* [PATCH net-next 1/5] net: ethernet: oa_tc6: Handle the OA TC6 SPI protected mode
From: Ciprian Regus via B4 Relay @ 2026-05-02 23:24 UTC (permalink / raw)
To: Parthiban Veerasooran, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Jonathan Corbet,
Shuah Khan, Andrew Lunn, Heiner Kallweit, Russell King,
Rob Herring, Krzysztof Kozlowski, Conor Dooley
Cc: netdev, linux-kernel, linux-doc, devicetree, Ciprian Regus
In-Reply-To: <20260503-adin1140-driver-v1-0-dd043cdd88f0@analog.com>
From: Ciprian Regus <ciprian.regus@analog.com>
Implement the OA TC6 standard defined protected mode for control (register
access) transactions. In addition to the current register access formats
the oa_tc6 driver handles, 1's complement values of the data field
are included (by both the host and the MACPHY) in the SPI transfer frames.
This feature acts as an integrity check.
Control write transactions look like this:
|<- 32 bits ->|<--- data_size --->|<- 32 bits ->|
MOSI: | ctrl header | reg write data | ignored |
MISO: | (discard) | echoed ctrl hdr | echoed data |
data_size (LEN = number of registers to read in a sequence):
Unprotected: 32 x (LEN + 1) bits
Protected: 2 x 32 x (LEN + 1) bits
Control read transaction:
|<- 32 bits ->|<--- 32 bits --> |<- data_size ->|
MOSI: | ctrl header | ignored ... |
MISO: | (discard) | echoed ctrl hdr | reg read data |
data_size (LEN = number of registers to read in a sequence):
Unprotected: 32 x (LEN + 1) bits
Protected: 2 x 32 x (LEN + 1) bits
Register data format ("reg write data" and "reg read data"):
Unprotected:
| W1 (normal) | W2 (normal) | ... | Wx (normal) |
Protected:
| W1 (normal) | W1 (complement) | ... | Wx (normal) | Wx (complement)|
The protected mode state can be read from the bit 5 of CONFIG0 (0x4)
register, and this setting is usually only configured during the
MACPHY's reset (depending on the device it can be done by setting the
state of a pin). We can read the protected mode configuration before any
other register access and since the SPI transfer is initially sized for an
unprotected read, the MACPHY's complement words are never clocked out
and no checking is required. The data transactions (Ethernet frames)
remain unchanged.
Signed-off-by: Ciprian Regus <ciprian.regus@analog.com>
---
drivers/net/ethernet/oa_tc6.c | 105 ++++++++++++++++++++++++++++++++++++------
1 file changed, 92 insertions(+), 13 deletions(-)
diff --git a/drivers/net/ethernet/oa_tc6.c b/drivers/net/ethernet/oa_tc6.c
index 91a906a7918a..546ca652d974 100644
--- a/drivers/net/ethernet/oa_tc6.c
+++ b/drivers/net/ethernet/oa_tc6.c
@@ -24,6 +24,7 @@
#define OA_TC6_REG_CONFIG0 0x0004
#define CONFIG0_SYNC BIT(15)
#define CONFIG0_ZARFE_ENABLE BIT(12)
+#define CONFIG0_PROTE BIT(5)
/* Status Register #0 */
#define OA_TC6_REG_STATUS0 0x0008
@@ -87,6 +88,7 @@
#define OA_TC6_PHY_C45_AUTO_NEG_MMS5 5 /* MMD 7 */
#define OA_TC6_PHY_C45_POWER_UNIT_MMS6 6 /* MMD 13 */
+#define OA_TC6_CTRL_PROT_REPLY_SIZE 4
#define OA_TC6_CTRL_HEADER_SIZE 4
#define OA_TC6_CTRL_REG_VALUE_SIZE 4
#define OA_TC6_CTRL_IGNORED_SIZE 4
@@ -95,6 +97,13 @@
(OA_TC6_CTRL_MAX_REGISTERS *\
OA_TC6_CTRL_REG_VALUE_SIZE) +\
OA_TC6_CTRL_IGNORED_SIZE)
+
+#define OA_TC6_CTRL_SPI_BUF_PROT_SIZE (OA_TC6_CTRL_HEADER_SIZE +\
+ (OA_TC6_CTRL_MAX_REGISTERS *\
+ (OA_TC6_CTRL_REG_VALUE_SIZE +\
+ OA_TC6_CTRL_PROT_REPLY_SIZE)) +\
+ OA_TC6_CTRL_IGNORED_SIZE)
+
#define OA_TC6_CHUNK_PAYLOAD_SIZE 64
#define OA_TC6_DATA_HEADER_SIZE 4
#define OA_TC6_CHUNK_SIZE (OA_TC6_DATA_HEADER_SIZE +\
@@ -129,6 +138,7 @@ struct oa_tc6 {
u8 rx_chunks_available;
bool rx_buf_overflow;
bool int_flag;
+ bool prot_ctrl;
};
enum oa_tc6_header_type {
@@ -212,25 +222,36 @@ static void oa_tc6_update_ctrl_write_data(struct oa_tc6 *tc6, u32 value[],
{
__be32 *tx_buf = tc6->spi_ctrl_tx_buf + OA_TC6_CTRL_HEADER_SIZE;
- for (int i = 0; i < length; i++)
+ for (int i = 0; i < length; i++) {
*tx_buf++ = cpu_to_be32(value[i]);
+ if (tc6->prot_ctrl)
+ *tx_buf++ = cpu_to_be32(~value[i]);
+ }
}
-static u16 oa_tc6_calculate_ctrl_buf_size(u8 length)
+static u16 oa_tc6_calculate_ctrl_buf_size(u8 length, bool ctrl_prot)
{
+ u32 reply_size = OA_TC6_CTRL_REG_VALUE_SIZE;
+
+ if (ctrl_prot)
+ reply_size += OA_TC6_CTRL_PROT_REPLY_SIZE;
+
/* Control command consists 4 bytes header + 4 bytes register value for
- * each register + 4 bytes ignored value.
+ * each register (+ 4 bytes for the register value complement in case
+ * protected mode is used) + 4 bytes ignored value.
*/
- return OA_TC6_CTRL_HEADER_SIZE + OA_TC6_CTRL_REG_VALUE_SIZE * length +
+ return OA_TC6_CTRL_HEADER_SIZE + reply_size * length +
OA_TC6_CTRL_IGNORED_SIZE;
}
static void oa_tc6_prepare_ctrl_spi_buf(struct oa_tc6 *tc6, u32 address,
u32 value[], u8 length,
- enum oa_tc6_register_op reg_op)
+ enum oa_tc6_register_op reg_op,
+ u16 buf_size)
{
__be32 *tx_buf = tc6->spi_ctrl_tx_buf;
+ memset(tx_buf, 0, buf_size);
*tx_buf = oa_tc6_prepare_ctrl_header(address, length, reg_op);
if (reg_op == OA_TC6_CTRL_REG_WRITE)
@@ -253,10 +274,12 @@ static int oa_tc6_check_ctrl_write_reply(struct oa_tc6 *tc6, u8 size)
return 0;
}
-static int oa_tc6_check_ctrl_read_reply(struct oa_tc6 *tc6, u8 size)
+static int oa_tc6_check_ctrl_read_reply(struct oa_tc6 *tc6, u8 length)
{
- u32 *rx_buf = tc6->spi_ctrl_rx_buf + OA_TC6_CTRL_IGNORED_SIZE;
- u32 *tx_buf = tc6->spi_ctrl_tx_buf;
+ __be32 *rx_buf = tc6->spi_ctrl_rx_buf + OA_TC6_CTRL_IGNORED_SIZE;
+ __be32 *tx_buf = tc6->spi_ctrl_tx_buf;
+ u32 complement;
+ u32 reply;
/* The echoed control read header must match with the one that was
* transmitted.
@@ -264,6 +287,20 @@ static int oa_tc6_check_ctrl_read_reply(struct oa_tc6 *tc6, u8 size)
if (*tx_buf != *rx_buf)
return -EPROTO;
+ if (tc6->prot_ctrl) {
+ /* Skip past the echoed header to the value/complement pairs */
+ rx_buf += 1;
+ for (int i = 0; i < length; i++) {
+ reply = be32_to_cpu(rx_buf[0]);
+ complement = be32_to_cpu(rx_buf[1]);
+
+ if (complement != ~reply)
+ return -EPROTO;
+
+ rx_buf += 2;
+ }
+ }
+
return 0;
}
@@ -273,8 +310,13 @@ static void oa_tc6_copy_ctrl_read_data(struct oa_tc6 *tc6, u32 value[],
__be32 *rx_buf = tc6->spi_ctrl_rx_buf + OA_TC6_CTRL_IGNORED_SIZE +
OA_TC6_CTRL_HEADER_SIZE;
- for (int i = 0; i < length; i++)
+ for (int i = 0; i < length; i++) {
value[i] = be32_to_cpu(*rx_buf++);
+
+ /* skip complement word */
+ if (tc6->prot_ctrl)
+ rx_buf++;
+ }
}
static int oa_tc6_perform_ctrl(struct oa_tc6 *tc6, u32 address, u32 value[],
@@ -283,10 +325,10 @@ static int oa_tc6_perform_ctrl(struct oa_tc6 *tc6, u32 address, u32 value[],
u16 size;
int ret;
- /* Prepare control command and copy to SPI control buffer */
- oa_tc6_prepare_ctrl_spi_buf(tc6, address, value, length, reg_op);
+ size = oa_tc6_calculate_ctrl_buf_size(length, tc6->prot_ctrl);
- size = oa_tc6_calculate_ctrl_buf_size(length);
+ /* Prepare control command and copy to SPI control buffer */
+ oa_tc6_prepare_ctrl_spi_buf(tc6, address, value, length, reg_op, size);
/* Perform SPI transfer */
ret = oa_tc6_spi_transfer(tc6, OA_TC6_CTRL_HEADER, size);
@@ -301,7 +343,7 @@ static int oa_tc6_perform_ctrl(struct oa_tc6 *tc6, u32 address, u32 value[],
return oa_tc6_check_ctrl_write_reply(tc6, size);
/* Check echoed/received control read command reply for errors */
- ret = oa_tc6_check_ctrl_read_reply(tc6, size);
+ ret = oa_tc6_check_ctrl_read_reply(tc6, length);
if (ret)
return ret;
@@ -1224,6 +1266,20 @@ netdev_tx_t oa_tc6_start_xmit(struct oa_tc6 *tc6, struct sk_buff *skb)
}
EXPORT_SYMBOL_GPL(oa_tc6_start_xmit);
+static int oa_tc6_check_ctrl_protection(struct oa_tc6 *tc6)
+{
+ u32 regval;
+ int ret;
+
+ ret = oa_tc6_read_register(tc6, OA_TC6_REG_CONFIG0, ®val);
+ if (ret)
+ return ret;
+
+ tc6->prot_ctrl = FIELD_GET(CONFIG0_PROTE, regval);
+
+ return 0;
+}
+
/**
* oa_tc6_init - allocates and initializes oa_tc6 structure.
* @spi: device with which data will be exchanged.
@@ -1276,6 +1332,29 @@ struct oa_tc6 *oa_tc6_init(struct spi_device *spi, struct net_device *netdev)
if (!tc6->spi_data_rx_buf)
return NULL;
+ ret = oa_tc6_check_ctrl_protection(tc6);
+ if (ret) {
+ dev_err(&tc6->spi->dev,
+ "Failed to check the protection mode: %d\n", ret);
+ return NULL;
+ }
+
+ if (tc6->prot_ctrl) {
+ tc6->spi_ctrl_tx_buf = devm_krealloc(&tc6->spi->dev,
+ tc6->spi_ctrl_tx_buf,
+ OA_TC6_CTRL_SPI_BUF_PROT_SIZE,
+ GFP_KERNEL);
+ if (!tc6->spi_ctrl_tx_buf)
+ return NULL;
+
+ tc6->spi_ctrl_rx_buf = devm_krealloc(&tc6->spi->dev,
+ tc6->spi_ctrl_rx_buf,
+ OA_TC6_CTRL_SPI_BUF_PROT_SIZE,
+ GFP_KERNEL);
+ if (!tc6->spi_ctrl_rx_buf)
+ return NULL;
+ }
+
ret = oa_tc6_sw_reset_macphy(tc6);
if (ret) {
dev_err(&tc6->spi->dev,
--
2.43.0
^ permalink raw reply related
* [PATCH net-next 0/5] net: Add ADIN1140 support
From: Ciprian Regus via B4 Relay @ 2026-05-02 23:24 UTC (permalink / raw)
To: Parthiban Veerasooran, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Jonathan Corbet,
Shuah Khan, Andrew Lunn, Heiner Kallweit, Russell King,
Rob Herring, Krzysztof Kozlowski, Conor Dooley
Cc: netdev, linux-kernel, linux-doc, devicetree, Ciprian Regus
This series introduces support for the ADIN1140 (also called AD3306)
10BASE-T1S single port MACPHY. The device integrates the MAC and PHY in
the same package. The communication with the host CPU is done through an
SPI interface, using the Open Alliance TC6 protocol for control and data
transactions. As a result, the oa_tc6 framework is used to implement
the communication with the device (register accesses and Ethernet frame
RX/TX).
The MAC and PHY are connected internally using an MII and MDIO bus.
The PHY is a half duplex 10Mbps device, which implements both the PLCA
RS (IEEE 802.3 clause 148) and CSMA/CD methods of accessing the Ethernet
medium. The 10BASE-T1S standard allows multiple PHY devices to be
connected (in parallel) on the same single twisted pair network segment,
so PLCA can be configured in order to provide a fair access scheme to
all the nodes and reduce the jitter introduced by the unordered CSMA/CD
transmits. The PHY's internal register map can be accessed using the
direct MDIO mode of the OA TC6. The control, status, phy id 1 & 2 C22
registers are mapped to the 0xFF00 - 0xFF03 range. As for C45
addressable devices, the PHY has PCS, PMA and PLCA blocks.
The first 2 patches in the series are changes to the oa_tc6, that would
make the framework usable by the subsequent ADIN1140 MAC driver.
The first commit is required because the ADIN1140 only allows protected
mode OA TC6 control transactions, which the oa_tc6 framework doesn't
currently implement.
The second commit is required in order to allow the MAC driver to have a
custom implementation for the mii_bus access methods as a workaround for
hardware issues:
1. The OA TC6 standard defines the direct and indirect access modes for
MDIO transactions. The ADIN1140 incorrectly advertises indirect mode
only (supported capabilities register - 0x2, bit 9), while actually
implementing just the direct mode. We cannot rely on the CAP register
to choose an access method (which oa_tc6 does by default, even though
it only implements the direct mode), so the driver has to use its
own.
2. The ADIN1140 cannot access the C22 register space of the internal
PHY, while the PHY is busy receiving frames. If that happens, the
CONFIG0 and CONFIG2 registers of the MAC will get corrupted and the
data transfer will stop. Those two registers configure settings for
the transfer protocol between the MAC and host, so the value for some
of their subfields shouldn't be changed while the netdev is up.
Since we know the PHY is internal, the MAC driver can implement a
custom mii_bus, which can intercept C22 accesses. Most of the
registers mapped in the 0x0 - 0x3 range (the only ones the PHY offers)
are read only, and their value can be read from somewhere else (e.g
the PHYID 1 & 2 have the same value as 0x1 in the MAC memory map).
C45 accesses do not cause this issue, so we can properly implement
them.
Even though they have different driver, the MAC one cannot function
without the PHY driver, since the PHY is not compatible with the generic
c22 driver. As such CONFIG_ADIN1140 selects CONFIG_ADIN1140_PHY.
Signed-off-by: Ciprian Regus <ciprian.regus@analog.com>
---
Ciprian Regus (5):
net: ethernet: oa_tc6: Handle the OA TC6 SPI protected mode
net: ethernet: oa_tc6: Allow custom mii_bus
net: phy: Add support for the ADIN1140 PHY
net: ethernet: adi: Add a driver for the ADIN1140 MACPHY
dt-bindings: net: Add bindings for the ADIN1140
.../devicetree/bindings/net/adi,adin1140.yaml | 69 ++
Documentation/networking/oa-tc6-framework.rst | 3 +-
MAINTAINERS | 15 +
drivers/net/ethernet/adi/Kconfig | 12 +
drivers/net/ethernet/adi/Makefile | 1 +
drivers/net/ethernet/adi/adin1140.c | 805 +++++++++++++++++++++
drivers/net/ethernet/microchip/lan865x/lan865x.c | 6 +-
drivers/net/ethernet/oa_tc6.c | 194 +++--
drivers/net/phy/Kconfig | 6 +
drivers/net/phy/Makefile | 1 +
drivers/net/phy/adin1140.c | 102 +++
include/linux/oa_tc6.h | 9 +-
12 files changed, 1173 insertions(+), 50 deletions(-)
---
base-commit: fbf6f64a4322cfeb0d98f39baf8ce18246dd12c0
change-id: 20260429-adin1140-driver-93ae0d376318
Best regards,
--
Ciprian Regus <ciprian.regus@analog.com>
^ permalink raw reply
* [PATCH net-next 3/5] net: phy: Add support for the ADIN1140 PHY
From: Ciprian Regus via B4 Relay @ 2026-05-02 23:24 UTC (permalink / raw)
To: Parthiban Veerasooran, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Jonathan Corbet,
Shuah Khan, Andrew Lunn, Heiner Kallweit, Russell King,
Rob Herring, Krzysztof Kozlowski, Conor Dooley
Cc: netdev, linux-kernel, linux-doc, devicetree, Ciprian Regus
In-Reply-To: <20260503-adin1140-driver-v1-0-dd043cdd88f0@analog.com>
From: Ciprian Regus <ciprian.regus@analog.com>
Add a driver for the ADIN1140's internal 10BASE-T1S PHY. The device
doesn't implement autonegotiation, so the link is always reported as
being up. Since the PHY has no link-change interrupts and the link is
always up, we set phydev->irq = PHY_MAC_INTERRUPT to prevent phylib from
polling the link state.
The device implements both C22 and C45 MDIO access methods, but can only
be discovered over C22, since the C45 MMD devices lack the MDIO_DEVID1 and
MDIO_DEVID2 registers. The indirect C45 over C22 feature is not
supported.
Signed-off-by: Ciprian Regus <ciprian.regus@analog.com>
---
MAINTAINERS | 7 ++++
drivers/net/phy/Kconfig | 6 +++
drivers/net/phy/Makefile | 1 +
drivers/net/phy/adin1140.c | 102 +++++++++++++++++++++++++++++++++++++++++++++
4 files changed, 116 insertions(+)
diff --git a/MAINTAINERS b/MAINTAINERS
index 27a073f53cea..1e58da5ef47a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1843,6 +1843,13 @@ S: Supported
W: https://ez.analog.com/linux-software-drivers
F: drivers/dma/dma-axi-dmac.c
+ANALOG DEVICES INC ETHERNET PHY DRIVERS
+M: Ciprian Regus <ciprian.regus@analog.com>
+L: netdev@vger.kernel.org
+S: Maintained
+W: https://ez.analog.com/linux-software-drivers
+F: drivers/net/phy/adin1140.c
+
ANALOG DEVICES INC IIO DRIVERS
M: Lars-Peter Clausen <lars@metafoo.de>
M: Michael Hennerich <Michael.Hennerich@analog.com>
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index b5ee338b620d..fa5cd59a3825 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -124,6 +124,12 @@ config ADIN1100_PHY
Currently supports the:
- ADIN1100 - Robust,Industrial, Low Power 10BASE-T1L Ethernet PHY
+config ADIN1140_PHY
+ tristate "Analog Devices ADIN1140 10BASE-T1S PHY"
+ help
+ Adds support for the Analog Devices, Inc. ADIN1140's internal
+ 10BASE-T1S PHY.
+
config AMCC_QT2025_PHY
tristate "AMCC QT2025 PHY"
depends on RUST_PHYLIB_ABSTRACTIONS
diff --git a/drivers/net/phy/Makefile b/drivers/net/phy/Makefile
index 05e4878af27a..2519364bc334 100644
--- a/drivers/net/phy/Makefile
+++ b/drivers/net/phy/Makefile
@@ -29,6 +29,7 @@ obj-y += $(sfp-obj-y) $(sfp-obj-m)
obj-$(CONFIG_ADIN_PHY) += adin.o
obj-$(CONFIG_ADIN1100_PHY) += adin1100.o
+obj-$(CONFIG_ADIN1140_PHY) += adin1140.o
obj-$(CONFIG_AIR_EN8811H_PHY) += air_en8811h.o
obj-$(CONFIG_AMD_PHY) += amd.o
obj-$(CONFIG_AMCC_QT2025_PHY) += qt2025.o
diff --git a/drivers/net/phy/adin1140.c b/drivers/net/phy/adin1140.c
new file mode 100644
index 000000000000..3244107ce9ef
--- /dev/null
+++ b/drivers/net/phy/adin1140.c
@@ -0,0 +1,102 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Driver for Analog Devices, Inc. ADIN1140 10BASE-T1S PHY
+ *
+ * Copyright 2026 Analog Devices Inc.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/phy.h>
+
+#define ADIN1140_PHY_ID 0x0283be00
+
+#define ADIN1140_PCS_CTRL 0x08f3
+#define ADIN1140_PCS_CTRL_LOOPBACK BIT(14)
+
+static int adin1140_phy_read_mmd(struct phy_device *phydev, int devnum,
+ u16 regnum)
+{
+ struct mii_bus *bus = phydev->mdio.bus;
+ int addr = phydev->mdio.addr;
+
+ return __mdiobus_c45_read(bus, addr, devnum, regnum);
+}
+
+static int adin1140_phy_write_mmd(struct phy_device *phydev, int devnum,
+ u16 regnum, u16 val)
+{
+ struct mii_bus *bus = phydev->mdio.bus;
+ int addr = phydev->mdio.addr;
+
+ return __mdiobus_c45_write(bus, addr, devnum, regnum, val);
+}
+
+static int adin1140_config_init(struct phy_device *phydev)
+{
+ /* The link status of the PHY doesn't need to be polled, because
+ * the device doesn't implement AN and there is no other mechanism
+ * to report the link state.
+ */
+ phydev->irq = PHY_MAC_INTERRUPT;
+
+ return 0;
+}
+
+static int adin1140_config_aneg(struct phy_device *phydev)
+{
+ /* phylib tries to clear BIT(12) in MDIO_CTRL1, since AN is disabled.
+ * However, on the ADIN1140, that field is non-standard, being used
+ * to control the reset status of the PHY (thus it needs to remain set).
+ */
+ return 0;
+}
+
+static int adin1140_loopback(struct phy_device *phydev, bool enable, int speed)
+{
+ if (enable && speed)
+ return -EOPNOTSUPP;
+
+ return phy_modify_mmd(phydev, MDIO_MMD_PCS, ADIN1140_PCS_CTRL,
+ ADIN1140_PCS_CTRL_LOOPBACK,
+ enable ? ADIN1140_PCS_CTRL_LOOPBACK : 0);
+}
+
+static int adin1140_read_status(struct phy_device *phydev)
+{
+ phydev->link = 1;
+ phydev->duplex = DUPLEX_HALF;
+ phydev->speed = SPEED_10;
+ phydev->autoneg = AUTONEG_DISABLE;
+
+ return 0;
+}
+
+static struct phy_driver adin1140_driver[] = {
+ {
+ PHY_ID_MATCH_EXACT(ADIN1140_PHY_ID),
+ .name = "ADIN1140",
+ .features = PHY_BASIC_T1S_P2MP_FEATURES,
+ .read_status = adin1140_read_status,
+ .config_init = adin1140_config_init,
+ .config_aneg = adin1140_config_aneg,
+ .set_loopback = adin1140_loopback,
+ .read_mmd = adin1140_phy_read_mmd,
+ .write_mmd = adin1140_phy_write_mmd,
+ .get_plca_cfg = genphy_c45_plca_get_cfg,
+ .set_plca_cfg = genphy_c45_plca_set_cfg,
+ .get_plca_status = genphy_c45_plca_get_status,
+ },
+};
+module_phy_driver(adin1140_driver);
+
+static const struct mdio_device_id __maybe_unused adin1140_tbl[] = {
+ { PHY_ID_MATCH_EXACT(ADIN1140_PHY_ID) },
+ { }
+};
+
+MODULE_DEVICE_TABLE(mdio, adin1140_tbl);
+
+MODULE_DESCRIPTION("Analog Devices, Inc. ADIN1140 10BASE-T1S PHY");
+MODULE_AUTHOR("Ciprian Regus <ciprian.regus@analog.com>");
+MODULE_LICENSE("GPL");
--
2.43.0
^ permalink raw reply related
* [PATCH net-next 2/5] net: ethernet: oa_tc6: Allow custom mii_bus
From: Ciprian Regus via B4 Relay @ 2026-05-02 23:24 UTC (permalink / raw)
To: Parthiban Veerasooran, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Jonathan Corbet,
Shuah Khan, Andrew Lunn, Heiner Kallweit, Russell King,
Rob Herring, Krzysztof Kozlowski, Conor Dooley
Cc: netdev, linux-kernel, linux-doc, devicetree, Ciprian Regus
In-Reply-To: <20260503-adin1140-driver-v1-0-dd043cdd88f0@analog.com>
From: Ciprian Regus <ciprian.regus@analog.com>
Some drivers that use oa_tc6 have to use their own mdio bus access
functions as a workaround for hardware issues. Support these cases by
adding a new parameter for the mii_bus in the oa_tc6_init(). In this
case, drivers are responsible for allocating the mii_bus struct, assign
the bus access methods and free the memory after it's no longer used
by oa_tc6. The mii_bus is registered/unregistered by oa_tc6. The phy
connection process does not change and it's still done by oa_tc6.
Drivers can still choose to use the default mii_bus access functions
implemented by oa_tc6 by passing a NULL reference in the mii_bus param.
To avoid extending the function signature every time a new configuration
option is needed, convert oa_tc6_init() to take a config struct.
Also, update the affected drivers and the oa_tc6 framework documentation.
Signed-off-by: Ciprian Regus <ciprian.regus@analog.com>
---
Documentation/networking/oa-tc6-framework.rst | 3 +-
drivers/net/ethernet/microchip/lan865x/lan865x.c | 6 +-
drivers/net/ethernet/oa_tc6.c | 89 +++++++++++++++---------
include/linux/oa_tc6.h | 9 ++-
4 files changed, 70 insertions(+), 37 deletions(-)
diff --git a/Documentation/networking/oa-tc6-framework.rst b/Documentation/networking/oa-tc6-framework.rst
index fe2aabde923a..eaa5b4b85b34 100644
--- a/Documentation/networking/oa-tc6-framework.rst
+++ b/Documentation/networking/oa-tc6-framework.rst
@@ -453,8 +453,7 @@ Device drivers API
The include/linux/oa_tc6.h defines the following functions:
-.. c:function:: struct oa_tc6 *oa_tc6_init(struct spi_device *spi, \
- struct net_device *netdev)
+.. c:function:: struct oa_tc6 *oa_tc6_init(struct oa_tc6_config *config);
Initialize OA TC6 lib.
diff --git a/drivers/net/ethernet/microchip/lan865x/lan865x.c b/drivers/net/ethernet/microchip/lan865x/lan865x.c
index 0277d9737369..c509c8a3e321 100644
--- a/drivers/net/ethernet/microchip/lan865x/lan865x.c
+++ b/drivers/net/ethernet/microchip/lan865x/lan865x.c
@@ -332,6 +332,7 @@ static const struct net_device_ops lan865x_netdev_ops = {
static int lan865x_probe(struct spi_device *spi)
{
+ struct oa_tc6_config tc6_config = {};
struct net_device *netdev;
struct lan865x_priv *priv;
int ret;
@@ -346,7 +347,10 @@ static int lan865x_probe(struct spi_device *spi)
spi_set_drvdata(spi, priv);
INIT_WORK(&priv->multicast_work, lan865x_multicast_work_handler);
- priv->tc6 = oa_tc6_init(spi, netdev);
+ tc6_config.spi = spi;
+ tc6_config.netdev = netdev;
+
+ priv->tc6 = oa_tc6_init(&tc6_config);
if (!priv->tc6) {
ret = -ENODEV;
goto free_netdev;
diff --git a/drivers/net/ethernet/oa_tc6.c b/drivers/net/ethernet/oa_tc6.c
index 546ca652d974..fa89b820133f 100644
--- a/drivers/net/ethernet/oa_tc6.c
+++ b/drivers/net/ethernet/oa_tc6.c
@@ -139,6 +139,7 @@ struct oa_tc6 {
bool rx_buf_overflow;
bool int_flag;
bool prot_ctrl;
+ bool own_mdiobus;
};
enum oa_tc6_header_type {
@@ -538,32 +539,37 @@ static int oa_tc6_mdiobus_register(struct oa_tc6 *tc6)
{
int ret;
- tc6->mdiobus = mdiobus_alloc();
if (!tc6->mdiobus) {
- netdev_err(tc6->netdev, "MDIO bus alloc failed\n");
- return -ENOMEM;
+ tc6->mdiobus = mdiobus_alloc();
+ if (!tc6->mdiobus) {
+ netdev_err(tc6->netdev, "MDIO bus alloc failed\n");
+ return -ENOMEM;
+ }
+
+ tc6->mdiobus->read = oa_tc6_mdiobus_read;
+ tc6->mdiobus->write = oa_tc6_mdiobus_write;
+ /* OPEN Alliance 10BASE-T1x compliance MAC-PHYs will have both C22 and
+ * C45 registers space. If the PHY is discovered via C22 bus protocol it
+ * assumes it uses C22 protocol and always uses C22 registers indirect
+ * access to access C45 registers. This is because, we don't have a
+ * clean separation between C22/C45 register space and C22/C45 MDIO bus
+ * protocols. Resulting, PHY C45 registers direct access can't be used
+ * which can save multiple SPI bus access. To support this feature, PHY
+ * drivers can set .read_mmd/.write_mmd in the PHY driver to call
+ * .read_c45/.write_c45. Ex: drivers/net/phy/microchip_t1s.c
+ */
+ tc6->mdiobus->read_c45 = oa_tc6_mdiobus_read_c45;
+ tc6->mdiobus->write_c45 = oa_tc6_mdiobus_write_c45;
+
+ tc6->own_mdiobus = true;
}
tc6->mdiobus->priv = tc6;
- tc6->mdiobus->read = oa_tc6_mdiobus_read;
- tc6->mdiobus->write = oa_tc6_mdiobus_write;
- /* OPEN Alliance 10BASE-T1x compliance MAC-PHYs will have both C22 and
- * C45 registers space. If the PHY is discovered via C22 bus protocol it
- * assumes it uses C22 protocol and always uses C22 registers indirect
- * access to access C45 registers. This is because, we don't have a
- * clean separation between C22/C45 register space and C22/C45 MDIO bus
- * protocols. Resulting, PHY C45 registers direct access can't be used
- * which can save multiple SPI bus access. To support this feature, PHY
- * drivers can set .read_mmd/.write_mmd in the PHY driver to call
- * .read_c45/.write_c45. Ex: drivers/net/phy/microchip_t1s.c
- */
- tc6->mdiobus->read_c45 = oa_tc6_mdiobus_read_c45;
- tc6->mdiobus->write_c45 = oa_tc6_mdiobus_write_c45;
- tc6->mdiobus->name = "oa-tc6-mdiobus";
tc6->mdiobus->parent = tc6->dev;
+ tc6->mdiobus->name = "oa-tc6-mdiobus";
snprintf(tc6->mdiobus->id, ARRAY_SIZE(tc6->mdiobus->id), "%s",
- dev_name(&tc6->spi->dev));
+ dev_name(&tc6->spi->dev));
ret = mdiobus_register(tc6->mdiobus);
if (ret) {
@@ -577,19 +583,30 @@ static int oa_tc6_mdiobus_register(struct oa_tc6 *tc6)
static void oa_tc6_mdiobus_unregister(struct oa_tc6 *tc6)
{
+ if (!tc6->mdiobus)
+ return;
+
mdiobus_unregister(tc6->mdiobus);
- mdiobus_free(tc6->mdiobus);
+
+ if (tc6->own_mdiobus)
+ mdiobus_free(tc6->mdiobus);
}
static int oa_tc6_phy_init(struct oa_tc6 *tc6)
{
int ret;
- ret = oa_tc6_check_phy_reg_direct_access_capability(tc6);
- if (ret) {
- netdev_err(tc6->netdev,
- "Direct PHY register access is not supported by the MAC-PHY\n");
- return ret;
+ /* If the driver provided a mii_bus, it is also responsible for
+ * implementing the bus access methods, so we don't have to worry
+ * about checking the PHY access mode.
+ */
+ if (!tc6->mdiobus) {
+ ret = oa_tc6_check_phy_reg_direct_access_capability(tc6);
+ if (ret) {
+ netdev_err(tc6->netdev,
+ "Direct PHY register access is not supported by the MAC-PHY\n");
+ return ret;
+ }
}
ret = oa_tc6_mdiobus_register(tc6);
@@ -621,7 +638,9 @@ static int oa_tc6_phy_init(struct oa_tc6 *tc6)
static void oa_tc6_phy_exit(struct oa_tc6 *tc6)
{
- phy_disconnect(tc6->phydev);
+ if (tc6->phydev)
+ phy_disconnect(tc6->phydev);
+
oa_tc6_mdiobus_unregister(tc6);
}
@@ -1282,24 +1301,28 @@ static int oa_tc6_check_ctrl_protection(struct oa_tc6 *tc6)
/**
* oa_tc6_init - allocates and initializes oa_tc6 structure.
- * @spi: device with which data will be exchanged.
- * @netdev: network device interface structure.
+ * @config: pointer to a caller-filled structure describing the MACPHY
+ * (SPI device, net_device, and config flags).
*
* Return: pointer reference to the oa_tc6 structure if the MAC-PHY
* initialization is successful otherwise NULL.
*/
-struct oa_tc6 *oa_tc6_init(struct spi_device *spi, struct net_device *netdev)
+struct oa_tc6 *oa_tc6_init(struct oa_tc6_config *config)
{
struct oa_tc6 *tc6;
int ret;
- tc6 = devm_kzalloc(&spi->dev, sizeof(*tc6), GFP_KERNEL);
+ if (!config)
+ return NULL;
+
+ tc6 = devm_kzalloc(&config->spi->dev, sizeof(*tc6), GFP_KERNEL);
if (!tc6)
return NULL;
- tc6->spi = spi;
- tc6->netdev = netdev;
- SET_NETDEV_DEV(netdev, &spi->dev);
+ tc6->spi = config->spi;
+ tc6->netdev = config->netdev;
+ tc6->mdiobus = config->mii_bus;
+ SET_NETDEV_DEV(tc6->netdev, &tc6->spi->dev);
mutex_init(&tc6->spi_ctrl_lock);
spin_lock_init(&tc6->tx_skb_lock);
diff --git a/include/linux/oa_tc6.h b/include/linux/oa_tc6.h
index 15f58e3c56c7..7ed7769bac88 100644
--- a/include/linux/oa_tc6.h
+++ b/include/linux/oa_tc6.h
@@ -8,11 +8,18 @@
*/
#include <linux/etherdevice.h>
+#include <linux/mdio.h>
#include <linux/spi/spi.h>
struct oa_tc6;
-struct oa_tc6 *oa_tc6_init(struct spi_device *spi, struct net_device *netdev);
+struct oa_tc6_config {
+ struct spi_device *spi;
+ struct net_device *netdev;
+ struct mii_bus *mii_bus;
+};
+
+struct oa_tc6 *oa_tc6_init(struct oa_tc6_config *config);
void oa_tc6_exit(struct oa_tc6 *tc6);
int oa_tc6_write_register(struct oa_tc6 *tc6, u32 address, u32 value);
int oa_tc6_write_registers(struct oa_tc6 *tc6, u32 address, u32 value[],
--
2.43.0
^ permalink raw reply related
* [PATCH net-next 4/5] net: ethernet: adi: Add a driver for the ADIN1140 MACPHY
From: Ciprian Regus via B4 Relay @ 2026-05-02 23:24 UTC (permalink / raw)
To: Parthiban Veerasooran, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Jonathan Corbet,
Shuah Khan, Andrew Lunn, Heiner Kallweit, Russell King,
Rob Herring, Krzysztof Kozlowski, Conor Dooley
Cc: netdev, linux-kernel, linux-doc, devicetree, Ciprian Regus
In-Reply-To: <20260503-adin1140-driver-v1-0-dd043cdd88f0@analog.com>
From: Ciprian Regus <ciprian.regus@analog.com>
Add a driver for ADIN1140. The device is a 10BASE-T1S MAC-PHY
(integrated in the same package) that connects to a CPU over an SPI bus,
and implements the Open Alliance TC6 protocol for control and frame
transfers. As such, this driver relies on oa_tc6 for the communication
with the device. The device has an alternative name (AD3306), so the
driver can be probed using one of the two compatible strings.
For control transactions, ADIN1140 only implements the protected mode.
The driver has a custom implementation for the mii_bus access methods as a
workaround for hardware issues:
1. The OA TC6 standard defines the direct and indirect access modes for
MDIO transactions. The ADIN1140 incorrectly advertises indirect mode
only (supported capabilities register - 0x2, bit 9), while actually
implementing just the direct mode. We cannot rely on the CAP register
to choose an access method (which oa_tc6 does by default, even though
it only implements the direct mode), so the driver has to use its
own.
2. The ADIN1140 cannot access the C22 register space of the internal
PHY, while the PHY is busy receiving frames. If that happens, the
CONFIG0 and CONFIG2 registers of the MAC will get corrupted and the
data transfer will stop. Those two registers configure settings for
the transfer protocol between the MAC and host, so the value for some
of their subfields shouldn't be changed while the netdev is up.
Since we know the PHY is internal, the MAC driver can implement a
custom mii_bus, which can intercept C22 accesses. Most of the
registers mapped in the 0x0 - 0x3 range (the only ones the PHY offers)
are read only, and their value can be read from somewhere else (e.g
the PHYID 1 & 2 have the same value as 0x1 in the MAC memory map).
For the fields that are R/W (loopback and AN/reset) in the control
register, the PHY driver already implements the set_loopback() and
config_aneg() functions. The C22 write function of the driver is a
no-op and is used to protect against the ioctl MDIO access path.
C45 accesses do not cause this issue, so we can properly implement
them.
Signed-off-by: Ciprian Regus <ciprian.regus@analog.com>
---
MAINTAINERS | 7 +
drivers/net/ethernet/adi/Kconfig | 12 +
drivers/net/ethernet/adi/Makefile | 1 +
drivers/net/ethernet/adi/adin1140.c | 805 ++++++++++++++++++++++++++++++++++++
4 files changed, 825 insertions(+)
diff --git a/MAINTAINERS b/MAINTAINERS
index 1e58da5ef47a..f9784c25beac 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1843,6 +1843,13 @@ S: Supported
W: https://ez.analog.com/linux-software-drivers
F: drivers/dma/dma-axi-dmac.c
+ANALOG DEVICES INC ETHERNET DRIVERS
+M: Ciprian Regus <ciprian.regus@analog.com>
+L: netdev@vger.kernel.org
+S: Maintained
+W: https://ez.analog.com/linux-software-drivers
+F: drivers/net/ethernet/adi/adin1140.c
+
ANALOG DEVICES INC ETHERNET PHY DRIVERS
M: Ciprian Regus <ciprian.regus@analog.com>
L: netdev@vger.kernel.org
diff --git a/drivers/net/ethernet/adi/Kconfig b/drivers/net/ethernet/adi/Kconfig
index 760a9a60bc15..bdb8ff7d15da 100644
--- a/drivers/net/ethernet/adi/Kconfig
+++ b/drivers/net/ethernet/adi/Kconfig
@@ -26,4 +26,16 @@ config ADIN1110
Say yes here to build support for Analog Devices ADIN1110
Low Power 10BASE-T1L Ethernet MAC-PHY.
+config ADIN1140
+ tristate "Analog Devices ADIN1140 MAC-PHY"
+ depends on SPI
+ select ADIN1140_PHY
+ select OA_TC6
+ help
+ Say yes here to build support for Analog Devices, Inc. ADIN1140
+ 10BASE-T1S Ethernet MAC-PHY.
+
+ To compile this driver as a module, choose M here. The module will be
+ called adin1140.
+
endif # NET_VENDOR_ADI
diff --git a/drivers/net/ethernet/adi/Makefile b/drivers/net/ethernet/adi/Makefile
index d0383d94303c..0390ca8ccc49 100644
--- a/drivers/net/ethernet/adi/Makefile
+++ b/drivers/net/ethernet/adi/Makefile
@@ -4,3 +4,4 @@
#
obj-$(CONFIG_ADIN1110) += adin1110.o
+obj-$(CONFIG_ADIN1140) += adin1140.o
diff --git a/drivers/net/ethernet/adi/adin1140.c b/drivers/net/ethernet/adi/adin1140.c
new file mode 100644
index 000000000000..5bc3f5732ed8
--- /dev/null
+++ b/drivers/net/ethernet/adi/adin1140.c
@@ -0,0 +1,805 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Driver for Analog Devices, Inc. ADIN1140 10BASE-T1S MAC-PHY
+ *
+ * Copyright 2026 Analog Devices Inc.
+ */
+
+#include <linux/etherdevice.h>
+#include <linux/kernel.h>
+#include <linux/mdio.h>
+#include <linux/module.h>
+#include <linux/oa_tc6.h>
+#include <linux/phy.h>
+
+#define ADIN1140_MMS_REG(m, r) ((((m) & GENMASK(3, 0)) << 16) | \
+ ((r) & GENMASK(15, 0)))
+
+#define ADIN1140_MACPHY_ID_REG ADIN1140_MMS_REG(0x0, 0x1)
+
+#define ADIN1140_CONFIG0_REG 0x0004
+#define ADIN1140_CONFIG0_TXFCSVE BIT(14)
+#define ADIN1140_CONFIG0_RFA_ZARFE BIT(12)
+#define ADIN1140_CONFIG0_CPS_64 GENMASK(2, 1)
+
+#define ADIN1140_CONFIG2_REG ADIN1140_MMS_REG(0x0, 0x6)
+#define ADIN1140_CONFIG2_FWD_UNK2HOST BIT(2)
+
+#define ADIN1140_MAC_P1_LOOP_ADDR_REG ADIN1140_MMS_REG(0x1, 0xC4)
+
+#define ADIN1140_MAC_ADDR_FILT_UPR_REG ADIN1140_MMS_REG(0x1, 0x50)
+#define ADIN1140_MAC_ADDR_FILT_APPLY2PORT1 BIT(30)
+#define ADIN1140_MAC_ADDR_FILT_TO_HOST BIT(16)
+
+#define ADIN1140_MAC_ADDR_FILT_LWR_REG ADIN1140_MMS_REG(0x1, 0x51)
+
+#define ADIN1140_MAC_ADDR_MASK_UPR_REG ADIN1140_MMS_REG(0x1, 0x70)
+#define ADIN1140_MAC_ADDR_MASK_LWR_REG ADIN1140_MMS_REG(0x1, 0x71)
+
+#define ADIN1140_MAC_FILT_MC_SLOT 0U
+#define ADIN1140_MAC_FILT_BC_SLOT 1U
+#define ADIN1140_MAC_FILT_UC_SLOT 2U
+#define ADIN1140_MAC_FILT_MAX_SLOT 16U
+
+#define ADIN1140_RX_FRAME_CNT ADIN1140_MMS_REG(0x1, 0xA1)
+#define ADIN1140_RX_BC_FRAME_CNT ADIN1140_MMS_REG(0x1, 0xA2)
+#define ADIN1140_RX_MC_FRAME_CNT ADIN1140_MMS_REG(0x1, 0xA3)
+#define ADIN1140_RX_UC_FRAME_CNT ADIN1140_MMS_REG(0x1, 0xA4)
+#define ADIN1140_RX_CRC_ERR_CNT ADIN1140_MMS_REG(0x1, 0xA5)
+#define ADIN1140_RX_ALIGN_ERR_CNT ADIN1140_MMS_REG(0x1, 0xA6)
+#define ADIN1140_RX_PREAMBLE_ERR_CNT ADIN1140_MMS_REG(0x1, 0xA7)
+#define ADIN1140_RX_SHORT_ERR_CNT ADIN1140_MMS_REG(0x1, 0xA8)
+#define ADIN1140_RX_LONG_ERR_CNT ADIN1140_MMS_REG(0x1, 0xA9)
+#define ADIN1140_RX_PHY_ERR_CNT ADIN1140_MMS_REG(0x1, 0xAA)
+#define ADIN1140_RX_DRP_FULL_CNT ADIN1140_MMS_REG(0x1, 0xAB)
+#define ADIN1140_RX_DRP_FILTER_CNT ADIN1140_MMS_REG(0x1, 0xAD)
+#define ADIN1140_RX_IFG_ERR_CNT ADIN1140_MMS_REG(0x1, 0xAE)
+#define ADIN1140_TX_FRAME_CNT ADIN1140_MMS_REG(0x1, 0xB1)
+#define ADIN1140_TX_BC_FRAME_CNT ADIN1140_MMS_REG(0x1, 0xB2)
+#define ADIN1140_TX_MC_FRAME_CNT ADIN1140_MMS_REG(0x1, 0xB3)
+#define ADIN1140_TX_UC_FRAME_CNT ADIN1140_MMS_REG(0x1, 0xB4)
+#define ADIN1140_TX_SINGLE_COL_CNT ADIN1140_MMS_REG(0x1, 0xB5)
+#define ADIN1140_TX_MULTI_COL_CNT ADIN1140_MMS_REG(0x1, 0xB6)
+#define ADIN1140_TX_DEFERRED_CNT ADIN1140_MMS_REG(0x1, 0xB7)
+#define ADIN1140_TX_LATE_COL_CNT ADIN1140_MMS_REG(0x1, 0xB8)
+#define ADIN1140_TX_EXCESS_COL_CNT ADIN1140_MMS_REG(0x1, 0xB9)
+#define ADIN1140_TX_UNDERRUN_CNT ADIN1140_MMS_REG(0x1, 0xBA)
+
+/* ADIN1140_MAC_FILT_MAX_SLOT - 3 (multicast, broadcast and unicast
+ * reserved slots)
+ */
+#define ADIN1140_MAC_FILT_AVAIL 13U
+
+#define ADIN1140_PHY_CTRL_DEFAULT 0x1000
+#define ADIN1140_PHY_STATUS_DEFAULT 0x082D
+
+#define ADIN1140_PHY_C45_PCS_MMS2 2 /* MMD 3 */
+#define ADIN1140_PHY_C45_PMA_PMD_MMS3 3 /* MMD 1 */
+#define ADIN1140_PHY_C45_VS_PLCA_MMS4 4 /* MMD 31 */
+
+#define ADIN1140_STATS_CNT 23
+#define ADIN1140_STATS_CHECK_DELAY (3 * HZ)
+
+struct adin1140_statistics_reg {
+ const char *name;
+ u32 addr;
+};
+
+struct adin1140_priv {
+ struct net_device *netdev;
+ struct oa_tc6 *tc6;
+ struct mii_bus *mdiobus;
+ struct work_struct rx_mode_work;
+ struct delayed_work stats_work;
+ /* Protect the stats array from concurrent accesses from
+ * adin1140_stats_work, adin1140_ndo_get_stats64
+ * and adin1140_get_ethtool_stats
+ */
+ spinlock_t stat_lock;
+
+ u64 stats[ADIN1140_STATS_CNT];
+};
+
+enum adin1140_statistics_entry {
+ rx_frames,
+ rx_broadcast_frames,
+ rx_multicast_frames,
+ rx_unicast_frames,
+ rx_crc_errors,
+ rx_align_errors,
+ rx_preamble_errors,
+ rx_short_frame_errors,
+ rx_long_frame_errors,
+ rx_phy_errors,
+ rx_fifo_full_dropped,
+ rx_addr_filter_dropped,
+ rx_ifg_errors,
+ tx_frames,
+ tx_broadcast_frames,
+ tx_multicast_frames,
+ tx_unicast_frames,
+ tx_single_collision,
+ tx_multi_collision,
+ tx_deferred,
+ tx_late_collision,
+ tx_excess_collision,
+ tx_underrun,
+};
+
+static const struct adin1140_statistics_reg adin1140_stats[] = {
+ {.name = "rx_frames", .addr = ADIN1140_RX_FRAME_CNT},
+ {.name = "rx_broadcast_frames", .addr = ADIN1140_RX_BC_FRAME_CNT},
+ {.name = "rx_multicast_frames", .addr = ADIN1140_RX_MC_FRAME_CNT},
+ {.name = "rx_unicast_frames", .addr = ADIN1140_RX_UC_FRAME_CNT},
+ {.name = "rx_crc_errors", .addr = ADIN1140_RX_CRC_ERR_CNT},
+ {.name = "rx_align_errors", .addr = ADIN1140_RX_ALIGN_ERR_CNT},
+ {.name = "rx_preamble_errors", .addr = ADIN1140_RX_PREAMBLE_ERR_CNT},
+ {.name = "rx_short_frame_errors", .addr = ADIN1140_RX_SHORT_ERR_CNT},
+ {.name = "rx_long_frame_errors", .addr = ADIN1140_RX_LONG_ERR_CNT},
+ {.name = "rx_phy_errors", .addr = ADIN1140_RX_PHY_ERR_CNT},
+ {.name = "rx_fifo_full_dropped", .addr = ADIN1140_RX_DRP_FULL_CNT},
+ {.name = "rx_addr_filt_dropped", .addr = ADIN1140_RX_DRP_FILTER_CNT},
+ {.name = "rx_ifg_errors", .addr = ADIN1140_RX_IFG_ERR_CNT},
+ {.name = "tx_frames", .addr = ADIN1140_TX_FRAME_CNT},
+ {.name = "tx_broadcast_frames", .addr = ADIN1140_TX_BC_FRAME_CNT},
+ {.name = "tx_multicast_frames", .addr = ADIN1140_TX_MC_FRAME_CNT},
+ {.name = "tx_unicast_frames", .addr = ADIN1140_TX_UC_FRAME_CNT},
+ {.name = "tx_single_collision", .addr = ADIN1140_TX_SINGLE_COL_CNT},
+ {.name = "tx_multi_collision", .addr = ADIN1140_TX_MULTI_COL_CNT},
+ {.name = "tx_deferred", .addr = ADIN1140_TX_DEFERRED_CNT},
+ {.name = "tx_late_collision", .addr = ADIN1140_TX_LATE_COL_CNT},
+ {.name = "tx_excess_collision", .addr = ADIN1140_TX_EXCESS_COL_CNT},
+ {.name = "tx_underrun", .addr = ADIN1140_TX_UNDERRUN_CNT},
+};
+
+static int adin1140_mac_filter_set(struct adin1140_priv *priv,
+ const u8 *addr, const u8 *mask,
+ u8 slot)
+{
+ u32 mask_reg;
+ u32 val;
+ int ret;
+
+ if (slot >= ADIN1140_MAC_FILT_MAX_SLOT)
+ return -ENOSPC;
+
+ ret = oa_tc6_write_register(priv->tc6,
+ ADIN1140_MAC_ADDR_FILT_UPR_REG + 2 * slot,
+ get_unaligned_be16(&addr[0]) |
+ ADIN1140_MAC_ADDR_FILT_APPLY2PORT1 |
+ ADIN1140_MAC_ADDR_FILT_TO_HOST);
+ if (ret)
+ return ret;
+
+ ret = oa_tc6_write_register(priv->tc6,
+ ADIN1140_MAC_ADDR_FILT_LWR_REG + 2 * slot,
+ get_unaligned_be32(&addr[2]));
+ if (ret)
+ return ret;
+
+ val = get_unaligned_be16(&mask[0]);
+ mask_reg = ADIN1140_MAC_ADDR_MASK_UPR_REG + (2 * slot);
+
+ ret = oa_tc6_write_register(priv->tc6, mask_reg, val);
+ if (ret)
+ return ret;
+
+ val = get_unaligned_be32(&mask[2]);
+ mask_reg = ADIN1140_MAC_ADDR_MASK_LWR_REG + (2 * slot);
+
+ return oa_tc6_write_register(priv->tc6, mask_reg, val);
+}
+
+static int adin1140_mac_filter_clear(struct adin1140_priv *priv, u8 slot)
+{
+ u8 mask[ETH_ALEN];
+ u8 addr[ETH_ALEN];
+
+ memset(mask, 0xFF, ETH_ALEN);
+ memset(addr, 0x0, ETH_ALEN);
+
+ return adin1140_mac_filter_set(priv, addr, mask, slot);
+}
+
+static int adin1140_filter_unicast(struct adin1140_priv *priv)
+{
+ u8 mask[ETH_ALEN];
+
+ memset(mask, 0xFF, ETH_ALEN);
+
+ return adin1140_mac_filter_set(priv, priv->netdev->dev_addr, mask,
+ ADIN1140_MAC_FILT_UC_SLOT);
+}
+
+static int adin1140_filter_all_multicast(struct adin1140_priv *priv, bool en)
+{
+ u8 multicast_addr[ETH_ALEN] = {1, 0, 0, 0, 0, 0};
+
+ if (en)
+ return adin1140_mac_filter_set(priv, multicast_addr,
+ multicast_addr,
+ ADIN1140_MAC_FILT_MC_SLOT);
+
+ return adin1140_mac_filter_clear(priv, ADIN1140_MAC_FILT_MC_SLOT);
+}
+
+static int adin1140_filter_broadcast(struct adin1140_priv *priv, bool enabled)
+{
+ u8 mask[ETH_ALEN];
+
+ if (enabled) {
+ memset(mask, 0xFF, ETH_ALEN);
+ return adin1140_mac_filter_set(priv, mask, mask,
+ ADIN1140_MAC_FILT_BC_SLOT);
+ }
+
+ return adin1140_mac_filter_clear(priv, ADIN1140_MAC_FILT_BC_SLOT);
+}
+
+static int adin1140_default_filter_config(struct adin1140_priv *priv)
+{
+ int ret;
+
+ ret = adin1140_filter_broadcast(priv, true);
+ if (ret)
+ return ret;
+
+ return adin1140_filter_unicast(priv);
+}
+
+static int adin1140_promiscuous_mode(struct adin1140_priv *priv, bool enabled)
+{
+ int ret;
+ u32 val;
+
+ ret = oa_tc6_read_register(priv->tc6, ADIN1140_CONFIG2_REG, &val);
+ if (ret)
+ return ret;
+
+ if (enabled)
+ val |= ADIN1140_CONFIG2_FWD_UNK2HOST;
+ else
+ val &= ~ADIN1140_CONFIG2_FWD_UNK2HOST;
+
+ return oa_tc6_write_register(priv->tc6, ADIN1140_CONFIG2_REG, val);
+}
+
+static void adin1140_rx_mode_work(struct work_struct *work)
+{
+ struct adin1140_priv *priv = container_of(work, struct adin1140_priv,
+ rx_mode_work);
+ struct netdev_hw_addr *ha;
+ bool all_multi, promisc;
+ u8 mask[ETH_ALEN];
+ u8 start, end;
+ u32 mac_addrs;
+ u8 slot, i;
+ int ret;
+
+ /* The ADIN1140 has 16 dest MAC address filter slots:
+ * 0 - reserved for all multicast filter.
+ * 1 - reserved for broadcast filter.
+ * 2 - reserved for the device's own unicast MAC.
+ * 3 -> 15 - available for other unicast/multicast filters.
+ */
+
+ mac_addrs = netdev_uc_count(priv->netdev) +
+ netdev_mc_count(priv->netdev);
+
+ if (priv->netdev->flags & IFF_PROMISC) {
+ promisc = true;
+ all_multi = false;
+ } else if (priv->netdev->flags & IFF_ALLMULTI) {
+ promisc = false;
+ all_multi = true;
+ } else if (mac_addrs <= ADIN1140_MAC_FILT_AVAIL) {
+ promisc = false;
+ all_multi = false;
+
+ slot = ADIN1140_MAC_FILT_UC_SLOT + 1;
+ memset(mask, 0xFF, ETH_ALEN);
+
+ netdev_for_each_uc_addr(ha, priv->netdev) {
+ ret = adin1140_mac_filter_set(priv, ha->addr, mask,
+ slot);
+ if (ret)
+ return;
+
+ slot++;
+ }
+
+ netdev_for_each_mc_addr(ha, priv->netdev) {
+ ret = adin1140_mac_filter_set(priv, ha->addr, mask,
+ slot);
+ if (ret)
+ return;
+
+ slot++;
+ }
+ } else {
+ /* The filter table is full. Enable promisc mode. */
+ promisc = true;
+ all_multi = false;
+
+ start = ADIN1140_MAC_FILT_UC_SLOT + 1;
+ end = ADIN1140_MAC_FILT_MAX_SLOT;
+ for (i = start; i < end; i++) {
+ ret = adin1140_mac_filter_clear(priv, i);
+ if (ret)
+ return;
+ }
+ }
+
+ ret = adin1140_promiscuous_mode(priv, promisc);
+ if (ret)
+ return;
+
+ adin1140_filter_all_multicast(priv, all_multi);
+}
+
+static void adin1140_rx_mode(struct net_device *netdev)
+{
+ struct adin1140_priv *priv = netdev_priv(netdev);
+
+ schedule_work(&priv->rx_mode_work);
+}
+
+static void adin1140_stats_work(struct work_struct *work)
+{
+ struct delayed_work *dwork = to_delayed_work(work);
+ u64 stat_buff[ADIN1140_STATS_CNT] = {};
+ struct adin1140_priv *priv;
+ u32 reg_val;
+ int ret;
+ u32 i;
+
+ priv = container_of(dwork, struct adin1140_priv, stats_work);
+
+ for (i = 0; i < ARRAY_SIZE(adin1140_stats); i++) {
+ ret = oa_tc6_read_register(priv->tc6, adin1140_stats[i].addr,
+ ®_val);
+ if (ret)
+ break;
+
+ stat_buff[i] = reg_val;
+ }
+
+ spin_lock(&priv->stat_lock);
+ memcpy(&priv->stats, stat_buff, sizeof(priv->stats));
+ spin_unlock(&priv->stat_lock);
+
+ schedule_delayed_work(dwork, ADIN1140_STATS_CHECK_DELAY);
+}
+
+static int adin1140_configure(struct adin1140_priv *priv)
+{
+ u32 val;
+ int ret;
+
+ ret = oa_tc6_zero_align_receive_frame_enable(priv->tc6);
+ if (ret)
+ return ret;
+
+ ret = oa_tc6_read_register(priv->tc6, ADIN1140_CONFIG0_REG, &val);
+ if (ret)
+ return ret;
+
+ /* Zero-Align Receive Frame Enable */
+ val |= ADIN1140_CONFIG0_RFA_ZARFE;
+
+ /* Transmit Frame Check Sequence Validation must be disabled
+ * to allow CRC appending by MAC (CONFIG2.CRC_APPEND)
+ */
+ val &= ~ADIN1140_CONFIG0_TXFCSVE;
+ val |= ADIN1140_CONFIG0_CPS_64;
+
+ ret = oa_tc6_write_register(priv->tc6, ADIN1140_CONFIG0_REG, val);
+ if (ret)
+ return ret;
+
+ /* Disable MAC loopback */
+ ret = oa_tc6_write_register(priv->tc6, ADIN1140_MAC_P1_LOOP_ADDR_REG,
+ 0x0);
+ if (ret)
+ return ret;
+
+ return adin1140_default_filter_config(priv);
+}
+
+static int adin1140_open(struct net_device *netdev)
+{
+ struct adin1140_priv *priv = netdev_priv(netdev);
+
+ schedule_delayed_work(&priv->stats_work, ADIN1140_STATS_CHECK_DELAY);
+
+ phy_start(netdev->phydev);
+ netif_start_queue(netdev);
+
+ return 0;
+}
+
+static int adin1140_close(struct net_device *netdev)
+{
+ struct adin1140_priv *priv = netdev_priv(netdev);
+
+ cancel_delayed_work_sync(&priv->stats_work);
+
+ netif_stop_queue(netdev);
+ phy_stop(netdev->phydev);
+
+ return 0;
+}
+
+static netdev_tx_t adin1140_start_xmit(struct sk_buff *skb,
+ struct net_device *netdev)
+{
+ struct adin1140_priv *priv = netdev_priv(netdev);
+
+ /* Pad frames to minimum Ethernet frame size (60 bytes without FCS).
+ * The MAC will append the FCS, but we need to ensure the frame is
+ * at least ETH_ZLEN bytes.
+ */
+ if (skb_put_padto(skb, ETH_ZLEN))
+ return NETDEV_TX_OK;
+
+ return oa_tc6_start_xmit(priv->tc6, skb);
+}
+
+static int adin1140_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd)
+{
+ if (!netif_running(netdev))
+ return -EINVAL;
+
+ return phy_do_ioctl(netdev, rq, cmd);
+}
+
+static int adin1140_set_mac_address(struct net_device *netdev, void *addr)
+{
+ struct adin1140_priv *priv = netdev_priv(netdev);
+ struct sockaddr *address = addr;
+ u8 mask[ETH_ALEN];
+ int ret;
+
+ ret = eth_prepare_mac_addr_change(netdev, addr);
+ if (ret < 0)
+ return ret;
+
+ if (ether_addr_equal(address->sa_data, netdev->dev_addr))
+ return 0;
+
+ memset(mask, 0xFF, ETH_ALEN);
+ ret = adin1140_mac_filter_set(priv, address->sa_data, mask,
+ ADIN1140_MAC_FILT_UC_SLOT);
+ if (ret)
+ return ret;
+
+ eth_commit_mac_addr_change(netdev, addr);
+
+ return 0;
+}
+
+static void adin1140_ndo_get_stats64(struct net_device *dev,
+ struct rtnl_link_stats64 *storage)
+{
+ struct adin1140_priv *priv = netdev_priv(dev);
+
+ storage->rx_packets = priv->netdev->stats.rx_packets;
+ storage->tx_packets = priv->netdev->stats.tx_packets;
+
+ storage->rx_bytes = priv->netdev->stats.rx_bytes;
+ storage->tx_bytes = priv->netdev->stats.tx_bytes;
+
+ spin_lock(&priv->stat_lock);
+
+ storage->rx_errors = priv->stats[rx_crc_errors] +
+ priv->stats[rx_align_errors] +
+ priv->stats[rx_preamble_errors] +
+ priv->stats[rx_short_frame_errors] +
+ priv->stats[rx_long_frame_errors] +
+ priv->stats[rx_phy_errors] +
+ priv->stats[rx_ifg_errors];
+
+ storage->tx_errors = priv->stats[tx_excess_collision] +
+ priv->stats[tx_underrun];
+
+ storage->rx_dropped = priv->stats[rx_fifo_full_dropped] +
+ priv->stats[rx_addr_filter_dropped];
+
+ storage->multicast = priv->stats[rx_multicast_frames];
+
+ storage->collisions = priv->stats[tx_single_collision] +
+ priv->stats[tx_multi_collision];
+
+ storage->rx_length_errors = priv->stats[rx_short_frame_errors] +
+ priv->stats[rx_long_frame_errors];
+ storage->rx_over_errors = priv->stats[rx_fifo_full_dropped];
+ storage->rx_crc_errors = priv->stats[rx_crc_errors];
+ storage->rx_frame_errors = priv->stats[rx_align_errors];
+ storage->rx_missed_errors = priv->stats[rx_fifo_full_dropped];
+
+ storage->tx_aborted_errors = priv->stats[tx_excess_collision];
+ storage->tx_fifo_errors = priv->stats[tx_underrun];
+ storage->tx_window_errors = priv->stats[tx_late_collision];
+
+ spin_unlock(&priv->stat_lock);
+}
+
+static void adin1140_get_drvinfo(struct net_device *netdev,
+ struct ethtool_drvinfo *info)
+{
+ strscpy(info->driver, "ADIN1140", sizeof(info->driver));
+ strscpy(info->bus_info, dev_name(netdev->dev.parent),
+ sizeof(info->bus_info));
+}
+
+static void adin1140_get_ethtool_stats(struct net_device *netdev,
+ struct ethtool_stats *stats, u64 *data)
+{
+ struct adin1140_priv *priv = netdev_priv(netdev);
+
+ spin_lock(&priv->stat_lock);
+ memcpy(data, &priv->stats, sizeof(u64) * ARRAY_SIZE(adin1140_stats));
+ spin_unlock(&priv->stat_lock);
+}
+
+static void adin1140_get_ethtool_strings(struct net_device *netdev, u32 sset,
+ u8 *p)
+{
+ u32 i;
+
+ switch (sset) {
+ case ETH_SS_STATS:
+ for (i = 0; i < ARRAY_SIZE(adin1140_stats); i++)
+ ethtool_puts(&p, adin1140_stats[i].name);
+
+ break;
+ }
+}
+
+static int adin1140_get_sset_count(struct net_device *netdev, int sset)
+{
+ switch (sset) {
+ case ETH_SS_STATS:
+ return ARRAY_SIZE(adin1140_stats);
+ default:
+ return -EOPNOTSUPP;
+ }
+}
+
+static int adin1140_get_phy_c45_mms(int devnum)
+{
+ switch (devnum) {
+ case MDIO_MMD_PCS:
+ return ADIN1140_PHY_C45_PCS_MMS2;
+ case MDIO_MMD_PMAPMD:
+ return ADIN1140_PHY_C45_PMA_PMD_MMS3;
+ case MDIO_MMD_VEND2:
+ return ADIN1140_PHY_C45_VS_PLCA_MMS4;
+ default:
+ return devnum;
+ }
+}
+
+static int adin1140_mdiobus_read_c45(struct mii_bus *bus, int addr,
+ int devnum, int regnum)
+{
+ struct oa_tc6 *tc6 = bus->priv;
+ u32 regval;
+ u32 mms;
+ int ret;
+
+ mms = adin1140_get_phy_c45_mms(devnum);
+ ret = oa_tc6_read_register(tc6, ADIN1140_MMS_REG(mms, regnum),
+ ®val);
+ if (ret)
+ return ret;
+
+ return regval;
+}
+
+static int adin1140_mdiobus_write_c45(struct mii_bus *bus, int addr,
+ int devnum, int regnum, u16 val)
+{
+ struct oa_tc6 *tc6 = bus->priv;
+ int ret;
+
+ ret = adin1140_get_phy_c45_mms(devnum);
+ if (ret < 0)
+ return ret;
+
+ return oa_tc6_write_register(tc6, ADIN1140_MMS_REG(ret, regnum), val);
+}
+
+static int adin1140_mdiobus_read(struct mii_bus *bus, int addr, int regnum)
+{
+ struct oa_tc6 *tc6 = bus->priv;
+ u32 reg_val;
+ int ret;
+
+ /* The ADIN1140's standard PHY C22 register map (OA TC6 0xFF00 -
+ * 0xFF1F), of which only 0xFF00 - 0xFF03 are implemented) cannot be
+ * accessed while frames are being received by the PHY. In case this
+ * happens the CONFIG0 and CONFIG2 register values will get corrupted,
+ * getting a random value. Both reads and writes cause the same
+ * behavior. This is a workaround that avoids MDIO accesses all
+ * together. Since this is a 10BASE-T1S PHY, only the loopback and
+ * reset (AN) bits in the control register (0x0) can be written.
+ * These functionalities have custom implementations in the PHY
+ * driver. Since the MAC and PHY are integrated in the same device, we
+ * can read the OA TC6 MACPHY ID register instead of the PHYID (0x2
+ * and 0x3) ones, as their value matches. C45 accesses do not cause
+ * this issue.
+ */
+
+ switch (regnum) {
+ case MII_BMCR:
+ return ADIN1140_PHY_CTRL_DEFAULT;
+ case MII_BMSR:
+ return ADIN1140_PHY_STATUS_DEFAULT;
+ case MII_PHYSID1:
+ ret = oa_tc6_read_register(tc6, ADIN1140_MACPHY_ID_REG,
+ ®_val);
+ if (ret)
+ return ret;
+
+ return FIELD_GET(GENMASK(31, 16), reg_val);
+ case MII_PHYSID2:
+ ret = oa_tc6_read_register(tc6, ADIN1140_MACPHY_ID_REG,
+ ®_val);
+ if (ret)
+ return ret;
+
+ return FIELD_GET(GENMASK(15, 0), reg_val);
+ default:
+ return 0xFFFF;
+ }
+}
+
+static int adin1140_mdiobus_write(struct mii_bus *bus, int addr, int regnum,
+ u16 val)
+{
+ return 0;
+}
+
+static int adin1140_mdio_register(struct adin1140_priv *priv)
+{
+ priv->mdiobus = mdiobus_alloc();
+ if (!priv->mdiobus) {
+ netdev_err(priv->netdev, "MDIO bus alloc failed\n");
+ return -ENOMEM;
+ }
+
+ priv->mdiobus->read = adin1140_mdiobus_read;
+ priv->mdiobus->write = adin1140_mdiobus_write;
+ priv->mdiobus->read_c45 = adin1140_mdiobus_read_c45;
+ priv->mdiobus->write_c45 = adin1140_mdiobus_write_c45;
+
+ return 0;
+}
+
+static const struct ethtool_ops adin1140_ethtool_ops = {
+ .get_drvinfo = adin1140_get_drvinfo,
+ .get_link = ethtool_op_get_link,
+ .get_ethtool_stats = adin1140_get_ethtool_stats,
+ .get_sset_count = adin1140_get_sset_count,
+ .get_strings = adin1140_get_ethtool_strings,
+ .get_link_ksettings = phy_ethtool_get_link_ksettings,
+ .set_link_ksettings = phy_ethtool_set_link_ksettings,
+};
+
+static const struct net_device_ops adin1140_netdev_ops = {
+ .ndo_open = adin1140_open,
+ .ndo_stop = adin1140_close,
+ .ndo_start_xmit = adin1140_start_xmit,
+ .ndo_set_mac_address = adin1140_set_mac_address,
+ .ndo_validate_addr = eth_validate_addr,
+ .ndo_set_rx_mode = adin1140_rx_mode,
+ .ndo_eth_ioctl = adin1140_ioctl,
+ .ndo_get_stats64 = adin1140_ndo_get_stats64,
+};
+
+static int adin1140_probe(struct spi_device *spi)
+{
+ struct oa_tc6_config tc6_config = {};
+ struct net_device *netdev;
+ struct adin1140_priv *priv;
+ int ret;
+
+ netdev = alloc_etherdev(sizeof(struct adin1140_priv));
+ if (!netdev)
+ return -ENOMEM;
+
+ priv = netdev_priv(netdev);
+ priv->netdev = netdev;
+ spi_set_drvdata(spi, priv);
+ spin_lock_init(&priv->stat_lock);
+
+ ret = adin1140_mdio_register(priv);
+ if (ret)
+ goto netdev_free;
+
+ tc6_config.spi = spi;
+ tc6_config.netdev = netdev;
+ tc6_config.mii_bus = priv->mdiobus;
+
+ priv->tc6 = oa_tc6_init(&tc6_config);
+ if (!priv->tc6) {
+ ret = -ENODEV;
+ goto mdio_free;
+ }
+
+ if (device_get_ethdev_address(&spi->dev, netdev))
+ eth_hw_addr_random(netdev);
+
+ ret = adin1140_configure(priv);
+ if (ret)
+ goto oa_tc6_exit;
+
+ INIT_WORK(&priv->rx_mode_work, adin1140_rx_mode_work);
+ INIT_DELAYED_WORK(&priv->stats_work, adin1140_stats_work);
+
+ netdev->if_port = IF_PORT_10BASET;
+ netdev->irq = spi->irq;
+ netdev->netdev_ops = &adin1140_netdev_ops;
+ netdev->ethtool_ops = &adin1140_ethtool_ops;
+ netdev->netns_immutable = true;
+ netdev->priv_flags |= IFF_LIVE_ADDR_CHANGE |
+ IFF_UNICAST_FLT;
+
+ ret = register_netdev(netdev);
+ if (ret) {
+ dev_err(&spi->dev, "Failed to register netdev (%d)", ret);
+ goto oa_tc6_exit;
+ }
+
+ return 0;
+
+oa_tc6_exit:
+ oa_tc6_exit(priv->tc6);
+mdio_free:
+ mdiobus_free(priv->mdiobus);
+netdev_free:
+ free_netdev(priv->netdev);
+
+ return ret;
+}
+
+static void adin1140_remove(struct spi_device *spi)
+{
+ struct adin1140_priv *priv = spi_get_drvdata(spi);
+
+ cancel_work_sync(&priv->rx_mode_work);
+ unregister_netdev(priv->netdev);
+ oa_tc6_exit(priv->tc6);
+ mdiobus_free(priv->mdiobus);
+ free_netdev(priv->netdev);
+}
+
+static const struct spi_device_id adin1140_spi_id[] = {
+ { .name = "adin1140" },
+ { .name = "ad3306" },
+ {},
+};
+MODULE_DEVICE_TABLE(spi, adin1140_spi_id);
+
+static const struct of_device_id adin1140_match_table[] = {
+ { .compatible = "adi,adin1140" },
+ { .compatible = "adi,ad3306" },
+ { }
+};
+MODULE_DEVICE_TABLE(of, adin1140_match_table);
+
+static struct spi_driver adin1140_driver = {
+ .driver = {
+ .name = "adin1140",
+ .of_match_table = adin1140_match_table,
+ },
+ .probe = adin1140_probe,
+ .remove = adin1140_remove,
+ .id_table = adin1140_spi_id,
+};
+module_spi_driver(adin1140_driver);
+
+MODULE_DESCRIPTION("Analog Devices, Inc. ADIN1140 10BASE-T1S MAC-PHY");
+MODULE_AUTHOR("Ciprian Regus <ciprian.regus@analog.com>");
+MODULE_LICENSE("GPL");
--
2.43.0
^ permalink raw reply related
* [PATCH net-next 5/5] dt-bindings: net: Add bindings for the ADIN1140
From: Ciprian Regus via B4 Relay @ 2026-05-02 23:24 UTC (permalink / raw)
To: Parthiban Veerasooran, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Jonathan Corbet,
Shuah Khan, Andrew Lunn, Heiner Kallweit, Russell King,
Rob Herring, Krzysztof Kozlowski, Conor Dooley
Cc: netdev, linux-kernel, linux-doc, devicetree, Ciprian Regus
In-Reply-To: <20260503-adin1140-driver-v1-0-dd043cdd88f0@analog.com>
From: Ciprian Regus <ciprian.regus@analog.com>
Add DT bindings for the ADIN1140 10BASE-T1S MACPHY. Update the
MAINTAINERS entry to include the bindings file as well.
Signed-off-by: Ciprian Regus <ciprian.regus@analog.com>
---
.../devicetree/bindings/net/adi,adin1140.yaml | 69 ++++++++++++++++++++++
MAINTAINERS | 1 +
2 files changed, 70 insertions(+)
diff --git a/Documentation/devicetree/bindings/net/adi,adin1140.yaml b/Documentation/devicetree/bindings/net/adi,adin1140.yaml
new file mode 100644
index 000000000000..26cd40d36f9b
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/adi,adin1140.yaml
@@ -0,0 +1,69 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/net/adi,adin1140.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: ADI ADIN1140 10BASE-T1S MAC-PHY
+
+maintainers:
+ - Ciprian Regus <ciprian.regus@analog.com>
+
+description: |
+ The ADIN1140 (also called AD3306) is a low power single port
+ 10BASE-T1S MAC-PHY. It integrates an Ethernet PHY with a MAC
+ and all the associated analog circuitry.
+ The device implements the Open Alliance TC6 10BASE-T1x MAC-PHY
+ Serial Interface specification and is compliant with the
+ IEEE 802.3cg-2019 Ethernet standard for 10 Mbps single pair
+ Ethernet (SPE). The device has a 4-wire SPI interface for
+ communication between the MAC and host processor.
+
+allOf:
+ - $ref: /schemas/net/ethernet-controller.yaml#
+ - $ref: /schemas/spi/spi-peripheral-props.yaml#
+
+properties:
+ compatible:
+ enum:
+ - adi,adin1140
+ - adi,ad3306
+
+ reg:
+ maxItems: 1
+
+ spi-max-frequency:
+ maximum: 25000000
+
+ interrupts:
+ maxItems: 1
+ description: Interrupt from the MAC-PHY for receive data available
+ and error conditions
+
+required:
+ - compatible
+ - reg
+ - interrupts
+ - spi-max-frequency
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ #include <dt-bindings/interrupt-controller/irq.h>
+
+ spi {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ ethernet@0 {
+ compatible = "adi,adin1140";
+ reg = <0>;
+ spi-max-frequency = <23000000>;
+
+ interrupt-parent = <&gpio>;
+ interrupts = <6 IRQ_TYPE_EDGE_FALLING>;
+
+ local-mac-address = [ 00 11 22 33 44 55 ];
+ };
+ };
diff --git a/MAINTAINERS b/MAINTAINERS
index f9784c25beac..55e1e78fe04e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1848,6 +1848,7 @@ M: Ciprian Regus <ciprian.regus@analog.com>
L: netdev@vger.kernel.org
S: Maintained
W: https://ez.analog.com/linux-software-drivers
+F: Documentation/devicetree/bindings/net/adi,adin1140.yaml
F: drivers/net/ethernet/adi/adin1140.c
ANALOG DEVICES INC ETHERNET PHY DRIVERS
--
2.43.0
^ permalink raw reply related
* Re: [PATCH net 0/2] net/sched: sch_cake: annotate data-races in cake_dump_class_stats (series)
From: patchwork-bot+netdevbpf @ 2026-05-03 0:10 UTC (permalink / raw)
To: Eric Dumazet
Cc: davem, kuba, pabeni, horms, jhs, toke, jiri, netdev, eric.dumazet
In-Reply-To: <20260430061610.3503483-1-edumazet@google.com>
Hello:
This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 30 Apr 2026 06:16:08 +0000 you wrote:
> cake_dump_class_stats() runs without qdisc spinlock being held.
>
> In this series (of two), I add READ_ONCE()/WRITE_ONCE() annotations for:
>
> - flow->head
> - flow->dropped
> - b->backlogs[]
> - flow->deficit
> - flow->cvars.dropping
> - flow->cvars.count
> - flow->cvars.p_drop
> - flow->cvars.blue_timer
> - flow->cvars.drop_next
>
> [...]
Here is the summary with links:
- [net,1/2] net/sched: sch_cake: annotate data-races in cake_dump_class_stats (I)
https://git.kernel.org/netdev/net/c/046111a1a35a
- [net,2/2] net/sched: sch_cake: annotate data-races in cake_dump_class_stats (II)
https://git.kernel.org/netdev/net/c/67dc6c56b871
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next 3/5] net: phy: Add support for the ADIN1140 PHY
From: Andrew Lunn @ 2026-05-03 0:40 UTC (permalink / raw)
To: ciprian.regus
Cc: Parthiban Veerasooran, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Jonathan Corbet,
Shuah Khan, Heiner Kallweit, Russell King, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, netdev, linux-kernel,
linux-doc, devicetree
In-Reply-To: <20260503-adin1140-driver-v1-3-dd043cdd88f0@analog.com>
> +static int adin1140_phy_read_mmd(struct phy_device *phydev, int devnum,
> + u16 regnum)
> +{
> + struct mii_bus *bus = phydev->mdio.bus;
> + int addr = phydev->mdio.addr;
> +
> + return __mdiobus_c45_read(bus, addr, devnum, regnum);
> +}
> +
> +static int adin1140_phy_write_mmd(struct phy_device *phydev, int devnum,
> + u16 regnum, u16 val)
> +{
> + struct mii_bus *bus = phydev->mdio.bus;
> + int addr = phydev->mdio.addr;
> +
> + return __mdiobus_c45_write(bus, addr, devnum, regnum, val);
> +}
Why do these exist?
> +static int adin1140_config_init(struct phy_device *phydev)
> +{
> + /* The link status of the PHY doesn't need to be polled, because
> + * the device doesn't implement AN and there is no other mechanism
> + * to report the link state.
> + */
> + phydev->irq = PHY_MAC_INTERRUPT;
I would prefer you don't abuse this.
> +static int adin1140_read_status(struct phy_device *phydev)
> +{
> + phydev->link = 1;
> + phydev->duplex = DUPLEX_HALF;
> + phydev->speed = SPEED_10;
> + phydev->autoneg = AUTONEG_DISABLE;
> +
> + return 0;
> +}
This should have no really cost, so just let phylib poll.
Andrew
^ permalink raw reply
* Re: [PATCH net-next 4/5] net: ethernet: adi: Add a driver for the ADIN1140 MACPHY
From: Andrew Lunn @ 2026-05-03 0:59 UTC (permalink / raw)
To: ciprian.regus
Cc: Parthiban Veerasooran, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Jonathan Corbet,
Shuah Khan, Heiner Kallweit, Russell King, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, netdev, linux-kernel,
linux-doc, devicetree
In-Reply-To: <20260503-adin1140-driver-v1-4-dd043cdd88f0@analog.com>
> +static int adin1140_get_phy_c45_mms(int devnum)
> +{
> + switch (devnum) {
> + case MDIO_MMD_PCS:
> + return ADIN1140_PHY_C45_PCS_MMS2;
> + case MDIO_MMD_PMAPMD:
> + return ADIN1140_PHY_C45_PMA_PMD_MMS3;
> + case MDIO_MMD_VEND2:
> + return ADIN1140_PHY_C45_VS_PLCA_MMS4;
> + default:
> + return devnum;
> + }
> +}
> +
> +static int adin1140_mdiobus_read_c45(struct mii_bus *bus, int addr,
> + int devnum, int regnum)
> +{
> + struct oa_tc6 *tc6 = bus->priv;
> + u32 regval;
> + u32 mms;
> + int ret;
> +
> + mms = adin1140_get_phy_c45_mms(devnum);
> + ret = oa_tc6_read_register(tc6, ADIN1140_MMS_REG(mms, regnum),
> + ®val);
> + if (ret)
> + return ret;
> +
> + return regval;
> +}
> +
> +static int adin1140_mdiobus_write_c45(struct mii_bus *bus, int addr,
> + int devnum, int regnum, u16 val)
> +{
> + struct oa_tc6 *tc6 = bus->priv;
> + int ret;
> +
> + ret = adin1140_get_phy_c45_mms(devnum);
> + if (ret < 0)
> + return ret;
> +
> + return oa_tc6_write_register(tc6, ADIN1140_MMS_REG(ret, regnum), val);
> +}
At a quick look, these seem the same as oa_tc6_mdiobus_read_c45() and
oa_tc6_mdiobus_write_c45(). Please export them and use them.
> +static int adin1140_mdiobus_read(struct mii_bus *bus, int addr, int regnum)
> +{
> + struct oa_tc6 *tc6 = bus->priv;
> + u32 reg_val;
> + int ret;
> +
> + /* The ADIN1140's standard PHY C22 register map (OA TC6 0xFF00 -
> + * 0xFF1F), of which only 0xFF00 - 0xFF03 are implemented) cannot be
> + * accessed while frames are being received by the PHY. In case this
> + * happens the CONFIG0 and CONFIG2 register values will get corrupted,
> + * getting a random value. Both reads and writes cause the same
> + * behavior. This is a workaround that avoids MDIO accesses all
> + * together. Since this is a 10BASE-T1S PHY, only the loopback and
> + * reset (AN) bits in the control register (0x0) can be written.
> + * These functionalities have custom implementations in the PHY
> + * driver. Since the MAC and PHY are integrated in the same device, we
> + * can read the OA TC6 MACPHY ID register instead of the PHYID (0x2
> + * and 0x3) ones, as their value matches. C45 accesses do not cause
> + * this issue.
> + */
> +
> + switch (regnum) {
> + case MII_BMCR:
> + return ADIN1140_PHY_CTRL_DEFAULT;
> + case MII_BMSR:
> + return ADIN1140_PHY_STATUS_DEFAULT;
> + case MII_PHYSID1:
> + ret = oa_tc6_read_register(tc6, ADIN1140_MACPHY_ID_REG,
> + ®_val);
> + if (ret)
> + return ret;
> +
> + return FIELD_GET(GENMASK(31, 16), reg_val);
> + case MII_PHYSID2:
> + ret = oa_tc6_read_register(tc6, ADIN1140_MACPHY_ID_REG,
> + ®_val);
> + if (ret)
> + return ret;
Is it even worth reading this register? Why not hard code this as
well? Or do you expect a new version of the device which is less
FUBAR, and having a different PHY ID?
> +static int adin1140_mdiobus_write(struct mii_bus *bus, int addr, int regnum,
> + u16 val)
> +{
> + return 0;
-EIO. Since writes are not support, you want to know if something
actually does a write.
> +static int adin1140_mdio_register(struct adin1140_priv *priv)
> +{
> + priv->mdiobus = mdiobus_alloc();
> + if (!priv->mdiobus) {
> + netdev_err(priv->netdev, "MDIO bus alloc failed\n");
> + return -ENOMEM;
> + }
> +
> + priv->mdiobus->read = adin1140_mdiobus_read;
> + priv->mdiobus->write = adin1140_mdiobus_write;
> + priv->mdiobus->read_c45 = adin1140_mdiobus_read_c45;
> + priv->mdiobus->write_c45 = adin1140_mdiobus_write_c45;
Name? id?
Andrew
^ permalink raw reply
* Re: [PATCH net-next 4/5] net: ethernet: adi: Add a driver for the ADIN1140 MACPHY
From: Andrew Lunn @ 2026-05-03 1:01 UTC (permalink / raw)
To: ciprian.regus
Cc: Parthiban Veerasooran, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Jonathan Corbet,
Shuah Khan, Heiner Kallweit, Russell King, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, netdev, linux-kernel,
linux-doc, devicetree
In-Reply-To: <20260503-adin1140-driver-v1-4-dd043cdd88f0@analog.com>
> +static int adin1140_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd)
> +{
> + if (!netif_running(netdev))
> + return -EINVAL;
> +
> + return phy_do_ioctl(netdev, rq, cmd);
> +}
phy_do_ioctl_running()
Andrew
^ permalink raw reply
* Re: [PATCH net-next v9 0/5] TLS read_sock performance scalability
From: Jakub Kicinski @ 2026-05-03 1:04 UTC (permalink / raw)
To: Chuck Lever
Cc: John Fastabend, Sabrina Dubroca, Eric Dumazet, Simon Horman,
Paolo Abeni, netdev, kernel-tls-handshake, Chuck Lever,
Hannes Reinecke, Alistair Francis
In-Reply-To: <20260429-tls-read-sock-v9-0-39e71aa7810f@oracle.com>
On Wed, 29 Apr 2026 17:48:07 -0400 Chuck Lever wrote:
> I'd like to encourage in-kernel kTLS consumers (i.e., NFS and
> NVMe/TCP) to coalesce on the use of read_sock. When I suggested
> this to Hannes, he reported a few performance scalability issues
> with read_sock.
Meaning, this series achieves.. what right now?
I mean - the headline is "performance scalability" and there's no
performance testing result in any of the messages :S
Patch 5 for instance "seems logical" but how much difference does
it make?
> However, batch async decryption and its
> submit/deliver scaffolding were dropped from this series because
> async_capable is always false for TLS 1.3, the TLS version that
> NFS and NVMe/TCP both require. Async crypto support for TLS 1.3
> is a prerequisite for revisiting that work.
>
> This series is now only a set of clean-ups. Support for async
> has been deferred until after TLS KeyUpdate has been merged.
What does "after TLS KeyUpdate has been merged" mean?
KeyUpdate is supported.. You mean in NFS? Or in async?
FTR async support is a major pain and we'd rather get rid of it
(and switch away from cryto API) than extend it.
^ permalink raw reply
* Re: [PATCH net-next v9 2/5] tls: Fix dangling skb pointer in tls_sw_read_sock()
From: Jakub Kicinski @ 2026-05-03 1:05 UTC (permalink / raw)
To: Chuck Lever
Cc: John Fastabend, Sabrina Dubroca, Eric Dumazet, Simon Horman,
Paolo Abeni, netdev, kernel-tls-handshake, Chuck Lever,
Hannes Reinecke, Alistair Francis
In-Reply-To: <20260429-tls-read-sock-v9-2-39e71aa7810f@oracle.com>
On Wed, 29 Apr 2026 17:48:09 -0400 Chuck Lever wrote:
> if (used < rxm->full_len) {
> rxm->offset += used;
> rxm->full_len -= used;
> - if (!desc->count)
> - goto read_sock_requeue;
> - } else {
> - consume_skb(skb);
> - if (!desc->count)
> - skb = NULL;
> + goto read_sock_requeue;
> }
> - } while (skb);
> + consume_skb(skb);
> + skb = NULL;
> + if (!desc->count)
> + break;
> + }
This diverges from how TCP behaves, AFAICT.
Short read is not a signal to break for TCP.
^ permalink raw reply
* Re: [PATCH net-next 5/5] dt-bindings: net: Add bindings for the ADIN1140
From: Andrew Lunn @ 2026-05-03 1:06 UTC (permalink / raw)
To: ciprian.regus
Cc: Parthiban Veerasooran, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Jonathan Corbet,
Shuah Khan, Heiner Kallweit, Russell King, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, netdev, linux-kernel,
linux-doc, devicetree
In-Reply-To: <20260503-adin1140-driver-v1-5-dd043cdd88f0@analog.com>
> + The ADIN1140 (also called AD3306) is a low power single port
> + 10BASE-T1S MAC-PHY. It integrates an Ethernet PHY with a MAC
> + and all the associated analog circuitry.
> + The device implements the Open Alliance TC6 10BASE-T1x MAC-PHY
The device _tries_ to implements the Open Alliance TC6 10BASE-T1x MAC-PHY.
> +examples:
> + - |
> + #include <dt-bindings/interrupt-controller/irq.h>
> +
> + spi {
> + #address-cells = <1>;
> + #size-cells = <0>;
> +
> + ethernet@0 {
> + compatible = "adi,adin1140";
> + reg = <0>;
> + spi-max-frequency = <23000000>;
> +
> + interrupt-parent = <&gpio>;
> + interrupts = <6 IRQ_TYPE_EDGE_FALLING>;
Table 1: OPEN serial 10BASE-T1x Interface Pin Definition
IRQn MAC-PHY Interrupt Request (Active Low)
Or is this something else which the device gets wrong?
Andrew
^ permalink raw reply
* Re: [PATCH net-next v9 3/5] tls: Factor tls_strp_msg_release() from tls_strp_msg_done()
From: Jakub Kicinski @ 2026-05-03 1:09 UTC (permalink / raw)
To: Chuck Lever
Cc: John Fastabend, Sabrina Dubroca, Eric Dumazet, Simon Horman,
Paolo Abeni, netdev, kernel-tls-handshake, Chuck Lever,
Hannes Reinecke, Alistair Francis
In-Reply-To: <20260429-tls-read-sock-v9-3-39e71aa7810f@oracle.com>
On Wed, 29 Apr 2026 17:48:10 -0400 Chuck Lever wrote:
> -void tls_strp_msg_done(struct tls_strparser *strp)
> +/**
> + * tls_strp_msg_release - release the current strparser message
> + * @strp: TLS stream parser instance
> + *
> + * Release the current record without triggering a check for the
> + * next record. Callers must invoke tls_strp_check_rcv() before
> + * releasing the socket lock, or queued data will stall until
> + * the next tls_strp_data_ready() event.
> + */
Please respect local style - don't add kdoc on internal functions.
This is not exported, just add the "body" of the comment above
the function. Kdoc on internal functions is a waste of LOC and
it's easy to forget when adding arguments.
> +void tls_strp_msg_release(struct tls_strparser *strp)
release -> consume
In context of TLS we "release" a socket when we unlock it.
And we "consume" and skb when we free it. So "consume" matches
the semantics better, no?
^ permalink raw reply
* Re: [PATCH net] net: eth: fbnic: Fix addr validation in pcs write
From: Andrew Lunn @ 2026-05-03 1:10 UTC (permalink / raw)
To: Mike Marciniszyn
Cc: Simon Horman, Alexander Duyck, Jakub Kicinski, kernel-team,
Andrew Lunn, David S. Miller, Eric Dumazet, Paolo Abeni, netdev,
linux-kernel, stable
In-Reply-To: <afYxULoCOaL3pQkm@PF5YBGDS.localdomain>
> I am working inside Meta with Alex and Kuba. I noticed the one off when
> doing the patch that reworks the shim.
>
> As to a real impact, that depends on the part2 series, but before that
> series no one would care, which is why I had in as part of
> the patch 1 series.
>
> Without the follow on work, I suspect that no one cares or would
> see any issue as I have yet to present the xpcs changes in part2.
>
> Perhaps the best thing to do is beef up the commit and remove the
> stable Cc, leaving the Fixes linkage?
I'm not even sure you need the Fixes, if you say nothing is observable
broken. Just make it part of the patchset, for net-next, on going
development work.
Andrew
^ permalink raw reply
* Re: [PATCH net-next v9 4/5] tls: Suppress spurious saved_data_ready on all receive paths
From: Jakub Kicinski @ 2026-05-03 1:19 UTC (permalink / raw)
To: Chuck Lever
Cc: John Fastabend, Sabrina Dubroca, Eric Dumazet, Simon Horman,
Paolo Abeni, netdev, kernel-tls-handshake, Chuck Lever
In-Reply-To: <20260429-tls-read-sock-v9-4-39e71aa7810f@oracle.com>
On Wed, 29 Apr 2026 17:48:11 -0400 Chuck Lever wrote:
> -void tls_strp_check_rcv(struct tls_strparser *strp)
> +/**
> + * tls_strp_check_rcv - parse queued data and optionally notify
> + * @strp: TLS stream parser instance
> + * @wake: if true, fire consumer notification when a record is newly
> + * parsed by this call
> + *
> + * Returns immediately when a record is already ready; the wake fires
> + * only on transitions from no-record to record-ready. Callers that
> + * need to notify a waiter about a record parsed by another path
> + * should invoke tls_rx_msg_ready() directly.
> + */
nit/reminder: no kdoc
> +void tls_strp_check_rcv(struct tls_strparser *strp, bool wake)
I wonder if it'd make sense to s/wake/announce/ for consistency?
> {
> if (unlikely(strp->stopped) || strp->msg_ready)
> return;
>
> if (tls_strp_read_sock(strp) == -ENOMEM)
> queue_work(tls_strp_wq, &strp->work);
> + else if (wake && strp->msg_ready)
> + tls_rx_msg_ready(strp);
> }
> diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
> index c58d3b0b0a8a..cbb068266bab 100644
> --- a/net/tls/tls_sw.c
> +++ b/net/tls/tls_sw.c
> @@ -1383,7 +1383,11 @@ tls_rx_rec_wait(struct sock *sk, struct sk_psock *psock, bool nonblock,
> return ret;
>
> if (!skb_queue_empty(&sk->sk_receive_queue)) {
> - tls_strp_check_rcv(&ctx->strp);
> + /* Defer notification to the exit point;
> + * this thread will consume the record
> + * directly.
this line could be un-wrapped AFAICT
> + */
> + tls_strp_check_rcv(&ctx->strp, false);
> if (tls_strp_msg_ready(ctx))
> break;
> }
> @@ -1869,9 +1873,17 @@ static int tls_record_content_type(struct msghdr *msg, struct tls_msg *tlm,
> return 1;
> }
>
> -static void tls_rx_rec_done(struct tls_sw_context_rx *ctx)
> +/* Parse any data left in the lower socket and hand off a single
> + * notification to the next reader. tls_rx_msg_ready() is a no-op
> + * when the current record has already been announced, so paths
> + * that drained ctx->rx_list without touching the strparser do
> + * not re-fire saved_data_ready() for a record BH or the worker
> + * already announced.
> + */
> +static void tls_rx_handoff(struct tls_sw_context_rx *ctx)
> {
> - tls_strp_msg_done(&ctx->strp);
> + tls_strp_check_rcv(&ctx->strp, false);
> + tls_rx_msg_ready(&ctx->strp);
> }
>
> /* This function traverses the rx_list in tls receive context to copies the
> @@ -2152,7 +2164,7 @@ int tls_sw_recvmsg(struct sock *sk,
> err = tls_record_content_type(msg, tls_msg(darg.skb), &control);
> if (err <= 0) {
> DEBUG_NET_WARN_ON_ONCE(darg.zc);
> - tls_rx_rec_done(ctx);
> + tls_strp_msg_release(&ctx->strp);
> put_on_rx_list_err:
> __skb_queue_tail(&ctx->rx_list, darg.skb);
> goto recv_end;
> @@ -2166,7 +2178,8 @@ int tls_sw_recvmsg(struct sock *sk,
> /* TLS 1.3 may have updated the length by more than overhead */
> rxm = strp_msg(darg.skb);
> chunk = rxm->full_len;
> - tls_rx_rec_done(ctx);
> + tls_strp_msg_release(&ctx->strp);
> + tls_strp_check_rcv(&ctx->strp, false);
>
> if (!darg.zc) {
> bool partially_consumed = chunk > len;
> @@ -2260,6 +2273,7 @@ int tls_sw_recvmsg(struct sock *sk,
> copied += decrypted;
>
> end:
> + tls_rx_handoff(ctx);
> tls_rx_reader_unlock(sk, ctx);
> if (psock)
> sk_psock_put(sk, psock);
> @@ -2300,7 +2314,7 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos,
> if (err < 0)
> goto splice_read_end;
>
> - tls_rx_rec_done(ctx);
> + tls_strp_msg_release(&ctx->strp);
> skb = darg.skb;
> }
>
> @@ -2327,6 +2341,7 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos,
> consume_skb(skb);
>
> splice_read_end:
> + tls_rx_handoff(ctx);
I don't get why the tls_rx_handoff() thing exists, TBH
Maybe it made sense in the context of the code which is no longer part
of the series. But without it it looks pretty odd. Fells like you should
simply be suppressing notifications when tls_strp_check_rcv() is called
by tls_rx_rec_done() and then tls_rx_reader_release() should make sure
it flushes the ->data_ready if it's exiting on a read && !announced
condition. In rcvmsg() path you're now calling tls_strp_check_rcv()
twice.
> tls_rx_reader_unlock(sk, ctx);
> return copied ? : err;
>
> @@ -2392,7 +2407,7 @@ int tls_sw_read_sock(struct sock *sk, read_descriptor_t *desc,
> tlm = tls_msg(skb);
> decrypted += rxm->full_len;
>
> - tls_rx_rec_done(ctx);
> + tls_strp_msg_release(&ctx->strp);
> }
>
> /* read_sock does not support reading control messages */
> @@ -2420,6 +2435,7 @@ int tls_sw_read_sock(struct sock *sk, read_descriptor_t *desc,
> }
>
> read_sock_end:
> + tls_rx_handoff(ctx);
> tls_rx_reader_release(sk, ctx);
> return copied ? : err;
>
> @@ -2504,10 +2520,18 @@ int tls_rx_msg_size(struct tls_strparser *strp, struct sk_buff *skb)
> return ret;
> }
>
> +/* Fire saved_data_ready() at most once per parsed record.
> + * msg_announced is cleared by tls_strp_msg_release() when the
> + * current record is consumed, arming the next announcement.
> + */
> void tls_rx_msg_ready(struct tls_strparser *strp)
Given the change to the semantics maybe this should be named
tls_rx_msg_maybe_announce() or _flush_announce() now ?
> {
> struct tls_sw_context_rx *ctx;
>
> + if (!READ_ONCE(strp->msg_ready) || strp->msg_announced)
> + return;
> + strp->msg_announced = 1;
> +
> ctx = container_of(strp, struct tls_sw_context_rx, strp);
> ctx->saved_data_ready(strp->sk);
> }
>
^ permalink raw reply
* Re: [PATCH net-next v9 1/5] tls: Abort the connection on decrypt failure
From: Jakub Kicinski @ 2026-05-03 1:20 UTC (permalink / raw)
To: Chuck Lever
Cc: John Fastabend, Sabrina Dubroca, Eric Dumazet, Simon Horman,
Paolo Abeni, netdev, kernel-tls-handshake, Chuck Lever,
Hannes Reinecke
In-Reply-To: <20260429-tls-read-sock-v9-1-39e71aa7810f@oracle.com>
On Wed, 29 Apr 2026 17:48:08 -0400 Chuck Lever wrote:
> Subject: [PATCH net-next v9 1/5] tls: Abort the connection on decrypt failure
I was gonna apply this one but the subject gives me pause.
It really oversells what this trivial refactor does..
^ permalink raw reply
* Re: [PATCH net 4/7] net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
From: Jakub Kicinski @ 2026-05-03 1:26 UTC (permalink / raw)
To: Sabrina Dubroca
Cc: davem, netdev, edumazet, pabeni, andrew+netdev, horms, bpf,
john.fastabend, linux-kselftest, 钱一铭, daniel,
jonathan.lemon
In-Reply-To: <afTXe_kAumf2vjvE@krikkit>
On Fri, 1 May 2026 18:40:27 +0200 Sabrina Dubroca wrote:
> > - MAX_SKB_FRAGS - msg_pl->sg.start + 1,
> > + NR_MSG_FRAG_IDS - msg_pl->sg.start + 1,
> > msg_pl->sg.data);
>
> And get rid of the [start] / NR - start dance to make this code a bit
> clearer?
Heh, yes. In hindsight that is quite a silly construct..
Let me apply the first 2 since the first fix is trivial and hopefully
find some time to check what Sashiko was saying some time this well.
^ permalink raw reply
* Re: [PATCH net-next V2 7/7] net/mlx5: Add profile to auto-enable switchdev mode at device init
From: Jakub Kicinski @ 2026-05-03 1:41 UTC (permalink / raw)
To: Mark Bloch
Cc: Tariq Toukan, Eric Dumazet, Paolo Abeni, Andrew Lunn,
David S. Miller, Leon Romanovsky, Jason Gunthorpe, Saeed Mahameed,
Shay Drory, Or Har-Toov, Edward Srouji, Maher Sanalla,
Simon Horman, Gerd Bayer, Moshe Shemesh, Kees Cook,
Patrisious Haddad, Parav Pandit, Carolina Jubran, Cosmin Ratiu,
linux-rdma, linux-kernel, netdev, Gal Pressman, Dragos Tatulea
In-Reply-To: <421e8885-5849-4390-8956-9bc344fa0bf0@nvidia.com>
On Sat, 2 May 2026 23:08:43 +0300 Mark Bloch wrote:
> Before I respin for the unrelated MR_CACHE cleanup, I’d like to confirm
> whether the opt-in profile approach is acceptable at all. Regardless
> of this last patch, the first 6 patches fix real representor/LAG locking
> issues and are needed independently, so I’d like to keep those moving toward
> acceptance as soon as possible.
For probe-time config module param is probably our only option.
I'd obviously prefer to have a devlink-level knob for this, instead
of a mlx5 specific one. Can we come up with some format that'd apply
more broadly? devlink=[$bfd:]flag1 ? so devlink=[$bdf:]switchdev-mode ?
BTW looks like issues Sashiko/Claude finds are slightly different,
let me send them out.
^ permalink raw reply
* Re: [PATCH net-next V2 4/7] net/mlx5: E-Switch, serialize representor lifecycle
From: Jakub Kicinski @ 2026-05-03 1:42 UTC (permalink / raw)
To: tariqt
Cc: Jakub Kicinski, edumazet, pabeni, andrew+netdev, davem, leon, jgg,
saeedm, mbloch, shayd, ohartoov, edwards, msanalla, horms, gbayer,
moshe, kees, phaddad, parav, cjubran, cratiu, linux-rdma,
linux-kernel, netdev, gal, dtatulea
In-Reply-To: <20260501041633.231662-5-tariqt@nvidia.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
---
net/mlx5: E-Switch, serialize representor lifecycle
This change replaces the ad-hoc bit/wait-queue coordination of E-Switch
representor lifecycle with the per-E-Switch reps_lock, adds nested
wrappers for the shared-FDB master IB path, and clears the rep_ops
pointer on unregister.
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
> index 66a773a99876..f70737437954 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
[ ... ]
> @@ -1825,7 +1831,11 @@ void mlx5_eswitch_disable(struct mlx5_eswitch *esw)
>
> devl_assert_locked(priv_to_devlink(esw->dev));
> mlx5_lag_disable_change(esw->dev);
> +
> + mlx5_esw_reps_block(esw);
> mlx5_eswitch_disable_locked(esw);
> + mlx5_esw_reps_unblock(esw);
> +
> esw->mode = MLX5_ESWITCH_LEGACY;
> mlx5_lag_enable_change(esw->dev);
> }
The commit message says "Take the representor lock around the mode
transition", but the assignment esw->mode = MLX5_ESWITCH_LEGACY happens
here after reps_lock has been dropped.
Meanwhile mlx5_eswitch_unregister_vport_reps_blocked() now reads
esw->mode under reps_lock to decide whether to call
__unload_reps_all_vport():
if (esw->mode == MLX5_ESWITCH_OFFLOADS)
__unload_reps_all_vport(esw, rep_type);
Should the mode store be moved inside the reps_block/reps_unblock
region so the reader's assumption about stability under reps_lock
holds?
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
> index 6a5143b63dfd..d4ac07c995b9 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
[ ... ]
> @@ -2425,21 +2436,22 @@ void mlx5_esw_reps_unblock(struct mlx5_eswitch *esw)
>
> static void esw_mode_change(struct mlx5_eswitch *esw, u16 mode)
> {
> + mlx5_esw_reps_unblock(esw);
> mlx5_devcom_comp_lock(esw->dev->priv.hca_devcom_comp);
> if (esw->dev->priv.flags & MLX5_PRIV_FLAGS_DISABLE_IB_ADEV ||
> mlx5_core_mp_enabled(esw->dev)) {
> esw->mode = mode;
> - mlx5_rescan_drivers_locked(esw->dev);
> - mlx5_devcom_comp_unlock(esw->dev->priv.hca_devcom_comp);
> - return;
> + goto out;
> }
>
> esw->dev->priv.flags |= MLX5_PRIV_FLAGS_DISABLE_IB_ADEV;
> mlx5_rescan_drivers_locked(esw->dev);
> esw->mode = mode;
> esw->dev->priv.flags &= ~MLX5_PRIV_FLAGS_DISABLE_IB_ADEV;
> +out:
> mlx5_rescan_drivers_locked(esw->dev);
> mlx5_devcom_comp_unlock(esw->dev->priv.hca_devcom_comp);
> + mlx5_esw_reps_block(esw);
> }
Both assignments to esw->mode in this function are reached after
reps_lock has been dropped at the top of the function.
mlx5_rescan_drivers_locked() can invoke driver bind/unbind which routes
through mlx5_eswitch_unregister_vport_reps(), and that path now takes
reps_lock and reads esw->mode to decide whether to call
__unload_reps_all_vport().
Can a rep-unregister that runs during the rescan observe a stale
esw->mode here and make the wrong unload decision?
[ ... ]
> @@ -4496,9 +4524,10 @@ mlx5_eswitch_vport_has_rep(const struct mlx5_eswitch *esw, u16 vport_num)
[ ... ]
> @@ -4525,9 +4585,35 @@ void mlx5_eswitch_unregister_vport_reps(struct mlx5_eswitch *esw, u8 rep_type)
>
> mlx5_esw_for_each_rep(esw, i, rep)
> atomic_set(&rep->rep_data[rep_type].state, REP_UNREGISTERED);
> +
> + esw->offloads.rep_ops[rep_type] = NULL;
> +}
This new NULL store on unregister appears to introduce a concurrent
NULL dereference in readers that do not hold reps_lock. Before this
patch, rep_ops[rep_type] was set once at register and never cleared,
so a REP_LOADED state check was sufficient to know the pointer was
valid.
mlx5_eswitch_get_proto_dev() is one such reader:
rep = mlx5_eswitch_get_rep(esw, vport);
if (atomic_read(&rep->rep_data[rep_type].state) == REP_LOADED &&
esw->offloads.rep_ops[rep_type]->get_proto_dev)
return esw->offloads.rep_ops[rep_type]->get_proto_dev(rep);
The state check and each pointer load here are independent reads. Can
a concurrent unregister on another CPU run between the state load and
the ->get_proto_dev dereference, transitioning the rep through
REP_REGISTERED/REP_UNREGISTERED and then storing NULL into rep_ops,
so the second load observes NULL?
mlx5_esw_offloads_rep_event_unpair() and mlx5_esw_offloads_pair() have
the same shape:
ops = esw->offloads.rep_ops[rep_type];
if (atomic_read(&rep->rep_data[rep_type].state) == REP_LOADED &&
ops->event)
ops->event(esw, rep, ...);
Neither path holds reps_lock; they run from the devcom PAIR/UNPAIR
event handler. Can ops be NULL here once an unregister has cleared
rep_ops?
If readers are expected to be safe, should they either take reps_lock,
be converted to RCU, or skip the NULL clear on unregister?
[ ... ]
--
pw-bot: cr
^ permalink raw reply
* Re: [PATCH net-next V2 6/7] net/mlx5: E-switch, load reps via work queue after registration
From: Jakub Kicinski @ 2026-05-03 1:42 UTC (permalink / raw)
To: tariqt
Cc: Jakub Kicinski, edumazet, pabeni, andrew+netdev, davem, leon, jgg,
saeedm, mbloch, shayd, ohartoov, edwards, msanalla, horms, gbayer,
moshe, kees, phaddad, parav, cjubran, cratiu, linux-rdma,
linux-kernel, netdev, gal, dtatulea
In-Reply-To: <20260501041633.231662-7-tariqt@nvidia.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
---
net/mlx5: E-switch, load reps via work queue after registration
This change defers loading of newly registered representors to the
E-Switch work queue so the handler can acquire the devlink lock that is
not held by the auxiliary driver registration context. The unregister
path continues to unload representors synchronously.
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
> index 8f656253981b..f26d1652dd05 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
> @@ -4563,6 +4563,38 @@ mlx5_eswitch_register_vport_reps_blocked(struct mlx5_eswitch *esw,
[ ... ]
> +static void mlx5_eswitch_reload_reps(struct mlx5_eswitch *esw)
> +{
> + mlx5_esw_reps_block(esw);
> + mlx5_eswitch_reload_reps_blocked(esw);
> + mlx5_esw_reps_unblock(esw);
> +}
> +
> static void
> mlx5_eswitch_register_vport_reps_locked(struct mlx5_eswitch *esw,
> const struct mlx5_eswitch_rep_ops *ops,
> @@ -4574,6 +4606,8 @@ mlx5_eswitch_register_vport_reps_locked(struct mlx5_eswitch *esw,
> mlx5_esw_reps_block(esw);
> mlx5_eswitch_register_vport_reps_blocked(esw, ops, rep_type);
> mlx5_esw_reps_unblock(esw);
> +
> + mlx5_esw_add_work(esw, mlx5_eswitch_reload_reps);
The return value of mlx5_esw_add_work() is discarded here.
Looking at mlx5_esw_add_work():
static int mlx5_esw_add_work(struct mlx5_eswitch *esw,
void (*func)(struct mlx5_eswitch *esw))
{
struct mlx5_host_work *host_work;
host_work = kzalloc_obj(*host_work, GFP_ATOMIC);
if (!host_work)
return -ENOMEM;
...
}
the allocation is GFP_ATOMIC and can fail, in which case no work is
queued.
If mlx5_esw_add_work() returns -ENOMEM while the E-Switch is already in
MLX5_ESWITCH_OFFLOADS mode, the reload that mlx5_eswitch_reload_reps()
was meant to perform never runs, so the newly registered rep type will
not be loaded for the already-enabled vports — which is the exact case
this commit is introducing infrastructure to handle.
Registration still returns success to the auxiliary driver
(mlx5e_rep_probe / mlx5r_rep_probe), with no log message, no retry, and
no way for the caller to notice the dropped reload.
The other existing caller, mlx5_esw_funcs_changed_handler(), does check
the return value of mlx5_esw_add_work(), suggesting allocation failure
is expected to be handled.
Should this call check the return value and at least emit a warning or
retry, so that a GFP_ATOMIC allocation failure during switchdev-mode
registration does not silently leave the representors unloaded?
> }
>
> void mlx5_eswitch_register_vport_reps(struct mlx5_eswitch *esw,
^ permalink raw reply
* Re: [PATCH net-next 3/3] net/mlx5: Add VHCA_ID page management mode support
From: Jakub Kicinski @ 2026-05-03 1:45 UTC (permalink / raw)
To: tariqt
Cc: Jakub Kicinski, edumazet, pabeni, andrew+netdev, davem, saeedm,
leon, mbloch, moshe, agoldberger, netdev, linux-rdma,
linux-kernel, gal, dtatulea
In-Reply-To: <20260501044156.260875-4-tariqt@nvidia.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
---
net/mlx5: Add VHCA_ID page management mode support
This change adds a VHCA_ID-based page management mode that uses vhca_id
instead of function_id as the effective function identifier when the
firmware advertises icm_mng_function_id_mode. Boot pages keep FUNC_ID
semantics for backward compatibility, and tracked pages are migrated to
the vhca_id key after set_hca_cap().
A few questions below on the per-type counter accounting, the boot-page
migration helper, and locking on the FW-driven page path.
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
> index e0eafcf0c52a..d3eaefc5c0e0 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
> @@ -852,6 +852,48 @@ bool mlx5_esw_vport_vhca_id(struct mlx5_eswitch *esw, u16 vportn, u16 *vhca_id)
> return true;
> }
>
> +u16 mlx5_esw_vhca_id_to_func_type(struct mlx5_core_dev *dev, u16 vhca_id)
> +{
> + struct mlx5_eswitch *esw = dev->priv.eswitch;
> + struct mlx5_vport *vport;
> + unsigned long i;
> + u16 type;
> +
> + if (vhca_id == MLX5_CAP_GEN(dev, vhca_id))
> + return MLX5_SELF;
> +
> + if (!esw)
> + return MLX5_FUNC_TYPE_NONE;
> +
> + mutex_lock(&esw->state_lock);
This function is reached from give_pages()/reclaim_pages()/
release_all_pages() via func_vhca_id_to_type(), which in turn runs
from the pg_wq work handler triggered by firmware page-request EQE
events. Does acquiring esw->state_lock on that path introduce a new
lock dependency?
Several eswitch paths (for example mlx5_esw_vport_enable(),
mlx5_esw_vport_disable(), mlx5_eswitch_set_vport_mac()) hold
state_lock while synchronously issuing firmware commands. Before this
patch, the page path held no eswitch locks.
Would it be safer to resolve the func_type outside of state_lock, for
example by caching the vhca_id-to-type mapping separately, or by
attaching the resolved type to the fw_page at give time so reclaim
does not need to look it up again?
> + mlx5_esw_for_each_vport(esw, i, vport) {
> + if (vport->vhca_id != vhca_id)
> + continue;
> +
> + if (vport->vport == MLX5_VPORT_HOST_PF) {
> + type = MLX5_HOST_PF;
> + goto unlock;
> + }
> +
> + if (xa_get_mark(&esw->vports, i, MLX5_ESW_VPT_SF)) {
> + type = MLX5_SF;
> + goto unlock;
> + }
> +
> + if (xa_get_mark(&esw->vports, i, MLX5_ESW_VPT_VF)) {
> + type = MLX5_VF;
> + goto unlock;
> + }
> +
> + type = MLX5_EC_VF;
> + goto unlock;
Can this fall-through misattribute counters?
If a matching vport is not HOST_PF and has neither the VPT_SF nor the
VPT_VF mark, it is unconditionally classified as MLX5_EC_VF. Would an
UPLINK, ECPF, manager, or adjacent-style vport whose vhca_id happens
to match end up charged to the EC_VF bucket here?
> + }
> + type = MLX5_FUNC_TYPE_NONE;
> +unlock:
> + mutex_unlock(&esw->state_lock);
> + return type;
> +}
> +
[ ... ]
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
> index a242053f3a58..52cf341ad6b3 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
> @@ -597,6 +597,9 @@ static int handle_hca_cap(struct mlx5_core_dev *dev, void *set_ctx)
> if (MLX5_CAP_GEN_MAX(dev, release_all_pages))
> MLX5_SET(cmd_hca_cap, set_hca_cap, release_all_pages, 1);
>
> + if (MLX5_CAP_GEN_MAX(dev, icm_mng_function_id_mode))
> + MLX5_SET(cmd_hca_cap, set_hca_cap, icm_mng_function_id_mode, 1);
> +
[ ... ]
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
> index 77ffa31cc505..7ebe88aa3b3e 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
[ ... ]
> @@ -89,12 +105,21 @@ static u16 func_id_to_type(struct mlx5_core_dev *dev, u16 func_id, bool ec_funct
> return MLX5_SF;
> }
>
> +static u16 func_vhca_id_to_type(struct mlx5_core_dev *dev, u16 func_vhca_id,
> + bool ec_function)
> +{
> + if (mlx5_page_mgt_mode_is_vhca_id(dev))
> + return mlx5_esw_vhca_id_to_func_type(dev, func_vhca_id);
> +
> + return func_id_to_type(dev, func_vhca_id, ec_function);
> +}
Can the give/reclaim accounting become asymmetric in VHCA_ID mode?
The per-type counters are only updated when the resolved type is not
MLX5_FUNC_TYPE_NONE:
func_type = func_vhca_id_to_type(dev, func_vhca_id, ec_function);
if (func_type != MLX5_FUNC_TYPE_NONE)
dev->priv.page_counters[func_type] += npages;
Since mlx5_esw_vhca_id_to_func_type() walks the eswitch vport table
dynamically on every call, can the give and the corresponding reclaim
resolve to different types?
For example, if a give runs before vport->vhca_id is populated in
mlx5_esw_vport_caps_get(), the lookup returns MLX5_FUNC_TYPE_NONE and
the counter is not incremented. Later, when the vport is fully
populated, reclaim resolves to a real type and decrements the counter
below the amount ever added, which on a u32 drives it to a very large
value.
Similarly, if a vport is removed before reclaim, the increment at
give time is recorded but the decrement at reclaim is skipped, so the
counter leaks upward.
Would caching the func_type on the fw_page at give time and reusing
it on reclaim make the accounting symmetric by construction?
[ ... ]
> @@ -658,30 +708,101 @@ static int req_pages_handler(struct notifier_block *nb,
> * req->npages (and not min ()).
> */
> req->npages = max_t(s32, npages, MAX_RECLAIM_NPAGES);
> - req->ec_function = ec_function;
> + if (!mlx5_page_mgt_mode_is_vhca_id(dev))
> + req->ec_function = ec_function;
> req->release_all = release_all;
> INIT_WORK(&req->work, pages_work_handler);
> queue_work(dev->priv.pg_wq, &req->work);
> return NOTIFY_OK;
> }
>
> +/*
> + * After set_hca_cap(), the second satisfy_startup_pages(dev, 0) may see
> + * VHCA_ID mode. If page_root_xa already has the PF entry from the first
> + * (boot) call under FUNC_ID keys 0 or (ec_function << 16), migrate that
> + * entry to the device vhca_id key so lookups use VHCA_ID semantics.
> + */
> +static int mlx5_pagealloc_migrate_pf_to_vhca_id(struct mlx5_core_dev *dev)
> +{
> + u32 vhca_id_key, old_key;
> + struct rb_root *root;
> + struct fw_page *fwp;
> + struct rb_node *p;
> + bool ec_function;
> + int err;
> +
> + if (xa_empty(&dev->priv.page_root_xa))
> + return 0;
> +
> + vhca_id_key = MLX5_CAP_GEN(dev, vhca_id);
> + ec_function = mlx5_core_is_ecpf(dev);
> +
> + old_key = ec_function ? (1U << 16) : 0;
> + root = xa_load(&dev->priv.page_root_xa, old_key);
> + if (!root)
> + return 0;
Does this assume the boot-path func_vhca_id was always 0?
The boot call to mlx5_cmd_query_pages() reads func_vhca_id directly
from the firmware output, and give_pages() then uses that value to
compute the key. The migration here instead hardcodes old_key as
ec_function ? (1U << 16) : 0.
If firmware returned a non-zero boot function_id, xa_load(old_key)
returns NULL, the function silently returns 0, the caller flips the
mode to VHCA_ID, and the original rb_root is orphaned in page_root_xa
under the old key. Subsequent free_fwp()/find_fw_page() paths would
then hit WARN_ON_ONCE(!root) and leak the DMA mappings and pages.
Would it be more robust to look up the actual key used at boot
(derived from the stored func_vhca_id), and to treat the "xa not
empty but old_key absent" case as an invariant violation rather than
silently succeeding?
> +
> + if (old_key == vhca_id_key)
> + return 0;
> +
> + err = xa_insert(&dev->priv.page_root_xa, vhca_id_key, root, GFP_KERNEL);
> + if (err) {
> + mlx5_core_warn(dev,
> + "failed to migrate page root key 0x%x to vhca_id 0x%x\n",
> + old_key, vhca_id_key);
> + return err;
> + }
> +
> + xa_erase(&dev->priv.page_root_xa, old_key);
> +
> + for (p = rb_first(root); p; p = rb_next(p)) {
> + fwp = rb_entry(p, struct fw_page, rb_node);
> + fwp->function = vhca_id_key;
> + }
Is the ordering here safe against any concurrent free_fwp()?
Between xa_erase(old_key) and the loop that updates fwp->function,
every fw_page still carries the old key while page_root_xa no longer
resolves it. If a free_fwp() were to run in that window:
root = xa_load(&dev->priv.page_root_xa, fwp->function);
if (WARN_ON_ONCE(!root))
return;
it would return early, skipping dma_unmap_page(), __free_page(), and
kfree(fwp), leaking the DMA mapping and the backing page.
No concurrent free path is structurally reachable today because this
runs before the EQ notifier is registered in mlx5_pagealloc_start(),
but would it be cleaner to update the fwp->function values first,
then swap the xarray entries (or store the new value at a single key)
so the two views cannot disagree?
> +
> + return 0;
> +}
> +
> int mlx5_satisfy_startup_pages(struct mlx5_core_dev *dev, int boot)
> {
> - u16 func_id;
> + bool ec_function = false;
> + u16 func_vhca_id;
> s32 npages;
> int err;
>
> - err = mlx5_cmd_query_pages(dev, &func_id, &npages, boot);
> + /* When boot flag is set, the icm_mng_function_id_mode capability is
> + * not yet set (only set after set_hca_cap()), so use FUNC_ID mode
> + * for backward compatibility. When boot is false, set mode from
> + * cap (set_hca_cap has run successfully).
> + */
> + if (boot) {
> + mlx5_page_mgt_mode_set(dev, MLX5_PAGE_MGT_MODE_FUNC_ID);
> + } else {
> + if (MLX5_CAP_GEN_MAX(dev, icm_mng_function_id_mode) ==
> + MLX5_ID_MODE_FUNCTION_VHCA_ID) {
The comment just above says "set mode from cap (set_hca_cap has run
successfully)", which reads as "use the current/negotiated cap value",
but the check uses MLX5_CAP_GEN_MAX rather than MLX5_CAP_GEN. The
sibling code in drivers/net/ethernet/mellanox/mlx5/core/debugfs.c uses
MLX5_CAP_GEN(dev, icm_mng_function_id_mode) for the same semantic
check.
Could the comment and the _MAX usage be made consistent? If anyone
later adds a conditional around the MLX5_SET() in handle_hca_cap()
(for example a module parameter), the driver would start flipping to
VHCA_ID mode based on _MAX without actually having enabled the feature
in firmware.
> + err = mlx5_pagealloc_migrate_pf_to_vhca_id(dev);
> + if (err)
> + return err;
> + mlx5_page_mgt_mode_set(dev, MLX5_PAGE_MGT_MODE_VHCA_ID);
> + }
> + }
Once page_mgt_mode is flipped to MLX5_PAGE_MGT_MODE_VHCA_ID, it stays
set in dev->priv and is only reset on the next boot=1 call. Between
teardown and the next boot=1 path (for example during health
recovery, PCI reset, or any async flow that runs page work before
mlx5_satisfy_startup_pages(dev, 1) re-runs), would a FW page-request
EQE observe a stale mode?
The req_pages EQ notifier is registered via mlx5_pagealloc_start()
and unregistered via mlx5_pagealloc_stop(), so this is not reachable
today, but would it be worth resetting the mode explicitly on the
teardown side rather than relying on the next reinit?
[ ... ]
> @@ -751,6 +874,9 @@ int mlx5_reclaim_startup_pages(struct mlx5_core_dev *dev)
> WARN(dev->priv.fw_pages,
> "FW pages counter is %d after reclaiming all pages\n",
> dev->priv.fw_pages);
> + if (mlx5_page_mgt_mode_is_vhca_id(dev) && !dev->priv.eswitch)
> + return 0;
> +
Does this guard address the asymmetric-counter case raised above?
It only skips the per-type WARNs when the eswitch is entirely absent.
In the common case where the eswitch is present but a vport's
vhca_id/marks change between give and reclaim, the counters can still
drift and these WARNs would still fire on normal teardown paths.
[ ... ]
^ permalink raw reply
* Re: [PATCH net-next 3/3] net/mlx5: Add VHCA_ID page management mode support
From: Jakub Kicinski @ 2026-05-03 1:45 UTC (permalink / raw)
To: tariqt
Cc: Jakub Kicinski, edumazet, pabeni, andrew+netdev, davem, saeedm,
leon, mbloch, moshe, agoldberger, netdev, linux-rdma,
linux-kernel, gal, dtatulea
In-Reply-To: <20260501044156.260875-4-tariqt@nvidia.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
---
Subject: net/mlx5: Add VHCA_ID page management mode support
This commit adds support for VHCA_ID-based page management mode. It
updates page management commands to conditionally use vhca_id and adds
a function to resolve the function type via vport lookup.
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
> --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
> @@ -852,6 +852,48 @@ bool mlx5_esw_vport_vhca_id(struct mlx5_eswitch *esw, u16 vportn, u16 *vhca_id)
> return true;
> }
>
> +u16 mlx5_esw_vhca_id_to_func_type(struct mlx5_core_dev *dev, u16 vhca_id)
> +{
> + struct mlx5_eswitch *esw = dev->priv.eswitch;
> + struct mlx5_vport *vport;
> + unsigned long i;
> + u16 type;
> +
> + if (vhca_id == MLX5_CAP_GEN(dev, vhca_id))
> + return MLX5_SELF;
> +
> + if (!esw)
> + return MLX5_FUNC_TYPE_NONE;
> +
> + mutex_lock(&esw->state_lock);
Can this race with driver unload?
Since the page allocator workqueue (pg_wq) is asynchronous and destroyed
after the eswitch structure is freed, could a pending page request evaluate
esw as valid just before it's freed, and then attempt to lock it here?
Also, is there a potential deadlock when acquiring esw->state_lock here?
If a thread holds the lock while sending a firmware command, and the
firmware issues a page request to complete it, the pg_wq worker will block
here waiting for the lock. Would this prevent the firmware command from
completing?
[ ... ]
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
> --- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
[ ... ]
> -static int give_pages(struct mlx5_core_dev *dev, u16 func_id, int npages,
> +static int give_pages(struct mlx5_core_dev *dev, u16 func_vhca_id, int npages,
> int event, bool ec_function)
> {
> - u32 function = get_function(func_id, ec_function);
> + u32 function = get_function_key(dev, func_vhca_id, ec_function);
> u32 out[MLX5_ST_SZ_DW(manage_pages_out)] = {0};
> int inlen = MLX5_ST_SZ_BYTES(manage_pages_in);
This isn't a new issue introduced by this patch, but does the npages
calculation risk an integer overflow?
The npages parameter is derived from the firmware payload, and the
allocation size is calculated as:
inlen += npages * MLX5_FLD_SZ_BYTES(manage_pages_in, pas[0]);
If a compromised firmware provides a massive npages value, could this
overflow the 32-bit inlen and result in an undersized kvzalloc allocation,
followed by an out-of-bounds write in the subsequent loop?
[ ... ]
> @@ -577,8 +626,9 @@ static int reclaim_pages(struct mlx5_core_dev *dev, u16 func_id, int npages,
> if (nclaimed)
> *nclaimed = num_claimed;
>
> - func_type = func_id_to_type(dev, func_id, ec_function);
> - dev->priv.page_counters[func_type] -= num_claimed;
> + func_type = func_vhca_id_to_type(dev, func_vhca_id, ec_function);
> + if (func_type != MLX5_FUNC_TYPE_NONE)
> + dev->priv.page_counters[func_type] -= num_claimed;
Does this dynamically look up the vport during page reclaim?
If an SF or VF has been destroyed and its vport removed, the lookup will
return MLX5_FUNC_TYPE_NONE. Will this cause the decrement to be skipped,
leading to a counter leak and triggering the WARN() statements in
mlx5_reclaim_startup_pages() during driver unload?
[ ... ]
> @@ -658,30 +708,101 @@ static int req_pages_handler(struct notifier_block *nb,
[ ... ]
> + } else {
> + if (MLX5_CAP_GEN_MAX(dev, icm_mng_function_id_mode) ==
> + MLX5_ID_MODE_FUNCTION_VHCA_ID) {
> + err = mlx5_pagealloc_migrate_pf_to_vhca_id(dev);
> + if (err)
> + return err;
> + mlx5_page_mgt_mode_set(dev, MLX5_PAGE_MGT_MODE_VHCA_ID);
> + }
> + }
What happens to the device state if mlx5_pagealloc_migrate_pf_to_vhca_id()
fails?
The firmware has already been instructed to use VHCA_ID mode during driver
load, but if the migration fails, the function returns early and leaves
dev->priv.page_mgt_mode as FUNC_ID.
When the initialization aborts and mlx5_reclaim_startup_pages() runs, will
the driver send reclaim commands using the old ID, causing the firmware
to reject them and leak the allocated DMA memory?
^ permalink raw reply
* Re: [PATCH net-next 09/12] gpio: tc956x: add TC956x/QPS615 support
From: Alex Elder @ 2026-05-03 1:45 UTC (permalink / raw)
To: Andrew Lunn
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh, daniel, mohd.anwar, a0987203069,
alexandre.torgue, ast, boon.khai.ng, chenchuangyu, chenhuacai,
daniel, hawk, hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <736fb3b7-c88a-4ec4-96ad-d1b79cc48d30@lunn.ch>
On 5/1/26 1:36 PM, Andrew Lunn wrote:
>> + * There is a TC956X PCI power controller driver that accesses the
>> + * direction and output value registers for GPIOs 2 and 3. These
>> + * GPIOs control the reset signal for the two downstream PCIe ports.
>> + * Their values will never change during operation of this driver, and
>> + * this driver reserves these two GPIOS.
>
> Why doesn't this power controller driver actually use this driver to
> control the GPIOs? Chicken/egg?
I am not the one with authority on this, but yes, that's my
understanding. *Something* about this chip requires that the
PCIe ports need to have some configuration done on them *before*
PCIe is powered up. So that driver uses the I2C interface to
apply these settings. Meanwhile this driver uses the PCIe-mapped
memory to manage the GPIO registers.
> Maybe add a comment why gpio-regmap.c cannot be used. You probably
> need to instantiate it twice, but i still think you will end up with
> less code.
It's possible gpio-regmap.c *could* be used. We started with
vendor code and this code got separated at some point along
the way. It was working, and I don't think I pursued other
options at that point. I'll look at this possibility before we
send out the next version.
What do you mean instantiate it twice?
-Alex
>
> Andrew
^ permalink raw reply
* Re: [PATCH net-next 11/12] misc: tc956x_pci: add TC956x/QPS615 support
From: Alex Elder @ 2026-05-03 2:06 UTC (permalink / raw)
To: Andrew Lunn
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, maxime.chevallier,
rmk+kernel, andersson, konradybcio, robh, krzk+dt, conor+dt,
linusw, brgl, arnd, gregkh, daniel, mohd.anwar, a0987203069,
alexandre.torgue, ast, boon.khai.ng, chenchuangyu, chenhuacai,
daniel, hawk, hkallweit1, inochiama, john.fastabend, julianbraha,
livelycarpet87, matthew.gerlach, mcoquelin.stm32, me,
prabhakar.mahadev-lad.rj, richardcochran, rohan.g.thomas, sdf,
siyanteng, weishangjuan, wens, netdev, bpf, linux-arm-msm,
devicetree, linux-gpio, linux-stm32, linux-arm-kernel,
linux-kernel
In-Reply-To: <f9336d01-e2d1-4894-848a-17ab20976872@lunn.ch>
On 5/1/26 4:07 PM, Andrew Lunn wrote:
>> diff --git a/drivers/misc/tc956x_pci.c b/drivers/misc/tc956x_pci.c
>
>> +static inline void chip_reset_assert(const struct tc956x_chip *chip,
>> + enum reset_id id)
>> +{
>> + tc956x_reset_clock_set(chip, true, true, true, (u8)id);
>> +}
>
> This is in drivers/misc, where the rules might be different. But in
> netdev, we don't like inline functions in .c files. It is better to
> let the compiler decide.
That was a mistake. I agree with that perspective. These functions
were moved out of the header file because they were only used here.
And in the process, I neglected to drop the inline. Will fix.
>> +static void chip_init_state(struct tc956x_chip *chip)
>> +{
>> + /* The only IP block we currently use is MSIGEN */
>> + chip_reset_assert(chip, RESET_MCU);
>> + chip_reset_assert(chip, RESET_MCU1);
>> + chip_reset_assert(chip, RESET_INTC);
>> + chip_reset_assert(chip, RESET_UART0);
>> + chip_clock_disable(chip, CLOCK_MCU);
>> + chip_clock_disable(chip, CLOCK_SRAM);
>> + chip_clock_disable(chip, CLOCK_PLL);
>> + chip_clock_disable(chip, CLOCK_SGMII);
>
> With my networking hat on, this one standard out.
>
>> + chip_clock_disable(chip, CLOCK_REFCLK);
>
> The name REFCLK is sometimes used as for the clock signals for RGMII?
You're saying that the REFCLK disable stood out, and you want to
understand what "REFCLK" actually represents?
I believe this is an *output* reference clock signal generated by the
TC9564. Looking at the schematic for the RB3gen2 it leads only to
a test point.
However I want to compare notes with Daniel on Monday about this.
Would it draw less attention if it were named "REFCLKO"?
In any case we can add some reassuring comments.
>
>> +static int
>> +tc956x_function_probe(struct pci_dev *pdev, const struct pci_device_id *id)
>> +{
>> + struct device *dev = &pdev->dev;
>> + struct tc956x_chip *chip;
>> + unsigned int msigen_irq;
>> + int ret;
>> +
>> + /* Despite being a PCI device, we require devicetree */
>> + if (!dev->of_node)
>> + return -EINVAL;
>
> Might be worth a dev_err(), since it is unusual.
Good suggestion. I'll add that.
Thanks a lot for your review.
-Alex
>
> Andrew
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox