* [PATCH net-next v9 1/4] net: phy: c45: add genphy_c45_pma_soft_reset()
From: javen @ 2026-07-03 7:13 UTC (permalink / raw)
To: andrew, hkallweit1, linux, davem, edumazet, kuba, pabeni,
freddy_gu, nb, maxime.chevallier
Cc: netdev, linux-kernel, daniel, vladimir.oltean, Javen Xu
In-Reply-To: <20260703071330.1707-1-javen_xu@realsil.com.cn>
From: Javen Xu <javen_xu@realsil.com.cn>
Add a generic Clause 45 software reset helper. The helper sets the reset
bit in the PMA/PMD control register and waits until the bit is cleared by
hardware.
Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>
Signed-off-by: Javen Xu <javen_xu@realsil.com.cn>
---
Changes in v2:
- no changes, new file
Changes in v3:
- re-order function according to the order in phy-c45.c
Changes in v4:
- no changes
Changes in v5:
- no changes
Changes in v6:
- increase timeout to 600ms
Changes in v7:
- no changes
Changes in v8:
- no changes
Changes in v9:
- rename genphy_c45_soft_reset to genphy_c45_pma_soft_reset
---
drivers/net/phy/phy-c45.c | 22 ++++++++++++++++++++++
include/linux/phy.h | 1 +
2 files changed, 23 insertions(+)
diff --git a/drivers/net/phy/phy-c45.c b/drivers/net/phy/phy-c45.c
index 126951741428..c1f817a59739 100644
--- a/drivers/net/phy/phy-c45.c
+++ b/drivers/net/phy/phy-c45.c
@@ -384,6 +384,28 @@ int genphy_c45_check_and_restart_aneg(struct phy_device *phydev, bool restart)
}
EXPORT_SYMBOL_GPL(genphy_c45_check_and_restart_aneg);
+/**
+ * genphy_c45_pma_soft_reset - software reset the PHY via Clause 45 PMA/PMD control register
+ * @phydev: target phy_device struct
+ *
+ * Return: 0 on success, negative errno on failure.
+ */
+int genphy_c45_pma_soft_reset(struct phy_device *phydev)
+{
+ int ret, val;
+
+ ret = phy_set_bits_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_CTRL1,
+ MDIO_CTRL1_RESET);
+ if (ret < 0)
+ return ret;
+
+ return phy_read_mmd_poll_timeout(phydev, MDIO_MMD_PMAPMD,
+ MDIO_CTRL1, val,
+ !(val & MDIO_CTRL1_RESET),
+ 5000, 600000, true);
+}
+EXPORT_SYMBOL_GPL(genphy_c45_pma_soft_reset);
+
/**
* genphy_c45_aneg_done - return auto-negotiation complete status
* @phydev: target phy_device struct
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 199a7aaa341b..d6bc19931fb8 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -2309,6 +2309,7 @@ int genphy_c37_read_status(struct phy_device *phydev, bool *changed);
/* Clause 45 PHY */
int genphy_c45_restart_aneg(struct phy_device *phydev);
int genphy_c45_check_and_restart_aneg(struct phy_device *phydev, bool restart);
+int genphy_c45_pma_soft_reset(struct phy_device *phydev);
int genphy_c45_aneg_done(struct phy_device *phydev);
int genphy_c45_read_link(struct phy_device *phydev);
int genphy_c45_read_lpa(struct phy_device *phydev);
--
2.43.0
^ permalink raw reply related
* [PATCH net-next v9 3/4] net: phy: realtek: add support for RTL8261C_CG
From: javen @ 2026-07-03 7:13 UTC (permalink / raw)
To: andrew, hkallweit1, linux, davem, edumazet, kuba, pabeni,
freddy_gu, nb, maxime.chevallier
Cc: netdev, linux-kernel, daniel, vladimir.oltean, Javen Xu
In-Reply-To: <20260703071330.1707-1-javen_xu@realsil.com.cn>
From: Javen Xu <javen_xu@realsil.com.cn>
This patch adds support for Realtek phy chip RTL8261C_CG. Its PHY ID is
0x001cc898.
This patch introduces a distinct family of handlers (probe, get_features,
config_aneg, read_status, config_intr, handle_interrupt).
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>
Signed-off-by: Javen Xu <javen_xu@realsil.com.cn>
---
Changes in v2:
- no changes, new file
Changes in v3:
- re-order function according to the order in phy-c45.c
- add kernel-doc about return value
- add MASTER_SLAVE_CFG_MASTER_PREFERRED,
MASTER_SLAVE_CFG_SLAVE_PREFERRED, MASTER_SLAVE_CFG_UNKNOWN,
MASTER_SLAVE_CFG_UNSUPPORTED, MASTER_SLAVE_CFG_SLAVE_PREFERRED cfg
Changes in v4:
- no changes
Changes in v5:
- remove genphy_c45_pma_setup_forced() for this is already done when
calling genphy_c45_config_aneg()
Changes in v6:
- when PHY_INTERRUPT_DISABLE, clear IMR and ISR
- if AUTONEG_DISABLE, nothing need to do in rtl8261x_config_aneg
- add rtl8261x_read_status, support 1G speed
Changes in v7:
- remove RTL8261X_IMR and RTL8261X_ISR, duplicated definition
- modify commit message
- continue with default behavior when meet unknown sub_phy_id
- change the internal order of rtl8261x_read_status
- expand RTL8261X_INT_MASK_DEFAULT
- add the handle for ADVERTISE_1000HALF in rtl8261x_config_aneg
Changes in v8:
- no changes
Changes in v9:
- get an status from genphy_c45_aneg_done()
---
drivers/net/phy/realtek/realtek_main.c | 192 +++++++++++++++++++++++++
1 file changed, 192 insertions(+)
diff --git a/drivers/net/phy/realtek/realtek_main.c b/drivers/net/phy/realtek/realtek_main.c
index 27268811f564..bd12f10843d9 100644
--- a/drivers/net/phy/realtek/realtek_main.c
+++ b/drivers/net/phy/realtek/realtek_main.c
@@ -141,6 +141,10 @@
#define RTL8211F_PHYSICAL_ADDR_WORD1 17
#define RTL8211F_PHYSICAL_ADDR_WORD2 18
+#define RTL8261X_EXT_ADDR_REG 0xa436
+#define RTL8261X_EXT_DATA_REG 0xa438
+#define RTL_8261X_SUB_PHY_ID_ADDR 0x801d
+
#define RTL822X_VND1_SERDES_OPTION 0x697a
#define RTL822X_VND1_SERDES_OPTION_MODE_MASK GENMASK(5, 0)
#define RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX_SGMII 0
@@ -251,6 +255,32 @@
#define RTL_8221B_VM_CG 0x001cc84a
#define RTL_8251B 0x001cc862
#define RTL_8261C 0x001cc890
+#define RTL_8261C_CG 0x001cc898
+
+#define RTL8261C_CE_MODEL 0x00
+#define RTL8261X_INT_AUTONEG_ERROR BIT(0)
+#define RTL8261X_INT_PAGE_RECV BIT(2)
+#define RTL8261X_INT_AUTONEG_DONE BIT(3)
+#define RTL8261X_INT_LINK_CHG BIT(4)
+#define RTL8261X_INT_PHY_REG_ACCESS BIT(5)
+#define RTL8261X_INT_PME BIT(7)
+#define RTL8261X_INT_ALDPS_CHG BIT(9)
+#define RTL8261X_INT_JABBER BIT(10)
+
+#define RTL8261X_INT_MASK_DEFAULT (RTL8261X_INT_AUTONEG_DONE | \
+ RTL8261X_INT_LINK_CHG | \
+ RTL8261X_INT_AUTONEG_ERROR | \
+ RTL8261X_INT_JABBER)
+
+#define RTL8261X_INT_MASK_ALL (RTL8261X_INT_AUTONEG_ERROR | \
+ RTL8261X_INT_PAGE_RECV | \
+ RTL8261X_INT_AUTONEG_DONE | \
+ RTL8261X_INT_LINK_CHG | \
+ RTL8261X_INT_PHY_REG_ACCESS | \
+ RTL8261X_INT_PME | \
+ RTL8261X_INT_ALDPS_CHG | \
+ RTL8261X_INT_JABBER)
+
/* RTL8211E and RTL8211F support up to three LEDs */
#define RTL8211x_LED_COUNT 3
@@ -310,6 +340,156 @@ static int rtl821x_modify_ext_page(struct phy_device *phydev, u16 ext_page,
return phy_restore_page(phydev, oldpage, ret);
}
+static int rtl8261x_probe(struct phy_device *phydev)
+{
+ int sub_phy_id, ret;
+
+ ret = phy_write_mmd(phydev, MDIO_MMD_VEND2, RTL8261X_EXT_ADDR_REG,
+ RTL_8261X_SUB_PHY_ID_ADDR);
+ if (ret < 0)
+ return ret;
+
+ ret = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL8261X_EXT_DATA_REG);
+ if (ret < 0)
+ return ret;
+
+ sub_phy_id = (ret >> 8) & 0xff;
+
+ switch (sub_phy_id) {
+ case RTL8261C_CE_MODEL:
+ phydev_info(phydev, "RTL8261C detected (sub_id 0x%02x)\n", sub_phy_id);
+ break;
+
+ default:
+ phydev_warn(phydev, "Unknown sub_id 0x%02x, default behavior\n", sub_phy_id);
+ return -ENODEV;
+ }
+
+ return 0;
+}
+
+static int rtl8261x_get_features(struct phy_device *phydev)
+{
+ int ret;
+
+ ret = genphy_c45_pma_read_abilities(phydev);
+ if (ret)
+ return ret;
+ /*
+ * Supplement Multi-Gig speeds that may not be automatically detected
+ * RTL8261X supports 2.5G/5G in addition to standard 10G
+ */
+ linkmode_set_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT,
+ phydev->supported);
+ linkmode_set_bit(ETHTOOL_LINK_MODE_5000baseT_Full_BIT,
+ phydev->supported);
+
+ return 0;
+}
+
+static int rtl8261x_read_status(struct phy_device *phydev)
+{
+ int ret, val = 0;
+
+ if (phydev->autoneg == AUTONEG_ENABLE) {
+ ret = genphy_c45_aneg_done(phydev);
+ if (ret < 0)
+ return ret;
+
+ if (ret) {
+ val = phy_read_mmd(phydev, MDIO_MMD_VEND2,
+ RTL822X_VND2_C22_REG(MII_STAT1000));
+ if (val < 0)
+ return val;
+ }
+ }
+
+ mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising, val);
+
+ ret = genphy_c45_read_status(phydev);
+ if (ret < 0)
+ return ret;
+
+ return 0;
+}
+
+static int rtl8261x_config_intr(struct phy_device *phydev)
+{
+ int ret;
+
+ if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
+ ret = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL8221B_VND2_INSR);
+ if (ret < 0)
+ return ret;
+
+ ret = phy_write_mmd(phydev, MDIO_MMD_VEND2, RTL8221B_VND2_INER,
+ RTL8261X_INT_MASK_DEFAULT);
+ if (ret < 0)
+ return ret;
+ } else {
+ ret = phy_write_mmd(phydev, MDIO_MMD_VEND2, RTL8221B_VND2_INER, 0);
+ if (ret < 0)
+ return ret;
+
+ ret = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL8221B_VND2_INSR);
+ if (ret < 0)
+ return ret;
+ }
+
+ return 0;
+}
+
+static irqreturn_t rtl8261x_handle_interrupt(struct phy_device *phydev)
+{
+ int irq_status;
+
+ irq_status = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL8221B_VND2_INSR);
+ if (irq_status < 0) {
+ phy_error(phydev);
+ return IRQ_NONE;
+ }
+
+ if (!(irq_status & RTL8261X_INT_MASK_ALL))
+ return IRQ_NONE;
+
+ if (irq_status & (RTL8261X_INT_LINK_CHG | RTL8261X_INT_AUTONEG_DONE |
+ RTL8261X_INT_AUTONEG_ERROR | RTL8261X_INT_JABBER))
+ phy_trigger_machine(phydev);
+
+ return IRQ_HANDLED;
+}
+
+static int rtl8261x_config_aneg(struct phy_device *phydev)
+{
+ u16 adv_1g = 0;
+ int ret;
+
+ ret = genphy_c45_config_aneg(phydev);
+ if (ret < 0)
+ return ret;
+
+ if (phydev->autoneg == AUTONEG_DISABLE)
+ return 0;
+
+ if (linkmode_test_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT,
+ phydev->advertising))
+ adv_1g = ADVERTISE_1000FULL;
+ if (linkmode_test_bit(ETHTOOL_LINK_MODE_1000baseT_Half_BIT,
+ phydev->advertising))
+ adv_1g |= ADVERTISE_1000HALF;
+
+ ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND2,
+ RTL822X_VND2_C22_REG(MII_CTRL1000),
+ ADVERTISE_1000FULL | ADVERTISE_1000HALF,
+ adv_1g);
+ if (ret < 0)
+ return ret;
+ if (ret > 0)
+ return genphy_c45_restart_aneg(phydev);
+
+ return 0;
+}
+
static int rtl821x_probe(struct phy_device *phydev)
{
struct device *dev = &phydev->mdio.dev;
@@ -3001,6 +3181,18 @@ static struct phy_driver realtek_drvs[] = {
.resume = genphy_resume,
.read_mmd = genphy_read_mmd_unsupported,
.write_mmd = genphy_write_mmd_unsupported,
+ }, {
+ PHY_ID_MATCH_EXACT(RTL_8261C_CG),
+ .name = "Realtek RTL8261C 10Gbps PHY",
+ .probe = rtl8261x_probe,
+ .get_features = rtl8261x_get_features,
+ .config_aneg = rtl8261x_config_aneg,
+ .read_status = rtl8261x_read_status,
+ .config_intr = rtl8261x_config_intr,
+ .handle_interrupt = rtl8261x_handle_interrupt,
+ .soft_reset = genphy_c45_pma_soft_reset,
+ .suspend = genphy_c45_pma_suspend,
+ .resume = genphy_c45_pma_resume,
},
};
--
2.43.0
^ permalink raw reply related
* [PATCH net-next v9 4/4] net: phy: realtek: load firmware for RTL8261C_CG
From: javen @ 2026-07-03 7:13 UTC (permalink / raw)
To: andrew, hkallweit1, linux, davem, edumazet, kuba, pabeni,
freddy_gu, nb, maxime.chevallier
Cc: netdev, linux-kernel, daniel, vladimir.oltean, Javen Xu
In-Reply-To: <20260703071330.1707-1-javen_xu@realsil.com.cn>
From: Javen Xu <javen_xu@realsil.com.cn>
This patch adds support for loading firmware. Download some parameters
for RTL8261C_CG.
Signed-off-by: Javen Xu <javen_xu@realsil.com.cn>
---
Changes in v2:
- remove __pack, struct rtl8261x_fw_header and rtl8261x_fw_entry will not pad
- reverse xmas tree for some definition
- add explanation on rtl_phy_write_mmd_bits()
Changes in v3:
- add struct rtl8261x_priv
Changes in v4:
- add struct device *dev
Changes in v5:
- no changes
Changes in v6:
- replace rtl_phy_write_mmd_bits with phy_modify_mmd, keep mdio lock
- check msb and lsb at the beginning of rtl8261x_fw_execute_entry()
- add comments on rtl8261x_config_init()
Changes in v7:
- no changes
Changes in v8:
- remove some phydev_err message in rtl8261x_fw_execute_entry() and
rtl8261x_config_init()
Changes in v9:
- no changes
---
drivers/net/phy/realtek/realtek_main.c | 214 +++++++++++++++++++++++++
1 file changed, 214 insertions(+)
diff --git a/drivers/net/phy/realtek/realtek_main.c b/drivers/net/phy/realtek/realtek_main.c
index bd12f10843d9..68a2de0b2bd3 100644
--- a/drivers/net/phy/realtek/realtek_main.c
+++ b/drivers/net/phy/realtek/realtek_main.c
@@ -8,7 +8,9 @@
* Copyright (c) 2004 Freescale Semiconductor, Inc.
*/
#include <linux/bitops.h>
+#include <linux/crc32.h>
#include <linux/ethtool_netlink.h>
+#include <linux/firmware.h>
#include <linux/of.h>
#include <linux/phy.h>
#include <linux/pm_wakeirq.h>
@@ -281,6 +283,43 @@
RTL8261X_INT_ALDPS_CHG | \
RTL8261X_INT_JABBER)
+#define FW_MAIN_MAGIC 0x52544C38
+#define FW_SUB_MAGIC_8261C 0x32363143
+#define RTL8261X_POLL_TIMEOUT_MS 100
+#define RTL8261X_MAX_MMD_DEV 31
+
+#define RTL8261C_CE_FW_NAME "rtl_nic/rtl8261c.bin"
+MODULE_FIRMWARE(RTL8261C_CE_FW_NAME);
+
+enum rtl8261x_fw_op {
+ OP_WRITE = 0x00, /* Write */
+ OP_POLL = 0x02, /* Polling */
+};
+
+struct rtl8261x_fw_header {
+ __le32 main_magic; /* Main magic number */
+ __le32 sub_magic; /* Sub magic number */
+ __le16 version_major; /* Major version */
+ __le16 version_minor; /* Minor version */
+ __le16 num_entries; /* Number of entries */
+ __le16 reserved; /* Reserved */
+ __le32 crc32; /* CRC32 checksum */
+};
+
+struct rtl8261x_fw_entry {
+ __u8 type; /* Operation type (OP_*) */
+ __u8 dev; /* MMD device */
+ __le16 addr; /* Register address */
+ __u8 msb; /* MSB bit position */
+ __u8 lsb; /* LSB bit position */
+ __le16 value; /* Value to write/compare */
+ __le16 timeout_ms; /* Poll timeout in milliseconds */
+ __u8 poll_set; /* Poll until equal (1) or not equal (0) */
+ __u8 reserved; /* Reserved */
+};
+
+#define FW_HEADER_SIZE sizeof(struct rtl8261x_fw_header)
+#define FW_ENTRY_SIZE sizeof(struct rtl8261x_fw_entry)
/* RTL8211E and RTL8211F support up to three LEDs */
#define RTL8211x_LED_COUNT 3
@@ -300,6 +339,11 @@ struct rtl821x_priv {
u16 iner;
};
+struct rtl8261x_priv {
+ const char *fw_name;
+ bool fw_loaded;
+};
+
static int rtl821x_read_page(struct phy_device *phydev)
{
return __phy_read(phydev, RTL821x_PAGE_SELECT);
@@ -342,8 +386,16 @@ static int rtl821x_modify_ext_page(struct phy_device *phydev, u16 ext_page,
static int rtl8261x_probe(struct phy_device *phydev)
{
+ struct device *dev = &phydev->mdio.dev;
+ struct rtl8261x_priv *priv;
int sub_phy_id, ret;
+ priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+ return -ENOMEM;
+
+ phydev->priv = priv;
+
ret = phy_write_mmd(phydev, MDIO_MMD_VEND2, RTL8261X_EXT_ADDR_REG,
RTL_8261X_SUB_PHY_ID_ADDR);
if (ret < 0)
@@ -357,6 +409,7 @@ static int rtl8261x_probe(struct phy_device *phydev)
switch (sub_phy_id) {
case RTL8261C_CE_MODEL:
+ priv->fw_name = RTL8261C_CE_FW_NAME;
phydev_info(phydev, "RTL8261C detected (sub_id 0x%02x)\n", sub_phy_id);
break;
@@ -413,6 +466,152 @@ static int rtl8261x_read_status(struct phy_device *phydev)
return 0;
}
+static int rtl8261x_verify_firmware(struct phy_device *phydev, const struct firmware *fw)
+{
+ const struct rtl8261x_fw_header *hdr;
+ u32 main_magic, sub_magic;
+ u32 calc_crc, file_crc;
+ size_t data_len;
+ u16 num_entries;
+
+ if (fw->size < FW_HEADER_SIZE) {
+ phydev_err(phydev, "Firmware too small: %zu bytes\n", fw->size);
+ return -EINVAL;
+ }
+
+ hdr = (const struct rtl8261x_fw_header *)fw->data;
+
+ main_magic = le32_to_cpu(hdr->main_magic);
+ if (main_magic != FW_MAIN_MAGIC) {
+ phydev_err(phydev, "Invalid firmware magic: 0x%08x\n", main_magic);
+ return -EINVAL;
+ }
+
+ sub_magic = le32_to_cpu(hdr->sub_magic);
+ if (sub_magic != FW_SUB_MAGIC_8261C) {
+ phydev_err(phydev, "Invalid sub magic: 0x%08x\n", sub_magic);
+ return -EINVAL;
+ }
+
+ num_entries = le16_to_cpu(hdr->num_entries);
+ data_len = num_entries * FW_ENTRY_SIZE;
+
+ if (fw->size != sizeof(*hdr) + data_len) {
+ phydev_err(phydev, "Firmware size mismatch\n");
+ return -EINVAL;
+ }
+
+ calc_crc = crc32(~0, fw->data + FW_HEADER_SIZE, data_len) ^ ~0;
+ file_crc = le32_to_cpu(hdr->crc32);
+
+ if (calc_crc != file_crc) {
+ phydev_err(phydev, "CRC32 mismatch: calculated=0x%08x file=0x%08x\n",
+ calc_crc, file_crc);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
+static int rtl8261x_fw_execute_entry(struct phy_device *phydev,
+ const struct rtl8261x_fw_entry *entry)
+{
+ u16 addr, value, timeout_ms;
+ u8 dev, msb, lsb, poll_set;
+ u32 bits, expect_val;
+ int ret, val;
+
+ dev = entry->dev;
+ addr = le16_to_cpu(entry->addr);
+ msb = entry->msb;
+ lsb = entry->lsb;
+ value = le16_to_cpu(entry->value);
+ timeout_ms = le16_to_cpu(entry->timeout_ms);
+ poll_set = entry->poll_set;
+
+ if (timeout_ms == 0)
+ timeout_ms = RTL8261X_POLL_TIMEOUT_MS;
+
+ if (dev > RTL8261X_MAX_MMD_DEV) {
+ phydev_err(phydev, "invalid firmware MMD device: dev=%u\n", dev);
+ return -EINVAL;
+ }
+
+ if (msb > 15 || lsb > msb) {
+ phydev_err(phydev, "invalid firmware bits: msb=%u, lsb=%u\n", msb, lsb);
+ return -EINVAL;
+ }
+
+ switch (entry->type) {
+ case OP_WRITE:
+ ret = phy_modify_mmd(phydev, dev, addr,
+ GENMASK(msb, lsb), (value << lsb) & GENMASK(msb, lsb));
+ if (ret)
+ return ret;
+ break;
+
+ case OP_POLL:
+ bits = GENMASK(msb, lsb);
+ expect_val = (value << lsb) & bits;
+
+ if (poll_set)
+ ret = phy_read_mmd_poll_timeout(phydev, dev, addr, val,
+ (val & bits) == expect_val,
+ 1000, timeout_ms * 1000, false);
+ else
+ ret = phy_read_mmd_poll_timeout(phydev, dev, addr, val,
+ (val & bits) != expect_val,
+ 1000, timeout_ms * 1000, false);
+ if (ret)
+ return ret;
+ break;
+
+ default:
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
+static int rtl8261x_fw_load(struct phy_device *phydev)
+{
+ struct rtl8261x_priv *priv = phydev->priv;
+ const struct rtl8261x_fw_entry *entry;
+ const struct rtl8261x_fw_header *hdr;
+ const struct firmware *fw;
+ int ret, i;
+
+ if (!priv->fw_name)
+ return 0;
+
+ ret = request_firmware(&fw, priv->fw_name, &phydev->mdio.dev);
+ if (ret) {
+ phydev_err(phydev, "Failed to load firmware %s: %d\n", priv->fw_name, ret);
+ return ret;
+ }
+
+ ret = rtl8261x_verify_firmware(phydev, fw);
+ if (ret)
+ goto release_fw;
+
+ hdr = (const struct rtl8261x_fw_header *)fw->data;
+
+ entry = (const struct rtl8261x_fw_entry *)(fw->data + FW_HEADER_SIZE);
+ for (i = 0; i < le16_to_cpu(hdr->num_entries); i++, entry++) {
+ ret = rtl8261x_fw_execute_entry(phydev, entry);
+ if (ret) {
+ phydev_err(phydev, "Entry %d failed: %d\n", i, ret);
+ goto release_fw;
+ }
+ }
+
+ priv->fw_loaded = true;
+
+release_fw:
+ release_firmware(fw);
+ return ret;
+}
+
static int rtl8261x_config_intr(struct phy_device *phydev)
{
int ret;
@@ -490,6 +689,20 @@ static int rtl8261x_config_aneg(struct phy_device *phydev)
return 0;
}
+static int rtl8261x_config_init(struct phy_device *phydev)
+{
+ struct rtl8261x_priv *priv = phydev->priv;
+
+ /* The firmware parameters are preserved across IEEE soft resets and
+ * suspend/resume cycles. Reloading is only necessary after a power
+ * cycle or hard reset.
+ */
+ if (priv->fw_name && !priv->fw_loaded)
+ return rtl8261x_fw_load(phydev);
+
+ return 0;
+}
+
static int rtl821x_probe(struct phy_device *phydev)
{
struct device *dev = &phydev->mdio.dev;
@@ -3185,6 +3398,7 @@ static struct phy_driver realtek_drvs[] = {
PHY_ID_MATCH_EXACT(RTL_8261C_CG),
.name = "Realtek RTL8261C 10Gbps PHY",
.probe = rtl8261x_probe,
+ .config_init = rtl8261x_config_init,
.get_features = rtl8261x_get_features,
.config_aneg = rtl8261x_config_aneg,
.read_status = rtl8261x_read_status,
--
2.43.0
^ permalink raw reply related
* [PATCH net-next v9 2/4] net: phy: c45: add setup and read master/slave helpers
From: javen @ 2026-07-03 7:13 UTC (permalink / raw)
To: andrew, hkallweit1, linux, davem, edumazet, kuba, pabeni,
freddy_gu, nb, maxime.chevallier
Cc: netdev, linux-kernel, daniel, vladimir.oltean, Javen Xu
In-Reply-To: <20260703071330.1707-1-javen_xu@realsil.com.cn>
From: Javen Xu <javen_xu@realsil.com.cn>
This patch adds two static helpers in drivers/net/phy/phy-c45.c to
configure and read back master-slave roles for non BASE-T1 Clause 45
PHYs via the 10GBASE-T AN control/status registers.
These helpers are wired into genphy_c45_config_aneg() and
genphy_c45_read_status(). This changes the observable ethtool output
for drivers using the generic c45 read path.
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Javen Xu <javen_xu@realsil.com.cn>
---
Changes in v2:
- no changes, new file
Changes in v3:
- re-order function according to the order in phy-c45.c
- add kernel-doc about return value
- add MASTER_SLAVE_CFG_MASTER_PREFERRED,
MASTER_SLAVE_CFG_SLAVE_PREFERRED, MASTER_SLAVE_CFG_UNKNOWN,
MASTER_SLAVE_CFG_UNSUPPORTED, MASTER_SLAVE_CFG_SLAVE_PREFERRED cfg
Changes in v4:
- no changes
Changes in v5:
- move genphy_c45_an_setup_master_slave() to genphy_c45_config_aneg(),
as that C22 does.
Changes in v6:
- add colon in the function description
- add genphy_c45_read_master_slave in read function
Changes in v7:
- when phydev->link is down, just return UNKNOWN
- modify commit message
Changes in v8:
- no changes
Changes in v9:
- no changes
---
drivers/net/phy/phy-c45.c | 103 ++++++++++++++++++++++++++++++++++++++
include/uapi/linux/mdio.h | 5 ++
2 files changed, 108 insertions(+)
diff --git a/drivers/net/phy/phy-c45.c b/drivers/net/phy/phy-c45.c
index c1f817a59739..870920311f9a 100644
--- a/drivers/net/phy/phy-c45.c
+++ b/drivers/net/phy/phy-c45.c
@@ -406,6 +406,97 @@ int genphy_c45_pma_soft_reset(struct phy_device *phydev)
}
EXPORT_SYMBOL_GPL(genphy_c45_pma_soft_reset);
+/**
+ * genphy_c45_an_setup_master_slave - Configure Master/Slave setting for C45 PHYs
+ * @phydev: target phy_device struct
+ *
+ * Description: Configure the forced or preferred Master/Slave role
+ * 10GBASE-T control register (MMD 7, Register 0x0020) according to
+ * IEEE 802.3 standards.
+ *
+ * Return: negative errno code on failure, 0 if Master/Slave didn't change,
+ * or 1 if Master/Slave modes changed.
+ */
+static int genphy_c45_an_setup_master_slave(struct phy_device *phydev)
+{
+ u16 ctl = 0;
+
+ switch (phydev->master_slave_set) {
+ case MASTER_SLAVE_CFG_MASTER_PREFERRED:
+ ctl = MDIO_AN_10GBT_CTRL_MS_PORT_TYPE;
+ break;
+ case MASTER_SLAVE_CFG_SLAVE_PREFERRED:
+ break;
+ case MASTER_SLAVE_CFG_MASTER_FORCE:
+ ctl = MDIO_AN_10GBT_CTRL_MS_ENABLE | MDIO_AN_10GBT_CTRL_MS_VALUE;
+ break;
+ case MASTER_SLAVE_CFG_SLAVE_FORCE:
+ ctl = MDIO_AN_10GBT_CTRL_MS_ENABLE;
+ break;
+ case MASTER_SLAVE_CFG_UNKNOWN:
+ case MASTER_SLAVE_CFG_UNSUPPORTED:
+ return 0;
+ default:
+ phydev_warn(phydev, "Unsupported Master/Slave mode\n");
+ return -EOPNOTSUPP;
+ }
+
+ return phy_modify_mmd_changed(phydev, MDIO_MMD_AN, MDIO_AN_10GBT_CTRL,
+ MDIO_AN_10GBT_CTRL_MS_ENABLE |
+ MDIO_AN_10GBT_CTRL_MS_VALUE |
+ MDIO_AN_10GBT_CTRL_MS_PORT_TYPE, ctl);
+}
+
+/**
+ * genphy_c45_read_master_slave - read master/slave status
+ * @phydev: target phy_device struct
+ *
+ * Description: Read the Master/Slave configuration and status
+ * from 10GBASE-T control/status registers (MMD 7, Reg 0x0020 and 0x0021).
+ *
+ * Return: 0 on success, or a negative error code on failure.
+ */
+static int genphy_c45_read_master_slave(struct phy_device *phydev)
+{
+ int val;
+
+ phydev->master_slave_get = MASTER_SLAVE_CFG_UNKNOWN;
+ phydev->master_slave_state = MASTER_SLAVE_STATE_UNKNOWN;
+
+ val = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_10GBT_CTRL);
+ if (val < 0)
+ return val;
+
+ if (val & MDIO_AN_10GBT_CTRL_MS_ENABLE) {
+ if (val & MDIO_AN_10GBT_CTRL_MS_VALUE)
+ phydev->master_slave_get = MASTER_SLAVE_CFG_MASTER_FORCE;
+ else
+ phydev->master_slave_get = MASTER_SLAVE_CFG_SLAVE_FORCE;
+ } else {
+ if (val & MDIO_AN_10GBT_CTRL_MS_PORT_TYPE)
+ phydev->master_slave_get = MASTER_SLAVE_CFG_MASTER_PREFERRED;
+ else
+ phydev->master_slave_get = MASTER_SLAVE_CFG_SLAVE_PREFERRED;
+ }
+
+ val = phy_read_mmd(phydev, MDIO_MMD_AN, MDIO_AN_10GBT_STAT);
+ if (val < 0)
+ return val;
+
+ if (val & MDIO_AN_10GBT_STAT_MS_FAULT) {
+ phydev->master_slave_state = MASTER_SLAVE_STATE_ERR;
+ } else if (phydev->link) {
+ if (val & MDIO_AN_10GBT_STAT_MS_RES)
+ phydev->master_slave_state = MASTER_SLAVE_STATE_MASTER;
+ else
+ phydev->master_slave_state = MASTER_SLAVE_STATE_SLAVE;
+ } else {
+ phydev->master_slave_state = MASTER_SLAVE_STATE_UNKNOWN;
+ }
+
+ return 0;
+}
+
/**
* genphy_c45_aneg_done - return auto-negotiation complete status
* @phydev: target phy_device struct
@@ -1214,6 +1305,10 @@ int genphy_c45_read_status(struct phy_device *phydev)
ret = genphy_c45_baset1_read_status(phydev);
if (ret < 0)
return ret;
+ } else {
+ ret = genphy_c45_read_master_slave(phydev);
+ if (ret < 0)
+ return ret;
}
phy_resolve_aneg_linkmode(phydev);
@@ -1247,6 +1342,14 @@ int genphy_c45_config_aneg(struct phy_device *phydev)
if (ret > 0)
changed = true;
+ if (!genphy_c45_baset1_able(phydev)) {
+ ret = genphy_c45_an_setup_master_slave(phydev);
+ if (ret < 0)
+ return ret;
+ if (ret > 0)
+ changed = true;
+ }
+
return genphy_c45_check_and_restart_aneg(phydev, changed);
}
EXPORT_SYMBOL_GPL(genphy_c45_config_aneg);
diff --git a/include/uapi/linux/mdio.h b/include/uapi/linux/mdio.h
index b2541c948fc1..06f4bc3c20c7 100644
--- a/include/uapi/linux/mdio.h
+++ b/include/uapi/linux/mdio.h
@@ -332,8 +332,13 @@
#define MDIO_AN_10GBT_CTRL_ADV2_5G 0x0080 /* Advertise 2.5GBASE-T */
#define MDIO_AN_10GBT_CTRL_ADV5G 0x0100 /* Advertise 5GBASE-T */
#define MDIO_AN_10GBT_CTRL_ADV10G 0x1000 /* Advertise 10GBASE-T */
+#define MDIO_AN_10GBT_CTRL_MS_ENABLE 0x8000 /* Master/slave manual config enable */
+#define MDIO_AN_10GBT_CTRL_MS_VALUE 0x4000 /* Master/slave config value (1=Master) */
+#define MDIO_AN_10GBT_CTRL_MS_PORT_TYPE 0x2000 /* Master Preferred Type */
/* AN 10GBASE-T status register. */
+#define MDIO_AN_10GBT_STAT_MS_FAULT 0x8000 /* Master/slave fault */
+#define MDIO_AN_10GBT_STAT_MS_RES 0x4000 /* Master/slave resolution (1=Master) */
#define MDIO_AN_10GBT_STAT_LP2_5G 0x0020 /* LP is 2.5GBT capable */
#define MDIO_AN_10GBT_STAT_LP5G 0x0040 /* LP is 5GBT capable */
#define MDIO_AN_10GBT_STAT_LPTRR 0x0200 /* LP training reset req. */
--
2.43.0
^ permalink raw reply related
* [PATCH net-next v9 0/4] Add support for RTL8261C_CG
From: javen @ 2026-07-03 7:13 UTC (permalink / raw)
To: andrew, hkallweit1, linux, davem, edumazet, kuba, pabeni,
freddy_gu, nb, maxime.chevallier
Cc: netdev, linux-kernel, daniel, vladimir.oltean, Javen Xu
From: Javen Xu <javen_xu@realsil.com.cn>
Add support for RTL8261C_CG and add support for loading firmware.
Javen Xu (4):
net: phy: c45: add genphy_c45_pma_soft_reset()
net: phy: c45: add setup and read master/slave helpers
net: phy: realtek: add support for RTL8261C_CG
net: phy: realtek: load firmware for RTL8261C_CG
drivers/net/phy/phy-c45.c | 125 ++++++++
drivers/net/phy/realtek/realtek_main.c | 406 +++++++++++++++++++++++++
include/linux/phy.h | 1 +
include/uapi/linux/mdio.h | 5 +
4 files changed, 537 insertions(+)
--
2.43.0
^ permalink raw reply
* [PATCH net 1/1] net: sctp: fix AUTH HMAC list overflow into auth_chunks
From: Ren Wei @ 2026-07-03 7:19 UTC (permalink / raw)
To: linux-sctp, netdev
Cc: marcelo.leitner, lucien.xin, davem, edumazet, pabeni, horms,
vladislav.yasevich, yuantan098, dstsmallbird, xizh2024,
enjou1224z
In-Reply-To: <cover.1782798905.git.xizh2024@lzu.edu.cn>
From: Zihan Xi <xizh2024@lzu.edu.cn>
sctp_auth_ep_set_hmacs() may advertise a 12-byte HMAC-ALGO parameter when
four identifiers are configured, but the association only stores ten bytes
in c.auth_hmacs. sctp_association_init() copies the advertised length and
overwrites the adjacent auth_chunks field, so sctp_auth_asoc_verify_hmac_id()
accepts forged HMAC identifiers and sctp_auth_get_hmac() indexes past
sctp_hmac_list.
Clamp the stored parameter length to the association buffer, copy only that
many bytes when initializing an association, and reject out-of-range HMAC
identifiers in sctp_auth_get_hmac().
Fixes: 65b07e5d0d09 ("[SCTP]: API updates to suport SCTP-AUTH extensions.")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Xin Liu <dstsmallbird@foxmail.com>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zihan Xi <xizh2024@lzu.edu.cn>
Reviewed-by: Ren Wei <enjou1224z@gmail.com>
---
net/sctp/associola.c | 10 +++++++---
net/sctp/auth.c | 10 ++++++++--
net/sctp/sm_statefuns.c | 2 ++
3 files changed, 17 insertions(+), 5 deletions(-)
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 62d3cc1558..760457def6 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -260,9 +260,13 @@ static struct sctp_association *sctp_association_init(
asoc->strreset_enable = ep->strreset_enable;
/* Save the hmacs and chunks list into this association */
- if (ep->auth_hmacs_list)
- memcpy(asoc->c.auth_hmacs, ep->auth_hmacs_list,
- ntohs(ep->auth_hmacs_list->param_hdr.length));
+ if (ep->auth_hmacs_list) {
+ size_t hmac_len = min_t(size_t,
+ ntohs(ep->auth_hmacs_list->param_hdr.length),
+ sizeof(asoc->c.auth_hmacs));
+
+ memcpy(asoc->c.auth_hmacs, ep->auth_hmacs_list, hmac_len);
+ }
if (ep->auth_chunk_list)
memcpy(asoc->c.auth_chunks, ep->auth_chunk_list,
ntohs(ep->auth_chunk_list->param_hdr.length));
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index be9782760f..4d14bd6185 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -447,6 +447,8 @@ struct sctp_shared_key *sctp_auth_get_shkey(
const struct sctp_hmac *sctp_auth_get_hmac(__u16 hmac_id)
{
+ if (hmac_id >= SCTP_AUTH_NUM_HMACS)
+ return NULL;
return &sctp_hmac_list[hmac_id];
}
@@ -510,6 +512,9 @@ int sctp_auth_asoc_verify_hmac_id(const struct sctp_association *asoc,
hmacs = (struct sctp_hmac_algo_param *)asoc->c.auth_hmacs;
n_elt = (ntohs(hmacs->param_hdr.length) -
sizeof(struct sctp_paramhdr)) >> 1;
+ n_elt = min_t(__u16, n_elt,
+ (sizeof(asoc->c.auth_hmacs) -
+ sizeof(struct sctp_paramhdr)) / sizeof(__u16));
return __sctp_auth_find_hmacid(hmacs->hmac_ids, n_elt, hmac_id);
}
@@ -708,8 +713,9 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep,
ep->auth_hmacs_list->hmac_ids[i] =
htons(hmacs->shmac_idents[i]);
ep->auth_hmacs_list->param_hdr.length =
- htons(sizeof(struct sctp_paramhdr) +
- hmacs->shmac_num_idents * sizeof(__u16));
+ htons(min_t(__u16, sizeof(struct sctp_paramhdr) +
+ hmacs->shmac_num_idents * sizeof(__u16),
+ SCTP_AUTH_NUM_HMACS * sizeof(__u16) + 2));
return 0;
}
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index d23d935e12..21cda509a0 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -4431,6 +4431,8 @@ static enum sctp_ierror sctp_sf_authenticate(
sig_len = ntohs(chunk->chunk_hdr->length) -
sizeof(struct sctp_auth_chunk);
hmac = sctp_auth_get_hmac(ntohs(auth_hdr->hmac_id));
+ if (!hmac)
+ return SCTP_IERROR_AUTH_BAD_HMAC;
if (sig_len != hmac->hmac_len)
return SCTP_IERROR_PROTO_VIOLATION;
--
2.43.0
^ permalink raw reply related
* [PATCH RFC net-next] net: dsa: mv88e6xxx: honor resolved flow control in mac_link_up
From: Luke Howard @ 2026-07-03 7:26 UTC (permalink / raw)
To: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Vivien Didelot, Gregory CLEMENT, Andrew Lunn
Cc: Cedric Jehasse, Kieran Tyrrell, Max Holtmann, Max Hunter,
Christoph Mellauner, Simon Gapp, netdev, linux-kernel,
Luke Howard
Program the pause status resolved by phylink into the Port MAC
Control register when forcing the link up, and return flow control
to hardware resolution when forcing the link down, mirroring the
existing treatment of speed and duplex.
Flow control is programmed before port_sync_link() so that the
port's MAC control is not modified while the link is forced up.
The MAC has a single flow control enable covering both directions;
as the driver only advertises MAC_SYM_PAUSE, rx_pause and tx_pause
are always equal here.
A fixed-link port whose device tree node lacks the "pause" property
now has flow control explicitly disabled while the link is forced
up, rather than being left at the chip's default.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Luke Howard <lukeh@padl.com>
---
drivers/net/dsa/mv88e6xxx/chip.c | 9 +++++++++
drivers/net/dsa/mv88e6xxx/port.c | 20 ++++++++++++++++++++
drivers/net/dsa/mv88e6xxx/port.h | 2 ++
3 files changed, 31 insertions(+)
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 80b877c74513d..73c28bf2bf3cb 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -974,6 +974,10 @@ static void mv88e6xxx_mac_link_down(struct phylink_config *config,
mode == MLO_AN_FIXED) && ops->port_sync_link)
err = ops->port_sync_link(chip, port, mode, false);
+ if (!err)
+ err = mv88e6xxx_port_set_force_flow_ctl(chip, port, false,
+ false);
+
if (!err && ops->port_set_speed_duplex)
err = ops->port_set_speed_duplex(chip, port, SPEED_UNFORCED,
DUPLEX_UNFORCED);
@@ -1012,6 +1016,11 @@ static void mv88e6xxx_mac_link_up(struct phylink_config *config,
goto error;
}
+ err = mv88e6xxx_port_set_force_flow_ctl(chip, port, true,
+ rx_pause);
+ if (err)
+ goto error;
+
if (ops->port_sync_link)
err = ops->port_sync_link(chip, port, mode, true);
}
diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c
index ea1fab71968a0..7ee802cf3412c 100644
--- a/drivers/net/dsa/mv88e6xxx/port.c
+++ b/drivers/net/dsa/mv88e6xxx/port.c
@@ -182,6 +182,26 @@ int mv88e6xxx_port_set_link(struct mv88e6xxx_chip *chip, int port, int link)
return 0;
}
+int mv88e6xxx_port_set_force_flow_ctl(struct mv88e6xxx_chip *chip, int port,
+ bool force, bool value)
+{
+ u16 reg;
+ int err;
+
+ err = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_MAC_CTL, ®);
+ if (err)
+ return err;
+
+ reg &= ~(MV88E6XXX_PORT_MAC_CTL_FORCE_FC | MV88E6XXX_PORT_MAC_CTL_FC);
+ if (force) {
+ reg |= MV88E6XXX_PORT_MAC_CTL_FORCE_FC;
+ if (value)
+ reg |= MV88E6XXX_PORT_MAC_CTL_FC;
+ }
+
+ return mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_MAC_CTL, reg);
+}
+
int mv88e6xxx_port_sync_link(struct mv88e6xxx_chip *chip, int port, unsigned int mode, bool isup)
{
const struct mv88e6xxx_ops *ops = chip->info->ops;
diff --git a/drivers/net/dsa/mv88e6xxx/port.h b/drivers/net/dsa/mv88e6xxx/port.h
index 5b6cde9f7406f..f98df6351f5b7 100644
--- a/drivers/net/dsa/mv88e6xxx/port.h
+++ b/drivers/net/dsa/mv88e6xxx/port.h
@@ -485,6 +485,8 @@ int mv88e6390_port_set_rgmii_delay(struct mv88e6xxx_chip *chip, int port,
phy_interface_t mode);
int mv88e6xxx_port_set_link(struct mv88e6xxx_chip *chip, int port, int link);
+int mv88e6xxx_port_set_force_flow_ctl(struct mv88e6xxx_chip *chip, int port,
+ bool force, bool value);
int mv88e6xxx_port_sync_link(struct mv88e6xxx_chip *chip, int port, unsigned int mode, bool isup);
int mv88e6185_port_sync_link(struct mv88e6xxx_chip *chip, int port, unsigned int mode, bool isup);
---
base-commit: 2bb62a85aff6d4c14a62a476dfabaada3c1cc014
change-id: 20260701-mv88e6xxx-flow-control-cafe32352712
Best regards,
--
Luke Howard <lukeh@padl.com>
^ permalink raw reply related
* Re: [PATCH net v2] ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
From: Qingfang Deng @ 2026-07-03 7:27 UTC (permalink / raw)
To: Norbert Szetei
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Sebastian Andrzej Siewior, Breno Leitao, Taegu Ha,
Kees Cook, linux-ppp, linux-kernel, Guillaume Nault, netdev
In-Reply-To: <D9C0245B-608B-4884-8A09-F55BA4A9F948@doyensec.com>
Hi,
On 2026/7/2 2:12, Norbert Szetei wrote:
> +/* Purge after the grace period: a late ppp_input() may still queue an
> + * skb on pch->file.rq before the last RCU reader drains.
> + */
> +static void ppp_release_channel_free(struct rcu_head *rcu)
> +{
> + struct channel *pch = container_of(rcu, struct channel, rcu);
> +
> + skb_queue_purge(&pch->file.xq);
> + skb_queue_purge(&pch->file.rq);
> + kfree(pch);
> +}
> +
> /*
> * Drop a reference to a ppp channel and free its memory if the refcount reaches
> * zero.
> @@ -3581,9 +3594,7 @@ static void ppp_release_channel(struct channel *pch)
> pr_err("ppp: destroying undead channel %p !\n", pch);
> return;
> }
> - skb_queue_purge(&pch->file.xq);
> - skb_queue_purge(&pch->file.rq);
> - kfree(pch);
> + call_rcu(&pch->rcu, ppp_release_channel_free);
> }
>
> static void __exit ppp_cleanup(void)
AI-review found an issue:
https://sashiko.dev/#/patchset/D9C0245B-608B-4884-8A09-F55BA4A9F948%40doyensec.com
An rcu_barrier() call is needed at the end of ppp_cleanup().
Regards,
Qingfang
^ permalink raw reply
* Re: [PATCH net-next v4 1/2] net: dsa: realtek: rtl8365mb: add SGMII support for RTL8367S
From: Maxime Chevallier @ 2026-07-03 7:29 UTC (permalink / raw)
To: Johan Alvarado, linusw, alsi, andrew, olteanv, kuba, davem,
edumazet, pabeni, linux
Cc: luizluca, namiltd, netdev, linux-kernel
In-Reply-To: <0100019f2496091c-0bf7417f-aa27-4465-972b-f9a9b156506a-000000@email.amazonses.com>
Hi Johan,
On 7/2/26 22:47, Johan Alvarado wrote:
> The RTL8367S can mux its embedded SerDes to external interface 1,
> which is typically used to connect the switch to a CPU port. The chip
> info table already declares SGMII as a supported interface mode for
> this chip, but the driver only implements RGMII so far.
>
> Implement SGMII support as a phylink PCS, with the configuration
> sequence derived from the GPL-licensed Realtek rtl8367c vendor driver
> as distributed in the Mercusys MR80X GPL code drop:
>
> - Add accessors for the SerDes indirect access registers (SDS_INDACS),
> through which the SerDes internal registers are reached.
>
> - Register a phylink_pcs for the SerDes, selected from mac_select_pcs
> for the SGMII interface, so the SerDes handling lives in the PCS
> operations rather than in the MAC operations.
>
> - Probe the SerDes tuning variant from the chip option register once
> at setup. The vendor driver keeps two sets of SerDes tuning
> parameters and selects between them based on this option; only the
> variant for a non-zero option (which all RTL8367S parts seen so far
> report) has been validated on hardware, so the SerDes interface
> modes are only advertised in that case. An unsupported variant thus
> fails at phylink validation time instead of at link configuration
> time.
>
> - Keep the embedded DW8051 microcontroller in reset and disabled. The
> vendor driver loads firmware into it to manage the SerDes link, but
> analysis of that firmware shows it only duplicates the link
> management phylink already performs: it polls the port status and
> writes the external interface force registers behind the driver's
> back.
>
> - Clear the line rate bypass bit for the external interface, tune the
> SerDes with the vendor-prescribed parameters, mux the SerDes to MAC8
> in SGMII mode and only then take the SerDes out of reset, as the
> vendor driver does.
>
> - After deasserting the SerDes reset, reset the SerDes data path via
> the SerDes BMCR register to flush the FIFOs and resync the PLL.
> This mirrors what the vendor firmware does right after deasserting
> the SerDes reset, and ensures a clean link state from cold boot.
>
> - Force the SGMII link parameters (link, speed, duplex) in the SDS_MISC
> register from pcs_link_up(). SGMII in-band autonegotiation is not
> implemented, so only fixed-link and conventional PHY setups are
> supported, just like RGMII. This is reported to phylink through
> pcs_inband_caps() returning LINK_INBAND_DISABLE, so phylink never
> selects an in-band-enabled negotiation mode for this PCS.
>
> - Program the SerDes pause controls in SDS_MISC from the resolved
> pause modes when forcing the MAC external interface in mac_link_up,
> as the vendor driver does, rather than leaving whatever state the
> boot firmware left there. This is done in the MAC layer because
> pcs_link_up() carries no pause information.
>
> - Implement pcs_get_state() by reading the link status from the
> SerDes, with the forced speed and duplex read back from SDS_MISC.
> Although the supported fixed-link and conventional PHY setups do not
> use it, the PCS owns the SerDes link state, and phylink consults
> pcs_get_state() to track the physical link when operating in in-band
> mode with autonegotiation disabled. The SerDes has no link interrupt
> wired up, so the PCS sets its poll flag.
>
> Tested on a Mercusys MR80X v2.20, where the RTL8367S is connected to
> the SoC over SGMII.
Ah nice conversion to phylink PCS :) I have a few comments below
>
> Suggested-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
> Suggested-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
> Suggested-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
> Signed-off-by: Johan Alvarado <contact@c127.dev>
> ---
[...]
> +static int rtl8365mb_pcs_config(struct phylink_pcs *pcs, unsigned int neg_mode,
> + phy_interface_t interface,
> + const unsigned long *advertising,
> + bool permit_pause_to_mac)
> +{
> + const int id = RTL8365MB_SDS_EXT_INTERFACE_ID;
> + struct rtl8365mb *mb = pcs_to_rtl8365mb(pcs);
> + struct realtek_priv *priv;
> + u16 val;
> + int ret;
> + int i;
> +
> + priv = mb->priv;
> +
> + /* This driver does not implement SGMII in-band autonegotiation yet, so
> + * the link parameters are forced from rtl8365mb_pcs_link_up() instead.
> + * rtl8365mb_pcs_inband_caps() reports this to phylink, which should
> + * therefore never select an in-band-enabled negotiation mode.
> + */
> + if (neg_mode == PHYLINK_PCS_NEG_INBAND_ENABLED)
> + return -EOPNOTSUPP;
As you implement the .pcs_inband_caps() method, phylink will pass you a valid
mode, no need for that check :)
[...]
> @@ -1218,14 +1680,46 @@ static void rtl8365mb_phylink_mac_link_up(struct phylink_config *config,
> p = &mb->ports[port];
> schedule_delayed_work(&p->mib_work, 0);
>
> - if (phy_interface_mode_is_rgmii(interface)) {
> + /* The SerDes forced link state is programmed by the PCS in
> + * rtl8365mb_pcs_link_up(); here only the MAC external interface force
> + * is configured, for both RGMII and SerDes.
> + */
> + if (phy_interface_mode_is_rgmii(interface) ||
> + rtl8365mb_interface_is_serdes(interface)) {
> ret = rtl8365mb_ext_config_forcemode(priv, port, true, speed,
> duplex, tx_pause,
> rx_pause);
> - if (ret)
> + if (ret) {
> dev_err(priv->dev,
> "failed to force mode on port %d: %pe\n", port,
> ERR_PTR(ret));
> + return;
> + }
> +
> + /* The SerDes has its own pause controls; program them from
> + * the resolved pause modes, as the vendor driver does when
> + * forcing the link on a SerDes external interface. This is
> + * done here rather than in rtl8365mb_pcs_link_up() because
> + * pcs_link_up() carries no pause information.
> + */
> + if (rtl8365mb_interface_is_serdes(interface)) {
> + u32 val = 0;
> +
> + if (tx_pause)
> + val |= RTL8365MB_SDS_MISC_SGMII_TXFC_MASK;
> + if (rx_pause)
> + val |= RTL8365MB_SDS_MISC_SGMII_RXFC_MASK;
Do you know what this does in HW ? Is this so that the PCS lets the Pause frames through
in either directions ?
I suspect this is something that would be only used for inband advertising
of pause settings (in such case, you don't even need that), but ofc I'm not sure :)
You already configure the MAC pause settings, can you test that these bits actually do
anything by exercising a bit flow control and checking if these registers are used ?
Otherwise, this is looking pretty good :)
Maxime
^ permalink raw reply
* Re: [PATCH v4 3/5] drm/xe/ras: Add support for error threshold
From: Tauro, Riana @ 2026-07-03 7:30 UTC (permalink / raw)
To: Raag Jadav, intel-xe, dri-devel, netdev
Cc: simona.vetter, airlied, kuba, lijo.lazar, Hawking.Zhang, davem,
pabeni, edumazet, dev, zachary.mckevitt, rodrigo.vivi,
michal.wajdeczko, matthew.d.roper, mallesh.koujalagi
In-Reply-To: <20260623101043.255897-4-raag.jadav@intel.com>
On 23-06-2026 15:39, Raag Jadav wrote:
> System controller allows getting/setting per counter threshold for
> correctable errors, which it uses to raise error events to the driver.
> Get/set it using the respective mailbox command.
>
> Signed-off-by: Raag Jadav <raag.jadav@intel.com>
Reviewed-by: Riana Tauro <riana.tauro@intel.com>
> ---
> v2: Add RAS operation status codes (Riana)
> v3: Reuse status codes and uapi mapping from counter series (Riana)
> Access request/response counter using local pointer (Riana)
> Mark unused field as reserved (Riana)
> v4: Make debug logs consistent (Riana)
> Update kdoc (Riana)
> ---
> drivers/gpu/drm/xe/xe_ras.c | 105 ++++++++++++++++++
> drivers/gpu/drm/xe/xe_ras.h | 2 +
> drivers/gpu/drm/xe/xe_ras_types.h | 51 +++++++++
> drivers/gpu/drm/xe/xe_sysctrl_mailbox_types.h | 4 +
> 4 files changed, 162 insertions(+)
>
> diff --git a/drivers/gpu/drm/xe/xe_ras.c b/drivers/gpu/drm/xe/xe_ras.c
> index 44f4e1a3455b..afee8202d24e 100644
> --- a/drivers/gpu/drm/xe/xe_ras.c
> +++ b/drivers/gpu/drm/xe/xe_ras.c
> @@ -270,6 +270,111 @@ int xe_ras_clear_counter(struct xe_device *xe, u8 severity, u8 component)
> return 0;
> }
>
> +/**
> + * xe_ras_get_threshold() - Get error counter threshold
> + * @xe: Xe device instance
> + * @severity: Error severity to be queried (&enum drm_xe_ras_error_severity)
> + * @component: Error component to be queried (&enum drm_xe_ras_error_component)
> + * @threshold: Counter threshold
> + *
> + * This function retrieves the error threshold of a specific counter based on
> + * severity and component.
> + *
> + * Return: 0 on success, negative error code on failure.
> + */
> +int xe_ras_get_threshold(struct xe_device *xe, u8 severity, u8 component, u32 *threshold)
> +{
> + struct xe_ras_get_threshold_response response = {};
> + struct xe_ras_get_threshold_request request = {};
> + struct xe_sysctrl_mailbox_command command = {};
> + struct xe_ras_error_class *counter;
> + size_t len;
> + int ret;
> +
> + counter = &request.counter;
> + counter->common.severity = drm_to_xe_ras_severity(severity);
> + counter->common.component = drm_to_xe_ras_component(component);
> +
> + xe_sysctrl_create_command(&command, XE_SYSCTRL_GROUP_GFSP, XE_SYSCTRL_CMD_GET_THRESHOLD,
> + &request, sizeof(request), &response, sizeof(response));
> +
> + guard(xe_pm_runtime)(xe);
> + ret = xe_sysctrl_send_command(&xe->sc, &command, &len);
> + if (ret) {
> + xe_err(xe, "sysctrl: failed to get threshold %d\n", ret);
> + return ret;
> + }
> +
> + if (len != sizeof(response)) {
> + xe_err(xe, "sysctrl: unexpected get threshold response length %zu (expected %zu)\n",
> + len, sizeof(response));
> + return -EIO;
> + }
> +
> + counter = &response.counter;
> + *threshold = response.threshold;
> +
> + xe_dbg(xe, "[RAS]: get threshold %u for %s %s\n", *threshold,
> + comp_to_str(counter->common.component), sev_to_str(counter->common.severity));
> + return 0;
> +}
> +
> +/**
> + * xe_ras_set_threshold() - Set error counter threshold
> + * @xe: Xe device instance
> + * @severity: Error severity to be set (&enum drm_xe_ras_error_severity)
> + * @component: Error component to be set (&enum drm_xe_ras_error_component)
> + * @threshold: Counter threshold
> + *
> + * This function sets the error threshold of a specific counter based on
> + * severity and component.
> + *
> + * Return: 0 on success, negative error code on failure.
> + */
> +int xe_ras_set_threshold(struct xe_device *xe, u8 severity, u8 component, u32 threshold)
> +{
> + struct xe_ras_set_threshold_response response = {};
> + struct xe_ras_set_threshold_request request = {};
> + struct xe_sysctrl_mailbox_command command = {};
> + struct xe_ras_error_class *counter;
> + size_t len;
> + int ret;
> +
> + counter = &request.counter;
> + counter->common.severity = drm_to_xe_ras_severity(severity);
> + counter->common.component = drm_to_xe_ras_component(component);
> + request.threshold = threshold;
> +
> + xe_sysctrl_create_command(&command, XE_SYSCTRL_GROUP_GFSP, XE_SYSCTRL_CMD_SET_THRESHOLD,
> + &request, sizeof(request), &response, sizeof(response));
> +
> + guard(xe_pm_runtime)(xe);
> + ret = xe_sysctrl_send_command(&xe->sc, &command, &len);
> + if (ret) {
> + xe_err(xe, "sysctrl: failed to set threshold %d\n", ret);
> + return ret;
> + }
> +
> + if (len != sizeof(response)) {
> + xe_err(xe, "sysctrl: unexpected set threshold response length %zu (expected %zu)\n",
> + len, sizeof(response));
> + return -EIO;
> + }
> +
> + ret = ras_status_to_errno(response.status);
> + if (ret) {
> + xe_err(xe, "sysctrl: set threshold command failed with status %#x\n",
> + response.status);
> + return ret;
> + }
> +
> + counter = &response.counter;
> +
> + xe_dbg(xe, "[RAS]: set threshold %u for %s %s\n", response.threshold,
> + comp_to_str(counter->common.component), sev_to_str(counter->common.severity));
> + return 0;
> +}
> +
> /**
> * xe_ras_init - Initialize Xe RAS
> * @xe: xe device instance
> diff --git a/drivers/gpu/drm/xe/xe_ras.h b/drivers/gpu/drm/xe/xe_ras.h
> index ba0b0224df23..1aa43c54b710 100644
> --- a/drivers/gpu/drm/xe/xe_ras.h
> +++ b/drivers/gpu/drm/xe/xe_ras.h
> @@ -15,6 +15,8 @@ void xe_ras_counter_threshold_crossed(struct xe_device *xe,
> struct xe_sysctrl_event_response *response);
> int xe_ras_get_counter(struct xe_device *xe, u8 severity, u8 component, u32 *value);
> int xe_ras_clear_counter(struct xe_device *xe, u8 severity, u8 component);
> +int xe_ras_get_threshold(struct xe_device *xe, u8 severity, u8 component, u32 *threshold);
> +int xe_ras_set_threshold(struct xe_device *xe, u8 severity, u8 component, u32 threshold);
> void xe_ras_init(struct xe_device *xe);
>
> #endif
> diff --git a/drivers/gpu/drm/xe/xe_ras_types.h b/drivers/gpu/drm/xe/xe_ras_types.h
> index 6688e11f57a8..747b651880cd 100644
> --- a/drivers/gpu/drm/xe/xe_ras_types.h
> +++ b/drivers/gpu/drm/xe/xe_ras_types.h
> @@ -121,4 +121,55 @@ struct xe_ras_clear_counter_response {
> /** @reserved1: Reserved for future use */
> u32 reserved1[3];
> } __packed;
> +
> +/**
> + * struct xe_ras_get_threshold_request - Request structure for get threshold
> + */
> +struct xe_ras_get_threshold_request {
> + /** @counter: Counter to get threshold for */
> + struct xe_ras_error_class counter;
> + /** @reserved: Reserved for future use */
> + u32 reserved;
> +} __packed;
> +
> +/**
> + * struct xe_ras_get_threshold_response - Response structure for get threshold
> + */
> +struct xe_ras_get_threshold_response {
> + /** @counter: Counter ID */
> + struct xe_ras_error_class counter;
> + /** @threshold: Current threshold of the counter */
> + u32 threshold;
> + /** @reserved: Reserved for future use */
> + u32 reserved[4];
> +} __packed;
> +
> +/**
> + * struct xe_ras_set_threshold_request - Request structure for set threshold
> + */
> +struct xe_ras_set_threshold_request {
> + /** @counter: Counter to set threshold for */
> + struct xe_ras_error_class counter;
> + /** @threshold: Threshold to be set */
> + u32 threshold;
> + /** @reserved: Reserved for future use */
> + u32 reserved;
> +} __packed;
> +
> +/**
> + * struct xe_ras_set_threshold_response - Response structure for set threshold
> + */
> +struct xe_ras_set_threshold_response {
> + /** @counter: Counter ID */
> + struct xe_ras_error_class counter;
> + /** @reserved: Reserved */
> + u32 reserved;
> + /** @threshold: Updated threshold */
> + u32 threshold;
> + /** @status: Operation status */
> + u32 status;
> + /** @reserved1: Reserved for future use */
> + u32 reserved1[2];
> +} __packed;
> +
> #endif
> diff --git a/drivers/gpu/drm/xe/xe_sysctrl_mailbox_types.h b/drivers/gpu/drm/xe/xe_sysctrl_mailbox_types.h
> index 6e3753554510..10f06aa5c4b5 100644
> --- a/drivers/gpu/drm/xe/xe_sysctrl_mailbox_types.h
> +++ b/drivers/gpu/drm/xe/xe_sysctrl_mailbox_types.h
> @@ -24,11 +24,15 @@ enum xe_sysctrl_group {
> *
> * @XE_SYSCTRL_CMD_GET_COUNTER: Get error counter value
> * @XE_SYSCTRL_CMD_CLEAR_COUNTER: Clear error counter value
> + * @XE_SYSCTRL_CMD_GET_THRESHOLD: Retrieve error threshold
> + * @XE_SYSCTRL_CMD_SET_THRESHOLD: Set error threshold
> * @XE_SYSCTRL_CMD_GET_PENDING_EVENT: Retrieve pending event
> */
> enum xe_sysctrl_gfsp_cmd {
> XE_SYSCTRL_CMD_GET_COUNTER = 0x03,
> XE_SYSCTRL_CMD_CLEAR_COUNTER = 0x04,
> + XE_SYSCTRL_CMD_GET_THRESHOLD = 0x05,
> + XE_SYSCTRL_CMD_SET_THRESHOLD = 0x06,
> XE_SYSCTRL_CMD_GET_PENDING_EVENT = 0x07,
> };
>
^ permalink raw reply
* [PATCH net-next 00/12] net: dsa: support for inband management of switches
From: Luke Howard @ 2026-07-03 7:30 UTC (permalink / raw)
To: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Vivien Didelot, Gregory CLEMENT, Andrew Lunn,
Simon Horman, Florian Fainelli, Tobias Waldekranz
Cc: Cedric Jehasse, Kieran Tyrrell, Max Holtmann, Max Hunter,
Christoph Mellauner, Simon Gapp, Ryan Wilkins, Mattias Forsblad,
netdev, linux-kernel, Luke Howard, Christian Marangi
This patch set shephards a series of commits made by Andrew Lunn
and others to support inband management of DSA switches. [1]
Specifically, it allows the switch itself to be managed using
DSA tagged frames instead of MDIO. MDIO is typically required
to enable inband management. An implementation is included for
the qca8k driver.
This is patch set one of four: the remaining sets add support
for the Remote Management Unit (RMU) in the mv88e6xxx, and then
general and mv88e6xxx support for "inband-only" mode where MDIO
is unavailable on the hardware.
Note: the patch to validate the source trunk against lags_len
was previously submitted and rejected, but I am including it as
the issue has been triggered when running in inband mode.
[1] https://github.com/lunn/linux/tree/v6.15-rc2-next-next-inband
Signed-off-by: Luke Howard <lukeh@padl.com>
---
Andrew Lunn (10):
net: dsa: qca8k: Move register access completion into DSA core
net: dsa: qca8K: Move queuing for request frame into the core
net: dsa: qca8k: dsa_inband_request: More normal return values
net: dsa: qca8k: Drop replies with wrong sequence numbers
net: dsa: qca8k: Move request sequence number handling into core
net: dsa: qca8k: Refactor sequence number mismatch to use error code
net: dsa: qca8k: Pass error code from reply decoder to requester
net: dsa: qca8k: Update error handling
net: dsa: qca8k: Move inband mutex into DSA core
net: dsa: Add helper to find ds_switch by index
Christian Marangi (1):
net: dsa: qca8k: drop redundant mgmt_eth_data
Luke Howard (1):
net: dsa: validate source trunk against lags_len
drivers/net/dsa/qca/qca8k-8xxx.c | 238 +++++++++----------------------------
drivers/net/dsa/qca/qca8k-common.c | 2 +-
drivers/net/dsa/qca/qca8k.h | 12 +-
include/net/dsa.h | 36 ++++++
net/dsa/dsa.c | 109 +++++++++++++++++
net/dsa/tag.h | 14 +++
6 files changed, 220 insertions(+), 191 deletions(-)
---
base-commit: 2bb62a85aff6d4c14a62a476dfabaada3c1cc014
change-id: 20260612-net-next-dsa-rmu-5cbb0f10ab8b
Best regards,
--
Luke Howard <lukeh@padl.com>
^ permalink raw reply
* [PATCH net-next 01/12] net: dsa: qca8k: Move register access completion into DSA core
From: Luke Howard @ 2026-07-03 7:30 UTC (permalink / raw)
To: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Vivien Didelot, Gregory CLEMENT, Andrew Lunn,
Simon Horman, Florian Fainelli, Tobias Waldekranz
Cc: Cedric Jehasse, Kieran Tyrrell, Max Holtmann, Max Hunter,
Christoph Mellauner, Simon Gapp, Ryan Wilkins, Mattias Forsblad,
netdev, linux-kernel, Luke Howard
In-Reply-To: <20260703-net-next-dsa-rmu-v1-0-a03febf20bb4@padl.com>
From: Andrew Lunn <andrew@lunn.ch>
When performing operations on a remote switch using Ethernet frames, a
completion is used between the sender of the request and the code
which receives the reply.
Move this completion into the DSA core, simplifying the driver. The
initialisation and reinitialisation of the completion is now performed
in the core. Also, the conversion of milliseconds to jiffies is also
in the core.
The MIB access via left untouched because it is not a simple
request/reply protocol.
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
---
drivers/net/dsa/qca/qca8k-8xxx.c | 43 +++++++++++++++-------------------------
drivers/net/dsa/qca/qca8k.h | 4 ++--
include/net/dsa.h | 12 +++++++++++
net/dsa/dsa.c | 22 ++++++++++++++++++++
4 files changed, 52 insertions(+), 29 deletions(-)
diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c
index 4c928983b8623..fe6fb69b6f92f 100644
--- a/drivers/net/dsa/qca/qca8k-8xxx.c
+++ b/drivers/net/dsa/qca/qca8k-8xxx.c
@@ -212,7 +212,7 @@ static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb)
}
}
- complete(&mgmt_eth_data->rw_done);
+ dsa_inband_complete(&mgmt_eth_data->inband);
}
static struct sk_buff *qca8k_alloc_mdio_header(enum mdio_cmd cmd, u32 reg, u32 *val,
@@ -332,8 +332,6 @@ static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
skb->dev = priv->mgmt_conduit;
- reinit_completion(&mgmt_eth_data->rw_done);
-
/* Increment seq_num and set it in the mdio pkt */
mgmt_eth_data->seq++;
qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
@@ -341,8 +339,8 @@ static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
dev_queue_xmit(skb);
- ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
- QCA8K_ETHERNET_TIMEOUT);
+ ret = dsa_inband_wait_for_completion(&mgmt_eth_data->inband,
+ QCA8K_ETHERNET_TIMEOUT);
*val = mgmt_eth_data->data[0];
if (len > QCA_HDR_MGMT_DATA1_LEN)
@@ -384,8 +382,6 @@ static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
skb->dev = priv->mgmt_conduit;
- reinit_completion(&mgmt_eth_data->rw_done);
-
/* Increment seq_num and set it in the mdio pkt */
mgmt_eth_data->seq++;
qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
@@ -393,8 +389,8 @@ static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
dev_queue_xmit(skb);
- ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
- QCA8K_ETHERNET_TIMEOUT);
+ ret = dsa_inband_wait_for_completion(&mgmt_eth_data->inband,
+ QCA8K_ETHERNET_TIMEOUT);
ack = mgmt_eth_data->ack;
@@ -594,8 +590,6 @@ qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
if (!skb)
return -ENOMEM;
- reinit_completion(&mgmt_eth_data->rw_done);
-
/* Increment seq_num and set it in the copy pkt */
mgmt_eth_data->seq++;
qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
@@ -603,8 +597,8 @@ qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
dev_queue_xmit(skb);
- ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
- QCA8K_ETHERNET_TIMEOUT);
+ ret = dsa_inband_wait_for_completion(&mgmt_eth_data->inband,
+ QCA8K_ETHERNET_TIMEOUT);
ack = mgmt_eth_data->ack;
@@ -696,8 +690,6 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
clear_skb->dev = mgmt_conduit;
write_skb->dev = mgmt_conduit;
- reinit_completion(&mgmt_eth_data->rw_done);
-
/* Increment seq_num and set it in the write pkt */
mgmt_eth_data->seq++;
qca8k_mdio_header_fill_seq_num(write_skb, mgmt_eth_data->seq);
@@ -705,8 +697,8 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
dev_queue_xmit(write_skb);
- ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
- QCA8K_ETHERNET_TIMEOUT);
+ ret = dsa_inband_wait_for_completion(&mgmt_eth_data->inband,
+ QCA8K_ETHERNET_TIMEOUT);
ack = mgmt_eth_data->ack;
@@ -733,8 +725,6 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
}
if (read) {
- reinit_completion(&mgmt_eth_data->rw_done);
-
/* Increment seq_num and set it in the read pkt */
mgmt_eth_data->seq++;
qca8k_mdio_header_fill_seq_num(read_skb, mgmt_eth_data->seq);
@@ -742,8 +732,8 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
dev_queue_xmit(read_skb);
- ret = wait_for_completion_timeout(&mgmt_eth_data->rw_done,
- QCA8K_ETHERNET_TIMEOUT);
+ ret = dsa_inband_wait_for_completion(&mgmt_eth_data->inband,
+ QCA8K_ETHERNET_TIMEOUT);
ack = mgmt_eth_data->ack;
@@ -762,8 +752,6 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
kfree_skb(read_skb);
}
exit:
- reinit_completion(&mgmt_eth_data->rw_done);
-
/* Increment seq_num and set it in the clear pkt */
mgmt_eth_data->seq++;
qca8k_mdio_header_fill_seq_num(clear_skb, mgmt_eth_data->seq);
@@ -771,8 +759,8 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
dev_queue_xmit(clear_skb);
- wait_for_completion_timeout(&mgmt_eth_data->rw_done,
- QCA8K_ETHERNET_TIMEOUT);
+ dsa_inband_wait_for_completion(&mgmt_eth_data->inband,
+ QCA8K_ETHERNET_TIMEOUT);
mutex_unlock(&mgmt_eth_data->mutex);
mutex_unlock(&priv->bus->mdio_lock);
@@ -1728,7 +1716,8 @@ qca8k_get_ethtool_stats_eth(struct dsa_switch *ds, int port, u64 *data)
if (ret)
goto exit;
- ret = wait_for_completion_timeout(&mib_eth_data->rw_done, QCA8K_ETHERNET_TIMEOUT);
+ ret = wait_for_completion_timeout(&mib_eth_data->rw_done,
+ msecs_to_jiffies(QCA8K_ETHERNET_TIMEOUT));
exit:
mutex_unlock(&mib_eth_data->mutex);
@@ -2105,7 +2094,7 @@ qca8k_sw_probe(struct mdio_device *mdiodev)
return -ENOMEM;
mutex_init(&priv->mgmt_eth_data.mutex);
- init_completion(&priv->mgmt_eth_data.rw_done);
+ dsa_inband_init(&priv->mgmt_eth_data.inband);
mutex_init(&priv->mib_eth_data.mutex);
init_completion(&priv->mib_eth_data.rw_done);
diff --git a/drivers/net/dsa/qca/qca8k.h b/drivers/net/dsa/qca/qca8k.h
index 9563388930325..938f2c9ff0cac 100644
--- a/drivers/net/dsa/qca/qca8k.h
+++ b/drivers/net/dsa/qca/qca8k.h
@@ -16,7 +16,7 @@
#define QCA8K_ETHERNET_MDIO_PRIORITY 7
#define QCA8K_ETHERNET_PHY_PRIORITY 6
-#define QCA8K_ETHERNET_TIMEOUT msecs_to_jiffies(5)
+#define QCA8K_ETHERNET_TIMEOUT 5
#define QCA8K_NUM_PORTS 7
#define QCA8K_NUM_CPU_PORTS 2
@@ -392,7 +392,7 @@ enum {
};
struct qca8k_mgmt_eth_data {
- struct completion rw_done;
+ struct dsa_inband inband;
struct mutex mutex; /* Enforce one mdio read/write at time */
bool ack;
u32 seq;
diff --git a/include/net/dsa.h b/include/net/dsa.h
index 8c16ef23cc102..9b0c109b3058a 100644
--- a/include/net/dsa.h
+++ b/include/net/dsa.h
@@ -7,6 +7,7 @@
#ifndef __LINUX_NET_DSA_H
#define __LINUX_NET_DSA_H
+#include <linux/completion.h>
#include <linux/if.h>
#include <linux/if_ether.h>
#include <linux/list.h>
@@ -1347,6 +1348,17 @@ int dsa_port_simple_hsr_join(struct dsa_switch *ds, int port,
int dsa_port_simple_hsr_leave(struct dsa_switch *ds, int port,
struct net_device *hsr);
+/* Perform operations on a switch by sending it request in Ethernet
+ * frames and expecting a response in a frame.
+ */
+struct dsa_inband {
+ struct completion completion;
+};
+
+void dsa_inband_init(struct dsa_inband *inband);
+void dsa_inband_complete(struct dsa_inband *inband);
+int dsa_inband_wait_for_completion(struct dsa_inband *inband, int timeout_ms);
+
/* Keep inline for faster access in hot path */
static inline bool netdev_uses_dsa(const struct net_device *dev)
{
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 9cb732f6b1e3e..dc4e5cdb2f5b2 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -1834,6 +1834,28 @@ int dsa_port_simple_hsr_leave(struct dsa_switch *ds, int port,
}
EXPORT_SYMBOL_GPL(dsa_port_simple_hsr_leave);
+void dsa_inband_init(struct dsa_inband *inband)
+{
+ init_completion(&inband->completion);
+}
+EXPORT_SYMBOL_GPL(dsa_inband_init);
+
+void dsa_inband_complete(struct dsa_inband *inband)
+{
+ complete(&inband->completion);
+}
+EXPORT_SYMBOL_GPL(dsa_inband_complete);
+
+int dsa_inband_wait_for_completion(struct dsa_inband *inband, int timeout_ms)
+{
+ unsigned long jiffies = msecs_to_jiffies(timeout_ms);
+
+ reinit_completion(&inband->completion);
+
+ return wait_for_completion_timeout(&inband->completion, jiffies);
+}
+EXPORT_SYMBOL_GPL(dsa_inband_wait_for_completion);
+
static const struct dsa_stubs __dsa_stubs = {
.conduit_hwtstamp_validate = __dsa_conduit_hwtstamp_validate,
};
--
2.43.0
^ permalink raw reply related
* [PATCH net-next 02/12] net: dsa: qca8K: Move queuing for request frame into the core
From: Luke Howard @ 2026-07-03 7:30 UTC (permalink / raw)
To: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Vivien Didelot, Gregory CLEMENT, Andrew Lunn,
Simon Horman, Florian Fainelli, Tobias Waldekranz
Cc: Cedric Jehasse, Kieran Tyrrell, Max Holtmann, Max Hunter,
Christoph Mellauner, Simon Gapp, Ryan Wilkins, Mattias Forsblad,
netdev, linux-kernel, Luke Howard
In-Reply-To: <20260703-net-next-dsa-rmu-v1-0-a03febf20bb4@padl.com>
From: Andrew Lunn <andrew@lunn.ch>
Combine the queuing of the request and waiting for the completion into
one core helper. Add the function dsa_rmu_request() to perform this.
Access to statistics is not a strict request/reply, so the
dsa_rmu_wait_for_completion needs to be kept.
It is also no possible to combine dsa_rmu_request() and
dsa_rmu_wait_for_completion() since we need to avoid the race of
sending the request, receiving a reply, and the completion has not
been reinitialised because the schedule at decided to do other things.
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
---
drivers/net/dsa/qca/qca8k-8xxx.c | 32 ++++++++++----------------------
include/net/dsa.h | 2 ++
net/dsa/dsa.c | 31 +++++++++++++++++++++++++++++++
3 files changed, 43 insertions(+), 22 deletions(-)
diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c
index fe6fb69b6f92f..4da6094552f1e 100644
--- a/drivers/net/dsa/qca/qca8k-8xxx.c
+++ b/drivers/net/dsa/qca/qca8k-8xxx.c
@@ -337,10 +337,8 @@ static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
mgmt_eth_data->ack = false;
- dev_queue_xmit(skb);
-
- ret = dsa_inband_wait_for_completion(&mgmt_eth_data->inband,
- QCA8K_ETHERNET_TIMEOUT);
+ ret = dsa_inband_request(&mgmt_eth_data->inband, skb,
+ QCA8K_ETHERNET_TIMEOUT);
*val = mgmt_eth_data->data[0];
if (len > QCA_HDR_MGMT_DATA1_LEN)
@@ -387,10 +385,8 @@ static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
mgmt_eth_data->ack = false;
- dev_queue_xmit(skb);
-
- ret = dsa_inband_wait_for_completion(&mgmt_eth_data->inband,
- QCA8K_ETHERNET_TIMEOUT);
+ ret = dsa_inband_request(&mgmt_eth_data->inband, skb,
+ QCA8K_ETHERNET_TIMEOUT);
ack = mgmt_eth_data->ack;
@@ -595,10 +591,8 @@ qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
mgmt_eth_data->ack = false;
- dev_queue_xmit(skb);
-
- ret = dsa_inband_wait_for_completion(&mgmt_eth_data->inband,
- QCA8K_ETHERNET_TIMEOUT);
+ ret = dsa_inband_request(&mgmt_eth_data->inband, skb,
+ QCA8K_ETHERNET_TIMEOUT);
ack = mgmt_eth_data->ack;
@@ -695,10 +689,8 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
qca8k_mdio_header_fill_seq_num(write_skb, mgmt_eth_data->seq);
mgmt_eth_data->ack = false;
- dev_queue_xmit(write_skb);
-
- ret = dsa_inband_wait_for_completion(&mgmt_eth_data->inband,
- QCA8K_ETHERNET_TIMEOUT);
+ ret = dsa_inband_request(&mgmt_eth_data->inband, write_skb,
+ QCA8K_ETHERNET_TIMEOUT);
ack = mgmt_eth_data->ack;
@@ -730,10 +722,8 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
qca8k_mdio_header_fill_seq_num(read_skb, mgmt_eth_data->seq);
mgmt_eth_data->ack = false;
- dev_queue_xmit(read_skb);
-
- ret = dsa_inband_wait_for_completion(&mgmt_eth_data->inband,
- QCA8K_ETHERNET_TIMEOUT);
+ ret = dsa_inband_request(&mgmt_eth_data->inband, read_skb,
+ QCA8K_ETHERNET_TIMEOUT);
ack = mgmt_eth_data->ack;
@@ -757,8 +747,6 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
qca8k_mdio_header_fill_seq_num(clear_skb, mgmt_eth_data->seq);
mgmt_eth_data->ack = false;
- dev_queue_xmit(clear_skb);
-
dsa_inband_wait_for_completion(&mgmt_eth_data->inband,
QCA8K_ETHERNET_TIMEOUT);
diff --git a/include/net/dsa.h b/include/net/dsa.h
index 9b0c109b3058a..6b5aeb99ec3bb 100644
--- a/include/net/dsa.h
+++ b/include/net/dsa.h
@@ -1357,6 +1357,8 @@ struct dsa_inband {
void dsa_inband_init(struct dsa_inband *inband);
void dsa_inband_complete(struct dsa_inband *inband);
+int dsa_inband_request(struct dsa_inband *inband, struct sk_buff *skb,
+ int timeout_ms);
int dsa_inband_wait_for_completion(struct dsa_inband *inband, int timeout_ms);
/* Keep inline for faster access in hot path */
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index dc4e5cdb2f5b2..534e391fac7b5 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -1856,6 +1856,37 @@ int dsa_inband_wait_for_completion(struct dsa_inband *inband, int timeout_ms)
}
EXPORT_SYMBOL_GPL(dsa_inband_wait_for_completion);
+/* dsa_inband_request - send an inband request frame and wait for the reply.
+ * @inband: inband state for the switch
+ * @skb: request frame; ownership is transferred to this function
+ * @insert_seqno: optional callback to stamp the sequence number into @skb
+ * @resp: buffer to receive the reply payload, or NULL if none is expected
+ * @resp_len: size of @resp in bytes
+ * @timeout_ms: how long to wait for the reply, in milliseconds
+ *
+ * Serialise against other inband operations, transmit @skb and wait for the
+ * matching reply handed back via dsa_inband_complete().
+ *
+ * Return the number of response bytes copied into @resp (0 when no response
+ * is expected) on success, or a negative errno (-EOPNOTSUPP if the conduit
+ * is down, -ETIMEDOUT if no reply arrived, or an error from the completer).
+ *
+ * Cannot use dsa_inband_wait_for_completion() since the completion needs to
+ * be reinitialised before the skb is queued, to avoid races.
+ */
+int dsa_inband_request(struct dsa_inband *inband, struct sk_buff *skb,
+ int timeout_ms)
+{
+ unsigned long jiffies = msecs_to_jiffies(timeout_ms);
+
+ reinit_completion(&inband->completion);
+
+ dev_queue_xmit(skb);
+
+ return wait_for_completion_timeout(&inband->completion, jiffies);
+}
+EXPORT_SYMBOL_GPL(dsa_inband_request);
+
static const struct dsa_stubs __dsa_stubs = {
.conduit_hwtstamp_validate = __dsa_conduit_hwtstamp_validate,
};
--
2.43.0
^ permalink raw reply related
* [PATCH net-next 03/12] net: dsa: qca8k: dsa_inband_request: More normal return values
From: Luke Howard @ 2026-07-03 7:30 UTC (permalink / raw)
To: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Vivien Didelot, Gregory CLEMENT, Andrew Lunn,
Simon Horman, Florian Fainelli, Tobias Waldekranz
Cc: Cedric Jehasse, Kieran Tyrrell, Max Holtmann, Max Hunter,
Christoph Mellauner, Simon Gapp, Ryan Wilkins, Mattias Forsblad,
netdev, linux-kernel, Luke Howard
In-Reply-To: <20260703-net-next-dsa-rmu-v1-0-a03febf20bb4@padl.com>
From: Andrew Lunn <andrew@lunn.ch>
wait_for_completion_timeout() has unusual return values. If it times
out, it returns 0, and on success it returns the number of remaining
jiffies for the timeout.
For the use case here, the remaining time is not needed. All that is
really interesting is, it succeeded and returns 0, or a timeout.
Massage the return value to fit this, and modify the callers to the
more usual pattern of ret < 0 is an error.
Sending the clear message is expected to fail, so don't check the
return value, and add a comment about this.
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
---
v2
Remove check on the clear message.
wait_for_completion_timeout() does not return negative values
---
drivers/net/dsa/qca/qca8k-8xxx.c | 24 +++++++++++-------------
net/dsa/dsa.c | 6 +++++-
2 files changed, 16 insertions(+), 14 deletions(-)
diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c
index 4da6094552f1e..b0cbe72c15b4c 100644
--- a/drivers/net/dsa/qca/qca8k-8xxx.c
+++ b/drivers/net/dsa/qca/qca8k-8xxx.c
@@ -348,8 +348,8 @@ static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
mutex_unlock(&mgmt_eth_data->mutex);
- if (ret <= 0)
- return -ETIMEDOUT;
+ if (ret)
+ return ret;
if (!ack)
return -EINVAL;
@@ -392,8 +392,8 @@ static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
mutex_unlock(&mgmt_eth_data->mutex);
- if (ret <= 0)
- return -ETIMEDOUT;
+ if (ret)
+ return ret;
if (!ack)
return -EINVAL;
@@ -596,8 +596,8 @@ qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
ack = mgmt_eth_data->ack;
- if (ret <= 0)
- return -ETIMEDOUT;
+ if (ret)
+ return ret;
if (!ack)
return -EINVAL;
@@ -694,8 +694,7 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
ack = mgmt_eth_data->ack;
- if (ret <= 0) {
- ret = -ETIMEDOUT;
+ if (ret) {
kfree_skb(read_skb);
goto exit;
}
@@ -727,10 +726,8 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
ack = mgmt_eth_data->ack;
- if (ret <= 0) {
- ret = -ETIMEDOUT;
+ if (ret)
goto exit;
- }
if (!ack) {
ret = -EINVAL;
@@ -747,8 +744,9 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
qca8k_mdio_header_fill_seq_num(clear_skb, mgmt_eth_data->seq);
mgmt_eth_data->ack = false;
- dsa_inband_wait_for_completion(&mgmt_eth_data->inband,
- QCA8K_ETHERNET_TIMEOUT);
+ /* This is expected to fail sometimes, so don't check return value. */
+ dsa_inband_request(&mgmt_eth_data->inband, clear_skb,
+ QCA8K_ETHERNET_TIMEOUT);
mutex_unlock(&mgmt_eth_data->mutex);
mutex_unlock(&priv->bus->mdio_lock);
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 534e391fac7b5..f6ae11b06b4ab 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -1878,12 +1878,16 @@ int dsa_inband_request(struct dsa_inband *inband, struct sk_buff *skb,
int timeout_ms)
{
unsigned long jiffies = msecs_to_jiffies(timeout_ms);
+ int ret;
reinit_completion(&inband->completion);
dev_queue_xmit(skb);
- return wait_for_completion_timeout(&inband->completion, jiffies);
+ ret = wait_for_completion_timeout(&inband->completion, jiffies);
+ if (ret == 0)
+ return -ETIMEDOUT;
+ return 0;
}
EXPORT_SYMBOL_GPL(dsa_inband_request);
--
2.43.0
^ permalink raw reply related
* [PATCH net-next 04/12] net: dsa: qca8k: Drop replies with wrong sequence numbers
From: Luke Howard @ 2026-07-03 7:30 UTC (permalink / raw)
To: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Vivien Didelot, Gregory CLEMENT, Andrew Lunn,
Simon Horman, Florian Fainelli, Tobias Waldekranz
Cc: Cedric Jehasse, Kieran Tyrrell, Max Holtmann, Max Hunter,
Christoph Mellauner, Simon Gapp, Ryan Wilkins, Mattias Forsblad,
netdev, linux-kernel, Luke Howard
In-Reply-To: <20260703-net-next-dsa-rmu-v1-0-a03febf20bb4@padl.com>
From: Andrew Lunn <andrew@lunn.ch>
A response with the wrong sequence number is likely to be a late
arriving responses, which the driver has already given up waiting for.
Drop it rather than signalling the complete. If the complete was
signalled, this late response could take the place of the genuine
reply which is soon to follow.
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
---
drivers/net/dsa/qca/qca8k-8xxx.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c
index b0cbe72c15b4c..3b3fe96016176 100644
--- a/drivers/net/dsa/qca/qca8k-8xxx.c
+++ b/drivers/net/dsa/qca/qca8k-8xxx.c
@@ -185,9 +185,9 @@ static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb)
/* We can ignore odd value, we always round up them in the alloc function. */
len *= sizeof(u16);
- /* Make sure the seq match the requested packet */
- if (get_unaligned_le32(&mgmt_ethhdr->seq) == mgmt_eth_data->seq)
- mgmt_eth_data->ack = true;
+ /* Make sure the seq match the requested packet. If not, drop. */
+ if (get_unaligned_le32(&mgmt_ethhdr->seq) != mgmt_eth_data->seq)
+ return;
if (cmd == MDIO_READ) {
u32 *val = mgmt_eth_data->data;
--
2.43.0
^ permalink raw reply related
* [PATCH net-next 05/12] net: dsa: qca8k: Move request sequence number handling into core
From: Luke Howard @ 2026-07-03 7:30 UTC (permalink / raw)
To: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Vivien Didelot, Gregory CLEMENT, Andrew Lunn,
Simon Horman, Florian Fainelli, Tobias Waldekranz
Cc: Cedric Jehasse, Kieran Tyrrell, Max Holtmann, Max Hunter,
Christoph Mellauner, Simon Gapp, Ryan Wilkins, Mattias Forsblad,
netdev, linux-kernel, Luke Howard
In-Reply-To: <20260703-net-next-dsa-rmu-v1-0-a03febf20bb4@padl.com>
From: Andrew Lunn <andrew@lunn.ch>
Each request/reply frame is likely to have a sequence number so that
request and the reply can be matched together. Move this sequence
number into the inband structure. The driver must provide a helper to
insert the sequence number into the skb, and the core will perform the
increment.
To allow different devices to have different size sequence numbers, a
mask is provided. This can be used for example to reduce the u32
sequence number down to a u8.
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
---
drivers/net/dsa/qca/qca8k-8xxx.c | 29 +++++++++--------------------
drivers/net/dsa/qca/qca8k.h | 1 -
include/net/dsa.h | 6 +++++-
net/dsa/dsa.c | 16 +++++++++++++++-
4 files changed, 29 insertions(+), 23 deletions(-)
diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c
index 3b3fe96016176..fc5070402188e 100644
--- a/drivers/net/dsa/qca/qca8k-8xxx.c
+++ b/drivers/net/dsa/qca/qca8k-8xxx.c
@@ -186,7 +186,8 @@ static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb)
len *= sizeof(u16);
/* Make sure the seq match the requested packet. If not, drop. */
- if (get_unaligned_le32(&mgmt_ethhdr->seq) != mgmt_eth_data->seq)
+ if (get_unaligned_le32(&mgmt_ethhdr->seq) !=
+ dsa_inband_seqno(&mgmt_eth_data->inband))
return;
if (cmd == MDIO_READ) {
@@ -332,12 +333,10 @@ static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
skb->dev = priv->mgmt_conduit;
- /* Increment seq_num and set it in the mdio pkt */
- mgmt_eth_data->seq++;
- qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
mgmt_eth_data->ack = false;
ret = dsa_inband_request(&mgmt_eth_data->inband, skb,
+ qca8k_mdio_header_fill_seq_num,
QCA8K_ETHERNET_TIMEOUT);
*val = mgmt_eth_data->data[0];
@@ -380,12 +379,10 @@ static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
skb->dev = priv->mgmt_conduit;
- /* Increment seq_num and set it in the mdio pkt */
- mgmt_eth_data->seq++;
- qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
mgmt_eth_data->ack = false;
ret = dsa_inband_request(&mgmt_eth_data->inband, skb,
+ qca8k_mdio_header_fill_seq_num,
QCA8K_ETHERNET_TIMEOUT);
ack = mgmt_eth_data->ack;
@@ -586,12 +583,10 @@ qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
if (!skb)
return -ENOMEM;
- /* Increment seq_num and set it in the copy pkt */
- mgmt_eth_data->seq++;
- qca8k_mdio_header_fill_seq_num(skb, mgmt_eth_data->seq);
mgmt_eth_data->ack = false;
ret = dsa_inband_request(&mgmt_eth_data->inband, skb,
+ qca8k_mdio_header_fill_seq_num,
QCA8K_ETHERNET_TIMEOUT);
ack = mgmt_eth_data->ack;
@@ -684,12 +679,10 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
clear_skb->dev = mgmt_conduit;
write_skb->dev = mgmt_conduit;
- /* Increment seq_num and set it in the write pkt */
- mgmt_eth_data->seq++;
- qca8k_mdio_header_fill_seq_num(write_skb, mgmt_eth_data->seq);
mgmt_eth_data->ack = false;
ret = dsa_inband_request(&mgmt_eth_data->inband, write_skb,
+ qca8k_mdio_header_fill_seq_num,
QCA8K_ETHERNET_TIMEOUT);
ack = mgmt_eth_data->ack;
@@ -716,12 +709,10 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
}
if (read) {
- /* Increment seq_num and set it in the read pkt */
- mgmt_eth_data->seq++;
- qca8k_mdio_header_fill_seq_num(read_skb, mgmt_eth_data->seq);
mgmt_eth_data->ack = false;
ret = dsa_inband_request(&mgmt_eth_data->inband, read_skb,
+ qca8k_mdio_header_fill_seq_num,
QCA8K_ETHERNET_TIMEOUT);
ack = mgmt_eth_data->ack;
@@ -739,13 +730,11 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
kfree_skb(read_skb);
}
exit:
- /* Increment seq_num and set it in the clear pkt */
- mgmt_eth_data->seq++;
- qca8k_mdio_header_fill_seq_num(clear_skb, mgmt_eth_data->seq);
mgmt_eth_data->ack = false;
/* This is expected to fail sometimes, so don't check return value. */
dsa_inband_request(&mgmt_eth_data->inband, clear_skb,
+ qca8k_mdio_header_fill_seq_num,
QCA8K_ETHERNET_TIMEOUT);
mutex_unlock(&mgmt_eth_data->mutex);
@@ -2080,7 +2069,7 @@ qca8k_sw_probe(struct mdio_device *mdiodev)
return -ENOMEM;
mutex_init(&priv->mgmt_eth_data.mutex);
- dsa_inband_init(&priv->mgmt_eth_data.inband);
+ dsa_inband_init(&priv->mgmt_eth_data.inband, U32_MAX);
mutex_init(&priv->mib_eth_data.mutex);
init_completion(&priv->mib_eth_data.rw_done);
diff --git a/drivers/net/dsa/qca/qca8k.h b/drivers/net/dsa/qca/qca8k.h
index 938f2c9ff0cac..1054ba1c7e590 100644
--- a/drivers/net/dsa/qca/qca8k.h
+++ b/drivers/net/dsa/qca/qca8k.h
@@ -395,7 +395,6 @@ struct qca8k_mgmt_eth_data {
struct dsa_inband inband;
struct mutex mutex; /* Enforce one mdio read/write at time */
bool ack;
- u32 seq;
u32 data[4];
};
diff --git a/include/net/dsa.h b/include/net/dsa.h
index 6b5aeb99ec3bb..cdf2487397c2b 100644
--- a/include/net/dsa.h
+++ b/include/net/dsa.h
@@ -1353,13 +1353,17 @@ int dsa_port_simple_hsr_leave(struct dsa_switch *ds, int port,
*/
struct dsa_inband {
struct completion completion;
+ u32 seqno;
+ u32 seqno_mask;
};
-void dsa_inband_init(struct dsa_inband *inband);
+void dsa_inband_init(struct dsa_inband *inband, u32 seqno_mask);
void dsa_inband_complete(struct dsa_inband *inband);
int dsa_inband_request(struct dsa_inband *inband, struct sk_buff *skb,
+ void (*insert_seqno)(struct sk_buff *skb, u32 seqno),
int timeout_ms);
int dsa_inband_wait_for_completion(struct dsa_inband *inband, int timeout_ms);
+u32 dsa_inband_seqno(struct dsa_inband *inband);
/* Keep inline for faster access in hot path */
static inline bool netdev_uses_dsa(const struct net_device *dev)
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index f6ae11b06b4ab..98a75ee08f011 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -1834,9 +1834,11 @@ int dsa_port_simple_hsr_leave(struct dsa_switch *ds, int port,
}
EXPORT_SYMBOL_GPL(dsa_port_simple_hsr_leave);
-void dsa_inband_init(struct dsa_inband *inband)
+void dsa_inband_init(struct dsa_inband *inband, u32 seqno_mask)
{
init_completion(&inband->completion);
+ inband->seqno_mask = seqno_mask;
+ inband->seqno = 0;
}
EXPORT_SYMBOL_GPL(dsa_inband_init);
@@ -1875,11 +1877,17 @@ EXPORT_SYMBOL_GPL(dsa_inband_wait_for_completion);
* be reinitialised before the skb is queued, to avoid races.
*/
int dsa_inband_request(struct dsa_inband *inband, struct sk_buff *skb,
+ void (*insert_seqno)(struct sk_buff *skb, u32 seqno),
int timeout_ms)
{
unsigned long jiffies = msecs_to_jiffies(timeout_ms);
int ret;
+ if (insert_seqno) {
+ WRITE_ONCE(inband->seqno, inband->seqno + 1);
+ insert_seqno(skb, inband->seqno & inband->seqno_mask);
+ }
+
reinit_completion(&inband->completion);
dev_queue_xmit(skb);
@@ -1891,6 +1899,12 @@ int dsa_inband_request(struct dsa_inband *inband, struct sk_buff *skb,
}
EXPORT_SYMBOL_GPL(dsa_inband_request);
+u32 dsa_inband_seqno(struct dsa_inband *inband)
+{
+ return READ_ONCE(inband->seqno) & inband->seqno_mask;
+}
+EXPORT_SYMBOL_GPL(dsa_inband_seqno);
+
static const struct dsa_stubs __dsa_stubs = {
.conduit_hwtstamp_validate = __dsa_conduit_hwtstamp_validate,
};
--
2.43.0
^ permalink raw reply related
* [PATCH net-next 06/12] net: dsa: qca8k: Refactor sequence number mismatch to use error code
From: Luke Howard @ 2026-07-03 7:30 UTC (permalink / raw)
To: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Vivien Didelot, Gregory CLEMENT, Andrew Lunn,
Simon Horman, Florian Fainelli, Tobias Waldekranz
Cc: Cedric Jehasse, Kieran Tyrrell, Max Holtmann, Max Hunter,
Christoph Mellauner, Simon Gapp, Ryan Wilkins, Mattias Forsblad,
netdev, linux-kernel, Luke Howard
In-Reply-To: <20260703-net-next-dsa-rmu-v1-0-a03febf20bb4@padl.com>
From: Andrew Lunn <andrew@lunn.ch>
Replace the boolean that the sequence numbers matches with an error
code. Now that responses with the wrong sequence number are dropped,
this is actually unused in this driver. However, other devices can
perform additional validation of a response with the correct sequence
number and potentially return -EPROTO to indicate some other sort of
error.
The value is only safe to use if the completion happens. Ensure the
return from the completion is always considered, and if it fails, a
timeout error is returned.
This is a preparation step to moving the error tracking into the DSA
core. This intermediate step is a bit ugly, but that all gets cleaned
up in the next patch.
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
---
v2
-ret -> err
Extended commit message warning the code is ugly
Point out it is not actually used by this driver
---
drivers/net/dsa/qca/qca8k-8xxx.c | 49 ++++++++++++++++------------------------
drivers/net/dsa/qca/qca8k.h | 2 +-
2 files changed, 20 insertions(+), 31 deletions(-)
diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c
index fc5070402188e..499cc8ef5ddea 100644
--- a/drivers/net/dsa/qca/qca8k-8xxx.c
+++ b/drivers/net/dsa/qca/qca8k-8xxx.c
@@ -314,7 +314,7 @@ static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
{
struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
struct sk_buff *skb;
- bool ack;
+ int err;
int ret;
skb = qca8k_alloc_mdio_header(MDIO_READ, reg, NULL,
@@ -333,8 +333,6 @@ static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
skb->dev = priv->mgmt_conduit;
- mgmt_eth_data->ack = false;
-
ret = dsa_inband_request(&mgmt_eth_data->inband, skb,
qca8k_mdio_header_fill_seq_num,
QCA8K_ETHERNET_TIMEOUT);
@@ -343,15 +341,15 @@ static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
if (len > QCA_HDR_MGMT_DATA1_LEN)
memcpy(val + 1, mgmt_eth_data->data + 1, len - QCA_HDR_MGMT_DATA1_LEN);
- ack = mgmt_eth_data->ack;
+ err = mgmt_eth_data->err;
mutex_unlock(&mgmt_eth_data->mutex);
if (ret)
return ret;
- if (!ack)
- return -EINVAL;
+ if (err)
+ return err;
return 0;
}
@@ -360,7 +358,7 @@ static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
{
struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
struct sk_buff *skb;
- bool ack;
+ int err;
int ret;
skb = qca8k_alloc_mdio_header(MDIO_WRITE, reg, val,
@@ -379,21 +377,19 @@ static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
skb->dev = priv->mgmt_conduit;
- mgmt_eth_data->ack = false;
-
ret = dsa_inband_request(&mgmt_eth_data->inband, skb,
qca8k_mdio_header_fill_seq_num,
QCA8K_ETHERNET_TIMEOUT);
- ack = mgmt_eth_data->ack;
+ err = mgmt_eth_data->err;
mutex_unlock(&mgmt_eth_data->mutex);
if (ret)
return ret;
- if (!ack)
- return -EINVAL;
+ if (err)
+ return err;
return 0;
}
@@ -577,25 +573,23 @@ qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
struct sk_buff *read_skb, u32 *val)
{
struct sk_buff *skb = skb_copy(read_skb, GFP_KERNEL);
- bool ack;
+ int err;
int ret;
if (!skb)
return -ENOMEM;
- mgmt_eth_data->ack = false;
-
ret = dsa_inband_request(&mgmt_eth_data->inband, skb,
qca8k_mdio_header_fill_seq_num,
QCA8K_ETHERNET_TIMEOUT);
- ack = mgmt_eth_data->ack;
+ err = mgmt_eth_data->err;
if (ret)
return ret;
- if (!ack)
- return -EINVAL;
+ if (err)
+ return err;
*val = mgmt_eth_data->data[0];
@@ -611,7 +605,7 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
u32 write_val, clear_val = 0, val;
struct net_device *mgmt_conduit;
int ret, ret1;
- bool ack;
+ int err;
if (regnum >= QCA8K_MDIO_MASTER_MAX_REG)
return -EINVAL;
@@ -679,21 +673,19 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
clear_skb->dev = mgmt_conduit;
write_skb->dev = mgmt_conduit;
- mgmt_eth_data->ack = false;
-
ret = dsa_inband_request(&mgmt_eth_data->inband, write_skb,
qca8k_mdio_header_fill_seq_num,
QCA8K_ETHERNET_TIMEOUT);
- ack = mgmt_eth_data->ack;
+ err = mgmt_eth_data->err;
if (ret) {
kfree_skb(read_skb);
goto exit;
}
- if (!ack) {
- ret = -EINVAL;
+ if (err) {
+ ret = err;
kfree_skb(read_skb);
goto exit;
}
@@ -709,19 +701,17 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
}
if (read) {
- mgmt_eth_data->ack = false;
-
ret = dsa_inband_request(&mgmt_eth_data->inband, read_skb,
qca8k_mdio_header_fill_seq_num,
QCA8K_ETHERNET_TIMEOUT);
- ack = mgmt_eth_data->ack;
+ err = mgmt_eth_data->err;
if (ret)
goto exit;
- if (!ack) {
- ret = -EINVAL;
+ if (err) {
+ ret = err;
goto exit;
}
@@ -730,7 +720,6 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
kfree_skb(read_skb);
}
exit:
- mgmt_eth_data->ack = false;
/* This is expected to fail sometimes, so don't check return value. */
dsa_inband_request(&mgmt_eth_data->inband, clear_skb,
diff --git a/drivers/net/dsa/qca/qca8k.h b/drivers/net/dsa/qca/qca8k.h
index 1054ba1c7e590..4c055aef674c2 100644
--- a/drivers/net/dsa/qca/qca8k.h
+++ b/drivers/net/dsa/qca/qca8k.h
@@ -394,7 +394,7 @@ enum {
struct qca8k_mgmt_eth_data {
struct dsa_inband inband;
struct mutex mutex; /* Enforce one mdio read/write at time */
- bool ack;
+ int err;
u32 data[4];
};
--
2.43.0
^ permalink raw reply related
* [PATCH net-next 07/12] net: dsa: qca8k: Pass error code from reply decoder to requester
From: Luke Howard @ 2026-07-03 7:30 UTC (permalink / raw)
To: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Vivien Didelot, Gregory CLEMENT, Andrew Lunn,
Simon Horman, Florian Fainelli, Tobias Waldekranz
Cc: Cedric Jehasse, Kieran Tyrrell, Max Holtmann, Max Hunter,
Christoph Mellauner, Simon Gapp, Ryan Wilkins, Mattias Forsblad,
netdev, linux-kernel, Luke Howard
In-Reply-To: <20260703-net-next-dsa-rmu-v1-0-a03febf20bb4@padl.com>
From: Andrew Lunn <andrew@lunn.ch>
The code which decodes the frame and signals the complete can detect
error within the reply, such as fields have unexpected values. Pass an
error code between the completer and the function waiting on the
complete. This simplifies the error handling, since all errors are
combined into one place.
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
---
v2:
Remove EPROTO if the sequence numbers don't match, drop the reply
---
drivers/net/dsa/qca/qca8k-8xxx.c | 70 +++++++++++++---------------------------
drivers/net/dsa/qca/qca8k.h | 2 --
include/net/dsa.h | 13 +++++++-
net/dsa/dsa.c | 33 +++++++++++++++++--
4 files changed, 65 insertions(+), 53 deletions(-)
diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c
index 499cc8ef5ddea..ffa3b1ba23bed 100644
--- a/drivers/net/dsa/qca/qca8k-8xxx.c
+++ b/drivers/net/dsa/qca/qca8k-8xxx.c
@@ -167,6 +167,8 @@ static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb)
struct qca_mgmt_ethhdr *mgmt_ethhdr;
u32 command;
u8 len, cmd;
+ u32 data[4];
+ int err = 0;
int i;
mgmt_ethhdr = (struct qca_mgmt_ethhdr *)skb_mac_header(skb);
@@ -191,7 +193,7 @@ static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb)
return;
if (cmd == MDIO_READ) {
- u32 *val = mgmt_eth_data->data;
+ u32 *val = &data[0];
*val = get_unaligned_le32(&mgmt_ethhdr->mdio_data);
@@ -213,7 +215,7 @@ static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb)
}
}
- dsa_inband_complete(&mgmt_eth_data->inband);
+ dsa_inband_complete(&mgmt_eth_data->inband, &data, sizeof(data), err);
}
static struct sk_buff *qca8k_alloc_mdio_header(enum mdio_cmd cmd, u32 reg, u32 *val,
@@ -314,7 +316,7 @@ static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
{
struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
struct sk_buff *skb;
- int err;
+ u32 data[4];
int ret;
skb = qca8k_alloc_mdio_header(MDIO_READ, reg, NULL,
@@ -335,30 +337,25 @@ static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
ret = dsa_inband_request(&mgmt_eth_data->inband, skb,
qca8k_mdio_header_fill_seq_num,
+ data, sizeof(data),
QCA8K_ETHERNET_TIMEOUT);
+ if (ret < 0)
+ goto out;
- *val = mgmt_eth_data->data[0];
+ *val = data[0];
if (len > QCA_HDR_MGMT_DATA1_LEN)
- memcpy(val + 1, mgmt_eth_data->data + 1, len - QCA_HDR_MGMT_DATA1_LEN);
-
- err = mgmt_eth_data->err;
+ memcpy(val + 1, &data[1], len - QCA_HDR_MGMT_DATA1_LEN);
+out:
mutex_unlock(&mgmt_eth_data->mutex);
- if (ret)
- return ret;
-
- if (err)
- return err;
-
- return 0;
+ return ret;
}
static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
{
struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
struct sk_buff *skb;
- int err;
int ret;
skb = qca8k_alloc_mdio_header(MDIO_WRITE, reg, val,
@@ -379,19 +376,12 @@ static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
ret = dsa_inband_request(&mgmt_eth_data->inband, skb,
qca8k_mdio_header_fill_seq_num,
+ NULL, 0,
QCA8K_ETHERNET_TIMEOUT);
- err = mgmt_eth_data->err;
-
mutex_unlock(&mgmt_eth_data->mutex);
- if (ret)
- return ret;
-
- if (err)
- return err;
-
- return 0;
+ return ret;
}
static int
@@ -573,7 +563,7 @@ qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
struct sk_buff *read_skb, u32 *val)
{
struct sk_buff *skb = skb_copy(read_skb, GFP_KERNEL);
- int err;
+ u32 data[4];
int ret;
if (!skb)
@@ -581,17 +571,13 @@ qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
ret = dsa_inband_request(&mgmt_eth_data->inband, skb,
qca8k_mdio_header_fill_seq_num,
+ data, sizeof(data),
QCA8K_ETHERNET_TIMEOUT);
- err = mgmt_eth_data->err;
-
if (ret)
return ret;
- if (err)
- return err;
-
- *val = mgmt_eth_data->data[0];
+ *val = data[0];
return 0;
}
@@ -604,8 +590,8 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
struct qca8k_mgmt_eth_data *mgmt_eth_data;
u32 write_val, clear_val = 0, val;
struct net_device *mgmt_conduit;
+ u32 resp_data[4];
int ret, ret1;
- int err;
if (regnum >= QCA8K_MDIO_MASTER_MAX_REG)
return -EINVAL;
@@ -675,21 +661,14 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
ret = dsa_inband_request(&mgmt_eth_data->inband, write_skb,
qca8k_mdio_header_fill_seq_num,
+ NULL, 0,
QCA8K_ETHERNET_TIMEOUT);
- err = mgmt_eth_data->err;
-
if (ret) {
kfree_skb(read_skb);
goto exit;
}
- if (err) {
- ret = err;
- kfree_skb(read_skb);
- goto exit;
- }
-
ret = read_poll_timeout(qca8k_phy_eth_busy_wait, ret1,
!(val & QCA8K_MDIO_MASTER_BUSY), 0,
QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC, false,
@@ -703,19 +682,13 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
if (read) {
ret = dsa_inband_request(&mgmt_eth_data->inband, read_skb,
qca8k_mdio_header_fill_seq_num,
+ resp_data, sizeof(resp_data),
QCA8K_ETHERNET_TIMEOUT);
- err = mgmt_eth_data->err;
-
if (ret)
goto exit;
- if (err) {
- ret = err;
- goto exit;
- }
-
- ret = mgmt_eth_data->data[0] & QCA8K_MDIO_MASTER_DATA_MASK;
+ ret = resp_data[0] & QCA8K_MDIO_MASTER_DATA_MASK;
} else {
kfree_skb(read_skb);
}
@@ -724,6 +697,7 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
/* This is expected to fail sometimes, so don't check return value. */
dsa_inband_request(&mgmt_eth_data->inband, clear_skb,
qca8k_mdio_header_fill_seq_num,
+ NULL, 0,
QCA8K_ETHERNET_TIMEOUT);
mutex_unlock(&mgmt_eth_data->mutex);
diff --git a/drivers/net/dsa/qca/qca8k.h b/drivers/net/dsa/qca/qca8k.h
index 4c055aef674c2..db89025b4243a 100644
--- a/drivers/net/dsa/qca/qca8k.h
+++ b/drivers/net/dsa/qca/qca8k.h
@@ -394,8 +394,6 @@ enum {
struct qca8k_mgmt_eth_data {
struct dsa_inband inband;
struct mutex mutex; /* Enforce one mdio read/write at time */
- int err;
- u32 data[4];
};
struct qca8k_mib_eth_data {
diff --git a/include/net/dsa.h b/include/net/dsa.h
index cdf2487397c2b..50ac6f0aa2e67 100644
--- a/include/net/dsa.h
+++ b/include/net/dsa.h
@@ -1350,17 +1350,28 @@ int dsa_port_simple_hsr_leave(struct dsa_switch *ds, int port,
/* Perform operations on a switch by sending it request in Ethernet
* frames and expecting a response in a frame.
+ *
+ * resp_lock protects resp and resp_len to ensure they are consistent.
+ * If there is a thread waiting for the response, resp will point to a
+ * buffer to copy the response to. If the thread has given up waiting,
+ * resp will be a NULL pointer.
*/
struct dsa_inband {
struct completion completion;
u32 seqno;
u32 seqno_mask;
+ int err;
+ spinlock_t resp_lock;
+ void *resp;
+ unsigned int resp_len;
};
void dsa_inband_init(struct dsa_inband *inband, u32 seqno_mask);
-void dsa_inband_complete(struct dsa_inband *inband);
+void dsa_inband_complete(struct dsa_inband *inband,
+ void *resp, unsigned int resp_len, int err);
int dsa_inband_request(struct dsa_inband *inband, struct sk_buff *skb,
void (*insert_seqno)(struct sk_buff *skb, u32 seqno),
+ void *resp, unsigned int resp_len,
int timeout_ms);
int dsa_inband_wait_for_completion(struct dsa_inband *inband, int timeout_ms);
u32 dsa_inband_seqno(struct dsa_inband *inband);
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 98a75ee08f011..3e480770854ca 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -1837,13 +1837,27 @@ EXPORT_SYMBOL_GPL(dsa_port_simple_hsr_leave);
void dsa_inband_init(struct dsa_inband *inband, u32 seqno_mask)
{
init_completion(&inband->completion);
+ spin_lock_init(&inband->resp_lock);
inband->seqno_mask = seqno_mask;
inband->seqno = 0;
}
EXPORT_SYMBOL_GPL(dsa_inband_init);
-void dsa_inband_complete(struct dsa_inband *inband)
+void dsa_inband_complete(struct dsa_inband *inband,
+ void *resp, unsigned int resp_len,
+ int err)
{
+ inband->err = err;
+
+ if (!err) {
+ spin_lock_bh(&inband->resp_lock);
+ resp_len = min(inband->resp_len, resp_len);
+ if (inband->resp && resp)
+ memcpy(inband->resp, resp, resp_len);
+ spin_unlock_bh(&inband->resp_lock);
+ inband->err = resp_len;
+ }
+
complete(&inband->completion);
}
EXPORT_SYMBOL_GPL(dsa_inband_complete);
@@ -1878,11 +1892,19 @@ EXPORT_SYMBOL_GPL(dsa_inband_wait_for_completion);
*/
int dsa_inband_request(struct dsa_inband *inband, struct sk_buff *skb,
void (*insert_seqno)(struct sk_buff *skb, u32 seqno),
+ void *resp, unsigned int resp_len,
int timeout_ms)
{
unsigned long jiffies = msecs_to_jiffies(timeout_ms);
int ret;
+ inband->err = 0;
+
+ spin_lock_bh(&inband->resp_lock);
+ inband->resp = resp;
+ inband->resp_len = resp_len;
+ spin_unlock_bh(&inband->resp_lock);
+
if (insert_seqno) {
WRITE_ONCE(inband->seqno, inband->seqno + 1);
insert_seqno(skb, inband->seqno & inband->seqno_mask);
@@ -1893,9 +1915,16 @@ int dsa_inband_request(struct dsa_inband *inband, struct sk_buff *skb,
dev_queue_xmit(skb);
ret = wait_for_completion_timeout(&inband->completion, jiffies);
+
+ spin_lock_bh(&inband->resp_lock);
+ inband->resp = NULL;
+ inband->resp_len = 0;
+ spin_unlock_bh(&inband->resp_lock);
+
if (ret == 0)
return -ETIMEDOUT;
- return 0;
+
+ return inband->err;
}
EXPORT_SYMBOL_GPL(dsa_inband_request);
--
2.43.0
^ permalink raw reply related
* [PATCH net-next 08/12] net: dsa: qca8k: Update error handling
From: Luke Howard @ 2026-07-03 7:30 UTC (permalink / raw)
To: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Vivien Didelot, Gregory CLEMENT, Andrew Lunn,
Simon Horman, Florian Fainelli, Tobias Waldekranz
Cc: Cedric Jehasse, Kieran Tyrrell, Max Holtmann, Max Hunter,
Christoph Mellauner, Simon Gapp, Ryan Wilkins, Mattias Forsblad,
netdev, linux-kernel, Luke Howard
In-Reply-To: <20260703-net-next-dsa-rmu-v1-0-a03febf20bb4@padl.com>
From: Andrew Lunn <andrew@lunn.ch>
Now that dsa_inband_request() can return positive values for the
length of the received reply, the return value checking needs to
change. This driver only uses short messages, and it is unlikely the
hardware will actually receive messages of less then 64 bytes. So
don't check the message length. However, ensure the return value is
either a negative error code, or 0. Ensure all users of
dsa_inband_request() return either a negative error, or 0 on success,
so as not to change the API.
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
---
drivers/net/dsa/qca/qca8k-8xxx.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c
index ffa3b1ba23bed..94332497902c2 100644
--- a/drivers/net/dsa/qca/qca8k-8xxx.c
+++ b/drivers/net/dsa/qca/qca8k-8xxx.c
@@ -341,6 +341,7 @@ static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
QCA8K_ETHERNET_TIMEOUT);
if (ret < 0)
goto out;
+ ret = 0;
*val = data[0];
if (len > QCA_HDR_MGMT_DATA1_LEN)
@@ -574,7 +575,7 @@ qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
data, sizeof(data),
QCA8K_ETHERNET_TIMEOUT);
- if (ret)
+ if (ret < 0)
return ret;
*val = data[0];
@@ -664,7 +665,7 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
NULL, 0,
QCA8K_ETHERNET_TIMEOUT);
- if (ret) {
+ if (ret < 0) {
kfree_skb(read_skb);
goto exit;
}
@@ -685,7 +686,7 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
resp_data, sizeof(resp_data),
QCA8K_ETHERNET_TIMEOUT);
- if (ret)
+ if (ret < 0)
goto exit;
ret = resp_data[0] & QCA8K_MDIO_MASTER_DATA_MASK;
--
2.43.0
^ permalink raw reply related
* [PATCH net-next 09/12] net: dsa: qca8k: Move inband mutex into DSA core
From: Luke Howard @ 2026-07-03 7:30 UTC (permalink / raw)
To: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Vivien Didelot, Gregory CLEMENT, Andrew Lunn,
Simon Horman, Florian Fainelli, Tobias Waldekranz
Cc: Cedric Jehasse, Kieran Tyrrell, Max Holtmann, Max Hunter,
Christoph Mellauner, Simon Gapp, Ryan Wilkins, Mattias Forsblad,
netdev, linux-kernel, Luke Howard
In-Reply-To: <20260703-net-next-dsa-rmu-v1-0-a03febf20bb4@padl.com>
From: Andrew Lunn <andrew@lunn.ch>
The mutex serves two purposes:
It serialises operations on the switch, so that only one
request/response can be happening at once.
It protects priv->mgmt_master, which itself has two purposes. If the
hardware is wrongly wired, the wrong switch port is connected to the
cpu, inband cannot be used. In this case it has the value
NULL. Additionally, if the master is down, it is set to NULL.
Otherwise it points to the netdev used to send frames to the switch.
The protection of priv->mgmt_master is not required. It is a single
pointer, which will be updated atomically. It is not expected that the
interface disappears, it only goes down. Hence mgmt_master will always
be valid, or NULL.
Move the check for the master device being NULL into the core. Also,
move the mutex for serialisation into the core.
The MIB operations don't follow request/response semantics, so its
mutex is left untouched.
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
---
drivers/net/dsa/qca/qca8k-8xxx.c | 68 ++++++++------------------------------
drivers/net/dsa/qca/qca8k-common.c | 2 +-
drivers/net/dsa/qca/qca8k.h | 1 -
include/net/dsa.h | 4 +++
net/dsa/dsa.c | 9 +++++
5 files changed, 27 insertions(+), 57 deletions(-)
diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c
index 94332497902c2..14371c3c9a459 100644
--- a/drivers/net/dsa/qca/qca8k-8xxx.c
+++ b/drivers/net/dsa/qca/qca8k-8xxx.c
@@ -324,65 +324,39 @@ static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
if (!skb)
return -ENOMEM;
- mutex_lock(&mgmt_eth_data->mutex);
-
- /* Check if the mgmt_conduit if is operational */
- if (!priv->mgmt_conduit) {
- kfree_skb(skb);
- mutex_unlock(&mgmt_eth_data->mutex);
- return -EINVAL;
- }
-
- skb->dev = priv->mgmt_conduit;
+ skb->dev = READ_ONCE(priv->mgmt_conduit);
ret = dsa_inband_request(&mgmt_eth_data->inband, skb,
qca8k_mdio_header_fill_seq_num,
data, sizeof(data),
QCA8K_ETHERNET_TIMEOUT);
if (ret < 0)
- goto out;
+ return ret;
ret = 0;
*val = data[0];
if (len > QCA_HDR_MGMT_DATA1_LEN)
memcpy(val + 1, &data[1], len - QCA_HDR_MGMT_DATA1_LEN);
-out:
- mutex_unlock(&mgmt_eth_data->mutex);
-
- return ret;
+ return 0;
}
static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
{
struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
struct sk_buff *skb;
- int ret;
skb = qca8k_alloc_mdio_header(MDIO_WRITE, reg, val,
QCA8K_ETHERNET_MDIO_PRIORITY, len);
if (!skb)
return -ENOMEM;
- mutex_lock(&mgmt_eth_data->mutex);
+ skb->dev = READ_ONCE(priv->mgmt_conduit);
- /* Check if the mgmt_conduit if is operational */
- if (!priv->mgmt_conduit) {
- kfree_skb(skb);
- mutex_unlock(&mgmt_eth_data->mutex);
- return -EINVAL;
- }
-
- skb->dev = priv->mgmt_conduit;
-
- ret = dsa_inband_request(&mgmt_eth_data->inband, skb,
- qca8k_mdio_header_fill_seq_num,
- NULL, 0,
- QCA8K_ETHERNET_TIMEOUT);
-
- mutex_unlock(&mgmt_eth_data->mutex);
-
- return ret;
+ return dsa_inband_request(&mgmt_eth_data->inband, skb,
+ qca8k_mdio_header_fill_seq_num,
+ NULL, 0,
+ QCA8K_ETHERNET_TIMEOUT);
}
static int
@@ -484,7 +458,7 @@ qca8k_bulk_read(void *ctx, const void *reg_buf, size_t reg_len,
struct qca8k_priv *priv = ctx;
u32 reg = *(u16 *)reg_buf;
- if (priv->mgmt_conduit &&
+ if (READ_ONCE(priv->mgmt_conduit) &&
!qca8k_read_eth(priv, reg, val_buf, val_len))
return 0;
@@ -507,7 +481,7 @@ qca8k_bulk_gather_write(void *ctx, const void *reg_buf, size_t reg_len,
u32 reg = *(u16 *)reg_buf;
u32 *val = (u32 *)val_buf;
- if (priv->mgmt_conduit &&
+ if (READ_ONCE(priv->mgmt_conduit) &&
!qca8k_write_eth(priv, reg, val, val_len))
return 0;
@@ -645,17 +619,7 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
* 3. Get the data if we are reading
* 4. Reset the mdio master (even with error)
*/
- mutex_lock(&mgmt_eth_data->mutex);
-
- /* Check if mgmt_conduit is operational */
- mgmt_conduit = priv->mgmt_conduit;
- if (!mgmt_conduit) {
- mutex_unlock(&mgmt_eth_data->mutex);
- mutex_unlock(&priv->bus->mdio_lock);
- ret = -EINVAL;
- goto err_mgmt_conduit;
- }
-
+ mgmt_conduit = READ_ONCE(priv->mgmt_conduit);
read_skb->dev = mgmt_conduit;
clear_skb->dev = mgmt_conduit;
write_skb->dev = mgmt_conduit;
@@ -701,14 +665,10 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
NULL, 0,
QCA8K_ETHERNET_TIMEOUT);
- mutex_unlock(&mgmt_eth_data->mutex);
mutex_unlock(&priv->bus->mdio_lock);
return ret;
- /* Error handling before lock */
-err_mgmt_conduit:
- kfree_skb(read_skb);
err_read_skb:
kfree_skb(clear_skb);
err_clear_skb:
@@ -1698,13 +1658,12 @@ qca8k_conduit_change(struct dsa_switch *ds, const struct net_device *conduit,
if (dp->index != 0)
return;
- mutex_lock(&priv->mgmt_eth_data.mutex);
mutex_lock(&priv->mib_eth_data.mutex);
- priv->mgmt_conduit = operational ? (struct net_device *)conduit : NULL;
+ WRITE_ONCE(priv->mgmt_conduit,
+ operational ? (struct net_device *)conduit : NULL);
mutex_unlock(&priv->mib_eth_data.mutex);
- mutex_unlock(&priv->mgmt_eth_data.mutex);
}
static int qca8k_connect_tag_protocol(struct dsa_switch *ds,
@@ -2032,7 +1991,6 @@ qca8k_sw_probe(struct mdio_device *mdiodev)
if (!priv->ds)
return -ENOMEM;
- mutex_init(&priv->mgmt_eth_data.mutex);
dsa_inband_init(&priv->mgmt_eth_data.inband, U32_MAX);
mutex_init(&priv->mib_eth_data.mutex);
diff --git a/drivers/net/dsa/qca/qca8k-common.c b/drivers/net/dsa/qca/qca8k-common.c
index 13005f10edb7d..def2c44042d7b 100644
--- a/drivers/net/dsa/qca/qca8k-common.c
+++ b/drivers/net/dsa/qca/qca8k-common.c
@@ -499,7 +499,7 @@ void qca8k_get_ethtool_stats(struct dsa_switch *ds, int port,
u32 hi = 0;
int ret;
- if (priv->mgmt_conduit && priv->info->ops->autocast_mib &&
+ if (READ_ONCE(priv->mgmt_conduit) && priv->info->ops->autocast_mib &&
priv->info->ops->autocast_mib(ds, port, data) > 0)
return;
diff --git a/drivers/net/dsa/qca/qca8k.h b/drivers/net/dsa/qca/qca8k.h
index db89025b4243a..ccf92c85ccb14 100644
--- a/drivers/net/dsa/qca/qca8k.h
+++ b/drivers/net/dsa/qca/qca8k.h
@@ -393,7 +393,6 @@ enum {
struct qca8k_mgmt_eth_data {
struct dsa_inband inband;
- struct mutex mutex; /* Enforce one mdio read/write at time */
};
struct qca8k_mib_eth_data {
diff --git a/include/net/dsa.h b/include/net/dsa.h
index 50ac6f0aa2e67..af16347a3d331 100644
--- a/include/net/dsa.h
+++ b/include/net/dsa.h
@@ -1355,8 +1355,12 @@ int dsa_port_simple_hsr_leave(struct dsa_switch *ds, int port,
* If there is a thread waiting for the response, resp will point to a
* buffer to copy the response to. If the thread has given up waiting,
* resp will be a NULL pointer.
+ *
+ * The lock is used to serialise all inband operations. It also protects
+ * the seqno, which is incremented while holding the lock.
*/
struct dsa_inband {
+ struct mutex lock; /* Serialise operations */
struct completion completion;
u32 seqno;
u32 seqno_mask;
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 3e480770854ca..2a8d47eb58e13 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -1837,6 +1837,7 @@ EXPORT_SYMBOL_GPL(dsa_port_simple_hsr_leave);
void dsa_inband_init(struct dsa_inband *inband, u32 seqno_mask)
{
init_completion(&inband->completion);
+ mutex_init(&inband->lock);
spin_lock_init(&inband->resp_lock);
inband->seqno_mask = seqno_mask;
inband->seqno = 0;
@@ -1898,6 +1899,13 @@ int dsa_inband_request(struct dsa_inband *inband, struct sk_buff *skb,
unsigned long jiffies = msecs_to_jiffies(timeout_ms);
int ret;
+ if (!skb->dev) {
+ kfree_skb(skb);
+ return -EOPNOTSUPP;
+ }
+
+ mutex_lock(&inband->lock);
+
inband->err = 0;
spin_lock_bh(&inband->resp_lock);
@@ -1920,6 +1928,7 @@ int dsa_inband_request(struct dsa_inband *inband, struct sk_buff *skb,
inband->resp = NULL;
inband->resp_len = 0;
spin_unlock_bh(&inband->resp_lock);
+ mutex_unlock(&inband->lock);
if (ret == 0)
return -ETIMEDOUT;
--
2.43.0
^ permalink raw reply related
* [PATCH net-next 10/12] net: dsa: qca8k: drop redundant mgmt_eth_data
From: Luke Howard @ 2026-07-03 7:30 UTC (permalink / raw)
To: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Vivien Didelot, Gregory CLEMENT, Andrew Lunn,
Simon Horman, Florian Fainelli, Tobias Waldekranz
Cc: Cedric Jehasse, Kieran Tyrrell, Max Holtmann, Max Hunter,
Christoph Mellauner, Simon Gapp, Ryan Wilkins, Mattias Forsblad,
netdev, linux-kernel, Luke Howard, Christian Marangi
In-Reply-To: <20260703-net-next-dsa-rmu-v1-0-a03febf20bb4@padl.com>
From: Christian Marangi <ansuelsmth@gmail.com>
Now that we generalized inband logic and functions to dsa core, we can
drop the custom qca8k struct to handle inband mgmt and use directly the
dsa core dsa_inband struct in the priv struct.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
---
drivers/net/dsa/qca/qca8k-8xxx.c | 30 +++++++++++-------------------
drivers/net/dsa/qca/qca8k.h | 6 +-----
2 files changed, 12 insertions(+), 24 deletions(-)
diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c
index 14371c3c9a459..3314dff580316 100644
--- a/drivers/net/dsa/qca/qca8k-8xxx.c
+++ b/drivers/net/dsa/qca/qca8k-8xxx.c
@@ -162,7 +162,6 @@ qca8k_set_page(struct qca8k_priv *priv, u16 page)
static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb)
{
- struct qca8k_mgmt_eth_data *mgmt_eth_data;
struct qca8k_priv *priv = ds->priv;
struct qca_mgmt_ethhdr *mgmt_ethhdr;
u32 command;
@@ -172,7 +171,6 @@ static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb)
int i;
mgmt_ethhdr = (struct qca_mgmt_ethhdr *)skb_mac_header(skb);
- mgmt_eth_data = &priv->mgmt_eth_data;
command = get_unaligned_le32(&mgmt_ethhdr->command);
cmd = FIELD_GET(QCA_HDR_MGMT_CMD, command);
@@ -189,7 +187,7 @@ static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb)
/* Make sure the seq match the requested packet. If not, drop. */
if (get_unaligned_le32(&mgmt_ethhdr->seq) !=
- dsa_inband_seqno(&mgmt_eth_data->inband))
+ dsa_inband_seqno(&priv->inband))
return;
if (cmd == MDIO_READ) {
@@ -215,7 +213,7 @@ static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb)
}
}
- dsa_inband_complete(&mgmt_eth_data->inband, &data, sizeof(data), err);
+ dsa_inband_complete(&priv->inband, data, sizeof(data), err);
}
static struct sk_buff *qca8k_alloc_mdio_header(enum mdio_cmd cmd, u32 reg, u32 *val,
@@ -314,7 +312,6 @@ static void qca8k_mdio_header_fill_seq_num(struct sk_buff *skb, u32 seq_num)
static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
{
- struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
struct sk_buff *skb;
u32 data[4];
int ret;
@@ -326,7 +323,7 @@ static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
skb->dev = READ_ONCE(priv->mgmt_conduit);
- ret = dsa_inband_request(&mgmt_eth_data->inband, skb,
+ ret = dsa_inband_request(&priv->inband, skb,
qca8k_mdio_header_fill_seq_num,
data, sizeof(data),
QCA8K_ETHERNET_TIMEOUT);
@@ -343,7 +340,6 @@ static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
{
- struct qca8k_mgmt_eth_data *mgmt_eth_data = &priv->mgmt_eth_data;
struct sk_buff *skb;
skb = qca8k_alloc_mdio_header(MDIO_WRITE, reg, val,
@@ -353,7 +349,7 @@ static int qca8k_write_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len)
skb->dev = READ_ONCE(priv->mgmt_conduit);
- return dsa_inband_request(&mgmt_eth_data->inband, skb,
+ return dsa_inband_request(&priv->inband, skb,
qca8k_mdio_header_fill_seq_num,
NULL, 0,
QCA8K_ETHERNET_TIMEOUT);
@@ -534,7 +530,7 @@ static const struct regmap_config qca8k_regmap_config = {
};
static int
-qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
+qca8k_phy_eth_busy_wait(struct dsa_inband *inband,
struct sk_buff *read_skb, u32 *val)
{
struct sk_buff *skb = skb_copy(read_skb, GFP_KERNEL);
@@ -544,8 +540,7 @@ qca8k_phy_eth_busy_wait(struct qca8k_mgmt_eth_data *mgmt_eth_data,
if (!skb)
return -ENOMEM;
- ret = dsa_inband_request(&mgmt_eth_data->inband, skb,
- qca8k_mdio_header_fill_seq_num,
+ ret = dsa_inband_request(inband, skb, qca8k_mdio_header_fill_seq_num,
data, sizeof(data),
QCA8K_ETHERNET_TIMEOUT);
@@ -562,7 +557,6 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
int regnum, u16 data)
{
struct sk_buff *write_skb, *clear_skb, *read_skb;
- struct qca8k_mgmt_eth_data *mgmt_eth_data;
u32 write_val, clear_val = 0, val;
struct net_device *mgmt_conduit;
u32 resp_data[4];
@@ -571,8 +565,6 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
if (regnum >= QCA8K_MDIO_MASTER_MAX_REG)
return -EINVAL;
- mgmt_eth_data = &priv->mgmt_eth_data;
-
write_val = QCA8K_MDIO_MASTER_BUSY | QCA8K_MDIO_MASTER_EN |
QCA8K_MDIO_MASTER_PHY_ADDR(phy) |
QCA8K_MDIO_MASTER_REG_ADDR(regnum);
@@ -624,7 +616,7 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
clear_skb->dev = mgmt_conduit;
write_skb->dev = mgmt_conduit;
- ret = dsa_inband_request(&mgmt_eth_data->inband, write_skb,
+ ret = dsa_inband_request(&priv->inband, write_skb,
qca8k_mdio_header_fill_seq_num,
NULL, 0,
QCA8K_ETHERNET_TIMEOUT);
@@ -637,7 +629,7 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
ret = read_poll_timeout(qca8k_phy_eth_busy_wait, ret1,
!(val & QCA8K_MDIO_MASTER_BUSY), 0,
QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC, false,
- mgmt_eth_data, read_skb, &val);
+ &priv->inband, read_skb, &val);
if (ret < 0 && ret1 < 0) {
ret = ret1;
@@ -645,7 +637,7 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
}
if (read) {
- ret = dsa_inband_request(&mgmt_eth_data->inband, read_skb,
+ ret = dsa_inband_request(&priv->inband, read_skb,
qca8k_mdio_header_fill_seq_num,
resp_data, sizeof(resp_data),
QCA8K_ETHERNET_TIMEOUT);
@@ -660,7 +652,7 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,
exit:
/* This is expected to fail sometimes, so don't check return value. */
- dsa_inband_request(&mgmt_eth_data->inband, clear_skb,
+ dsa_inband_request(&priv->inband, clear_skb,
qca8k_mdio_header_fill_seq_num,
NULL, 0,
QCA8K_ETHERNET_TIMEOUT);
@@ -1991,7 +1983,7 @@ qca8k_sw_probe(struct mdio_device *mdiodev)
if (!priv->ds)
return -ENOMEM;
- dsa_inband_init(&priv->mgmt_eth_data.inband, U32_MAX);
+ dsa_inband_init(&priv->inband, U32_MAX);
mutex_init(&priv->mib_eth_data.mutex);
init_completion(&priv->mib_eth_data.rw_done);
diff --git a/drivers/net/dsa/qca/qca8k.h b/drivers/net/dsa/qca/qca8k.h
index ccf92c85ccb14..48bd5531d13e2 100644
--- a/drivers/net/dsa/qca/qca8k.h
+++ b/drivers/net/dsa/qca/qca8k.h
@@ -391,10 +391,6 @@ enum {
QCA8K_CPU_PORT6,
};
-struct qca8k_mgmt_eth_data {
- struct dsa_inband inband;
-};
-
struct qca8k_mib_eth_data {
struct completion rw_done;
struct mutex mutex; /* Process one command at time */
@@ -458,7 +454,7 @@ struct qca8k_priv {
struct device *dev;
struct gpio_desc *reset_gpio;
struct net_device *mgmt_conduit; /* Track if mdio/mib Ethernet is available */
- struct qca8k_mgmt_eth_data mgmt_eth_data;
+ struct dsa_inband inband;
struct qca8k_mib_eth_data mib_eth_data;
struct qca8k_mdio_cache mdio_cache;
struct qca8k_pcs pcs_port_0;
--
2.43.0
^ permalink raw reply related
* [PATCH net-next 11/12] net: dsa: Add helper to find ds_switch by index
From: Luke Howard @ 2026-07-03 7:30 UTC (permalink / raw)
To: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Vivien Didelot, Gregory CLEMENT, Andrew Lunn,
Simon Horman, Florian Fainelli, Tobias Waldekranz
Cc: Cedric Jehasse, Kieran Tyrrell, Max Holtmann, Max Hunter,
Christoph Mellauner, Simon Gapp, Ryan Wilkins, Mattias Forsblad,
netdev, linux-kernel, Luke Howard
In-Reply-To: <20260703-net-next-dsa-rmu-v1-0-a03febf20bb4@padl.com>
From: Andrew Lunn <andrew@lunn.ch>
The DSA header for an RMU frame includes the switch index to indicate
which switch sent the RMU frame. Add a helper which walks the list of
ports and finds the corresponding switch. Since this is not the hot
path for data frames, the overhead of multiple ports per switch is not
considered a problem.
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
---
net/dsa/tag.h | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/net/dsa/tag.h b/net/dsa/tag.h
index cf52283fe9df4..c21d746652601 100644
--- a/net/dsa/tag.h
+++ b/net/dsa/tag.h
@@ -44,6 +44,20 @@ static inline struct net_device *dsa_conduit_find_user(struct net_device *dev,
return NULL;
}
+static inline struct dsa_switch *dsa_conduit_find_switch(struct net_device *dev,
+ int device)
+{
+ struct dsa_port *cpu_dp = dev->dsa_ptr;
+ struct dsa_switch_tree *dst = cpu_dp->dst;
+ struct dsa_port *dp;
+
+ list_for_each_entry(dp, &dst->ports, list)
+ if (dp->ds->index == device)
+ return dp->ds;
+
+ return NULL;
+}
+
/**
* dsa_software_untag_vlan_aware_bridge: Software untagging for VLAN-aware bridge
* @skb: Pointer to received socket buffer (packet)
--
2.43.0
^ permalink raw reply related
* [PATCH net-next 12/12] net: dsa: validate source trunk against lags_len
From: Luke Howard @ 2026-07-03 7:30 UTC (permalink / raw)
To: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Vivien Didelot, Gregory CLEMENT, Andrew Lunn,
Simon Horman, Florian Fainelli, Tobias Waldekranz
Cc: Cedric Jehasse, Kieran Tyrrell, Max Holtmann, Max Hunter,
Christoph Mellauner, Simon Gapp, Ryan Wilkins, Mattias Forsblad,
netdev, linux-kernel, Luke Howard
In-Reply-To: <20260703-net-next-dsa-rmu-v1-0-a03febf20bb4@padl.com>
A DSA frame with an invalid source trunk ID could cause an out-of-bounds
read access of dst->lags.
Add a check to dsa_lag_by_id() to validate the LAG ID is not zero, and is
less than or equal to dst->lags_len. (The LAG ID is derived by adding one
to the source trunk ID.)
Note: this is in the fast path for any frames within a trunk.
Fixes: 5b60dadb71db ("net: dsa: tag_dsa: Support reception of packets from LAG devices")
Signed-off-by: Luke Howard <lukeh@padl.com>
---
include/net/dsa.h | 3 +++
1 file changed, 3 insertions(+)
diff --git a/include/net/dsa.h b/include/net/dsa.h
index af16347a3d331..9f01ea5bbd877 100644
--- a/include/net/dsa.h
+++ b/include/net/dsa.h
@@ -190,6 +190,9 @@ struct dsa_switch_tree {
static inline struct dsa_lag *dsa_lag_by_id(struct dsa_switch_tree *dst,
unsigned int id)
{
+ if (unlikely(id == 0 || id > dst->lags_len))
+ return NULL;
+
/* DSA LAG IDs are one-based, dst->lags is zero-based */
return dst->lags[id - 1];
}
--
2.43.0
^ permalink raw reply related
* Re: [PATCH net] net/stmmac: Set Rx queue page_pool to NULL when freeing DMA resources
From: Paolo Abeni @ 2026-07-03 7:26 UTC (permalink / raw)
To: j.raczynski
Cc: netdev, andrew+netdev, davem, edumazet, kuba, pabeni,
mcoquelin.stm32, linux-kernel, k.tegowski, k.domagalski,
yashwant.v
In-Reply-To: <20260630100953.747868-1-j.raczynski@samsung.com>
From: AI Reviewer <ai@example.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
Full review at: https://netdev-ai.bots.linux.dev/sashiko/
---
net/stmmac: Set Rx queue page_pool to NULL when freeing DMA resources
This patch makes __free_dma_rx_desc_resources() clear rx_q->page_pool
after destroying it, to avoid a kernel panic if a subsequent
reinitialization triggers another teardown while page_pool_create()
fails in __alloc_dma_rx_desc_resources().
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index 2a0d7eff88d3..6cc5a3496f39 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> @@ -2172,8 +2172,10 @@ static void __free_dma_rx_desc_resources(struct stmmac_priv *priv,
> xdp_rxq_info_unreg(&rx_q->xdp_rxq);
>
> kfree(rx_q->buf_pool);
> - if (rx_q->page_pool)
> + if (rx_q->page_pool) {
> page_pool_destroy(rx_q->page_pool);
> + rx_q->page_pool = NULL;
> + }
> }
[High]
Does this fix leave the other resources in __free_dma_rx_desc_resources()
exposed to the same crash class the commit message describes?
The same teardown function also frees rx_q->buf_pool, rx_q->dma_rx (or
rx_q->dma_erx), and uses rx_q->dma_rx_phy without ever clearing any of
those pointers:
static void __free_dma_rx_desc_resources(...)
{
...
if (rx_q->xsk_pool)
dma_free_rx_xskbufs(priv, dma_conf, queue);
else
dma_free_rx_skbufs(priv, dma_conf, queue);
...
if (priv->extend_desc)
addr = rx_q->dma_erx;
else
addr = rx_q->dma_rx;
size = stmmac_get_rx_desc_size(priv) * dma_conf->dma_rx_size;
dma_free_coherent(priv->device, size, addr, rx_q->dma_rx_phy);
...
kfree(rx_q->buf_pool);
if (rx_q->page_pool) {
page_pool_destroy(rx_q->page_pool);
rx_q->page_pool = NULL;
}
}
Consider the same failure scenario the commit message names (a
page_pool_create() failure during reinitialization), but applied to a
later queue.
After ifdown, __free_dma_rx_desc_resources() has run on every queue and
buf_pool, dma_rx/dma_erx, and dma_rx_phy are all stale dangling values
on every queue.
On ifup, __alloc_dma_rx_desc_resources() begins assigning fresh pointers
queue by queue:
rx_q->page_pool = page_pool_create(&pp_params);
if (IS_ERR(rx_q->page_pool)) {
ret = PTR_ERR(rx_q->page_pool);
rx_q->page_pool = NULL;
return ret;
}
rx_q->buf_pool = kzalloc_objs(*rx_q->buf_pool, ...);
...
addr = dma_alloc_coherent(priv->device, size, &rx_q->dma_rx_phy, ...);
...
If page_pool_create() fails on queue Q, the rollback in
alloc_dma_rx_desc_resources():
err_dma:
free_dma_rx_desc_resources(priv, dma_conf);
walks every queue including Q+1..N-1, where buf_pool, dma_rx/dma_erx and
dma_rx_phy still hold the stale values left behind by the prior
__free_dma_rx_desc_resources() call.
Does __free_dma_rx_desc_resources() on those queues then:
- read rx_q->buf_pool[i] in dma_free_rx_skbufs() ->
stmmac_free_rx_buffer() from already-freed slab memory:
static void stmmac_free_rx_buffer(...)
{
struct stmmac_rx_buffer *buf = &rx_q->buf_pool[i];
if (buf->page)
page_pool_put_full_page(rx_q->page_pool, buf->page, false);
...
}
- call dma_free_coherent() a second time on the stale
rx_q->dma_rx/dma_erx and rx_q->dma_rx_phy?
- call kfree() a second time on the stale rx_q->buf_pool?
Would also nulling rx_q->buf_pool, rx_q->dma_rx, rx_q->dma_erx, and
rx_q->dma_rx_phy in __free_dma_rx_desc_resources() (or having the alloc
path defensively reset them before any early return) be appropriate to
cover the same failure mode the commit message describes?
--
This is an AI-generated review.
^ permalink raw reply
* Re: [PATCH net] bnge/bng_re: fix ring ID widths
From: Paolo Abeni @ 2026-07-03 7:33 UTC (permalink / raw)
To: Vikas Gupta, davem, edumazet, kuba, andrew+netdev, horms
Cc: netdev, linux-kernel, linux-rdma, leonro, jgg, bhargava.marreddy,
rahul-rg.gupta, vsrama-krishna.nemani, rajashekar.hudumula,
ajit.khaparde, Siva Reddy Kallam, Dharmender Garg,
Yendapally Reddy Dhananjaya Reddy
In-Reply-To: <20260630101554.1221733-1-vikas.gupta@broadcom.com>
On 6/30/26 12:15 PM, Vikas Gupta wrote:
> diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_rmem.h b/drivers/net/ethernet/broadcom/bnge/bnge_rmem.h
> index 341c7f81ed09..bb0c79a1ee60 100644
> --- a/drivers/net/ethernet/broadcom/bnge/bnge_rmem.h
> +++ b/drivers/net/ethernet/broadcom/bnge/bnge_rmem.h
> @@ -184,7 +184,7 @@ struct bnge_ctx_mem_info {
> struct bnge_ring_struct {
> struct bnge_ring_mem_info ring_mem;
>
> - u16 fw_ring_id;
> + u32 fw_ring_id;
Sashiko gemini has a few concerns about the id size increases:
https://sashiko.dev/#/patchset/20260630101554.1221733-1-vikas.gupta%40broadcom.com
please have a look.
/P
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox