/drivers/net/pcs/Makefile
+++ b/drivers/net/pcs/Makefile
@@ -1,8 +1,8 @@
# SPDX-License-Identifier: GPL-2.0
# Makefile for Linux PCS drivers
-pcs_xpcs-$(CONFIG_PCS_XPCS) := pcs-xpcs.o pcs-xpcs-plat.o \
- pcs-xpcs-nxp.o pcs-xpcs-wx.o
+pcs_xpcs-$(CONFIG_PCS_XPCS) := pcs-xpcs.o pcs-xpcs-nxp.o pcs-xpcs-regmap.o \
+ pcs-xpcs-plat.o pcs-xpcs-wx.o
obj-$(CONFIG_PCS_XPCS) += pcs_xpcs.o
obj-$(CONFIG_PCS_LYNX) += pcs-lynx.o
diff --git a/drivers/net/pcs/pcs-xpcs-regmap.c b/drivers/net/pcs/pcs-xpcs-regmap.c
new file mode 100644
index 0000000000000..20a54a3605951
--- /dev/null
+++ b/drivers/net/pcs/pcs-xpcs-regmap.c
@@ -0,0 +1,203 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Synopsys DesignWare XPCS regmap helpers
+ *
+ * Copyright (C) 2026 RISCstar Solutions.
+ * Copyright (C) 2024 Serge Semin
+ */
+
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/mdio.h>
+#include <linux/pcs/pcs-xpcs.h>
+#include <linux/pcs/pcs-xpcs-regmap.h>
+#include <linux/regmap.h>
+
+#include "pcs-xpcs.h"
+
+/* Page select register for the indirect MMIO CSRs access */
+#define DW_VR_CSR_VIEWPORT 0xff
+
+struct dw_xpcs_regmap {
+ struct device *dev;
+ struct mii_bus *bus;
+ struct regmap *regmap;
+ bool reg_indir;
+};
+
+static ptrdiff_t xpcs_regmap_addr_format(int dev, int reg)
+{
+ return FIELD_PREP(0x1f0000, dev) | FIELD_PREP(0xffff, reg);
+}
+
+static u16 xpcs_regmap_addr_page(ptrdiff_t csr)
+{
+ return FIELD_GET(0x1fff00, csr);
+}
+
+static ptrdiff_t xpcs_regmap_addr_offset(ptrdiff_t csr)
+{
+ return FIELD_GET(0xff, csr);
+}
+
+static int xpcs_regmap_read_reg_indirect(struct dw_xpcs_regmap *pxpcs, int dev,
+ int reg)
+{
+ ptrdiff_t csr, ofs;
+ unsigned int val;
+ u16 page;
+ int res;
+
+ csr = xpcs_regmap_addr_format(dev, reg);
+ page = xpcs_regmap_addr_page(csr);
+ ofs = xpcs_regmap_addr_offset(csr);
+
+ res = regmap_write(pxpcs->regmap, DW_VR_CSR_VIEWPORT, page);
+ if (res < 0)
+ return res;
+
+ res = regmap_read(pxpcs->regmap, ofs, &val);
+ if (res < 0)
+ return res;
+
+ return val & 0xffff;
+}
+
+static int xpcs_regmap_write_reg_indirect(struct dw_xpcs_regmap *pxpcs, int dev,
+ int reg, u16 val)
+{
+ ptrdiff_t csr, ofs;
+ u16 page;
+ int res;
+
+ csr = xpcs_regmap_addr_format(dev, reg);
+ page = xpcs_regmap_addr_page(csr);
+ ofs = xpcs_regmap_addr_offset(csr);
+
+ res = regmap_write(pxpcs->regmap, DW_VR_CSR_VIEWPORT, page);
+ if (res < 0)
+ return res;
+
+ return regmap_write(pxpcs->regmap, ofs, val);
+}
+
+static int xpcs_regmap_read_reg_direct(struct dw_xpcs_regmap *pxpcs, int dev,
+ int reg)
+{
+ unsigned int val;
+ ptrdiff_t csr;
+ int res;
+
+ csr = xpcs_regmap_addr_format(dev, reg);
+ res = regmap_read(pxpcs->regmap, csr, &val);
+ if (res < 0)
+ return res;
+
+ return val & 0xffff;
+}
+
+static int xpcs_regmap_write_reg_direct(struct dw_xpcs_regmap *pxpcs, int dev,
+ int reg, u16 val)
+{
+ ptrdiff_t csr = xpcs_regmap_addr_format(dev, reg);
+
+ return regmap_write(pxpcs->regmap, csr, val);
+}
+
+static int xpcs_regmap_read_c22(struct mii_bus *bus, int addr, int reg)
+{
+ struct dw_xpcs_regmap *pxpcs = bus->priv;
+
+ if (addr != 0)
+ return -ENODEV;
+
+ if (pxpcs->reg_indir)
+ return xpcs_regmap_read_reg_indirect(pxpcs, MDIO_MMD_VEND2, reg);
+ else
+ return xpcs_regmap_read_reg_direct(pxpcs, MDIO_MMD_VEND2, reg);
+}
+
+static int xpcs_regmap_write_c22(struct mii_bus *bus, int addr, int reg, u16 val)
+{
+ struct dw_xpcs_regmap *pxpcs = bus->priv;
+
+ if (addr != 0)
+ return -ENODEV;
+
+ if (pxpcs->reg_indir)
+ return xpcs_regmap_write_reg_indirect(pxpcs, MDIO_MMD_VEND2, reg, val);
+ else
+ return xpcs_regmap_write_reg_direct(pxpcs, MDIO_MMD_VEND2, reg, val);
+}
+
+static int xpcs_regmap_read_c45(struct mii_bus *bus, int addr, int dev, int reg)
+{
+ struct dw_xpcs_regmap *pxpcs = bus->priv;
+
+ if (addr != 0)
+ return -ENODEV;
+
+ if (pxpcs->reg_indir)
+ return xpcs_regmap_read_reg_indirect(pxpcs, dev, reg);
+ else
+ return xpcs_regmap_read_reg_direct(pxpcs, dev, reg);
+}
+
+static int xpcs_regmap_write_c45(struct mii_bus *bus, int addr, int dev,
+ int reg, u16 val)
+{
+ struct dw_xpcs_regmap *pxpcs = bus->priv;
+
+ if (addr != 0)
+ return -ENODEV;
+
+ if (pxpcs->reg_indir)
+ return xpcs_regmap_write_reg_indirect(pxpcs, dev, reg, val);
+ else
+ return xpcs_regmap_write_reg_direct(pxpcs, dev, reg, val);
+}
+
+struct dw_xpcs *devm_xpcs_regmap_register(struct device *dev,
+ const struct xpcs_regmap_config *config)
+{
+ static atomic_t id = ATOMIC_INIT(-1);
+ struct dw_xpcs_regmap *pxpcs;
+ int ret;
+
+ pxpcs = devm_kzalloc(dev, sizeof(*pxpcs), GFP_KERNEL);
+ if (!pxpcs)
+ return ERR_PTR(-ENOMEM);
+
+ pxpcs->dev = dev;
+ pxpcs->regmap = config->regmap;
+ pxpcs->reg_indir = config->reg_indir;
+
+ pxpcs->bus = devm_mdiobus_alloc_size(dev, 0);
+ if (!pxpcs->bus)
+ return ERR_PTR(-ENOMEM);
+
+ pxpcs->bus->name = "DW XPCS MCI/APB3";
+ pxpcs->bus->read = xpcs_regmap_read_c22;
+ pxpcs->bus->write = xpcs_regmap_write_c22;
+ pxpcs->bus->read_c45 = xpcs_regmap_read_c45;
+ pxpcs->bus->write_c45 = xpcs_regmap_write_c45;
+ pxpcs->bus->phy_mask = ~0;
+ pxpcs->bus->parent = dev;
+ pxpcs->bus->priv = pxpcs;
+
+ snprintf(pxpcs->bus->id, MII_BUS_ID_SIZE,
+ "dwxpcs-%x", atomic_inc_return(&id));
+
+ /* MDIO-bus here serves as just a back-end engine abstracting out
+ * the MDIO and MCI/APB3 IO interfaces utilized for the DW XPCS CSRs
+ * access.
+ */
+ ret = devm_mdiobus_register(dev, pxpcs->bus);
+ if (ret) {
+ dev_err(dev, "Failed to create MDIO bus\n");
+ return ERR_PTR(ret);
+ }
+
+ return xpcs_create_mdiodev(pxpcs->bus, 0);
+}
+EXPORT_SYMBOL_GPL(devm_xpcs_regmap_register);
diff --git a/include/linux/pcs/pcs-xpcs-regmap.h b/include/linux/pcs/pcs-xpcs-regmap.h
new file mode 100644
index 0000000000000..19c99d4160365
--- /dev/null
+++ b/include/linux/pcs/pcs-xpcs-regmap.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#ifndef __LINUX_PCS_XPCS_REGMAP_H
+#define __LINUX_PCS_XPCS_REGMAP_H
+
+#include <linux/types.h>
+
+struct device;
+struct regmap;
+struct dw_xpcs;
+
+struct xpcs_regmap_config {
+ struct regmap *regmap;
+ bool reg_indir;
+};
+
+struct dw_xpcs *devm_xpcs_regmap_register(
+ struct device *dev, const struct xpcs_regmap_config *config);
+
+#endif /* __LINUX_PCS_XPCS_REGMAP_H */
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 00/12] net: enable TC956x support
From: Alex Elder @ 2026-05-01 15:54 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh
Cc: daniel, elder, mohd.anwar, a0987203069, alexandre.torgue, ast,
boon.khai.ng, chenchuangyu, chenhuacai, daniel, hawk, hkallweit1,
inochiama, john.fastabend, julianbraha, livelycarpet87,
matthew.gerlach, mcoquelin.stm32, me, prabhakar.mahadev-lad.rj,
richardcochran, rohan.g.thomas, sdf, siyanteng, weishangjuan,
wens, netdev, bpf, linux-arm-msm, devicetree, linux-gpio,
linux-stm32, linux-arm-kernel, linux-kernel
This series introduces stmmac driver support for the Toshiba TC9564
(also known as Qualcomm QPS615). This is an Ethernet-AVB/TSN bridge IC
that provides a high-speed connection between a host SoC and Ethernet
devices on a network. It incorporates a PCIe switch, and implements
two 10 Gbps capable Ethernet MACs (along with other IP blocks), and
is essentially a small and highly-specialized SoC. The TC9564 is a
member of a family of similar chips, and the driver code uses "tc956x"
to reflect this.
TC956x chips incorporate a PCIe gen 3 switch, with one upstream and
three downstream ports. Its PCIe functionality is already supported
upstream, including a power control driver that performs some early
configuration of the PCI ports ("pci-pwrctrl-tc9563.c").
One of the PCIe switch's downstream ports has an internal PCIe endpoint,
which implements two PCIe functions, each of which has an Ethernet MAC
(eMAC) subsystem. The eMAC is composed of a Synopsis Designware XGMAC
combined with an XPCS and PMA. Each MAC is capable of operating at
10M/100M/1G/2.5G/5Gps and 10Gps. The initial target platform is the
Qualcomm RB3gen2, which supports a 10Gbps Marvell PHY on port A, and
a 2.5Gbps Qualcomm PHY on port B. (The Marvell PHY is not populated on
all RB3gen2 boards, and only 2.5 Gbps support is included initially.)
TC956x chips also implement several other blocks of functionality,
including a GPIO controller, interrupt controllers (MSIGEN), I2C
and SPI, a UART, and an Arm Cortex M3 CPU with 128KB SRAM. The GPIO
interface exposes several lines to manage external resets. The
interrupt controllers are used internally by the MAC functions. The
UART, SPI, microcontroller, and SRAM are currently unused.
----------------------------------
| Host |
------+...+----------+........+---
|i2c| | PCIe |
----------------+...+----------+........+------
| TC956x |I2C| |upstream| |
| ----- --+--------+--- |
| ----- ------ ------- | PCIe switch | |
| |SPI| |GPIO| |reset| | | |
| ----- ------ |clock| | DS3 DS2 DS1 | |
| ------- ---++--++--++-- |
| ----- ------ downstream// \\ \\ | downstream
| |MCU| |SRAM| /==========/ \\ \===== PCIe port 1
| ----- ------ //PCIe port 3 \\ |
| || \======= downstream
| ----+-----------++-----------+---- | PCIe port 2
| | M | internal PCIe endpoint | M | |
| | S |------------------------| S | ------ |
| | I | PCIe | | PCIe | I | |UART| |
| | G |function 0| |function 1| G | ------ |
| | E |----++----| |----++----| E | |
| | N | eMAC 0 | | eMAC 1 | N | |
--------+.......+------+.....+-----------------
|USXGMII| |SGMII|
--+.......+-- --+.....+--
| ARQ113C | | QEP8121 |
| PHY | | PHY |
------------- -----------
The primary objective for this series is to support the Ethernet
functionality provided by the TC956x. The code providing this
support has been structured into three distinct modules.
- A driver for the GPIO controller
- Code enabling the TC956x-specific eMAC/MSIGEN hardware
- A "chip" driver, associated with the PCIe functions
The GPIO driver is implemented separately because in some hardware
configurations, these GPIO lines are used to manage resets for
external Ethernet PHYs. We describe these PHYs via devicetree,
where the GPIO-based reset signals are defined using phandles.
The code for the eMAC/MSIGEN consists of a new source file that
populates hardware-specific details about the two MACs, and integrates
with the existing stmmac driver. This also required implementing some
enhancements to the core stmmac driver, described further below.
To manage the common functionality (including configuring address
translation and controlling internal reset and clock signals), a
"chip" driver is implemented. This chip driver is associated with
the PCIe function *itself*, not the eMAC associated with the function.
The driver binds to the internal PCI functions 0 and 1, and creates
a shared data structure describing the common chip elements the two
driver instances share. Three auxiliary bus devices are created to
represent the GPIO controller and the two Synopsys MAC controllers.
The driver instance for PCIe function 0 has responsibility for
controlling the common chip functionality--creating the GPIO
controller auxiliary device, configuring address translation
between PCIe address space and internal addresses, and controlling
clocks and resets. It creates a data structure--shared via its
platform data pointer with PCIe function 1--to represent shared
"chip" information. In addition, PCIe function 0 creates an
auxiliary device to represent its attached eMAC. It allocates
IRQs and maps BAR address ranges for use by the stmmac driver,
passing them in a structure via the auxiliary device's platform
data.
PCIe function 1 defers probing until after PCIe function 0 has
created the shared data structure. After that its only job is
to set up IRQs and mapped memory and create the eMAC1 auxiliary
device.
The version of the Synopsys MAC IP is 3.01, which is largely compatible
with version 2.20. The core stmmac driver required several changes to
enable support for the TC956x.
- A change to dwxgmac2 support changes the interrupt mode when
multi_msi_en is enabled.
- While most support for version 3.01 simply uses the 2.20 code,
an erratum related to the RX ring length is implemented for
3.01 DMA operations.
- Having the PCIe device be separate from an auxiliarly device
implementing the eMAC required allowing a distinct DMA device
to be maintained for an stmmac interface.
In addition:
- A new source file provides memory-mapped access to XPCS using
regmap. The alignment of the TC956x MDIO registers aren't
suitable for using simple MMIO.
- Two additional XPCS changes are implemented that provides
support for the XPCS as implemented in the TC956x.
This series is available here:
https://github.com/riscstar/linux/tree/tc956x/stmmac-v1
-Alex (and Daniel)
Alex Elder (3):
net: stmmac: dma: create a separate dma_device pointer
gpio: tc956x: add TC956x/QPS615 support
misc: tc956x_pci: add TC956x/QPS615 support
Daniel Thompson (9):
net: pcs: pcs-xpcs-regmap: support XPCS memory-mapped MDIO bus via
regmap
net: pcs: pcs-xpcs: select operating mode for 10G-baseR capable PCS
net: pcs: pcs-xpcs: Preserve BMCR_ANENBLE during link up
net: stmmac: dwxgmac2: Add multi MSI interrupt mode
net: stmmac: dwxgmac2: Add XGMAC 3.01a support
net: stmmac: dwxgmac2: export symbols for XGMAC 3.01a DMA
dt-bindings: net: toshiba,tc965x-dwmac: add TC956x Ethernet bridge
net: stmmac: tc956x: add TC956x/QPS615 support
arm64: dts: qcom: qcs6490-rb3gen2: enable TC9564 with a single QCS8081
phy
.../bindings/net/toshiba,tc956x-dwmac.yaml | 111 +++
arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts | 45 +-
drivers/gpio/Kconfig | 11 +
drivers/gpio/Makefile | 1 +
drivers/gpio/gpio-tc956x.c | 209 +++++
drivers/misc/Kconfig | 10 +
drivers/misc/Makefile | 1 +
drivers/misc/tc956x_pci.c | 667 +++++++++++++++
drivers/net/ethernet/stmicro/stmmac/Kconfig | 13 +
drivers/net/ethernet/stmicro/stmmac/Makefile | 2 +
.../net/ethernet/stmicro/stmmac/chain_mode.c | 12 +-
.../ethernet/stmicro/stmmac/dwmac-tc956x.c | 791 ++++++++++++++++++
.../net/ethernet/stmicro/stmmac/dwxgmac2.h | 12 +
.../ethernet/stmicro/stmmac/dwxgmac2_core.c | 1 +
.../ethernet/stmicro/stmmac/dwxgmac2_descs.c | 1 +
.../ethernet/stmicro/stmmac/dwxgmac2_dma.c | 78 +-
.../net/ethernet/stmicro/stmmac/ring_mode.c | 12 +-
drivers/net/ethernet/stmicro/stmmac/stmmac.h | 1 +
.../net/ethernet/stmicro/stmmac/stmmac_main.c | 59 +-
.../net/ethernet/stmicro/stmmac/stmmac_xdp.c | 2 +-
drivers/net/pcs/Makefile | 4 +-
drivers/net/pcs/pcs-xpcs-regmap.c | 203 +++++
drivers/net/pcs/pcs-xpcs.c | 43 +-
include/linux/pcs/pcs-xpcs-regmap.h | 20 +
include/linux/stmmac.h | 1 +
include/soc/toshiba/tc956x-dwmac.h | 84 ++
26 files changed, 2341 insertions(+), 53 deletions(-)
create mode 100644 Documentation/devicetree/bindings/net/toshiba,tc956x-dwmac.yaml
create mode 100644 drivers/gpio/gpio-tc956x.c
create mode 100644 drivers/misc/tc956x_pci.c
create mode 100644 drivers/net/ethernet/stmicro/stmmac/dwmac-tc956x.c
create mode 100644 drivers/net/pcs/pcs-xpcs-regmap.c
create mode 100644 include/linux/pcs/pcs-xpcs-regmap.h
create mode 100644 include/soc/toshiba/tc956x-dwmac.h
base-commit: 254f49634ee16a731174d2ae34bc50bd5f45e731
--
2.51.0
^ permalink raw reply
* [PATCH net-next 3/3] net: selftests: add getsockopt_iter regression tests
From: Breno Leitao @ 2026-05-01 15:52 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Stefano Garzarella, Shuah Khan, sdf.kernel
Cc: netdev, linux-kernel, virtualization, linux-kselftest,
Breno Leitao, kernel-team
In-Reply-To: <20260501-getsock_one-v1-0-810ce23ea70e@debian.org>
Add a single kselftest covering the proto_ops getsockopt_iter
conversions for AF_NETLINK and AF_VSOCK, using one fixture per protocol:
netlink:
NETLINK_PKTINFO covers the flag-style int path (exact size, oversize
clamp, undersize -EINVAL); NETLINK_LIST_MEMBERSHIPS covers the
size-discovery path that always reports the required buffer length back
via optlen, even when the user buffer is too small to receive any group
bits.
vsock:
SO_VM_SOCKETS_BUFFER_SIZE covers the u64 path (exact size, oversize
clamp, undersize -EINVAL).
Each fixture also exercises an unknown optname and a bogus level so
the returned-length / errno semantics preserved by the sockopt_t
conversion are pinned down.
Signed-off-by: Breno Leitao <leitao@debian.org>
---
tools/testing/selftests/net/Makefile | 1 +
tools/testing/selftests/net/getsockopt_iter.c | 213 ++++++++++++++++++++++++++
2 files changed, 214 insertions(+)
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index a275ed5840265..baa30287cf222 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -176,6 +176,7 @@ TEST_GEN_PROGS := \
bind_timewait \
bind_wildcard \
epoll_busy_poll \
+ getsockopt_iter \
icmp_rfc4884 \
ipv6_fragmentation \
proc_net_pktgen \
diff --git a/tools/testing/selftests/net/getsockopt_iter.c b/tools/testing/selftests/net/getsockopt_iter.c
new file mode 100644
index 0000000000000..179f9e84926fd
--- /dev/null
+++ b/tools/testing/selftests/net/getsockopt_iter.c
@@ -0,0 +1,213 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Quick test for getsockopt{_iter} tests.
+ *
+ * Each fixture targets one converted protocol and pins down the
+ * returned-length / errno semantics across buffer-size variations,
+ * an unknown optname and a bogus level.
+ *
+ * - netlink: NETLINK_PKTINFO covers the flag-style int path; the
+ * NETLINK_LIST_MEMBERSHIPS cases cover the size-discovery path
+ * that always reports the required buffer length back via optlen,
+ * even when the user buffer is too small to receive any group bits.
+ * - vsock: SO_VM_SOCKETS_BUFFER_SIZE covers the u64 path.
+ *
+ * Author: Breno Leitao <leitao@debian.org>
+ */
+
+#include <errno.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <linux/netlink.h>
+#include <linux/rtnetlink.h>
+#include <linux/vm_sockets.h>
+#include <sys/socket.h>
+#include "kselftest_harness.h"
+
+#ifndef AF_VSOCK
+#define AF_VSOCK 40
+#endif
+
+/* ---------- netlink ---------- */
+
+FIXTURE(netlink)
+{
+ int fd;
+};
+
+FIXTURE_SETUP(netlink)
+{
+ int group = RTNLGRP_LINK;
+
+ self->fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
+ if (self->fd < 0)
+ SKIP(return, "AF_NETLINK socket: %s", strerror(errno));
+
+ /* Joining a multicast group grows nlk->ngroups so the
+ * NETLINK_LIST_MEMBERSHIPS path has a non-zero size to report.
+ */
+ if (setsockopt(self->fd, SOL_NETLINK, NETLINK_ADD_MEMBERSHIP,
+ &group, sizeof(group)) < 0)
+ SKIP(return, "NETLINK_ADD_MEMBERSHIP: %s", strerror(errno));
+}
+
+FIXTURE_TEARDOWN(netlink)
+{
+ if (self->fd >= 0)
+ close(self->fd);
+}
+
+TEST_F(netlink, pktinfo_exact)
+{
+ int val = -1;
+ socklen_t optlen = sizeof(val);
+
+ ASSERT_EQ(0, getsockopt(self->fd, SOL_NETLINK, NETLINK_PKTINFO,
+ &val, &optlen));
+ ASSERT_EQ(sizeof(int), optlen);
+ ASSERT_TRUE(val == 0 || val == 1);
+}
+
+TEST_F(netlink, pktinfo_oversize_clamped)
+{
+ char buf[16] = {};
+ socklen_t optlen = sizeof(buf);
+
+ ASSERT_EQ(0, getsockopt(self->fd, SOL_NETLINK, NETLINK_PKTINFO,
+ buf, &optlen));
+ ASSERT_EQ(sizeof(int), optlen);
+}
+
+TEST_F(netlink, pktinfo_undersize)
+{
+ char buf[2] = {};
+ socklen_t optlen = sizeof(buf);
+
+ ASSERT_EQ(-1, getsockopt(self->fd, SOL_NETLINK, NETLINK_PKTINFO,
+ buf, &optlen));
+ ASSERT_EQ(EINVAL, errno);
+}
+
+TEST_F(netlink, list_memberships_size_discovery)
+{
+ socklen_t optlen = 0;
+ char dummy;
+
+ ASSERT_EQ(0, getsockopt(self->fd, SOL_NETLINK,
+ NETLINK_LIST_MEMBERSHIPS,
+ &dummy, &optlen));
+ ASSERT_GT(optlen, 0);
+ ASSERT_EQ(0, optlen % sizeof(__u32));
+}
+
+TEST_F(netlink, list_memberships_full_read)
+{
+ __u32 buf[64] = {};
+ socklen_t optlen = sizeof(buf);
+
+ ASSERT_EQ(0, getsockopt(self->fd, SOL_NETLINK,
+ NETLINK_LIST_MEMBERSHIPS,
+ buf, &optlen));
+ ASSERT_GT(optlen, 0);
+ ASSERT_LE(optlen, sizeof(buf));
+ ASSERT_EQ(0, optlen % sizeof(__u32));
+}
+
+TEST_F(netlink, bad_level)
+{
+ int val;
+ socklen_t optlen = sizeof(val);
+
+ ASSERT_EQ(-1, getsockopt(self->fd, SOL_SOCKET + 1, NETLINK_PKTINFO,
+ &val, &optlen));
+ ASSERT_EQ(ENOPROTOOPT, errno);
+}
+
+TEST_F(netlink, bad_optname)
+{
+ int val;
+ socklen_t optlen = sizeof(val);
+
+ ASSERT_EQ(-1, getsockopt(self->fd, SOL_NETLINK, 0x7fff,
+ &val, &optlen));
+ ASSERT_EQ(ENOPROTOOPT, errno);
+}
+
+/* ---------- vsock ---------- */
+
+FIXTURE(vsock)
+{
+ int fd;
+};
+
+FIXTURE_SETUP(vsock)
+{
+ self->fd = socket(AF_VSOCK, SOCK_STREAM, 0);
+ if (self->fd < 0)
+ SKIP(return, "AF_VSOCK socket: %s", strerror(errno));
+}
+
+FIXTURE_TEARDOWN(vsock)
+{
+ if (self->fd >= 0)
+ close(self->fd);
+}
+
+TEST_F(vsock, buffer_size_exact)
+{
+ uint64_t val = 0;
+ socklen_t optlen = sizeof(val);
+
+ ASSERT_EQ(0, getsockopt(self->fd, AF_VSOCK,
+ SO_VM_SOCKETS_BUFFER_SIZE,
+ &val, &optlen));
+ ASSERT_EQ(sizeof(uint64_t), optlen);
+ ASSERT_GT(val, 0);
+}
+
+TEST_F(vsock, buffer_size_oversize_clamped)
+{
+ char buf[16] = {};
+ socklen_t optlen = sizeof(buf);
+
+ ASSERT_EQ(0, getsockopt(self->fd, AF_VSOCK,
+ SO_VM_SOCKETS_BUFFER_SIZE,
+ buf, &optlen));
+ ASSERT_EQ(sizeof(uint64_t), optlen);
+}
+
+TEST_F(vsock, buffer_size_undersize)
+{
+ char buf[4] = {};
+ socklen_t optlen = sizeof(buf);
+
+ ASSERT_EQ(-1, getsockopt(self->fd, AF_VSOCK,
+ SO_VM_SOCKETS_BUFFER_SIZE,
+ buf, &optlen));
+ ASSERT_EQ(EINVAL, errno);
+}
+
+TEST_F(vsock, bad_level)
+{
+ uint64_t val;
+ socklen_t optlen = sizeof(val);
+
+ ASSERT_EQ(-1, getsockopt(self->fd, SOL_SOCKET + 1,
+ SO_VM_SOCKETS_BUFFER_SIZE,
+ &val, &optlen));
+ ASSERT_EQ(ENOPROTOOPT, errno);
+}
+
+TEST_F(vsock, bad_optname)
+{
+ uint64_t val;
+ socklen_t optlen = sizeof(val);
+
+ ASSERT_EQ(-1, getsockopt(self->fd, AF_VSOCK, 0x7fff,
+ &val, &optlen));
+ ASSERT_EQ(ENOPROTOOPT, errno);
+}
+
+TEST_HARNESS_MAIN
--
2.52.0
^ permalink raw reply related
* [PATCH net-next 2/3] vsock: convert to getsockopt_iter
From: Breno Leitao @ 2026-05-01 15:52 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Stefano Garzarella, Shuah Khan, sdf.kernel
Cc: netdev, linux-kernel, virtualization, linux-kselftest,
Breno Leitao, kernel-team
In-Reply-To: <20260501-getsock_one-v1-0-810ce23ea70e@debian.org>
Convert AF_VSOCK's getsockopt implementation to use the new
getsockopt_iter callback with sockopt_t. The single
vsock_connectible_getsockopt() callback is shared by both
vsock_stream_ops and vsock_seqpacket_ops, so both proto_ops are
updated to use .getsockopt_iter.
Key changes:
- Replace (char __user *optval, int __user *optlen) with sockopt_t *opt
- Use opt->optlen for buffer length (input) and returned size (output)
- Use copy_to_iter() instead of put_user()/copy_to_user()
Signed-off-by: Breno Leitao <leitao@debian.org>
---
net/vmw_vsock/af_vsock.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 44037b066a5ff..d4a97eeb596e6 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -155,6 +155,7 @@
#include <linux/random.h>
#include <linux/skbuff.h>
#include <linux/smp.h>
+#include <linux/uio.h>
#include <linux/socket.h>
#include <linux/stddef.h>
#include <linux/sysctl.h>
@@ -2091,8 +2092,7 @@ static int vsock_connectible_setsockopt(struct socket *sock,
static int vsock_connectible_getsockopt(struct socket *sock,
int level, int optname,
- char __user *optval,
- int __user *optlen)
+ sockopt_t *opt)
{
struct sock *sk = sock->sk;
struct vsock_sock *vsk = vsock_sk(sk);
@@ -2110,8 +2110,7 @@ static int vsock_connectible_getsockopt(struct socket *sock,
if (level != AF_VSOCK)
return -ENOPROTOOPT;
- if (get_user(len, optlen))
- return -EFAULT;
+ len = opt->optlen;
memset(&v, 0, sizeof(v));
@@ -2142,11 +2141,10 @@ static int vsock_connectible_getsockopt(struct socket *sock,
return -EINVAL;
if (len > lv)
len = lv;
- if (copy_to_user(optval, &v, len))
+ if (copy_to_iter(&v, len, &opt->iter_out) != len)
return -EFAULT;
- if (put_user(len, optlen))
- return -EFAULT;
+ opt->optlen = len;
return 0;
}
@@ -2631,7 +2629,7 @@ static const struct proto_ops vsock_stream_ops = {
.listen = vsock_listen,
.shutdown = vsock_shutdown,
.setsockopt = vsock_connectible_setsockopt,
- .getsockopt = vsock_connectible_getsockopt,
+ .getsockopt_iter = vsock_connectible_getsockopt,
.sendmsg = vsock_connectible_sendmsg,
.recvmsg = vsock_connectible_recvmsg,
.mmap = sock_no_mmap,
@@ -2653,7 +2651,7 @@ static const struct proto_ops vsock_seqpacket_ops = {
.listen = vsock_listen,
.shutdown = vsock_shutdown,
.setsockopt = vsock_connectible_setsockopt,
- .getsockopt = vsock_connectible_getsockopt,
+ .getsockopt_iter = vsock_connectible_getsockopt,
.sendmsg = vsock_connectible_sendmsg,
.recvmsg = vsock_connectible_recvmsg,
.mmap = sock_no_mmap,
--
2.52.0
^ permalink raw reply related
* [PATCH net-next 1/3] netlink: convert to getsockopt_iter
From: Breno Leitao @ 2026-05-01 15:52 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Stefano Garzarella, Shuah Khan, sdf.kernel
Cc: netdev, linux-kernel, virtualization, linux-kselftest,
Breno Leitao, kernel-team
In-Reply-To: <20260501-getsock_one-v1-0-810ce23ea70e@debian.org>
Convert AF_NETLINK's getsockopt implementation to use the new
getsockopt_iter callback with sockopt_t.
Key changes:
- Replace (char __user *optval, int __user *optlen) with sockopt_t *opt
- Use opt->optlen for buffer length (input) and returned size (output)
- Use copy_to_iter() instead of put_user()/copy_to_user()
- For NETLINK_LIST_MEMBERSHIPS: walk the groups bitmap and emit each
u32 sequentially via copy_to_iter(), then set opt->optlen to the
total size required (ALIGN(BITS_TO_BYTES(ngroups), sizeof(u32))).
The wrapper writes opt->optlen back to userspace even on partial
failure, preserving the existing API that lets userspace discover
the needed allocation size.
Signed-off-by: Breno Leitao <leitao@debian.org>
---
net/netlink/af_netlink.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 2aeb0680807d6..db3be485b4804 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -39,6 +39,7 @@
#include <linux/fs.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
+#include <linux/uio.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/rtnetlink.h>
@@ -1716,18 +1717,18 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
}
static int netlink_getsockopt(struct socket *sock, int level, int optname,
- char __user *optval, int __user *optlen)
+ sockopt_t *opt)
{
struct sock *sk = sock->sk;
struct netlink_sock *nlk = nlk_sk(sk);
unsigned int flag;
int len, val;
+ u32 group;
if (level != SOL_NETLINK)
return -ENOPROTOOPT;
- if (get_user(len, optlen))
- return -EFAULT;
+ len = opt->optlen;
if (len < 0)
return -EINVAL;
@@ -1751,14 +1752,14 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
idx = pos / sizeof(unsigned long);
shift = (pos % sizeof(unsigned long)) * 8;
- if (put_user((u32)(nlk->groups[idx] >> shift),
- (u32 __user *)(optval + pos))) {
+ group = (u32)(nlk->groups[idx] >> shift);
+ if (copy_to_iter(&group, sizeof(u32),
+ &opt->iter_out) != sizeof(u32)) {
err = -EFAULT;
break;
}
}
- if (put_user(ALIGN(BITS_TO_BYTES(nlk->ngroups), sizeof(u32)), optlen))
- err = -EFAULT;
+ opt->optlen = ALIGN(BITS_TO_BYTES(nlk->ngroups), sizeof(u32));
netlink_unlock_table();
return err;
}
@@ -1784,8 +1785,8 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
len = sizeof(int);
val = test_bit(flag, &nlk->flags);
- if (put_user(len, optlen) ||
- copy_to_user(optval, &val, len))
+ opt->optlen = len;
+ if (copy_to_iter(&val, len, &opt->iter_out) != len)
return -EFAULT;
return 0;
@@ -2813,7 +2814,7 @@ static const struct proto_ops netlink_ops = {
.listen = sock_no_listen,
.shutdown = sock_no_shutdown,
.setsockopt = netlink_setsockopt,
- .getsockopt = netlink_getsockopt,
+ .getsockopt_iter = netlink_getsockopt,
.sendmsg = netlink_sendmsg,
.recvmsg = netlink_recvmsg,
.mmap = sock_no_mmap,
--
2.52.0
^ permalink raw reply related
* [PATCH net-next 0/3] net: Convert AF_NETLINK and AF_VSOCK to getsockopt_iter API
From: Breno Leitao @ 2026-05-01 15:52 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Stefano Garzarella, Shuah Khan, sdf.kernel
Cc: netdev, linux-kernel, virtualization, linux-kselftest,
Breno Leitao, kernel-team
Continue the work to convert protocols to the new getsockopt_iter API.
Convert AF_NETLINK and AF_VSOCK getsockopt implementations to the new
sockopt_t/getsockopt_iter API, and add kselftests that verify the size
and errno semantics are preserved across the conversion.
I chose these two socket families because they are probably one of the
most used protocols,, ensuring that any potential bugs will be
discovered and reported quickly.
The selftest was added as suggested by Stanislav Fomichev in [1].
Link: https://lore.kernel.org/all/adkSnyihmD1Atfcf@devvm17672.vll0.facebook.com/ [1]
Signed-off-by: Breno Leitao <leitao@debian.org>
---
Breno Leitao (3):
netlink: convert to getsockopt_iter
vsock: convert to getsockopt_iter
net: selftests: add getsockopt_iter regression tests
net/netlink/af_netlink.c | 21 +--
net/vmw_vsock/af_vsock.c | 16 +-
tools/testing/selftests/net/Makefile | 1 +
tools/testing/selftests/net/getsockopt_iter.c | 213 ++++++++++++++++++++++++++
4 files changed, 232 insertions(+), 19 deletions(-)
---
base-commit: edf4bee4215a173c0534d1851d7523d827149f9e
change-id: 20260501-getsock_one-a62758a9ba25
prerequisite-change-id: 20260501-getsock_iter_first-87f6a74c24e0:v1
Best regards,
--
Breno Leitao <leitao@debian.org>
^ permalink raw reply
* Re: [PATCH] selftests: mptcp: add test for IPv6 subflow SLAB placement
From: Matthieu Baerts @ 2026-05-01 15:45 UTC (permalink / raw)
To: Vastargazing, martineau
Cc: mptcp, netdev, linux-kselftest, shuah, stable, Florian Westphal
In-Reply-To: <20260501151454.211598-1-vebohr@gmail.com>
Hi Vastargazing,
(+cc Florian who did a similar review on netfilter ML)
On 01/05/2026 17:14, Vastargazing wrote:
> Add mptcp_v6_initcall.sh to verify that MPTCP IPv6 subflow child
> sockets are allocated from the TCPv6 SLAB cache, not the kmalloc-4k
> fallback.
>
> tcpv6_prot_override must copy tcpv6_prot after proto_register(&tcpv6_prot)
> populates tcpv6_prot.slab. If the copy runs too early, override.slab
> stays NULL (frozen by __ro_after_init) and subflow children fall back
> to kmalloc-4k. This lacks SLAB_TYPESAFE_BY_RCU, allowing lockless
> ehash lookups in __inet_lookup_established to read freed memory.
>
> The test exercises the IPv6 accept path via MPTCP connections between
> two network namespaces, then checks that the TCPv6 slab active object
> count grew. On a fixed kernel, the delta is ~2 * NR_CONNS (one subflow
> per side per connection); on a broken kernel, it stays near zero because
> children land in kmalloc-4k instead.
>
> Topology: two netns connected via veth pair with /64 ULA addresses;
> NR_CONNS parallel short-lived MPTCP connections are established and held
> open long enough to sample /proc/slabinfo. The test skips if
> CONFIG_MPTCP_IPV6 is absent (checked via kallsyms) or /proc/slabinfo is
> unreadable.
>
> Verified on Ubuntu 6.17 kernel predating the fix: TAP "not ok 1 ...
> TCPv6 slab gains MPTCPv6 subflow children" with delta=0. On kernels
> with the fix, delta is well above the threshold of NR_CONNS/2.
Thank you for adding this new test, and for having validated
9b55b253907e ("mptcp: fix slab-use-after-free in
__inet_lookup_established").
(...)
My following review comments are very similar to the ones shared by
Florian for another on the Netfilter ML.
> diff --git a/tools/testing/selftests/net/mptcp/mptcp_v6_initcall.sh b/tools/testing/selftests/net/mptcp/mptcp_v6_initcall.sh
> new file mode 100644
This should say '755', else you get
# Warning: file mptcp_v6_initcall.sh is not executable
(Plus our CI will not validate that test.)
Me too, I'm not sure whether we should add regression tests for
regression tests sake. Else we'll also quickly accumulate thousands of
such scripts and test run time will explode. Globally, we prefer adding
a new subtest instead of a full test.
Here, you are validating an issue in the init code, that is very
unlikely to change. If a test was needed during the submission of the
original fix, I would have suggested adding a quick test in our
packetdrill repo instead:
https://github.com/multipath-tcp/packetdrill
An existing packetdrill test could be modified to check the slabs in v4
and v6, but I'm still not convinced it is worth it.
Cheers,
Matt
--
Sponsored by the NGI0 Core fund.
^ permalink raw reply
* Re: [RFC PATCH 1/2] net: af_unix: Useful handling of LSM denials on SCM_RIGHTS
From: Jori Koolstra @ 2026-05-01 15:34 UTC (permalink / raw)
To: Kuniyuki Iwashima
Cc: Alexander Viro, Christian Brauner, Jan Kara, Eric Dumazet,
Paolo Abeni, Willem de Bruijn, David S . Miller, Jakub Kicinski,
Jens Axboe, Kees Cook, Simon Horman, Andy Lutomirski, Will Drewry,
Jeff Layton, Oleg Nesterov, Andrei Vagin, Pavel Tikhomirov,
Mateusz Guzik, Joel Granados, Charlie Mirabile, Aleksa Sarai,
linux-fsdevel, linux-kernel, netdev, io-uring
In-Reply-To: <CAAVpQUBKeN2KtRkRAFr8sYJM1_-rbkdjsujau5fAyaiP_dO6FA@mail.gmail.com>
> Op 30-04-2026 04:04 CEST schreef Kuniyuki Iwashima <kuniyu@google.com>:
>
>
> On Tue, Apr 28, 2026 at 10:51 AM Jori Koolstra <jkoolstra@xs4all.nl> wrote:
> >
> > Right now if some LSM such as Smack denies an AF_UNIX socket peer to
> > receive an SCM_RIGHTS fd the SCM_RIGHTS fd array will be cut short at
> > that point, and MSG_CTRUNC is set on return of recvmsg(). This is
> > highly problematic behaviour, because it leaves the receiver
> > wondering what happened. As per man page MSG_CTRUNC is supposed to
> > indicate that the control buffer was sized too short, but suddenly
> > a permission error might result in the exact same flag being set.
> > Moreover, the receiver has no chance to determine how many fds got
> > originally sent and how many were suppressed.[1]
> >
> > Add two MSG_* flags:
>
> Since we only have 5 bits remaining for future extension,
> we need to consider the use case a bit more carefully.
>
Right. Since it wasn't a lot of work I implemented it exactly as the request
was made from userspace, and then discuss it from there. By the way, I suppose
nothing can be done about that small flag space?
>
> > - MSG_RIGHTS_DENIAL is set whenever any file is rejected by the LSM
> > during recvmsg() of SCM_RIGHTS fds.
>
> Is this really needed ?
>
> Even if the fd array is truncated, the application will traverse
> the array anyway since it has some fds already installed (to
> clean up in case of MSG_CTRUNC ?).
>
> Then, it will find the -EPERM entry.
>
> I assume no one uses MSG_RIGHTS_DENIAL without
> MSG_RIGHTS_FILTER.
>
I guess that is a fair assumption to make. We can certainly do without
MSG_RIGHTS_DENIAL if saving flags is important. I also suggested that
we may see whether we can make MSG_RIGHTS_FILTER the default behavior.
In the mean time I've found grep.app, and it turns out the answer is no.
Apparently almost no one checks even for the truncation flag (mostly 1 fd
is passed and then it is check the cmsg lenght). But cpython has this for
instance:
/* Close all descriptors coming from SCM_RIGHTS, so they don't leak. */
for (cmsgh = ((msg.msg_controllen > 0) ? CMSG_FIRSTHDR(&msg) : NULL);
cmsgh != NULL; cmsgh = CMSG_NXTHDR(&msg, cmsgh)) {
cmsg_status = get_cmsg_data_len(&msg, cmsgh, &cmsgdatalen);
if (cmsg_status < 0)
break;
if (cmsgh->cmsg_level == SOL_SOCKET &&
cmsgh->cmsg_type == SCM_RIGHTS) {
size_t numfds;
int *fdp;
numfds = cmsgdatalen / sizeof(int);
fdp = (int *)CMSG_DATA(cmsgh);
while (numfds-- > 0)
close(*fdp++);
}
if (cmsg_status != 0)
break;
}
>
> > - If MSG_RIGHTS_FILTER is passed as a flag to recvmsg(), the SCM_RIGHTS
>
> Does this flag need per-recvmsg() granularity ?
>
Perhaps not. What would be the alternative? A fcntl option for the socket fd?
> If the application does not welcome the truncated fd array,
> it would have passed MSG_RIGHTS_FILTER to every
> recvmsg(), no ?
>
Correct.
Thanks,
Jori.
^ permalink raw reply
* Re: [PATCH] amd-xgbe: fix PTP addend overflow causing frozen clock
From: Simon Horman @ 2026-05-01 15:32 UTC (permalink / raw)
To: gfuchedgi
Cc: Raju Rangoju, Prashanth Kumar K R, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Richard Cochran,
netdev, linux-kernel
In-Reply-To: <20260429-fix-xgbe-ptp-addend-v1-1-fca5b0ca5e62@gmail.com>
On Wed, Apr 29, 2026 at 02:54:14PM -0700, Gregory Fuchedgi via B4 Relay wrote:
> From: Gregory Fuchedgi <gfuchedgi@gmail.com>
>
> XGBE_PTP_ACT_CLK_FREQ and XGBE_V2_PTP_ACT_CLK_FREQ were 10x too
> large (500MHz/1GHz instead of 50MHz/100MHz), causing the computed
> addend to overflow the 32-bit tstamp_addend. In the general case
> this would result in the clock advancing at the wrong rate. For v2
> (PCI), ptpclk_rate is hardcoded to 125MHz, so the addend formula
> (ACT_CLK_FREQ << 32) / ptpclk_rate yields exactly 8 * 2^32, and
> when stored to the 32-bit tstamp_addend the value is zero. With
> addend = 0 the hardware accumulator never overflows and the PTP
> clock is fully stopped. For v1 (platform), ptpclk_rate is read from
> ACPI/DT so the exact overflow behavior depends on the
> firmware-reported frequency.
>
> Define the constants as NSEC_PER_SEC / SSINC so the relationship is
> explicit and cannot drift out of sync.
>
> Fixes: fbd47be098b5 ("amd-xgbe: add hardware PTP timestamping support")
> Tested-by: Gregory Fuchedgi <gfuchedgi@gmail.com>
> Signed-off-by: Gregory Fuchedgi <gfuchedgi@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
There is an AI generated review of this patch available on sashiko.dev.
While I do believe the issues flagged there warrant investigation
as possible follow-up, I do not think they should delay progress
of this patch.
^ permalink raw reply
* Re: [PATCH iproute2-next 0/5] netshaper: Extend netshaper support
From: Stephen Hemminger @ 2026-05-01 15:17 UTC (permalink / raw)
To: Mohsin Bashir; +Cc: netdev, dsahern, pabeni, kuba, ernis
In-Reply-To: <20260501011611.3533573-1-mohsin.bashr@gmail.com>
On Thu, 30 Apr 2026 18:16:06 -0700
Mohsin Bashir <mohsin.bashr@gmail.com> wrote:
> From: Mohsin Bashir <hmohsin@meta.com>
>
> This series extends the netshaper CLI with missing parameter support
> and adds the group command for building scheduling hierarchies.
>
> The existing netshaper tool only supports setting bw-max on individual
> shapers. This series adds the remaining shaper attributes (bw-min,
> weight, priority) needed for TX scheduling, and introduces the
> group command which ties leaf shapers to a parent node in a single
> operation.
>
> Mohsin Bashir (5):
> netshaper: Extract parse_scope() and parse_rate() helpers
> netshaper: Add bw-min and weight parameter support
> netshaper: Extend show output with parent, bw-min and weight
> netshaper: Make handle id optional for node scope
> netshaper: Add group command for creating scheduling hierarchies
>
> netshaper/netshaper.c | 398 ++++++++++++++++++++++++++++++++++--------
> 1 file changed, 324 insertions(+), 74 deletions(-)
>
AI review liked the patch but found a JSON break
As always there are some noise things here.
Like the suggestion about noreturn attribute.
Subject: Re: [PATCH iproute2] netshaper: Add group command and parameter support
On Thu, 30 Apr 2026, Mohsin Bashir wrote:
> This series adds netshaper support for scheduling hierarchies, bw-min/weight
> parameters, and improved output formatting.
Overall the patches look good and follow most iproute2 conventions properly.
I especially appreciate that all new code correctly uses strcmp() instead of
matches() for argument parsing.
However, there are a few minor issues that should be addressed:
> @@ -47,55 +54,98 @@ static const char *net_shaper_scope_names[NET_SHAPER_SCOPE_MAX + 1] = {
> static void print_netshaper_attrs(struct nlmsghdr *answer)
> [...]
> + printf("\n");
> }
The raw printf("\n") at the end of print_netshaper_attrs() breaks JSON output.
All output should use the print_XXX() helpers to maintain proper JSON formatting.
This should be:
print_nl();
or handled by the print functions themselves. The print helpers ensure that
JSON output remains valid when the -j flag is used.
> @@ -103,13 +153,14 @@ static int do_cmd(int argc, char **argv, int cmd)
> [...]
> while (argc > 0) {
> if (strcmp(*argv, "dev") == 0) {
> NEXT_ARG();
> ifindex = ll_name_to_index(*argv);
In do_cmd(), the return value of ll_name_to_index() is not properly validated.
When the device doesn't exist, this function returns 0. The code should check:
ifindex = ll_name_to_index(*argv);
if (ifindex == 0) {
fprintf(stderr, "Device \"%s\" not found\n", *argv);
return -1;
}
This validation is correctly done in do_group() but missing in do_cmd().
> @@ -31,13 +31,20 @@ static void usage(void)
> {
> fprintf(stderr,
> "Usage: netshaper [ OPTIONS ] { COMMAND | help }\n"
The usage() function should be marked with __attribute__((noreturn)) as per
iproute2 coding conventions:
static void usage(void) __attribute__((noreturn));
static void usage(void)
{
...
exit(-1);
}
This helps the compiler with optimization and static analysis.
These are all minor issues in an otherwise well-structured patch series.
The code properly uses designated initializers, validates input with
appropriate helpers, and follows the error handling patterns correctly.
With these small fixes, the series would be ready for inclusion.
Best regards
^ permalink raw reply
* [PATCH] selftests: mptcp: add test for IPv6 subflow SLAB placement
From: Vastargazing @ 2026-05-01 15:14 UTC (permalink / raw)
To: matttbe, martineau
Cc: mptcp, netdev, linux-kselftest, shuah, Vastargazing, stable
Add mptcp_v6_initcall.sh to verify that MPTCP IPv6 subflow child
sockets are allocated from the TCPv6 SLAB cache, not the kmalloc-4k
fallback.
tcpv6_prot_override must copy tcpv6_prot after proto_register(&tcpv6_prot)
populates tcpv6_prot.slab. If the copy runs too early, override.slab
stays NULL (frozen by __ro_after_init) and subflow children fall back
to kmalloc-4k. This lacks SLAB_TYPESAFE_BY_RCU, allowing lockless
ehash lookups in __inet_lookup_established to read freed memory.
The test exercises the IPv6 accept path via MPTCP connections between
two network namespaces, then checks that the TCPv6 slab active object
count grew. On a fixed kernel, the delta is ~2 * NR_CONNS (one subflow
per side per connection); on a broken kernel, it stays near zero because
children land in kmalloc-4k instead.
Topology: two netns connected via veth pair with /64 ULA addresses;
NR_CONNS parallel short-lived MPTCP connections are established and held
open long enough to sample /proc/slabinfo. The test skips if
CONFIG_MPTCP_IPV6 is absent (checked via kallsyms) or /proc/slabinfo is
unreadable.
Verified on Ubuntu 6.17 kernel predating the fix: TAP "not ok 1 ...
TCPv6 slab gains MPTCPv6 subflow children" with delta=0. On kernels
with the fix, delta is well above the threshold of NR_CONNS/2.
Fixes: b19bc2945b40 ("mptcp: implement delegated actions")
Cc: stable@vger.kernel.org
Signed-off-by: Vastargazing <vebohr@gmail.com>
---
tools/testing/selftests/net/mptcp/Makefile | 1 +
.../selftests/net/mptcp/mptcp_v6_initcall.sh | 140 ++++++++++++++++++
2 files changed, 141 insertions(+)
create mode 100644 tools/testing/selftests/net/mptcp/mptcp_v6_initcall.sh
diff --git a/tools/testing/selftests/net/mptcp/Makefile b/tools/testing/selftests/net/mptcp/Makefile
index 22ba0da2adb8..c9f329441490 100644
--- a/tools/testing/selftests/net/mptcp/Makefile
+++ b/tools/testing/selftests/net/mptcp/Makefile
@@ -14,6 +14,7 @@ TEST_PROGS := \
mptcp_connect_splice.sh \
mptcp_join.sh \
mptcp_sockopt.sh \
+ mptcp_v6_initcall.sh \
pm_netlink.sh \
simult_flows.sh \
userspace_pm.sh \
diff --git a/tools/testing/selftests/net/mptcp/mptcp_v6_initcall.sh b/tools/testing/selftests/net/mptcp/mptcp_v6_initcall.sh
new file mode 100644
index 000000000000..c55fc74b5ffb
--- /dev/null
+++ b/tools/testing/selftests/net/mptcp/mptcp_v6_initcall.sh
@@ -0,0 +1,140 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Verify that MPTCP IPv6 subflow child sockets are allocated from the
+# TCPv6 slab cache.
+#
+# tcpv6_prot_override is initialised by copying tcpv6_prot, which is only
+# safe after proto_register(&tcpv6_prot) has populated tcpv6_prot.slab.
+# If the override copy runs too early during init, override.slab stays
+# NULL and __ro_after_init freezes that. Subflow child sockets then fall
+# back to kmalloc (kmalloc-4k for a TCPv6 sock), which lacks
+# SLAB_TYPESAFE_BY_RCU; lockless ehash lookups in __inet_lookup_established
+# can read freed memory.
+#
+# This test exercises the IPv6 accept path, which goes through the
+# override proto, and then asserts that the live TCPv6 slab population
+# grew. On a kernel where the override slab is NULL the delta is ~0,
+# because the children land in kmalloc-4k instead.
+
+#shellcheck disable=SC2086
+
+. "$(dirname "${0}")/mptcp_lib.sh"
+
+ns1=""
+ns2=""
+ret=0
+
+NR_CONNS=20
+TIMEOUT_POLL=30
+TIMEOUT_TEST=$((TIMEOUT_POLL * 2 + 1))
+PORT_BASE=20000
+
+# This function is used in the cleanup trap
+#shellcheck disable=SC2317,SC2329
+cleanup()
+{
+ for ns in "${ns1}" "${ns2}"; do
+ [ -n "${ns}" ] || continue
+ ip netns pids "${ns}" | xargs --no-run-if-empty kill -SIGKILL &>/dev/null
+ done
+ mptcp_lib_ns_exit "${ns1}" "${ns2}"
+}
+
+mptcp_lib_check_mptcp
+mptcp_lib_check_tools ip ss
+
+if ! mptcp_lib_kallsyms_has "tcpv6_prot_override$"; then
+ mptcp_lib_pr_skip "CONFIG_MPTCP_IPV6 not available"
+ exit ${KSFT_SKIP}
+fi
+
+if ! [ -r /proc/slabinfo ]; then
+ mptcp_lib_pr_skip "/proc/slabinfo not readable"
+ exit ${KSFT_SKIP}
+fi
+
+if ! awk '/^TCPv6 / { found = 1 } END { exit !found }' /proc/slabinfo; then
+ mptcp_lib_pr_skip "TCPv6 slab cache not present"
+ exit ${KSFT_SKIP}
+fi
+
+trap cleanup EXIT
+mptcp_lib_ns_init ns1 ns2
+
+ip -n "${ns1}" link add eth1 type veth peer name eth1 netns "${ns2}"
+ip -n "${ns1}" link set eth1 up
+ip -n "${ns1}" -6 addr add fc00::1/64 dev eth1 nodad
+ip -n "${ns2}" link set eth1 up
+ip -n "${ns2}" -6 addr add fc00::2/64 dev eth1 nodad
+
+# Wait for DAD-less addresses to settle
+ip -n "${ns1}" -6 route get fc00::2 >/dev/null 2>&1 || sleep 0.1
+
+get_tcpv6_active()
+{
+ awk '/^TCPv6 / { print $2 }' /proc/slabinfo
+}
+
+before=$(get_tcpv6_active)
+
+for i in $(seq 1 ${NR_CONNS}); do
+ echo "a" |
+ timeout ${TIMEOUT_TEST} \
+ ip netns exec "${ns2}" \
+ ./mptcp_connect -6 -p $((PORT_BASE + i)) -l \
+ -t ${TIMEOUT_POLL} -w ${TIMEOUT_POLL} \
+ :: >/dev/null 2>&1 &
+done
+
+# wait_local_port_listen() only checks one port. Walk every port so we
+# do not start the connectors before all listeners are ready.
+for i in $(seq 1 ${NR_CONNS}); do
+ mptcp_lib_wait_local_port_listen "${ns2}" $((PORT_BASE + i))
+done
+
+for i in $(seq 1 ${NR_CONNS}); do
+ echo "b" |
+ timeout ${TIMEOUT_TEST} \
+ ip netns exec "${ns1}" \
+ ./mptcp_connect -6 -p $((PORT_BASE + i)) \
+ -t ${TIMEOUT_POLL} -w ${TIMEOUT_POLL} \
+ fc00::2 >/dev/null 2>&1 &
+done
+
+# Wait for the accept side to materialise child sockets. ss reports the
+# number of established TCP connections in ns2 owned by mptcp_connect.
+established=0
+for _ in $(seq 20); do
+ established=$(ip netns exec "${ns2}" ss -H -t -6 state established 2>/dev/null | wc -l)
+ [ "${established}" -ge "${NR_CONNS}" ] && break
+ sleep 1
+done
+
+after=$(get_tcpv6_active)
+delta=$(( after - before ))
+
+# Conservative threshold: NR_CONNS connections (each producing at least
+# a server-side accepted child) must leave a clearly observable footprint
+# in the TCPv6 slab. On a regressed kernel, override.slab == NULL routes
+# every child into kmalloc-4k and the TCPv6 delta stays near zero.
+threshold=$(( NR_CONNS / 2 ))
+
+msg="TCPv6 slab gains MPTCPv6 subflow children"
+mptcp_lib_print_title "${msg}"
+if [ "${established}" -lt "${NR_CONNS}" ]; then
+ mptcp_lib_pr_fail "only ${established}/${NR_CONNS} connections established"
+ mptcp_lib_result_fail "${msg}"
+ ret=${KSFT_FAIL}
+elif [ "${delta}" -ge "${threshold}" ]; then
+ mptcp_lib_pr_ok "delta=${delta}"
+ mptcp_lib_result_pass "${msg}"
+else
+ mptcp_lib_pr_fail "delta=${delta} below ${threshold}:" \
+ "subflow children likely in kmalloc fallback"
+ mptcp_lib_result_fail "${msg}"
+ ret=${KSFT_FAIL}
+fi
+
+mptcp_lib_result_print_all_tap
+exit ${ret}
--
2.51.0
^ permalink raw reply related
* Re: [PATCH v2 iproute2-next] utils: add fflush_monitor() helper
From: Stephen Hemminger @ 2026-05-01 15:10 UTC (permalink / raw)
To: David Ahern
Cc: Eric Dumazet, David S . Miller, Jakub Kicinski, Paolo Abeni,
netdev, eric.dumazet
In-Reply-To: <6e00eaa5-a4d7-45dd-9d90-fb319b76c9fa@kernel.org>
On Thu, 30 Apr 2026 09:35:08 -0600
David Ahern <dsahern@kernel.org> wrote:
> On 4/27/26 2:19 AM, Eric Dumazet wrote:
> > Some fflush() calls only make sense for monitor programs.
> >
> > For other cases, forcing a flush is expensive.
> >
> > After this patch, ip, tc and ss are correctly buffering most of their
> > output when redirected to a file.
> >
> > Signed-off-by: Eric Dumazet <edumazet@google.com>
> > ---
> > include/utils.h | 7 +++++++
> > ip/ipaddress.c | 12 +++++++-----
> > ip/iplink.c | 4 ++--
> > ip/ipmonitor.c | 1 +
> > ip/ipmptcp.c | 10 +++++-----
> > ip/ipneigh.c | 4 ++--
> > ip/ipnetconf.c | 2 +-
> > ip/ipnetns.c | 2 +-
> > ip/ipnexthop.c | 12 ++++++------
> > ip/iproute.c | 4 ++--
> > ip/iprule.c | 2 +-
> > ip/iptoken.c | 2 +-
> > ip/tcp_metrics.c | 2 +-
> > lib/utils.c | 1 +
> > misc/ss.c | 3 ++-
> > tc/tc_class.c | 2 +-
> > tc/tc_filter.c | 2 +-
> > tc/tc_monitor.c | 1 +
> > tc/tc_qdisc.c | 2 +-
> > 19 files changed, 44 insertions(+), 31 deletions(-)
> >
>
> no longer applies after merging main to next.
>
I put the other version in iproute2 since wanted to test and it
did not depend on any later kernel changes
^ permalink raw reply
* [PATCH 1/1] ovpn: tcp - defer TX from softirq to workqueue
From: Dao Zhong Ma @ 2026-05-01 14:54 UTC (permalink / raw)
To: linux-kernel, netdev, antonio
Cc: sd, andrew+netdev, davem, edumazet, kuba, pabeni, Dao Zhong Ma
In-Reply-To: <20260501145425.757147-1-cz1346219@gmail.com>
ovpn_tcp_send_skb() holds sk->sk_lock.slock while performing the full TCP
send in softirq context. This can hold the spinlock for a long time
(large skb), blocking lock_sock() users. This can starve the RCU GP
kthread and trigger RCU stalls warnings and hung tasks.
Defer the TCP send operation to process context:
- In interrupt context, only enqueue the skb under the spinlock
schedule tcp_tx_work.
- In process context, dequeue and flush the send queue under lock_sock()
This reduces the softirq critical section to a short duration, allowing
lock_sock() users to make progress and preventing RCU stalls.
Signed-off-by: Dao Zhong Ma <cz1346219@gmail.com>
---
drivers/net/ovpn/tcp.c | 80 +++++++++++++++++++++++++++++++-----------
1 file changed, 59 insertions(+), 21 deletions(-)
diff --git a/drivers/net/ovpn/tcp.c b/drivers/net/ovpn/tcp.c
index 65054cc84be5..d75ad0c22a30 100644
--- a/drivers/net/ovpn/tcp.c
+++ b/drivers/net/ovpn/tcp.c
@@ -6,6 +6,7 @@
* Author: Antonio Quartulli <antonio@openvpn.net>
*/
+#include <linux/interrupt.h>
#include <linux/skbuff.h>
#include <net/hotdata.h>
#include <net/inet_common.h>
@@ -312,6 +313,40 @@ static void ovpn_tcp_send_sock(struct ovpn_peer *peer, struct sock *sk)
peer->tcp.tx_in_progress = false;
}
+/* Caller must hold sk->sk_lock.slock. */
+static bool ovpn_tcp_queue_skb(struct ovpn_peer *peer, struct sk_buff *skb)
+{
+ if (skb_queue_len(&peer->tcp.out_queue) >=
+ READ_ONCE(net_hotdata.max_backlog)) {
+ dev_dstats_tx_dropped(peer->ovpn->dev);
+ kfree_skb(skb);
+ return false;
+ }
+
+ __skb_queue_tail(&peer->tcp.out_queue, skb);
+ return true;
+}
+
+/* Caller must hold sk->sk_lock.slock and own the socket. */
+static void ovpn_tcp_tx_flush(struct ovpn_peer *peer, struct sock *sk)
+{
+ struct sk_buff *skb;
+
+ if (peer->tcp.out_msg.skb)
+ ovpn_tcp_send_sock(peer, sk);
+
+ while (!peer->tcp.out_msg.skb) {
+ skb = __skb_dequeue(&peer->tcp.out_queue);
+ if (!skb)
+ break;
+
+ peer->tcp.out_msg.skb = skb;
+ peer->tcp.out_msg.len = skb->len;
+ peer->tcp.out_msg.offset = 0;
+ ovpn_tcp_send_sock(peer, sk);
+ }
+}
+
void ovpn_tcp_tx_work(struct work_struct *work)
{
struct ovpn_socket *sock;
@@ -320,7 +355,7 @@ void ovpn_tcp_tx_work(struct work_struct *work)
lock_sock(sock->sk);
if (sock->peer)
- ovpn_tcp_send_sock(sock->peer, sock->sk);
+ ovpn_tcp_tx_flush(sock->peer, sock->sk);
release_sock(sock->sk);
}
@@ -345,32 +380,38 @@ static void ovpn_tcp_send_sock_skb(struct ovpn_peer *peer, struct sock *sk,
void ovpn_tcp_send_skb(struct ovpn_peer *peer, struct sock *sk,
struct sk_buff *skb)
{
+ struct ovpn_socket *sock;
u16 len = skb->len;
+ bool queued;
*(__be16 *)__skb_push(skb, sizeof(u16)) = htons(len);
- spin_lock_nested(&sk->sk_lock.slock, OVPN_TCP_DEPTH_NESTING);
- if (sock_owned_by_user(sk)) {
- if (skb_queue_len(&peer->tcp.out_queue) >=
- READ_ONCE(net_hotdata.max_backlog)) {
- dev_dstats_tx_dropped(peer->ovpn->dev);
- kfree_skb(skb);
- goto unlock;
- }
- __skb_queue_tail(&peer->tcp.out_queue, skb);
- } else {
- ovpn_tcp_send_sock_skb(peer, sk, skb);
+ if (unlikely(in_interrupt())) {
+ spin_lock_nested(&sk->sk_lock.slock, OVPN_TCP_DEPTH_NESTING);
+ queued = ovpn_tcp_queue_skb(peer, skb);
+ spin_unlock(&sk->sk_lock.slock);
+ if (!queued)
+ return;
+
+ rcu_read_lock();
+ sock = rcu_dereference_sk_user_data(sk);
+ if (sock)
+ schedule_work(&sock->tcp_tx_work);
+ rcu_read_unlock();
+ return;
}
-unlock:
- spin_unlock(&sk->sk_lock.slock);
+
+ lock_sock_nested(sk, OVPN_TCP_DEPTH_NESTING);
+ queued = ovpn_tcp_queue_skb(peer, skb);
+ if (queued)
+ ovpn_tcp_tx_flush(peer, sk);
+ release_sock(sk);
}
static void ovpn_tcp_release(struct sock *sk)
{
- struct sk_buff_head queue;
struct ovpn_socket *sock;
struct ovpn_peer *peer;
- struct sk_buff *skb;
rcu_read_lock();
sock = rcu_dereference_sk_user_data(sk);
@@ -390,11 +431,7 @@ static void ovpn_tcp_release(struct sock *sk)
}
rcu_read_unlock();
- __skb_queue_head_init(&queue);
- skb_queue_splice_init(&peer->tcp.out_queue, &queue);
-
- while ((skb = __skb_dequeue(&queue)))
- ovpn_tcp_send_sock_skb(peer, sk, skb);
+ ovpn_tcp_tx_flush(peer, sk);
peer->tcp.sk_cb.prot->release_cb(sk);
ovpn_peer_put(peer);
@@ -653,3 +690,4 @@ void __init ovpn_tcp_init(void)
&inet6_stream_ops);
#endif
}
+
--
2.54.0
^ permalink raw reply related
* [PATCH 0/1] ovpn: tcp - defer TX from softirq to workqueue
From: Dao Zhong Ma @ 2026-05-01 14:54 UTC (permalink / raw)
To: linux-kernel, netdev, antonio
Cc: sd, andrew+netdev, davem, edumazet, kuba, pabeni, Dao Zhong Ma
Hi,
I observed system hangs when using OpenVPN across suspend/resume
under heavy network load.
The issue can be reproduced with:
1. Establish an OpenVPN connection
2. Generate traffic with iperf3
3. Add CPU/memory pressure with stress-ng
4. Suspend and resume the system
After resume, the system may become unresponsive. SysRq output shows
tasks spinning on sk->sk_lock.slock, and RCU stall warnings are
observed.
Kernel logs and stack traces:
kernel: watchdog: BUG: soft lockup - CPU#4 stuck for 22s! [stress-ng-cpu:11506]
kernel: CPU#4 Utilization every 4000ms during lockup:
kernel: #1: 0% system, 100% softirq, 1% hardirq, 0% idle
kernel: #2: 0% system, 100% softirq, 0% hardirq, 0% idle
kernel: #3: 0% system, 100% softirq, 1% hardirq, 0% idle
kernel: #4: 0% system, 100% softirq, 0% hardirq, 0% idle
kernel: #5: 0% system, 100% softirq, 0% hardirq, 0% idle
kernel: CPU: 4 UID: 1000 PID: 11506 Comm: stress-ng-cpu Tainted: G U 7.0.2-2-cachyos #1 PREEMPT 136cb9373f01c1def72b1b5def9dd1fcc7884035
kernel: Tainted: [U]=USER
kernel: Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP05, BIOS 03.18 01/08/2026
kernel: RIP: 0010:native_queued_spin_lock_slowpath+0x5a/0x260
kernel: Code: 08 0f 92 c0 b9 ff 00 ff ff 23 0f 89 c2 c1 e2 08 09 ca 81 fa 00 01 00 00 73 5a 85 c9 74 0e 66 90 80 3f 00 74 07 f3 90 80 3f 00 <75> f9 66 c7 07 01 00 65 48 ff 05 3f c6 d8 01 5b 41 5e 41 5f 5d e9
kernel: RSP: 0000:ffffcf548d9bb758 EFLAGS: 00000202
kernel: RAX: 0000000000000000 RBX: ffff8ec75f9f4d48 RCX: 0000000000000001
kernel: RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffff8ec75f9f4d48
kernel: RBP: 0000000000000000 R08: 0000000000000000 R09: ffff8ec8547abd80
kernel: R10: 0000000000000020 R11: 0000000000000020 R12: ffff8ec75f9f4c00
kernel: R13: ffff8ec862d9d400 R14: ffff8ec753ade400 R15: ffff8ec771548800
kernel: FS: 00007f9b4fcd0b00(0000) GS:ffff8eccfe99c000(0000) knlGS:0000000000000000
kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kernel: CR2: 00007ffb7e1f8e38 CR3: 0000000166ced000 CR4: 0000000000f50ef0
kernel: PKRU: 55555554
kernel: Call Trace:
kernel: <TASK>
kernel: _raw_spin_lock+0x2a/0x40
kernel: ovpn_tcp_send_skb+0x4c/0x130 [ovpn 03847a96bef64ed5cc535ef1935e53bb388bcced]
kernel: ovpn_encrypt_post+0x95/0x1f0 [ovpn 03847a96bef64ed5cc535ef1935e53bb388bcced]
kernel: ovpn_send+0x15f/0x230 [ovpn 03847a96bef64ed5cc535ef1935e53bb388bcced]
kernel: ovpn_net_xmit+0x30f/0x560 [ovpn 03847a96bef64ed5cc535ef1935e53bb388bcced]
kernel: dev_hard_start_xmit+0x93/0x140
kernel: __dev_queue_xmit+0x99b/0xa80
kernel: ? __dev_queue_xmit+0x6f/0xa80
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: ? nf_hook_slow+0x4b/0xd0
kernel: ? __pfx_ip_finish_output+0x10/0x10
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: ? nf_hook+0x9c/0xb0
kernel: ip_finish_output2+0x189/0x320
kernel: dst_output+0x99/0xd0
kernel: __ip_queue_xmit+0x209/0x350
kernel: __tcp_transmit_skb+0x4cb/0xba0
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: ? __alloc_skb+0x2b6/0x340
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: ? skb_split+0x5f/0x3c0
kernel: tcp_write_xmit+0xad3/0x1a50
kernel: ? __pfx_tcp_write_timer+0x10/0x10
kernel: tcp_send_loss_probe+0x94/0x2b0
kernel: ? __pfx_tcp_write_timer+0x10/0x10
kernel: tcp_write_timer+0x67/0xb0
kernel: __run_timer_base+0x33d/0x500
kernel: tmigr_handle_remote+0x3da/0x3e0
kernel: run_timer_softirq.cold+0x47/0x394
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: ? __pfx_tick_nohz_handler+0x10/0x10
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: ? ktime_get+0x48/0xa0
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: ? clockevents_program_event+0xaa/0xf0
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: ? srso_alias_return_thunk+0x5/0xfbef5
kernel: irq_exit_rcu+0x1ad/0x290
kernel: sysvec_apic_timer_interrupt+0x33/0x80
kernel: asm_sysvec_apic_timer_interrupt+0x1a/0x20
kernel: RIP: 0033:0x559fc1ece66f
kernel: Code: 44 89 c8 c0 e8 03 44 31 c0 83 e0 01 66 41 d1 e8 f7 d8 66 25 08 84 44 31 c0 45 89 c8 41 c0 e8 04 41 31 c0 41 83 e0 01 41 f7 d8 <66> 41 81 e0 08 84 66 d1 e8 41 31 c0 44 89 c8 c0 e8 05 44 31 c0 83
kernel: RSP: 002b:00007ffe1344e860 EFLAGS: 00000297
kernel: RAX: 00000000ffff5912 RBX: 000000000000000a RCX: 00007ffe1344ebcb
kernel: RDX: 00007ffe1344ea27 RSI: 00007ffe1344ec60 RDI: 0000559fc318d450
kernel: RBP: 00007ffe1344edf0 R08: 00000000ffffffff R09: 00000000000000b4
kernel: R10: 0000559fc333b3e0 R11: 0000000000000000 R12: 00007f9b4fcc6258
kernel: R13: 0000000000000000 R14: 0000559fc316ed00 R15: 0000559fc3337e00
kernel: </TASK>
Dao Zhong Ma (1):
ovpn: tcp - defer TX from softirq to workqueue to avoid RCU stalls
drivers/net/ovpn/tcp.c | 80 +++++++++++++++++++++++++++++++-----------
1 file changed, 59 insertions(+), 21 deletions(-)
--
2.54.0
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox