* Re: [PATCH net] sctp: validate stream count in sctp_process_strreset_inreq()
From: Xin Long @ 2026-07-08 21:20 UTC (permalink / raw)
To: Cen Zhang (Microsoft)
Cc: marcelo.leitner, davem, edumazet, kuba, pabeni, horms, linux-sctp,
netdev, linux-kernel, AutonomousCodeSecurity, tgopinath, kys
In-Reply-To: <20260707203215.2752-1-blbllhy@gmail.com>
On Tue, Jul 7, 2026 at 4:32 PM Cen Zhang (Microsoft) <blbllhy@gmail.com> wrote:
>
> When processing a RESET_IN_REQUEST from a peer,
> sctp_process_strreset_inreq() derives the stream count from the
> parameter length but does not check whether the resulting
> RESET_OUT_REQUEST response would exceed SCTP_MAX_CHUNK_LEN.
>
> The OUT request header (sctp_strreset_outreq, 16 bytes) is 8 bytes larger
> than the IN request header (sctp_strreset_inreq, 8 bytes). Generally, the
> IP payload is bounded to 65535 bytes, so the stream list cannot be
> large enough to trigger the overflow. However, on interfaces with MTU >
> 65535 (e.g., loopback with IPv6 jumbograms), a stream list that fits
> within the incoming IN parameter can cause a __u16 overflow in
> sctp_make_strreset_req() when computing the OUT response size, leading to
> an undersized skb allocation, raising a kernel BUG:
>
> net/core/skbuff.c:207 skb_panic
> net/core/skbuff.c:2625 skb_put
> net/sctp/sm_make_chunk.c:1535 sctp_addto_chunk
> net/sctp/sm_make_chunk.c:3695 sctp_make_strreset_req
> net/sctp/stream.c:655 sctp_process_strreset_inreq
>
> The local setsockopt path (sctp_send_reset_streams) already performs length
> validation, but the network packet path does not. Fix by adding similar
> length check before calling sctp_make_strreset_req().
>
> Fixes: 7f9d68ac944e ("sctp: implement sender-side procedures for SSN Reset
> Request Parameter")
> Reported-by: AutonomousCodeSecurity@microsoft.com
> Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
> ---
> net/sctp/stream.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/net/sctp/stream.c b/net/sctp/stream.c
> index 5c2fdedea..ea3805712 100644
> --- a/net/sctp/stream.c
> +++ b/net/sctp/stream.c
> @@ -639,6 +639,10 @@ struct sctp_chunk *sctp_process_strreset_inreq(
>
> nums = (ntohs(param.p->length) - sizeof(*inreq)) / sizeof(__u16);
> str_p = inreq->list_of_streams;
> + if (nums * sizeof(__u16) + sizeof(struct sctp_strreset_outreq)
> + > SCTP_MAX_CHUNK_LEN - sizeof(struct sctp_reconf_chunk)) {
> + goto out;
> + }
> for (i = 0; i < nums; i++) {
> if (ntohs(str_p[i]) >= stream->outcnt) {
> result = SCTP_STRRESET_ERR_WRONG_SSN;
> --
> 2.53.0
>
I think we should also prevent sending such an 'inreq', since it will
always be rejected by the peer. We can add improve the check in
'sctp_send_reset_streams()' like:
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index ea3805712b76..51a14d1f2391 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -308,7 +308,8 @@ int sctp_send_reset_streams(struct sctp_association *asoc,
goto out;
param_len += str_nums * sizeof(__u16) +
- sizeof(struct sctp_strreset_inreq);
+ (out ? sizeof(struct sctp_strreset_inreq)
+ : sizeof(struct
sctp_strreset_outreq));
}
Nits: Please keep the '>' on the same line as the left-hand operand and
indent the continuation line using the usual kernel style. Also No braces
are needed for a single statement.
if (nums * sizeof(__u16) + sizeof(struct sctp_strreset_outreq) >
SCTP_MAX_CHUNK_LEN - sizeof(struct sctp_reconf_chunk))
goto out;
Thanks.
^ permalink raw reply related
* [PATCH net-next v7 0/6] pds_core: Add PLDM firmware update and host backed memory support
From: Nikhil P. Rao @ 2026-07-08 21:22 UTC (permalink / raw)
To: netdev
Cc: kuba, brett.creeley, eric.joyner, andrew+netdev, davem, edumazet,
pabeni, jacob.e.keller, Nikhil P. Rao
This series adds PLDM-based firmware update support to the pds_core
driver. PLDM (Platform Level Data Model) is a DMTF standard for firmware
management that provides a vendor-neutral interface for firmware updates.
The implementation uses the kernel's pldmfw library for package parsing
and component matching. Users can update entire firmware packages or
individual components via devlink flash. Component information is
displayed via devlink info, showing firmware versions and update status
for each component.
The series also adds host backed memory support, allowing firmware to
request memory pages from the host for its operations.
Changes since v6:
- Patch 3 (PLDM firmware update):
- Add config space read after pci_clear_master() in teardown to ensure
in-flight DMA has completed before freeing deferred buffers
- Use list_splice_init() to detach deferred DMA list under lock, then
iterate and free without holding the lock
- Add NL_SET_ERR_MSG_MOD calls to PLDM error paths for better error
reporting via netlink extack
- Use PDSC_FW_COMPONENT_FULL_NAME_BUFLEN macro instead of ad-hoc buffer
size in pdsc_flash_component()
- Simplify finalize_update loop condition to `if (err != -EAGAIN)`
- Reject devlink flash with component parameter when firmware doesn't
support PLDM (returns -EOPNOTSUPP). This depends on a fix submitted
via net: https://lore.kernel.org/netdev/20260708163649.128620-1-nikhil.rao@amd.com
- Update documentation clarifying fw.gold is not a flash target
- Patch 4 (component info):
- Use READ_ONCE/WRITE_ONCE pairing for num_components to get a consistent
snapshot; avoids iterating zero times with no fallback when recovery
path invalidates the cache concurrently
Changes since v5:
- Patch 3: Changed "fw.suc.mainfw" to "fw.suc" for System Unit Controller
firmware to be consistent with the "fw.mainfw" to "fw" change in v4
- Fixed bugs identified by sashiko:
Patch 3 (PLDM firmware update):
- Remove stray kdoc fragment in pds_core_send_component_op enum
Patch 4 (component info):
- Fix fallback to dev_info.fw_version when pdsc_get_component_info()
succeeds but returns zero components
Patch 5 (host backed memory):
- Expand PDSC_HOST_MEM_MAX_CONTIG comment to clarify why PAGE_SIZE <<
MAX_PAGE_ORDER is not used
Changes since v4 (sashiko review, Simon Horman):
- Invalidate cached component info in recovery path to ensure stale
versions are not reported after firmware changes
- Fix v1 error handling: propagate errors from pdsc_dl_fw_list_info_get()
instead of masking them
- Fix v2 error handling: fall back to dev_info.fw_version only when
pdsc_get_component_info() fails; propagate devlink errors so partial
replies are discarded
- Clean up max_fw_slots comment to clarify it contains component count
Changes since v3:
- Changed "fw.mainfw" to just "fw" for main firmware (Jakub Kicinski).
Gold slot main firmware is reported as "fw.gold".
- Removed redundant memset before alloc_pages (Paolo Abeni)
- Changed dev_err to dev_warn for alloc_pages failure (Paolo Abeni)
- Only report dev_info.fw_version for identity version 1 (version 2+
reports firmware via PLDM component info)
- Fixed checkpatch alignment issue by extracting pdsc_dl_info_get_v1()
helper function
Changes since v2:
- Use driver-defined component names instead of passing through firmware
names (Jakub Kicinski). Added component_type enum that firmware populates,
driver maps to stable names like fw, fw.gold, fw.bootloader.
Added documentation of firmware version names to pds_core.rst.
- Fixed bugs identified by sashiko:
Patch 2 (identity version 2):
- Fix comment using wrong macro names (IDENTIFY vs IDENTITY)
Patch 3 (PLDM firmware update):
- DMA-after-free on EAGAIN/ETIMEDOUT: when a command times out or
returns busy, firmware may still be accessing the DMA buffer; defer
freeing until a subsequent command succeeds
- Use dev_warn_once for incompatible firmware version (ver==0)
- Clear component cache after flash to show updated versions
Patch 4 (component info):
- Fix min_t(u8) truncation of max_fw_slots (u16) to min_t(u16)
- Fix F_FIXED early return skipping F_RUNNING flag check
- Don't fail devlink info if component query fails; use dev_warn_once
and continue to report generic fields (fw, asic.id, serial_number)
Patch 5 (host backed memory):
- Switch from adminq to devcmd; fixes both workqueue self-deadlock
during recovery (adminq completion runs on same wq as health_thread)
and health_work re-queued after cancel (adminq timeout re-queues work)
- Remove MEM_DEL from teardown path; fixes both MEM_DEL sent twice
for same tag and num_host_mem_reqs ambiguous semantics (now only
tracks pages to free). pci_clear_master guarantees DMA quiescence.
- Fix PDSC_HOST_MEM_MAX_CONTIG to 4MB constant (was arch-dependent)
- Not fixed: pdsc_host_mem_add() failure ignored; partial host memory
is acceptable and firmware handles fewer regions than requested
Patch 6 (debugfs):
- Move pdsc_debugfs_del_host_mem() before pdsc_host_mem_free() to
fix use-after-free race with debugfs readers
- Use %u for unsigned types and %pad for dma_addr_t
- Remove "file exists" check (now dead code since teardown removes file)
Note: The following fix was submitted separately via net:
- DMA in flight during teardown (call pci_clear_master before freeing
host memory):
https://lore.kernel.org/all/20260604213637.3844317-1-nikhil.rao@amd.com/
Changes since v1:
- Removed redefinition of __counted_by kernel primitive (Jakub Kicinski)
- Fixed kdoc warnings in pds_core_if.h
- Fixed checkpatch warnings
- Fixed bugs identified by sashiko:
Patch 2 (identity version 2):
- Zero data region before firmware commands
- Suppress expected error message during identify probe
Patch 3 (PLDM firmware update):
- Memory leak in pdsc_send_component_image() error path
- Memory leak in pdsc_flash_component() error path
- Missing devcmd_lock in pdsc_devcmd_finalize_update()
- Fixed dma_mapping_error() return value handling (returns boolean, not error code)
- Skip logic for components with index > 255
Patch 4 (component info):
- Added generic fw version display for all identity versions
- Handle components with both RUNNING and STARTUP flags
Patch 5 (host backed memory):
- Race between pdsc_remove and health thread (use-after-free)
- Set missing index field in MEM_QUERY command
- Host memory allocation size and zeroing
- Don't free host memory on MEM_ADD timeout (firmware may still be using it)
Patch 6 (debugfs):
- Fix dentry reference leak in debugfs_lookup (missing dput)
- Improvements:
- Cache component info to avoid repeated firmware queries (patch 4)
Note: The following fix for an existing bug was submitted separately
via net:
- Timeout error overwritten with stale status:
https://lore.kernel.org/netdev/20260515212907.998028-1-nikhil.rao@amd.com/
Link to v6: https://lore.kernel.org/netdev/20260623-upstream_v6-v6-0-3bb64e0dc4f3@amd.com/
Signed-off-by: Nikhil P. Rao <nikhil.rao@amd.com>
Brett Creeley (4):
pds_core: add support for quiet devcmd failures
pds_core: add support for identity version 2
pds_core: add PLDM firmware update support via devlink flash
pds_core: add PLDM component info display
Nikhil P. Rao (2):
pds_core: add host backed memory support for firmware
pds_core: add debugfs support for host backed memory
.../device_drivers/ethernet/amd/pds_core.rst | 89 ++
drivers/net/ethernet/amd/Kconfig | 1 +
drivers/net/ethernet/amd/pds_core/core.c | 173 ++++
drivers/net/ethernet/amd/pds_core/core.h | 54 +-
drivers/net/ethernet/amd/pds_core/debugfs.c | 45 +
drivers/net/ethernet/amd/pds_core/dev.c | 140 +++-
drivers/net/ethernet/amd/pds_core/devlink.c | 147 +++-
drivers/net/ethernet/amd/pds_core/fw.c | 789 +++++++++++++++++-
drivers/net/ethernet/amd/pds_core/main.c | 9 +-
include/linux/pds/pds_core_if.h | 469 +++++++++++
10 files changed, 1893 insertions(+), 23 deletions(-)
--
2.43.0
^ permalink raw reply
* [PATCH 2/6] pds_core: add support for identity version 2
From: Nikhil P. Rao @ 2026-07-08 21:22 UTC (permalink / raw)
To: netdev
Cc: kuba, brett.creeley, eric.joyner, andrew+netdev, davem, edumazet,
pabeni, jacob.e.keller
In-Reply-To: <20260708212222.296202-1-nikhil.rao@amd.com>
From: Brett Creeley <brett.creeley@amd.com>
Add a new capabilities field in struct pds_core_dev_identity,
which requires bumping the identity version to 2, i.e.
PDS_CORE_IDENTITY_VERSION_2. If version 2 negotiation fails,
then quietly fall back to version 1. If version 1 negotiation
fails, then driver load will fail.
Another patch in the series will make use of the capabilities
field.
Signed-off-by: Brett Creeley <brett.creeley@amd.com>
---
drivers/net/ethernet/amd/pds_core/dev.c | 40 ++++++++++++++++++++-----
include/linux/pds/pds_core_if.h | 4 +++
2 files changed, 37 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/amd/pds_core/dev.c b/drivers/net/ethernet/amd/pds_core/dev.c
index dd9989cfe6b3..84ea502ecb12 100644
--- a/drivers/net/ethernet/amd/pds_core/dev.c
+++ b/drivers/net/ethernet/amd/pds_core/dev.c
@@ -250,15 +250,17 @@ int pdsc_devcmd_reset(struct pdsc *pdsc)
return pdsc_devcmd(pdsc, &cmd, &comp, pdsc->devcmd_timeout);
}
-static int pdsc_devcmd_identify_locked(struct pdsc *pdsc)
+static int pdsc_devcmd_identify_locked(struct pdsc *pdsc, u8 drv_ident_ver,
+ bool do_msg)
{
union pds_core_dev_comp comp = {};
union pds_core_dev_cmd cmd = {
.identify.opcode = PDS_CORE_CMD_IDENTIFY,
- .identify.ver = PDS_CORE_IDENTITY_VERSION_1,
+ .identify.ver = drv_ident_ver,
};
- return pdsc_devcmd_locked(pdsc, &cmd, &comp, pdsc->devcmd_timeout);
+ return __pdsc_devcmd_locked(pdsc, &cmd, &comp, pdsc->devcmd_timeout,
+ do_msg);
}
static void pdsc_init_devinfo(struct pdsc *pdsc)
@@ -281,8 +283,9 @@ static void pdsc_init_devinfo(struct pdsc *pdsc)
dev_dbg(pdsc->dev, "fw_version %s\n", pdsc->dev_info.fw_version);
}
-static int pdsc_identify(struct pdsc *pdsc)
+static int pdsc_identify_ver(struct pdsc *pdsc, u8 drv_ident_ver)
{
+ bool do_msg = drv_ident_ver == PDS_CORE_IDENTITY_VERSION_1;
struct pds_core_drv_identity drv = {};
size_t sz;
int err;
@@ -305,17 +308,24 @@ static int pdsc_identify(struct pdsc *pdsc)
sz = min_t(size_t, sizeof(drv), sizeof(pdsc->cmd_regs->data));
memcpy_toio(&pdsc->cmd_regs->data, &drv, sz);
- err = pdsc_devcmd_identify_locked(pdsc);
+ err = pdsc_devcmd_identify_locked(pdsc, drv_ident_ver, do_msg);
if (!err) {
sz = min_t(size_t, sizeof(pdsc->dev_ident),
sizeof(pdsc->cmd_regs->data));
memcpy_fromio(&pdsc->dev_ident, &pdsc->cmd_regs->data, sz);
+
+ /* V1 firmware doesn't set capabilities, so the field may
+ * contain garbage from the outgoing driver identity.
+ */
+ if (pdsc->dev_ident.version < PDS_CORE_IDENTITY_VERSION_2)
+ pdsc->dev_ident.capabilities = 0;
}
mutex_unlock(&pdsc->devcmd_lock);
if (err) {
- dev_err(pdsc->dev, "Cannot identify device: %pe\n",
- ERR_PTR(err));
+ if (do_msg)
+ dev_err(pdsc->dev, "Cannot identify device: %pe\n",
+ ERR_PTR(err));
return err;
}
@@ -334,6 +344,22 @@ static int pdsc_identify(struct pdsc *pdsc)
return 0;
}
+static int pdsc_identify(struct pdsc *pdsc)
+{
+ int err;
+
+ /* Older firmware rejects anything but PDS_CORE_IDENTITY_VERSION_1
+ * with PDS_RC_EVERSION (-EINVAL), so retry with V1 on version
+ * rejection. Don't retry on other errors like -ENXIO/-ETIMEDOUT
+ * which indicate firmware is not running or hung.
+ */
+ err = pdsc_identify_ver(pdsc, PDS_CORE_IDENTITY_VERSION_2);
+ if (err == -EINVAL)
+ err = pdsc_identify_ver(pdsc, PDS_CORE_IDENTITY_VERSION_1);
+
+ return err;
+}
+
void pdsc_dev_uninit(struct pdsc *pdsc)
{
if (pdsc->intr_info) {
diff --git a/include/linux/pds/pds_core_if.h b/include/linux/pds/pds_core_if.h
index 17a87c1a55d7..619186f26b5b 100644
--- a/include/linux/pds/pds_core_if.h
+++ b/include/linux/pds/pds_core_if.h
@@ -119,6 +119,8 @@ struct pds_core_drv_identity {
* value in usecs to device units using:
* device units = usecs * mult / div
* @vif_types: How many of each VIF device type is supported
+ * @capabilities: Device capabilities
+ * only supported on version >= PDS_CORE_IDENTITY_VERSION_2
*/
struct pds_core_dev_identity {
u8 version;
@@ -131,9 +133,11 @@ struct pds_core_dev_identity {
__le32 intr_coal_mult;
__le32 intr_coal_div;
__le16 vif_types[PDS_DEV_TYPE_MAX];
+ __le64 capabilities;
};
#define PDS_CORE_IDENTITY_VERSION_1 1
+#define PDS_CORE_IDENTITY_VERSION_2 2
/**
* struct pds_core_dev_identify_cmd - Driver/device identify command
--
2.43.0
^ permalink raw reply related
* [PATCH 1/6] pds_core: add support for quiet devcmd failures
From: Nikhil P. Rao @ 2026-07-08 21:22 UTC (permalink / raw)
To: netdev
Cc: kuba, brett.creeley, eric.joyner, andrew+netdev, davem, edumazet,
pabeni, jacob.e.keller
In-Reply-To: <20260708212222.296202-1-nikhil.rao@amd.com>
From: Brett Creeley <brett.creeley@amd.com>
Currently there aren't any use-cases that require special handling
on whether or not to print devcmd failures. Specifically
non-generic failures, i.e. not supported failures. Add support to
allow these messages to be suppressed. This will be used when
adding support to negotiate PDS_CORE_IDENTITY_VERSION_2.
Signed-off-by: Brett Creeley <brett.creeley@amd.com>
---
drivers/net/ethernet/amd/pds_core/dev.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/amd/pds_core/dev.c b/drivers/net/ethernet/amd/pds_core/dev.c
index bded6b33289c..dd9989cfe6b3 100644
--- a/drivers/net/ethernet/amd/pds_core/dev.c
+++ b/drivers/net/ethernet/amd/pds_core/dev.c
@@ -126,7 +126,8 @@ static const char *pdsc_devcmd_str(int opcode)
}
}
-static int pdsc_devcmd_wait(struct pdsc *pdsc, u8 opcode, int max_seconds)
+static int __pdsc_devcmd_wait(struct pdsc *pdsc, u8 opcode, int max_seconds,
+ const bool do_msg)
{
struct device *dev = pdsc->dev;
unsigned long start_time;
@@ -179,7 +180,7 @@ static int pdsc_devcmd_wait(struct pdsc *pdsc, u8 opcode, int max_seconds)
status = pdsc_devcmd_status(pdsc);
err = pdsc_err_to_errno(status);
- if (err && err != -EAGAIN)
+ if (do_msg && err && err != -EAGAIN)
dev_err(dev, "DEVCMD %d %s failed, status=%d err %d %pe\n",
opcode, pdsc_devcmd_str(opcode), status, err,
ERR_PTR(err));
@@ -187,8 +188,9 @@ static int pdsc_devcmd_wait(struct pdsc *pdsc, u8 opcode, int max_seconds)
return err;
}
-int pdsc_devcmd_locked(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
- union pds_core_dev_comp *comp, int max_seconds)
+static int __pdsc_devcmd_locked(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
+ union pds_core_dev_comp *comp, int max_seconds,
+ const bool do_msg)
{
int err;
@@ -197,7 +199,7 @@ int pdsc_devcmd_locked(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
memcpy_toio(&pdsc->cmd_regs->cmd, cmd, sizeof(*cmd));
pdsc_devcmd_dbell(pdsc);
- err = pdsc_devcmd_wait(pdsc, cmd->opcode, max_seconds);
+ err = __pdsc_devcmd_wait(pdsc, cmd->opcode, max_seconds, do_msg);
if ((err == -ENXIO || err == -ETIMEDOUT) && pdsc->wq)
queue_work(pdsc->wq, &pdsc->health_work);
@@ -207,6 +209,12 @@ int pdsc_devcmd_locked(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
return err;
}
+int pdsc_devcmd_locked(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
+ union pds_core_dev_comp *comp, int max_seconds)
+{
+ return __pdsc_devcmd_locked(pdsc, cmd, comp, max_seconds, true);
+}
+
int pdsc_devcmd(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
union pds_core_dev_comp *comp, int max_seconds)
{
--
2.43.0
^ permalink raw reply related
* [PATCH 6/6] pds_core: add debugfs support for host backed memory
From: Nikhil P. Rao @ 2026-07-08 21:22 UTC (permalink / raw)
To: netdev
Cc: kuba, brett.creeley, eric.joyner, andrew+netdev, davem, edumazet,
pabeni, jacob.e.keller, Nikhil P. Rao, Vamsi Atluri
In-Reply-To: <20260708212222.296202-1-nikhil.rao@amd.com>
Add debugfs entry to dump host backed memory allocations for debug
purposes.
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Vamsi Atluri <Vamsi.Atluri@amd.com>
Signed-off-by: Nikhil P. Rao <nikhil.rao@amd.com>
---
drivers/net/ethernet/amd/pds_core/core.c | 2 +
drivers/net/ethernet/amd/pds_core/core.h | 1 +
drivers/net/ethernet/amd/pds_core/debugfs.c | 45 +++++++++++++++++++++
3 files changed, 48 insertions(+)
diff --git a/drivers/net/ethernet/amd/pds_core/core.c b/drivers/net/ethernet/amd/pds_core/core.c
index 356a69c895b6..d4857bf4860d 100644
--- a/drivers/net/ethernet/amd/pds_core/core.c
+++ b/drivers/net/ethernet/amd/pds_core/core.c
@@ -500,6 +500,7 @@ void pdsc_teardown(struct pdsc *pdsc, bool removing)
pdsc->viftype_status = NULL;
}
+ pdsc_debugfs_del_host_mem(pdsc);
pdsc_host_mem_free(pdsc);
pdsc_dev_uninit(pdsc);
@@ -511,6 +512,7 @@ int pdsc_start(struct pdsc *pdsc)
pds_core_intr_mask(&pdsc->intr_ctrl[pdsc->adminqcq.intx],
PDS_CORE_INTR_MASK_CLEAR);
pdsc_host_mem_add(pdsc);
+ pdsc_debugfs_add_host_mem(pdsc);
return 0;
}
diff --git a/drivers/net/ethernet/amd/pds_core/core.h b/drivers/net/ethernet/amd/pds_core/core.h
index 085f2e988aa0..791756a50870 100644
--- a/drivers/net/ethernet/amd/pds_core/core.h
+++ b/drivers/net/ethernet/amd/pds_core/core.h
@@ -306,6 +306,7 @@ void pdsc_debugfs_add_irqs(struct pdsc *pdsc);
void pdsc_debugfs_add_qcq(struct pdsc *pdsc, struct pdsc_qcq *qcq);
void pdsc_debugfs_del_qcq(struct pdsc_qcq *qcq);
void pdsc_debugfs_add_host_mem(struct pdsc *pdsc);
+void pdsc_debugfs_del_host_mem(struct pdsc *pdsc);
int pdsc_err_to_errno(enum pds_core_status_code code);
bool pdsc_is_fw_running(struct pdsc *pdsc);
diff --git a/drivers/net/ethernet/amd/pds_core/debugfs.c b/drivers/net/ethernet/amd/pds_core/debugfs.c
index 810a0cd9bcac..ef0a1b7d159b 100644
--- a/drivers/net/ethernet/amd/pds_core/debugfs.c
+++ b/drivers/net/ethernet/amd/pds_core/debugfs.c
@@ -178,3 +178,48 @@ void pdsc_debugfs_del_qcq(struct pdsc_qcq *qcq)
debugfs_remove_recursive(qcq->dentry);
qcq->dentry = NULL;
}
+
+static int host_mem_show(struct seq_file *seq, void *v)
+{
+ struct pdsc *pdsc = seq->private;
+ struct pdsc_host_mem *hm;
+ int i;
+
+ if (!pdsc->host_mem_reqs || pdsc->num_host_mem_reqs == 0) {
+ seq_puts(seq, "No host memory allocated\n");
+ return 0;
+ }
+
+ seq_printf(seq, "Host memory requests: %u\n\n",
+ pdsc->num_host_mem_reqs);
+ seq_puts(seq, "Tag Size Order PA\n");
+ seq_puts(seq, "--- ---- ----- --\n");
+
+ for (i = 0; i < pdsc->num_host_mem_reqs; i++) {
+ hm = &pdsc->host_mem_reqs[i];
+
+ if (!hm->pg)
+ continue;
+
+ seq_printf(seq, "%-6u %-12u %-6u %pad\n",
+ hm->tag, hm->size, hm->order, &hm->pa);
+ }
+
+ return 0;
+}
+DEFINE_SHOW_ATTRIBUTE(host_mem);
+
+void pdsc_debugfs_add_host_mem(struct pdsc *pdsc)
+{
+ if (!(pdsc->dev_ident.capabilities &
+ cpu_to_le64(PDS_CORE_DEV_CAP_HOST_MEM)))
+ return;
+
+ debugfs_create_file("host_mem", 0400, pdsc->dentry,
+ pdsc, &host_mem_fops);
+}
+
+void pdsc_debugfs_del_host_mem(struct pdsc *pdsc)
+{
+ debugfs_lookup_and_remove("host_mem", pdsc->dentry);
+}
--
2.43.0
^ permalink raw reply related
* [PATCH 3/6] pds_core: add PLDM firmware update support via devlink flash
From: Nikhil P. Rao @ 2026-07-08 21:22 UTC (permalink / raw)
To: netdev
Cc: kuba, brett.creeley, eric.joyner, andrew+netdev, davem, edumazet,
pabeni, jacob.e.keller, Nikhil P . Rao
In-Reply-To: <20260708212222.296202-1-nikhil.rao@amd.com>
From: Brett Creeley <brett.creeley@amd.com>
Implement PLDM FW Update in the pds_core driver using the upstream
pldmfw API. This allows updating an entire PLDM FW package at once
or updating specific firmware components by name.
Flash the entire image:
devlink dev flash pci/0000:b5:00.0 file firmware.pldmfw
Flash a specific component from the PLDM FW package:
devlink dev flash pci/0000:b5:00.0 \
file firmware.pldmfw component fw.cpld
Per-component update uses driver-defined component names (fw, fw.cpld,
etc.). Not all components support per-component update - devlink will
reject the request if the specified component cannot be updated.
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Brett Creeley <brett.creeley@amd.com>
Signed-off-by: Nikhil P. Rao <nikhil.rao@amd.com>
---
.../device_drivers/ethernet/amd/pds_core.rst | 89 ++
drivers/net/ethernet/amd/Kconfig | 1 +
drivers/net/ethernet/amd/pds_core/core.c | 9 +
drivers/net/ethernet/amd/pds_core/core.h | 30 +-
drivers/net/ethernet/amd/pds_core/dev.c | 82 ++
drivers/net/ethernet/amd/pds_core/devlink.c | 2 +-
drivers/net/ethernet/amd/pds_core/fw.c | 781 +++++++++++++++++-
drivers/net/ethernet/amd/pds_core/main.c | 5 +
include/linux/pds/pds_core_if.h | 401 +++++++++
9 files changed, 1395 insertions(+), 5 deletions(-)
diff --git a/Documentation/networking/device_drivers/ethernet/amd/pds_core.rst b/Documentation/networking/device_drivers/ethernet/amd/pds_core.rst
index 9e8a16c44102..49487a35c163 100644
--- a/Documentation/networking/device_drivers/ethernet/amd/pds_core.rst
+++ b/Documentation/networking/device_drivers/ethernet/amd/pds_core.rst
@@ -102,6 +102,95 @@ currently in use, and that bank will used for the next boot::
# devlink dev flash pci/0000:b5:00.0 \
file pensando/dsc_fw_1.63.0-22.tar
+Firmware Management (PLDM)
+==========================
+
+Firmware that supports PLDM can be updated using the devlink flash command
+with a PLDM firmware package. The entire package can be updated at once::
+
+ # devlink dev flash pci/0000:b5:00.0 file firmware.pldmfw
+
+Individual components can also be updated by specifying the component name::
+
+ # devlink dev flash pci/0000:b5:00.0 \
+ file firmware.pldmfw component fw.cpld
+
+Per-component update uses driver-defined component names (fw, fw.cpld,
+etc.). Not all components support per-component update -
+devlink will reject the request if the specified component cannot
+be updated.
+
+Gold (recovery) components can be updated by specifying the base component
+name (e.g., ``fw`` for ``fw.gold``) with a goldfw package file when the
+device supports per-component update. The ``.gold`` suffix in devlink info
+output indicates the gold slot version, not a flash target.
+
+Info versions (PLDM)
+====================
+
+Firmware that supports PLDM reports component versions using driver-defined
+names. The driver reports the following component versions:
+
+.. list-table:: devlink info versions for PLDM-capable firmware
+ :widths: 5 5 90
+
+ * - Name
+ - Type
+ - Description
+ * - ``fw``
+ - running, stored
+ - Main firmware
+ * - ``fw.gold``
+ - stored
+ - Gold (recovery) firmware
+ * - ``fw.bootloader``
+ - running, stored
+ - Boot loader
+ * - ``fw.cpld``
+ - running, stored
+ - CPLD
+ * - ``fw.secure``
+ - running, stored
+ - Secure boot firmware
+ * - ``fw.fpga``
+ - running, stored
+ - FPGA configuration
+ * - ``fw.suc``
+ - running, stored
+ - System Unit Controller firmware
+ * - ``fw.suc.bootloader``
+ - running, stored
+ - System Unit Controller bootloader
+ * - ``fw.uboot``
+ - running, stored
+ - U-Boot bootloader
+ * - ``asic.id``
+ - fixed
+ - The ASIC type for this device
+ * - ``asic.rev``
+ - fixed
+ - The revision of the ASIC for this device
+
+Example output::
+
+ $ devlink dev info pci/0000:00:05.0
+ pci/0000:00:05.0:
+ driver pds_core
+ serial_number FLM18420073
+ versions:
+ fixed:
+ asic.id 0x0
+ asic.rev 0x0
+ running:
+ fw.bootloader 1.2.3
+ fw 1.3.0
+ fw.cpld 3.18
+ stored:
+ fw.bootloader 1.2.3
+ fw.gold 1.2.0
+ fw 1.3.0
+ fw.cpld 3.18
+
Health Reporters
================
diff --git a/drivers/net/ethernet/amd/Kconfig b/drivers/net/ethernet/amd/Kconfig
index e35991141a1a..743e3d4b6b94 100644
--- a/drivers/net/ethernet/amd/Kconfig
+++ b/drivers/net/ethernet/amd/Kconfig
@@ -171,6 +171,7 @@ config PDS_CORE
depends on 64BIT && PCI
select AUXILIARY_BUS
select NET_DEVLINK
+ select PLDMFW
help
This enables the support for the AMD/Pensando Core device family of
adapters. More specific information on this driver can be
diff --git a/drivers/net/ethernet/amd/pds_core/core.c b/drivers/net/ethernet/amd/pds_core/core.c
index 38a2446571af..6c62ff7a32f0 100644
--- a/drivers/net/ethernet/amd/pds_core/core.c
+++ b/drivers/net/ethernet/amd/pds_core/core.c
@@ -483,6 +483,15 @@ void pdsc_teardown(struct pdsc *pdsc, bool removing)
cancel_work_sync(&pdsc->adminqcq.work);
pci_clear_master(pdsc->pdev);
+ if (!pdsc->pdev->is_virtfn) {
+ u16 val;
+
+ /* Flush any in-flight DMA before freeing buffers.
+ * A config read completion cannot return until all prior
+ * device-initiated memory writes have completed.
+ */
+ pci_read_config_word(pdsc->pdev, PCI_VENDOR_ID, &val);
+ }
pdsc_core_uninit(pdsc);
diff --git a/drivers/net/ethernet/amd/pds_core/core.h b/drivers/net/ethernet/amd/pds_core/core.h
index b7fe9ad73349..c686f0bbbaeb 100644
--- a/drivers/net/ethernet/amd/pds_core/core.h
+++ b/drivers/net/ethernet/amd/pds_core/core.h
@@ -23,6 +23,14 @@
#define PDSC_SETUP_RECOVERY false
#define PDSC_SETUP_INIT true
+struct pdsc_deferred_dma {
+ struct list_head list;
+ dma_addr_t dma_addr;
+ void *va;
+ size_t size;
+ enum dma_data_direction dir;
+};
+
struct pdsc_dev_bar {
void __iomem *vaddr;
phys_addr_t bus_addr;
@@ -185,6 +193,8 @@ struct pdsc {
struct mutex devcmd_lock; /* lock for dev_cmd operations */
struct mutex config_lock; /* lock for configuration operations */
spinlock_t adminq_lock; /* lock for adminq operations */
+ struct list_head deferred_dma_list;
+ spinlock_t deferred_dma_lock; /* lock for deferred DMA list */
refcount_t adminq_refcnt;
struct pds_core_dev_info_regs __iomem *info_regs;
struct pds_core_dev_cmd_regs __iomem *cmd_regs;
@@ -199,6 +209,8 @@ struct pdsc {
u64 last_eid;
struct pdsc_viftype *viftype_status;
struct work_struct pci_reset_work;
+
+ struct pds_core_component_list_info fw_components;
};
/** enum pds_core_dbell_bits - bitwise composition of dbell values.
@@ -281,8 +293,16 @@ bool pdsc_is_fw_running(struct pdsc *pdsc);
bool pdsc_is_fw_good(struct pdsc *pdsc);
int pdsc_devcmd(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
union pds_core_dev_comp *comp, int max_seconds);
+int pdsc_devcmd_with_data(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
+ const void *data, size_t data_len,
+ union pds_core_dev_comp *comp, int max_seconds);
+int pdsc_devcmd_with_data_nomsg(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
+ const void *data, size_t data_len,
+ union pds_core_dev_comp *comp, int max_seconds);
int pdsc_devcmd_locked(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
union pds_core_dev_comp *comp, int max_seconds);
+int pdsc_devcmd_locked_nomsg(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
+ union pds_core_dev_comp *comp, int max_seconds);
int pdsc_devcmd_init(struct pdsc *pdsc);
int pdsc_devcmd_reset(struct pdsc *pdsc);
int pdsc_dev_init(struct pdsc *pdsc);
@@ -315,11 +335,19 @@ void pdsc_process_adminq(struct pdsc_qcq *qcq);
void pdsc_work_thread(struct work_struct *work);
irqreturn_t pdsc_adminq_isr(int irq, void *data);
-int pdsc_firmware_update(struct pdsc *pdsc, const struct firmware *fw,
+int pdsc_firmware_update(struct pdsc *pdsc,
+ struct devlink_flash_update_params *params,
struct netlink_ext_ack *extack);
+int pdsc_get_component_info(struct pdsc *pdsc);
+const char *pdsc_fw_type_to_name(u8 type);
void pdsc_fw_down(struct pdsc *pdsc);
void pdsc_fw_up(struct pdsc *pdsc);
void pdsc_pci_reset_thread(struct work_struct *work);
+void pdsc_deferred_dma_add(struct pdsc *pdsc, struct pdsc_deferred_dma *entry,
+ dma_addr_t dma_addr, void *va, size_t size,
+ enum dma_data_direction dir);
+void pdsc_deferred_dma_free(struct pdsc *pdsc);
+
#endif /* _PDSC_H_ */
diff --git a/drivers/net/ethernet/amd/pds_core/dev.c b/drivers/net/ethernet/amd/pds_core/dev.c
index 84ea502ecb12..b149d29bd256 100644
--- a/drivers/net/ethernet/amd/pds_core/dev.c
+++ b/drivers/net/ethernet/amd/pds_core/dev.c
@@ -206,15 +206,56 @@ static int __pdsc_devcmd_locked(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
else
memcpy_fromio(comp, &pdsc->cmd_regs->comp, sizeof(*comp));
+ if (err != -ETIMEDOUT && err != -EAGAIN)
+ pdsc_deferred_dma_free(pdsc);
+
return err;
}
+void pdsc_deferred_dma_add(struct pdsc *pdsc, struct pdsc_deferred_dma *entry,
+ dma_addr_t dma_addr, void *va, size_t size,
+ enum dma_data_direction dir)
+{
+ entry->dma_addr = dma_addr;
+ entry->va = va;
+ entry->size = size;
+ entry->dir = dir;
+
+ spin_lock(&pdsc->deferred_dma_lock);
+ list_add_tail(&entry->list, &pdsc->deferred_dma_list);
+ spin_unlock(&pdsc->deferred_dma_lock);
+}
+
+void pdsc_deferred_dma_free(struct pdsc *pdsc)
+{
+ struct pdsc_deferred_dma *entry, *tmp;
+ LIST_HEAD(local_list);
+
+ spin_lock(&pdsc->deferred_dma_lock);
+ list_splice_init(&pdsc->deferred_dma_list, &local_list);
+ spin_unlock(&pdsc->deferred_dma_lock);
+
+ list_for_each_entry_safe(entry, tmp, &local_list, list) {
+ dma_unmap_single(pdsc->dev, entry->dma_addr,
+ entry->size, entry->dir);
+ kfree(entry->va);
+ list_del(&entry->list);
+ kfree(entry);
+ }
+}
+
int pdsc_devcmd_locked(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
union pds_core_dev_comp *comp, int max_seconds)
{
return __pdsc_devcmd_locked(pdsc, cmd, comp, max_seconds, true);
}
+int pdsc_devcmd_locked_nomsg(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
+ union pds_core_dev_comp *comp, int max_seconds)
+{
+ return __pdsc_devcmd_locked(pdsc, cmd, comp, max_seconds, false);
+}
+
int pdsc_devcmd(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
union pds_core_dev_comp *comp, int max_seconds)
{
@@ -227,6 +268,47 @@ int pdsc_devcmd(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
return err;
}
+static int __pdsc_devcmd_with_data(struct pdsc *pdsc,
+ union pds_core_dev_cmd *cmd,
+ const void *data, size_t data_len,
+ union pds_core_dev_comp *comp,
+ int max_seconds, bool do_msg)
+{
+ int err;
+
+ mutex_lock(&pdsc->devcmd_lock);
+ if (!pdsc->cmd_regs) {
+ err = -ENXIO;
+ goto unlock;
+ }
+ if (data_len > sizeof(pdsc->cmd_regs->data)) {
+ err = -ENOSPC;
+ goto unlock;
+ }
+ memcpy_toio(&pdsc->cmd_regs->data, data, data_len);
+ err = __pdsc_devcmd_locked(pdsc, cmd, comp, max_seconds, do_msg);
+unlock:
+ mutex_unlock(&pdsc->devcmd_lock);
+
+ return err;
+}
+
+int pdsc_devcmd_with_data(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
+ const void *data, size_t data_len,
+ union pds_core_dev_comp *comp, int max_seconds)
+{
+ return __pdsc_devcmd_with_data(pdsc, cmd, data, data_len,
+ comp, max_seconds, true);
+}
+
+int pdsc_devcmd_with_data_nomsg(struct pdsc *pdsc, union pds_core_dev_cmd *cmd,
+ const void *data, size_t data_len,
+ union pds_core_dev_comp *comp, int max_seconds)
+{
+ return __pdsc_devcmd_with_data(pdsc, cmd, data, data_len,
+ comp, max_seconds, false);
+}
+
int pdsc_devcmd_init(struct pdsc *pdsc)
{
union pds_core_dev_comp comp = {};
diff --git a/drivers/net/ethernet/amd/pds_core/devlink.c b/drivers/net/ethernet/amd/pds_core/devlink.c
index 2ea97e1c5939..3b763ee1715e 100644
--- a/drivers/net/ethernet/amd/pds_core/devlink.c
+++ b/drivers/net/ethernet/amd/pds_core/devlink.c
@@ -90,7 +90,7 @@ int pdsc_dl_flash_update(struct devlink *dl,
{
struct pdsc *pdsc = devlink_priv(dl);
- return pdsc_firmware_update(pdsc, params->fw, extack);
+ return pdsc_firmware_update(pdsc, params, extack);
}
static char *fw_slotnames[] = {
diff --git a/drivers/net/ethernet/amd/pds_core/fw.c b/drivers/net/ethernet/amd/pds_core/fw.c
index fa626719e68d..dc793005ec70 100644
--- a/drivers/net/ethernet/amd/pds_core/fw.c
+++ b/drivers/net/ethernet/amd/pds_core/fw.c
@@ -1,6 +1,9 @@
// SPDX-License-Identifier: GPL-2.0
/* Copyright(c) 2023 Advanced Micro Devices, Inc */
+#include <linux/pldmfw.h>
+#include <linux/vmalloc.h>
+
#include "core.h"
/* The worst case wait for the install activity is about 25 minutes when
@@ -14,6 +17,52 @@
/* Number of periodic log updates during fw file download */
#define PDSC_FW_INTERVAL_FRACTION 32
+#define PDSC_FW_COMPONENT_PREFIX "fw."
+#define PDSC_FW_COMPONENT_FULL_NAME_BUFLEN \
+ (sizeof(PDSC_FW_COMPONENT_PREFIX) + PDS_CORE_FW_COMPONENT_NAME_BUFLEN)
+
+/* Driver-defined component type to name mapping.
+ * PDS_CORE_FW_TYPE_MAIN is NULL - handled specially as "fw" without prefix.
+ */
+static const char * const pdsc_fw_type_names[] = {
+ [PDS_CORE_FW_TYPE_MAIN] = NULL,
+ [PDS_CORE_FW_TYPE_BOOT] = "bootloader",
+ [PDS_CORE_FW_TYPE_CPLD] = "cpld",
+ [PDS_CORE_FW_TYPE_SECURE] = "secure",
+ [PDS_CORE_FW_TYPE_FPGA] = "fpga",
+ [PDS_CORE_FW_TYPE_SUC_MAIN] = "suc",
+ [PDS_CORE_FW_TYPE_SUC_BOOT] = "suc.bootloader",
+ [PDS_CORE_FW_TYPE_UBOOT] = "uboot",
+};
+
+const char *pdsc_fw_type_to_name(u8 type)
+{
+ if (type < ARRAY_SIZE(pdsc_fw_type_names) && pdsc_fw_type_names[type])
+ return pdsc_fw_type_names[type];
+ return NULL;
+}
+
+static u8 pdsc_name_to_fw_type(const char *name)
+{
+ size_t prefix_len;
+ int i;
+
+ /* "fw" without suffix maps to main firmware */
+ if (!strcmp(name, "fw"))
+ return PDS_CORE_FW_TYPE_MAIN;
+
+ prefix_len = str_has_prefix(name, PDSC_FW_COMPONENT_PREFIX);
+ if (prefix_len)
+ name += prefix_len;
+
+ for (i = 1; i < ARRAY_SIZE(pdsc_fw_type_names); i++) {
+ if (pdsc_fw_type_names[i] &&
+ !strcmp(name, pdsc_fw_type_names[i]))
+ return i;
+ }
+ return 0;
+}
+
static int pdsc_devcmd_fw_download_locked(struct pdsc *pdsc, u64 addr,
u32 offset, u32 length)
{
@@ -23,7 +72,7 @@ static int pdsc_devcmd_fw_download_locked(struct pdsc *pdsc, u64 addr,
.fw_download.addr = cpu_to_le64(addr),
.fw_download.length = cpu_to_le32(length),
};
- union pds_core_dev_comp comp;
+ union pds_core_dev_comp comp = {};
return pdsc_devcmd_locked(pdsc, &cmd, &comp, pdsc->devcmd_timeout);
}
@@ -95,9 +144,12 @@ static int pdsc_fw_status_long_wait(struct pdsc *pdsc,
return err;
}
-int pdsc_firmware_update(struct pdsc *pdsc, const struct firmware *fw,
- struct netlink_ext_ack *extack)
+static int
+pdsc_legacy_firmware_update(struct pdsc *pdsc,
+ struct devlink_flash_update_params *params,
+ struct netlink_ext_ack *extack)
{
+ const struct firmware *fw = params->fw;
u32 buf_sz, copy_sz, offset;
struct devlink *dl;
int next_interval;
@@ -105,6 +157,12 @@ int pdsc_firmware_update(struct pdsc *pdsc, const struct firmware *fw,
int err = 0;
int fw_slot;
+ if (params->component) {
+ NL_SET_ERR_MSG_MOD(extack,
+ "Component update not supported by this device");
+ return -EOPNOTSUPP;
+ }
+
dev_info(pdsc->dev, "Installing firmware\n");
if (!pdsc->cmd_regs)
@@ -195,3 +253,720 @@ int pdsc_firmware_update(struct pdsc *pdsc, const struct firmware *fw,
NULL, 0, 0);
return err;
}
+
+struct pdsc_component_priv {
+ u16 component_id;
+ bool skip;
+ struct list_head list_entry;
+};
+
+struct pds_core_fwu_priv {
+ struct pldmfw context;
+ struct devlink_flash_update_params *params;
+ struct netlink_ext_ack *extack;
+ struct pdsc *pdsc;
+ struct list_head components;
+};
+
+static void pdsc_free_fwu_priv(struct pds_core_fwu_priv *priv)
+{
+ struct pdsc_component_priv *component_priv, *tmp;
+
+ list_for_each_entry_safe(component_priv, tmp, &priv->components,
+ list_entry) {
+ list_del(&component_priv->list_entry);
+ kfree(component_priv);
+ }
+}
+
+static int pdsc_devcmd_match_record_desc(struct pdsc *pdsc, u16 desc_type,
+ u16 desc_size, const u8 *desc_data,
+ u8 *match)
+{
+ union pds_core_dev_cmd cmd = {
+ .match_record_desc.opcode = PDS_CORE_CMD_MATCH_RECORD_DESC,
+ .match_record_desc.ver = 1,
+ .match_record_desc.type = cpu_to_le16(desc_type),
+ .match_record_desc.size = cpu_to_le16(desc_size),
+ };
+ union pds_core_dev_comp comp = {};
+ int err;
+
+ err = pdsc_devcmd_with_data(pdsc, &cmd, desc_data, desc_size,
+ &comp, pdsc->devcmd_timeout);
+ *match = comp.match_record_desc.match;
+
+ return err;
+}
+
+static bool pdsc_match_record_descs(struct pldmfw *context,
+ struct pldmfw_record *record)
+{
+ struct pds_core_fwu_priv *priv =
+ container_of(context, struct pds_core_fwu_priv, context);
+ struct pdsc *pdsc = priv->pdsc;
+ struct pldmfw_desc_tlv *desc;
+
+ if (!pldmfw_op_pci_match_record(context, record))
+ return false;
+
+ list_for_each_entry(desc, &record->descs, entry) {
+ u8 match;
+ int err;
+
+ switch (desc->type) {
+ /* skip types checked in pldmfw_op_pci_match_record */
+ case PLDM_DESC_ID_PCI_VENDOR_ID:
+ case PLDM_DESC_ID_PCI_DEVICE_ID:
+ case PLDM_DESC_ID_PCI_SUBVENDOR_ID:
+ case PLDM_DESC_ID_PCI_SUBDEV_ID:
+ continue;
+ }
+
+ if (!desc->size)
+ return false;
+
+ err = pdsc_devcmd_match_record_desc(pdsc, desc->type,
+ desc->size, desc->data,
+ &match);
+ if (err) {
+ dev_err(pdsc->dev,
+ "match_record_desc failed type: 0x%04x size: %u, err %d\n",
+ desc->type, desc->size, err);
+ return false;
+ }
+ /* all record descriptors must match */
+ if (!match)
+ return false;
+ }
+
+ return true;
+}
+
+static int pdsc_devcmd_send_package_data(struct pdsc *pdsc, u64 addr,
+ u16 length, u16 offset, u16 total_len)
+{
+ union pds_core_dev_cmd cmd = {
+ .send_pkg_data.opcode = PDS_CORE_CMD_SEND_PKG_DATA,
+ .send_pkg_data.ver = 1,
+ .send_pkg_data.data_pa = cpu_to_le64(addr),
+ .send_pkg_data.data_len = cpu_to_le16(length),
+ .send_pkg_data.offset = cpu_to_le16(offset),
+ .send_pkg_data.total_len = cpu_to_le16(total_len),
+ };
+ union pds_core_dev_comp comp = {};
+
+ return pdsc_devcmd(pdsc, &cmd, &comp, pdsc->devcmd_timeout);
+}
+
+static int pdsc_send_package_data(struct pldmfw *context, const u8 *data,
+ u16 length)
+{
+ struct pds_core_fwu_priv *priv =
+ container_of(context, struct pds_core_fwu_priv, context);
+ struct pdsc_deferred_dma *deferred;
+ struct device *dev = context->dev;
+ struct pdsc *pdsc = priv->pdsc;
+ dma_addr_t dma_addr;
+ u8 *package_data;
+ u32 offset;
+ int err;
+
+ if (!length)
+ return 0;
+
+ deferred = kmalloc_obj(*deferred, GFP_KERNEL);
+ if (!deferred)
+ return -ENOMEM;
+
+ package_data = kmemdup(data, length, GFP_KERNEL);
+ if (!package_data) {
+ kfree(deferred);
+ return -ENOMEM;
+ }
+
+ dma_addr = dma_map_single(dev, package_data, length, DMA_TO_DEVICE);
+ if (dma_mapping_error(dev, dma_addr)) {
+ dev_err(dev, "Failed to dma_map package_data length 0x%x\n",
+ length);
+ kfree(package_data);
+ kfree(deferred);
+ return -ENOMEM;
+ }
+
+ for (offset = 0; offset < length; offset += PDS_PAGE_SIZE) {
+ u32 copy_sz;
+
+ copy_sz = min_t(unsigned int, PDS_PAGE_SIZE, length - offset);
+ err = pdsc_devcmd_send_package_data(pdsc, dma_addr + offset,
+ copy_sz, offset, length);
+ if (err) {
+ NL_SET_ERR_MSG_MOD(priv->extack,
+ "Failed to send package data");
+ break;
+ }
+ }
+
+ if (err == -ETIMEDOUT || err == -EAGAIN) {
+ pdsc_deferred_dma_add(pdsc, deferred, dma_addr,
+ package_data, length, DMA_TO_DEVICE);
+ return err;
+ }
+
+ kfree(deferred);
+ dma_unmap_single(dev, dma_addr, length, DMA_TO_DEVICE);
+ kfree(package_data);
+ return err;
+}
+
+static bool pdsc_component_type_exists(struct pdsc *pdsc, u8 type)
+{
+ int i;
+
+ for (i = 0; i < pdsc->fw_components.num_components; i++) {
+ if (pdsc->fw_components.info[i].component_type == type)
+ return true;
+ }
+ return false;
+}
+
+static u8 pdsc_get_component_type_by_id(struct pdsc *pdsc, u16 component_id)
+{
+ int i;
+
+ for (i = 0; i < pdsc->fw_components.num_components; i++) {
+ struct pds_core_fw_component_info *info =
+ &pdsc->fw_components.info[i];
+
+ if (info->identifier == component_id)
+ return info->component_type;
+ }
+ return 0;
+}
+
+static bool pdsc_component_id_matches_type(struct pdsc *pdsc,
+ u8 component_id, u8 type)
+{
+ int i;
+
+ for (i = 0; i < pdsc->fw_components.num_components; i++) {
+ struct pds_core_fw_component_info *info =
+ &pdsc->fw_components.info[i];
+
+ if (info->identifier == component_id &&
+ info->component_type == type)
+ return true;
+ }
+ return false;
+}
+
+static bool pdsc_skip_component(struct pds_core_fwu_priv *priv,
+ u16 component_id)
+{
+ struct pdsc_component_priv *component_priv;
+
+ list_for_each_entry(component_priv, &priv->components, list_entry) {
+ if (component_priv->component_id == component_id)
+ return component_priv->skip;
+ }
+
+ return false;
+}
+
+static int pdsc_send_component_table(struct pldmfw *context,
+ struct pldmfw_component *component,
+ u8 transfer_flag)
+{
+ struct pds_core_fwu_priv *priv =
+ container_of(context, struct pds_core_fwu_priv, context);
+ struct pds_core_component_tbl *component_tbl;
+ struct pdsc_component_priv *component_priv;
+ struct device *dev = context->dev;
+ union pds_core_dev_comp comp = {};
+ union pds_core_dev_cmd cmd = {};
+ struct pdsc *pdsc = priv->pdsc;
+ bool skip_component = false;
+ u8 requested_type = 0;
+ u16 buf_sz, tbl_sz;
+ int err = 0;
+
+ dev_dbg(dev,
+ "component name %s classification %u id %u activation_method %u ver_len %d ver_str %.*s index %u size %u transfer_flag 0x%02x\n",
+ priv->params->component, component->classification,
+ component->identifier, component->activation_method,
+ component->version_len, component->version_len,
+ component->version_string, component->index,
+ component->component_size, transfer_flag);
+
+ component_priv = kzalloc_obj(*component_priv, GFP_KERNEL);
+ if (!component_priv)
+ return -ENOMEM;
+
+ if (priv->params->component) {
+ requested_type = pdsc_name_to_fw_type(priv->params->component);
+ if (component->identifier > U8_MAX ||
+ !pdsc_component_id_matches_type(pdsc,
+ component->identifier,
+ requested_type)) {
+ skip_component = true;
+ goto add_component_priv;
+ }
+ }
+
+ buf_sz = sizeof(pdsc->cmd_regs->data);
+ tbl_sz = struct_size(component_tbl, version_str,
+ component->version_len);
+ if (tbl_sz > buf_sz) {
+ dev_err(dev, "component_tbl size %d too big, max size: %d\n",
+ tbl_sz, buf_sz);
+ err = -ENOSPC;
+ goto free_component_priv;
+ }
+ component_tbl = kzalloc(tbl_sz, GFP_KERNEL);
+ if (!component_tbl) {
+ err = -ENOMEM;
+ goto free_component_priv;
+ }
+
+ component_tbl->comparison_stamp =
+ cpu_to_le32(component->comparison_stamp);
+ component_tbl->classification = cpu_to_le16(component->classification);
+ component_tbl->identifier = cpu_to_le16(component->identifier);
+ component_tbl->transfer_flag = transfer_flag;
+ component_tbl->version_str_type = component->version_type;
+ component_tbl->version_str_len = component->version_len;
+ memcpy(component_tbl->version_str, component->version_string,
+ component->version_len);
+
+ cmd.send_component_tbl.opcode = PDS_CORE_CMD_SEND_COMPONENT_TBL;
+ cmd.send_component_tbl.ver = 1;
+ cmd.send_component_tbl.slot_id = PDS_CORE_FW_SLOT_INVALID;
+
+ err = pdsc_devcmd_with_data(pdsc, &cmd, component_tbl, tbl_sz,
+ &comp, pdsc->devcmd_timeout);
+ kfree(component_tbl);
+ if (err) {
+ dev_err(dev, "Failed sending component table: %pe\n",
+ ERR_PTR(err));
+ goto free_component_priv;
+ }
+
+ if (comp.send_component_tbl.response == 1 &&
+ comp.send_component_tbl.response_code ==
+ PDS_CORE_COMPONENT_PREREQS_NOT_MET)
+ skip_component = true;
+
+add_component_priv:
+ component_priv->skip = skip_component;
+ component_priv->component_id = component->identifier;
+ list_add(&component_priv->list_entry, &priv->components);
+
+ return 0;
+
+free_component_priv:
+ kfree(component_priv);
+ return err;
+}
+
+int pdsc_get_component_info(struct pdsc *pdsc)
+{
+ union pds_core_dev_cmd cmd = {
+ .get_component_info.opcode = PDS_CORE_CMD_GET_COMPONENT_INFO,
+ .get_component_info.ver = 1,
+ };
+ struct pds_core_component_list_info *list_info;
+ struct pdsc_deferred_dma *deferred;
+ union pds_core_dev_comp comp = {};
+ dma_addr_t dma_addr;
+ u8 num_components;
+ int err, i;
+
+ deferred = kmalloc_obj(*deferred);
+ if (!deferred)
+ return -ENOMEM;
+
+ list_info = kzalloc(PDS_PAGE_SIZE, GFP_KERNEL);
+ if (!list_info) {
+ kfree(deferred);
+ return -ENOMEM;
+ }
+
+ dma_addr = dma_map_single(pdsc->dev, list_info, PDS_PAGE_SIZE,
+ DMA_FROM_DEVICE);
+ if (dma_mapping_error(pdsc->dev, dma_addr)) {
+ dev_err(pdsc->dev,
+ "Failed to dma_map component_list_info length %d\n",
+ PDS_PAGE_SIZE);
+ kfree(list_info);
+ kfree(deferred);
+ return -ENOMEM;
+ }
+
+ cmd.get_component_info.data_len = cpu_to_le16(PDS_PAGE_SIZE);
+ cmd.get_component_info.data_pa = cpu_to_le64(dma_addr);
+
+ err = pdsc_devcmd(pdsc, &cmd, &comp, pdsc->devcmd_timeout * 2);
+ if (err == -ETIMEDOUT || err == -EAGAIN) {
+ pdsc_deferred_dma_add(pdsc, deferred, dma_addr, list_info,
+ PDS_PAGE_SIZE, DMA_FROM_DEVICE);
+ return err;
+ }
+
+ kfree(deferred);
+ dma_unmap_single(pdsc->dev, dma_addr, PDS_PAGE_SIZE, DMA_FROM_DEVICE);
+ if (err)
+ goto out;
+
+ if (comp.get_component_info.ver == 0) {
+ /* Don't support backward compatibility as version 0 has
+ * alignment issues, so give a hint to users to update
+ * their firmware
+ */
+ dev_warn_once(pdsc->dev,
+ "Incompatible get_component_info version %u reported by firmware\n",
+ comp.get_component_info.ver);
+ err = 0;
+ goto out;
+ }
+
+ num_components = list_info->num_components;
+ if (num_components > PDS_CORE_FW_COMPONENT_LIST_LEN) {
+ err = -ENOMEM;
+ goto out;
+ }
+
+ pdsc->fw_components.num_components = num_components;
+ for (i = 0; i < num_components; i++) {
+ struct pds_core_fw_component_info *info =
+ &pdsc->fw_components.info[i];
+
+ memcpy(info, &list_info->info[i], sizeof(*info));
+ info->version[PDS_CORE_FW_COMPONENT_VER_BUFLEN - 1] = 0;
+ info->name[PDS_CORE_FW_COMPONENT_NAME_BUFLEN - 1] = 0;
+ }
+
+out:
+ kfree(list_info);
+ return err;
+}
+
+static int pdsc_devcmd_send_component(struct pdsc *pdsc,
+ struct pds_core_flash_component *info,
+ u16 info_sz, dma_addr_t addr, u32 length,
+ u32 offset, u16 slot_id,
+ union pds_core_dev_comp *comp)
+{
+ union pds_core_dev_cmd cmd = {
+ .send_component.opcode = PDS_CORE_CMD_SEND_COMPONENT,
+ .send_component.ver = 1,
+ .send_component.operation = PDS_CORE_SEND_COMPONENT_START,
+ .send_component.data_pa = cpu_to_le64(addr),
+ .send_component.data_len = cpu_to_le32(length),
+ .send_component.offset = cpu_to_le32(offset),
+ .send_component.slot_id = slot_id,
+ };
+ unsigned long timeout = 300 * HZ;
+ unsigned long start_time;
+ unsigned long end_time;
+ int err;
+
+ start_time = jiffies;
+ end_time = start_time + timeout;
+ do {
+ /* prevent noisy/benign devcmd failures */
+ err = pdsc_devcmd_with_data_nomsg(pdsc, &cmd, info, info_sz,
+ comp, 60);
+ if (err != -EAGAIN)
+ break;
+
+ /* if required, subsequent commands check status of
+ * PDS_CORE_CMD_SEND_COMPONENT command, which returns
+ * EAGAIN while the command is still running,
+ * else we get the final command status.
+ */
+ cmd.send_component.operation = PDS_CORE_SEND_COMPONENT_STATUS;
+ msleep(20);
+ } while (time_before(jiffies, end_time));
+
+ if (err == -EAGAIN || err == -ETIMEDOUT)
+ dev_err(pdsc->dev, "PDS_CORE_CMD_SEND_COMPONENT timed out\n");
+
+ return err;
+}
+
+static int pdsc_flash_component_chunk(struct pdsc *pdsc, struct device *dev,
+ struct pds_core_flash_component *info,
+ u16 info_sz, const u8 *data, u16 copy_sz,
+ u32 offset, u8 slot_id,
+ union pds_core_dev_comp *comp)
+{
+ struct pdsc_deferred_dma *deferred;
+ dma_addr_t dma_addr;
+ u8 *component_data;
+ int err;
+
+ deferred = kmalloc_obj(*deferred, GFP_KERNEL);
+ if (!deferred)
+ return -ENOMEM;
+
+ component_data = kmemdup(data, copy_sz, GFP_KERNEL);
+ if (!component_data) {
+ kfree(deferred);
+ return -ENOMEM;
+ }
+
+ dma_addr = dma_map_single(dev, component_data, copy_sz, DMA_TO_DEVICE);
+ if (dma_mapping_error(dev, dma_addr)) {
+ dev_err(dev,
+ "Failed to dma_map component_data at offset 0x%x copy_sz 0x%x\n",
+ offset, copy_sz);
+ kfree(component_data);
+ kfree(deferred);
+ return -ENOMEM;
+ }
+
+ err = pdsc_devcmd_send_component(pdsc, info, info_sz, dma_addr,
+ copy_sz, offset, slot_id, comp);
+ if (err == -ETIMEDOUT || err == -EAGAIN) {
+ pdsc_deferred_dma_add(pdsc, deferred, dma_addr,
+ component_data, copy_sz, DMA_TO_DEVICE);
+ return err;
+ }
+
+ kfree(deferred);
+ dma_unmap_single(dev, dma_addr, copy_sz, DMA_TO_DEVICE);
+ kfree(component_data);
+
+ return err;
+}
+
+static int pdsc_flash_component(struct pldmfw *context,
+ struct pldmfw_component *component)
+{
+ char component_name_buf[PDSC_FW_COMPONENT_FULL_NAME_BUFLEN];
+ struct pds_core_fwu_priv *priv =
+ container_of(context, struct pds_core_fwu_priv, context);
+ struct pds_core_flash_component *component_info;
+ const char *component_name = NULL;
+ struct device *dev = context->dev;
+ struct pdsc *pdsc = priv->pdsc;
+ u16 buf_sz, info_sz;
+ struct devlink *dl;
+ u8 component_type;
+ u32 total_len;
+ u32 offset;
+ int err;
+
+ if (pdsc_skip_component(priv, component->identifier))
+ return 0;
+
+ component_type = pdsc_get_component_type_by_id(pdsc,
+ component->identifier);
+ if (component_type) {
+ const char *type_name = pdsc_fw_type_to_name(component_type);
+
+ if (type_name) {
+ snprintf(component_name_buf, sizeof(component_name_buf),
+ "%s%s", PDSC_FW_COMPONENT_PREFIX, type_name);
+ component_name = component_name_buf;
+ }
+ }
+
+ total_len = component->component_size;
+ dev_dbg(dev,
+ "component name %s class %u id %u act_meth %u ver_str %.*s index %u size %u\n",
+ component_name ?: "(unknown)", component->classification,
+ component->identifier, component->activation_method,
+ component->version_len, component->version_string,
+ component->index, component->component_size);
+
+ buf_sz = sizeof(pdsc->cmd_regs->data);
+ info_sz = struct_size(component_info, version_str,
+ component->version_len);
+ if (info_sz > buf_sz) {
+ dev_err(dev, "component_info size %d too big, max size: %d\n",
+ info_sz, buf_sz);
+ return -ENOSPC;
+ }
+ component_info = vzalloc(info_sz);
+ if (!component_info)
+ return -ENOMEM;
+
+ component_info->comparison_stamp =
+ cpu_to_le32(component->comparison_stamp);
+ component_info->image_size = cpu_to_le32(total_len);
+ component_info->classification = cpu_to_le16(component->classification);
+ component_info->identifier = cpu_to_le16(component->identifier);
+ component_info->options = cpu_to_le16(component->options);
+ component_info->version_str_type = component->version_type;
+ component_info->version_str_len = component->version_len;
+ memcpy(component_info->version_str, component->version_string,
+ component->version_len);
+
+ dl = priv_to_devlink(pdsc);
+
+ offset = 0;
+ while (offset < total_len) {
+ union pds_core_dev_comp comp = {};
+ u16 copy_sz;
+
+ copy_sz = min_t(unsigned int, PDS_PAGE_SIZE,
+ total_len - offset);
+
+ err = pdsc_flash_component_chunk(pdsc, dev, component_info,
+ info_sz,
+ component->component_data +
+ offset, copy_sz, offset,
+ PDS_CORE_FW_SLOT_INVALID,
+ &comp);
+ if (err &&
+ comp.send_component.compat_response &&
+ (comp.send_component.compat_response_code ==
+ PDS_CORE_COMPONENT_STAMP_IDENTICAL ||
+ comp.send_component.compat_response_code ==
+ PDS_CORE_COMPONENT_STAMP_LOWER)) {
+ err = 0;
+ devlink_flash_update_status_notify(dl, "Skipped",
+ component_name,
+ 0, 0);
+ goto skip_component;
+ }
+
+ if (err) {
+ NL_SET_ERR_MSG_MOD(priv->extack,
+ "Failed to flash component");
+ goto err_out;
+ }
+
+ offset += copy_sz;
+ devlink_flash_update_status_notify(dl,
+ "Erasing/Flashing",
+ component_name, offset,
+ total_len);
+ }
+
+ vfree(component_info);
+ return 0;
+
+err_out:
+ devlink_flash_update_status_notify(dl,
+ "Erasing/Flashing Component Failed",
+ component_name, 0, 0);
+skip_component:
+ vfree(component_info);
+ return err;
+}
+
+static int pdsc_devcmd_finalize_update(struct pdsc *pdsc)
+{
+ union pds_core_dev_cmd cmd = {
+ .finalize_update.opcode = PDS_CORE_CMD_FINALIZE_UPDATE,
+ .finalize_update.ver = 1,
+ };
+ union pds_core_dev_comp comp = {};
+
+ return pdsc_devcmd(pdsc, &cmd, &comp, pdsc->devcmd_timeout);
+}
+
+static int pdsc_finalize_update(struct pldmfw *context)
+{
+ struct pds_core_fwu_priv *priv =
+ container_of(context, struct pds_core_fwu_priv, context);
+ const char *component_name = priv->params->component;
+ unsigned long start_time, end_time;
+ struct device *dev = context->dev;
+ struct pdsc *pdsc = priv->pdsc;
+ struct devlink *dl;
+ int err;
+
+ dl = priv_to_devlink(pdsc);
+
+ start_time = jiffies;
+ end_time = start_time + (PDSC_FW_INSTALL_TIMEOUT * HZ);
+ do {
+ err = pdsc_devcmd_finalize_update(pdsc);
+ if (err != -EAGAIN)
+ break;
+
+ dev_dbg(dev, "retrying finalize_update: %pe\n", ERR_PTR(err));
+ msleep(20);
+ } while (time_before(jiffies, end_time) && err == -EAGAIN);
+
+ if (err) {
+ devlink_flash_update_status_notify(dl, "Finalize Update Failed",
+ component_name, 0, 0);
+ NL_SET_ERR_MSG_MOD(priv->extack, "Finalize update failed");
+ return err;
+ }
+
+ devlink_flash_update_status_notify(dl, "Finalized Update",
+ component_name, 0, 0);
+ return 0;
+}
+
+static const struct pldmfw_ops pdsc_pldmfw_ops = {
+ .match_record = pdsc_match_record_descs,
+ .send_package_data = pdsc_send_package_data,
+ .send_component_table = pdsc_send_component_table,
+ .flash_component = pdsc_flash_component,
+ .finalize_update = pdsc_finalize_update
+};
+
+static int pdsc_pldm_firmware_update(struct pdsc *pdsc,
+ struct devlink_flash_update_params *params,
+ struct netlink_ext_ack *extack,
+ const struct firmware *fw)
+{
+ struct pds_core_fwu_priv priv = {};
+ int err;
+
+ if (!pdsc->fw_components.num_components) {
+ err = pdsc_get_component_info(pdsc);
+ if (err) {
+ NL_SET_ERR_MSG_MOD(extack,
+ "Failed to get component info");
+ return err;
+ }
+ }
+
+ if (params->component) {
+ u8 type = pdsc_name_to_fw_type(params->component);
+
+ if (!type || !pdsc_component_type_exists(pdsc, type)) {
+ NL_SET_ERR_MSG_MOD(extack, "Unknown component name");
+ return -ENOENT;
+ }
+ }
+
+ INIT_LIST_HEAD(&priv.components);
+ priv.context.ops = &pdsc_pldmfw_ops;
+ priv.context.dev = pdsc->dev;
+ priv.params = params;
+ priv.extack = extack;
+ priv.pdsc = pdsc;
+
+ err = pldmfw_flash_image(&priv.context, fw);
+ pdsc_free_fwu_priv(&priv);
+
+ return err;
+}
+
+int pdsc_firmware_update(struct pdsc *pdsc,
+ struct devlink_flash_update_params *params,
+ struct netlink_ext_ack *extack)
+{
+ int err;
+
+ if (pdsc->dev_ident.version >= PDS_CORE_IDENTITY_VERSION_2 &&
+ pdsc->dev_ident.capabilities &
+ cpu_to_le64(PDS_CORE_DEV_CAP_PLDM_FW_UPDATE))
+ err = pdsc_pldm_firmware_update(pdsc, params, extack,
+ params->fw);
+ else
+ err = pdsc_legacy_firmware_update(pdsc, params, extack);
+
+ /* Invalidate cached component info so next info_get refreshes */
+ pdsc->fw_components.num_components = 0;
+
+ return err;
+}
diff --git a/drivers/net/ethernet/amd/pds_core/main.c b/drivers/net/ethernet/amd/pds_core/main.c
index 22db78343eb0..17b64177871a 100644
--- a/drivers/net/ethernet/amd/pds_core/main.c
+++ b/drivers/net/ethernet/amd/pds_core/main.c
@@ -246,6 +246,8 @@ static int pdsc_init_pf(struct pdsc *pdsc)
mutex_init(&pdsc->devcmd_lock);
mutex_init(&pdsc->config_lock);
spin_lock_init(&pdsc->adminq_lock);
+ INIT_LIST_HEAD(&pdsc->deferred_dma_list);
+ spin_lock_init(&pdsc->deferred_dma_lock);
mutex_lock(&pdsc->config_lock);
set_bit(PDSC_S_FW_DEAD, &pdsc->state);
@@ -311,6 +313,7 @@ static int pdsc_init_pf(struct pdsc *pdsc)
destroy_workqueue(pdsc->wq);
mutex_destroy(&pdsc->config_lock);
mutex_destroy(&pdsc->devcmd_lock);
+ pdsc_deferred_dma_free(pdsc);
pci_free_irq_vectors(pdsc->pdev);
pdsc_unmap_bars(pdsc);
err_out_release_regions:
@@ -452,6 +455,7 @@ static void pdsc_remove(struct pci_dev *pdev)
}
pci_disable_device(pdev);
+ pdsc_deferred_dma_free(pdsc);
ida_free(&pdsc_ida, pdsc->uid);
pdsc_debugfs_del_dev(pdsc);
@@ -499,6 +503,7 @@ static void pdsc_reset_prepare(struct pci_dev *pdev)
pci_release_regions(pdev);
if (pci_is_enabled(pdev))
pci_disable_device(pdev);
+ pdsc_deferred_dma_free(pdsc);
}
static void pdsc_reset_done(struct pci_dev *pdev)
diff --git a/include/linux/pds/pds_core_if.h b/include/linux/pds/pds_core_if.h
index 619186f26b5b..5a1fafaccf20 100644
--- a/include/linux/pds/pds_core_if.h
+++ b/include/linux/pds/pds_core_if.h
@@ -40,6 +40,13 @@ enum pds_core_cmd_opcode {
PDS_CORE_CMD_FW_DOWNLOAD = 4,
PDS_CORE_CMD_FW_CONTROL = 5,
+ PDS_CORE_CMD_GET_COMPONENT_INFO = 6,
+ PDS_CORE_CMD_SEND_PKG_DATA = 7,
+ PDS_CORE_CMD_SEND_COMPONENT_TBL = 8,
+ PDS_CORE_CMD_SEND_COMPONENT = 9,
+ PDS_CORE_CMD_FINALIZE_UPDATE = 10,
+ PDS_CORE_CMD_MATCH_RECORD_DESC = 11,
+
/* SR/IOV commands */
PDS_CORE_CMD_VF_GETATTR = 60,
PDS_CORE_CMD_VF_SETATTR = 61,
@@ -100,6 +107,14 @@ struct pds_core_drv_identity {
char driver_ver_str[32];
};
+/**
+ * enum pds_core_dev_capability - Device capabilities
+ * @PDS_CORE_DEV_CAP_PLDM_FW_UPDATE: Device only supports FW update via PLDM
+ */
+enum pds_core_dev_capability {
+ PDS_CORE_DEV_CAP_PLDM_FW_UPDATE = BIT(0),
+};
+
#define PDS_DEV_TYPE_MAX 16
/**
* struct pds_core_dev_identity - Device identity information
@@ -119,6 +134,9 @@ struct pds_core_drv_identity {
* value in usecs to device units using:
* device units = usecs * mult / div
* @vif_types: How many of each VIF device type is supported
+ * @max_fw_slots: Number of firmware components reported by device
+ * only supported on version >= PDS_CORE_IDENTITY_VERSION_2
+ * @rsvd2: Word boundary padding
* @capabilities: Device capabilities
* only supported on version >= PDS_CORE_IDENTITY_VERSION_2
*/
@@ -133,6 +151,8 @@ struct pds_core_dev_identity {
__le32 intr_coal_mult;
__le32 intr_coal_div;
__le16 vif_types[PDS_DEV_TYPE_MAX];
+ __le16 max_fw_slots;
+ u8 rsvd2[6];
__le64 capabilities;
};
@@ -279,11 +299,20 @@ enum pds_core_fw_control_oper {
PDS_CORE_FW_GET_LIST = 7,
};
+/**
+ * enum pds_core_fw_slot - Firmware slot identifiers
+ * @PDS_CORE_FW_SLOT_INVALID: Let firmware select slot based on package metadata
+ * @PDS_CORE_FW_SLOT_A: Primary firmware slot A
+ * @PDS_CORE_FW_SLOT_B: Primary firmware slot B
+ * @PDS_CORE_FW_SLOT_GOLD: Gold/recovery firmware slot
+ * @PDS_CORE_FW_SLOT_MAX: Sentinel value indicating no slot resolved
+ */
enum pds_core_fw_slot {
PDS_CORE_FW_SLOT_INVALID = 0,
PDS_CORE_FW_SLOT_A = 1,
PDS_CORE_FW_SLOT_B = 2,
PDS_CORE_FW_SLOT_GOLD = 3,
+ PDS_CORE_FW_SLOT_MAX = 0xff,
};
/**
@@ -450,6 +479,364 @@ struct pds_core_vf_ctrl_comp {
u8 status;
};
+/**
+ * struct pds_core_send_pkg_data_cmd - Send package data command
+ * @opcode: Opcode PDS_CORE_CMD_SEND_PKG_DATA
+ * @ver: Driver's max support version of this command
+ * @total_len: Total length of the package data
+ * @offset: Offset in the package data, non-zero if multiple commands are
+ * needed for sending the package data
+ * @data_len: Length of data stored at data_pa
+ * @data_pa: Data physical address for DMA to device
+ *
+ * The package data may be too large to store in a single buffer, so multiple
+ * PDS_CORE_CMD_SEND_PKG_DATA devcmds may be needed.
+ */
+struct pds_core_send_pkg_data_cmd {
+ u8 opcode;
+ u8 ver;
+ __le16 total_len;
+ __le16 offset;
+ __le16 data_len;
+ __le64 data_pa;
+};
+
+/**
+ * struct pds_core_send_pkg_data_comp - Send package data completion
+ * @status: Status of the command (enum pds_core_status_code)
+ * @ver: Device's max supported version of this command
+ * @rsvd: Word boundary padding
+ */
+struct pds_core_send_pkg_data_comp {
+ u8 status;
+ u8 ver;
+ u8 rsvd[2];
+};
+
+/**
+ * struct pds_core_component_tbl - Component table details
+ * @comparison_stamp: Comparison stamp used for component version checks
+ * @classification: Vendor specific classification info
+ * @identifier: Component's ID
+ * @transfer_flag: Part of the component table this request represents
+ * @version_str_type: The types of strings used
+ * @version_str_len: Length of @version_str
+ * @version_str: Component version information
+ */
+struct pds_core_component_tbl {
+ __le32 comparison_stamp;
+ __le16 classification;
+ __le16 identifier;
+ u8 transfer_flag;
+ u8 version_str_type;
+ u8 version_str_len;
+ u8 version_str[];
+};
+
+/**
+ * struct pds_core_send_component_tbl_cmd - Send component table command
+ * @opcode: Opcode PDS_CORE_CMD_SEND_COMPONENT_TBL
+ * @ver: Driver's max support version of this command
+ * @slot_id: enum pds_core_fw_slot
+ * @rsvd: Word boundary padding
+ *
+ * Expects to find component table info (struct pds_core_component_tbl)
+ * in cmd_regs->data. Driver should keep the devcmd interface locked
+ * while preparing the component table info.
+ */
+struct pds_core_send_component_tbl_cmd {
+ u8 opcode;
+ u8 ver;
+ u8 slot_id;
+ u8 rsvd;
+};
+
+enum pds_core_component_resp_code {
+ PDS_CORE_COMPONENT_VALID = 0x0,
+ PDS_CORE_COMPONENT_STAMP_IDENTICAL = 0x1,
+ PDS_CORE_COMPONENT_STAMP_LOWER = 0x2,
+ PDS_CORE_COMPONENT_STAMP_OR_VERSION_INVALID = 0x3,
+ PDS_CORE_COMPONENT_CONFLICT = 0x4,
+ PDS_CORE_COMPONENT_PREREQS_NOT_MET = 0x5,
+ PDS_CORE_COMPONENT_NOT_SUPPORTED = 0x6,
+ PDS_CORE_COMPONENT_FW_TYPE_INVALID = 0xd0,
+};
+
+/**
+ * struct pds_core_send_component_tbl_comp - Send component table completion
+ * @status: Status of the command (enum pds_core_status_code)
+ * @ver: Device's max supported version of this command
+ * @completion_code: Component completion code
+ * @response: Component response
+ * @response_code: Component response code
+ * @slot_id: Actual slot_id of the component (enum pds_core_fw_slot)
+ * @rsvd: Word boundary padding
+ */
+struct pds_core_send_component_tbl_comp {
+ u8 status;
+ u8 ver;
+ u8 completion_code;
+ u8 response;
+ u8 response_code;
+ u8 slot_id;
+ u8 rsvd[2];
+};
+
+/**
+ * enum pds_core_send_component_op - PDS_CORE_CMD_SEND_COMPONENT operation
+ * @PDS_CORE_SEND_COMPONENT_START: Initial operation to start transfer
+ * @PDS_CORE_SEND_COMPONENT_STATUS: Subsequent calls to check on status
+ */
+enum pds_core_send_component_op {
+ PDS_CORE_SEND_COMPONENT_START = 0,
+ PDS_CORE_SEND_COMPONENT_STATUS = 1,
+};
+
+#define PDS_CORE_FW_COMPONENT_ID_INVALID 0xFFFF
+/**
+ * struct pds_core_flash_component - Component details
+ * @comparison_stamp: Comparison stamp used for component version checks
+ * @image_size: Component image size
+ * @classification: Vendor specific classification info
+ * @identifier: Component's ID
+ * @options: Component options
+ * @rsvd: Word boundary padding
+ * @version_str_type: The types of strings used
+ * @version_str_len: Length of @version_str
+ * @version_str: Component version information
+ */
+struct pds_core_flash_component {
+ __le32 comparison_stamp;
+ __le32 image_size;
+ __le16 classification;
+ __le16 identifier;
+ __le16 options;
+ u8 rsvd[3];
+ u8 version_str_type;
+ u8 version_str_len;
+ u8 version_str[];
+};
+
+/**
+ * struct pds_core_send_component_cmd - Send component command
+ * @opcode: Opcode PDS_CORE_CMD_SEND_COMPONENT
+ * @ver: Driver's max supported version of this command
+ * @slot_id: enum pds_core_fw_slot
+ * @operation: enum pds_core_send_component_op
+ * @offset: Offset into the component, non-zero if multiple commands
+ * are needed for a single component
+ * @data_len: Length of this part of the component stored at @data_pa
+ * @rsvd: Word boundary padding
+ * @data_pa: DMA address of the component
+ *
+ * A component may be too large to store in a single buffer, so multiple
+ * PDS_CORE_CMD_SEND_COMPONENT devcmds may be needed.
+ *
+ * Expects to find flash component info (struct pds_core_flash_component)
+ * in cmd_regs->data. Driver should keep the devcmd interface locked
+ * while preparing and sending the flash component info.
+ */
+struct pds_core_send_component_cmd {
+ u8 opcode;
+ u8 ver;
+ u8 slot_id;
+ u8 operation;
+ __le32 offset;
+ __le32 data_len;
+ u8 rsvd[4];
+ __le64 data_pa;
+};
+
+/**
+ * struct pds_core_send_component_comp - Send component completion
+ * @status: Status of the command (enum pds_core_status_code)
+ * @ver: Device's max supported version of this command
+ * @completion_code: Completion code
+ * @compat_response: Compatibility response (0 = Component can be updated)
+ * @compat_response_code: Compatibility response code
+ * @rsvd: Word boundary padding
+ */
+struct pds_core_send_component_comp {
+ u8 status;
+ u8 ver;
+ u8 completion_code;
+ u8 compat_response;
+ u8 compat_response_code;
+ u8 rsvd[3];
+};
+
+/**
+ * enum pds_core_fw_component_type - Firmware component type
+ * @PDS_CORE_FW_TYPE_UNKNOWN: Unknown component type
+ * @PDS_CORE_FW_TYPE_MAIN: Main firmware
+ * @PDS_CORE_FW_TYPE_BOOT: Boot loader
+ * @PDS_CORE_FW_TYPE_CPLD: CPLD firmware
+ * @PDS_CORE_FW_TYPE_SECURE: Secure firmware
+ * @PDS_CORE_FW_TYPE_FPGA: FPGA configuration
+ * @PDS_CORE_FW_TYPE_SUC_MAIN: System Unit Controller firmware
+ * @PDS_CORE_FW_TYPE_SUC_BOOT: System Unit Controller bootloader
+ * @PDS_CORE_FW_TYPE_UBOOT: U-Boot bootloader
+ *
+ * Gold/recovery variants are identified by slot_id == PDS_CORE_FW_SLOT_GOLD
+ * and reported with a ".gold" suffix (e.g., fw.gold).
+ */
+enum pds_core_fw_component_type {
+ PDS_CORE_FW_TYPE_UNKNOWN = 0,
+ PDS_CORE_FW_TYPE_MAIN = 1,
+ PDS_CORE_FW_TYPE_BOOT = 2,
+ PDS_CORE_FW_TYPE_CPLD = 3,
+ PDS_CORE_FW_TYPE_SECURE = 4,
+ PDS_CORE_FW_TYPE_FPGA = 5,
+ PDS_CORE_FW_TYPE_SUC_MAIN = 6,
+ PDS_CORE_FW_TYPE_SUC_BOOT = 7,
+ PDS_CORE_FW_TYPE_UBOOT = 8,
+};
+
+/**
+ * enum pds_core_component_info_flags - Component info flags
+ * @PDS_CORE_FW_COMPONENT_INFO_F_RUNNING: Component is currently running
+ * @PDS_CORE_FW_COMPONENT_INFO_F_STARTUP: Component version on next FW boot
+ * @PDS_CORE_FW_COMPONENT_INFO_F_FIXED: Component is fixed and cannot be updated
+ * @PDS_CORE_FW_COMPONENT_INFO_F_UPDATE_BY_NAME: Component can be updated
+ * by name
+ */
+enum pds_core_component_info_flags {
+ PDS_CORE_FW_COMPONENT_INFO_F_RUNNING = BIT(0),
+ PDS_CORE_FW_COMPONENT_INFO_F_STARTUP = BIT(1),
+ PDS_CORE_FW_COMPONENT_INFO_F_FIXED = BIT(2),
+ PDS_CORE_FW_COMPONENT_INFO_F_UPDATE_BY_NAME = BIT(3),
+};
+
+/**
+ * struct pds_core_fw_component_info - GET_COMPONENT_INFO entry
+ * @name: Component's name
+ * @component_type: enum pds_core_fw_component_type
+ * @rsvd: Word boundary padding
+ * @flags: enum pds_core_component_info_flags
+ * @identifier: Component's identifier
+ * @slot_id: Component's slot identifier
+ * @version: Component's version
+ */
+struct pds_core_fw_component_info {
+#define PDS_CORE_FW_COMPONENT_NAME_BUFLEN 24
+ char name[PDS_CORE_FW_COMPONENT_NAME_BUFLEN];
+ u8 component_type;
+ u8 rsvd[3];
+ __le16 flags;
+ u8 identifier;
+ u8 slot_id;
+#define PDS_CORE_FW_COMPONENT_VER_BUFLEN 32
+ char version[PDS_CORE_FW_COMPONENT_VER_BUFLEN];
+};
+
+#define PDS_CORE_FW_COMPONENT_LIST_LEN ((PDS_PAGE_SIZE - 8) / \
+ sizeof(struct pds_core_fw_component_info))
+
+/**
+ * struct pds_core_component_list_info - GET_COMPONENT_INFO completion data
+ * @num_components: Number of valid components
+ * @rsvd: Word boundary padding
+ * @info: List of valid components
+ */
+struct pds_core_component_list_info {
+ u8 num_components;
+ u8 rsvd[7];
+ struct pds_core_fw_component_info info[PDS_CORE_FW_COMPONENT_LIST_LEN];
+};
+
+/**
+ * struct pds_core_get_component_info_cmd - GET_COMPONENT_INFO command
+ * @opcode: PDS_CORE_CMD_GET_COMPONENT_INFO
+ * @ver: Driver's max supported version of this command
+ * @data_len: Length of data at data_pa
+ * @rsvd: Word boundary padding
+ * @data_pa: DMA address of data
+ *
+ * FW populates struct pds_core_component_list_info pointed to by @data_pa
+ */
+struct pds_core_get_component_info_cmd {
+ u8 opcode;
+ u8 ver;
+ __le16 data_len;
+ u8 rsvd[4];
+ __le64 data_pa;
+};
+
+/**
+ * struct pds_core_get_component_info_comp - GET_COMPONENT_INFO completion
+ * @status: enum pds_core_status_code
+ * @ver: Device's max supported version of this command
+ * @rsvd: Word boundary padding
+ */
+struct pds_core_get_component_info_comp {
+ u8 status;
+ u8 ver;
+ u8 rsvd[2];
+};
+
+/**
+ * struct pds_core_finalize_update_cmd - FINALIZE_UPDATE command
+ * @opcode: PDS_CORE_CMD_FINALIZE_UPDATE
+ * @ver: Driver's max support version of this command
+ * @rsvd: Word boundary padding
+ *
+ * Driver sends at the end of updating all components to finalize the update
+ */
+struct pds_core_finalize_update_cmd {
+ u8 opcode;
+ u8 ver;
+ u8 rsvd[2];
+};
+
+/**
+ * struct pds_core_finalize_update_comp - FINALIZE_UPDATE completion
+ * @status: enum pds_core_status_code
+ * @ver: Device's max supported version of this command
+ * @rsvd: Word boundary padding
+ */
+struct pds_core_finalize_update_comp {
+ u8 status;
+ u8 ver;
+ u8 rsvd[2];
+};
+
+/**
+ * struct pds_core_match_record_desc_cmd - MATCH_RECORD_DESC command
+ * @opcode: PDS_CORE_CMD_MATCH_RECORD_DESC
+ * @ver: Driver's max supported version of this command
+ * @type: PLDM Descriptor Identifier Type
+ * @size: Length of the Descriptor Identifier Value
+ * @rsvd: Word boundary padding
+ *
+ * Expects to find the Descriptor Identifier Data in cmd_regs->data. Driver
+ * should keep the devcmd interface locked while preparing and sending this
+ * command.
+ */
+struct pds_core_match_record_desc_cmd {
+ u8 opcode;
+ u8 ver;
+ __le16 type;
+ __le16 size;
+ u8 rsvd[2];
+};
+
+/**
+ * struct pds_core_match_record_desc_comp - MATCH_RECORD_DESC completion
+ * @status: enum pds_core_status_code
+ * @ver: Device's max supported version of this command
+ * @match: Whether or not the Record Descriptor matches the device
+ * @rsvd: Word boundary padding
+ *
+ * When status is PDS_RC_SUCCESS, then @match is valid, otherwise it's
+ * undefined.
+ */
+struct pds_core_match_record_desc_comp {
+ u8 status;
+ u8 ver;
+ u8 match;
+ u8 rsvd;
+};
+
/*
* union pds_core_dev_cmd - Overlay of core device command structures
*/
@@ -466,6 +853,13 @@ union pds_core_dev_cmd {
struct pds_core_vf_setattr_cmd vf_setattr;
struct pds_core_vf_getattr_cmd vf_getattr;
struct pds_core_vf_ctrl_cmd vf_ctrl;
+
+ struct pds_core_get_component_info_cmd get_component_info;
+ struct pds_core_send_pkg_data_cmd send_pkg_data;
+ struct pds_core_send_component_tbl_cmd send_component_tbl;
+ struct pds_core_send_component_cmd send_component;
+ struct pds_core_finalize_update_cmd finalize_update;
+ struct pds_core_match_record_desc_cmd match_record_desc;
};
/*
@@ -484,6 +878,13 @@ union pds_core_dev_comp {
struct pds_core_vf_setattr_comp vf_setattr;
struct pds_core_vf_getattr_comp vf_getattr;
struct pds_core_vf_ctrl_comp vf_ctrl;
+
+ struct pds_core_get_component_info_comp get_component_info;
+ struct pds_core_send_pkg_data_comp send_pkg_data;
+ struct pds_core_send_component_tbl_comp send_component_tbl;
+ struct pds_core_send_component_comp send_component;
+ struct pds_core_finalize_update_comp finalize_update;
+ struct pds_core_match_record_desc_comp match_record_desc;
};
/**
--
2.43.0
^ permalink raw reply related
* [PATCH 5/6] pds_core: add host backed memory support for firmware
From: Nikhil P. Rao @ 2026-07-08 21:22 UTC (permalink / raw)
To: netdev
Cc: kuba, brett.creeley, eric.joyner, andrew+netdev, davem, edumazet,
pabeni, jacob.e.keller, Nikhil P. Rao, Vamsi Atluri
In-Reply-To: <20260708212222.296202-1-nikhil.rao@amd.com>
Some newer AMD/Pensando cards have minimal memory and there are cases
where components, specifically in the control plane, need more memory.
This series adds support for host backed DMA memory that can be used
by the firmware for the previously mentioned cases.
Host memory allocation is best-effort: if some allocations fail, the
driver continues with whatever succeeded. Firmware gracefully degrades
when less memory is available than requested.
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Vamsi Atluri <Vamsi.Atluri@amd.com>
Signed-off-by: Nikhil P. Rao <nikhil.rao@amd.com>
---
drivers/net/ethernet/amd/pds_core/core.c | 160 +++++++++++++++++++++++
drivers/net/ethernet/amd/pds_core/core.h | 22 ++++
drivers/net/ethernet/amd/pds_core/main.c | 4 +-
include/linux/pds/pds_core_if.h | 64 +++++++++
4 files changed, 249 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/amd/pds_core/core.c b/drivers/net/ethernet/amd/pds_core/core.c
index a7a0bcf98ed3..356a69c895b6 100644
--- a/drivers/net/ethernet/amd/pds_core/core.c
+++ b/drivers/net/ethernet/amd/pds_core/core.c
@@ -500,6 +500,7 @@ void pdsc_teardown(struct pdsc *pdsc, bool removing)
pdsc->viftype_status = NULL;
}
+ pdsc_host_mem_free(pdsc);
pdsc_dev_uninit(pdsc);
set_bit(PDSC_S_FW_DEAD, &pdsc->state);
@@ -509,6 +510,7 @@ int pdsc_start(struct pdsc *pdsc)
{
pds_core_intr_mask(&pdsc->intr_ctrl[pdsc->adminqcq.intx],
PDS_CORE_INTR_MASK_CLEAR);
+ pdsc_host_mem_add(pdsc);
return 0;
}
@@ -673,3 +675,161 @@ void pdsc_health_thread(struct work_struct *work)
out_unlock:
mutex_unlock(&pdsc->config_lock);
}
+
+static void pdsc_host_mem_del_one(struct pdsc *pdsc, u16 tag, u8 reason)
+{
+ union pds_core_dev_comp comp = {};
+ union pds_core_dev_cmd cmd = {
+ .host_mem.opcode = PDS_CORE_CMD_HOST_MEM,
+ .host_mem.oper = PDS_CORE_HOST_MEM_DEL,
+ .host_mem.tag = cpu_to_le16(tag),
+ .host_mem.reason = reason,
+ };
+
+ dev_dbg(pdsc->dev, "Sending devcmd for mem del tag %d\n", tag);
+ pdsc_devcmd(pdsc, &cmd, &comp, pdsc->devcmd_timeout);
+}
+
+static int pdsc_host_mem_add_one(struct pdsc *pdsc, int index)
+{
+ struct pdsc_host_mem *hm = &pdsc->host_mem_reqs[index];
+ union pds_core_dev_comp comp = {};
+ union pds_core_dev_cmd cmd = {};
+ int err;
+
+ cmd.host_mem.opcode = PDS_CORE_CMD_HOST_MEM;
+ cmd.host_mem.oper = PDS_CORE_HOST_MEM_QUERY;
+ cmd.host_mem.index = cpu_to_le16(index);
+ dev_dbg(pdsc->dev, "Sending devcmd for mem query index %d\n", index);
+ err = pdsc_devcmd(pdsc, &cmd, &comp, pdsc->devcmd_timeout);
+ if (err || comp.status != PDS_RC_SUCCESS) {
+ dev_err(pdsc->dev, "mem query failed err %d status %d\n",
+ err, comp.status);
+ return err ? err : -EIO;
+ }
+ hm->size = le32_to_cpu(comp.host_mem.size);
+ hm->tag = le16_to_cpu(comp.host_mem.tag);
+ dev_dbg(pdsc->dev, "mem query returned size %d tag %d\n",
+ hm->size, hm->tag);
+
+ if (!hm->size || hm->size > PDSC_HOST_MEM_MAX_CONTIG) {
+ dev_err(pdsc->dev, "invalid size %d for tag %d\n",
+ hm->size, hm->tag);
+ err = -EINVAL;
+ goto err_del;
+ }
+
+ hm->order = get_order(hm->size);
+ hm->pg = alloc_pages(GFP_KERNEL | __GFP_ZERO | __GFP_NOWARN, hm->order);
+ if (!hm->pg) {
+ dev_warn(pdsc->dev, "alloc order %d failed for tag %d\n",
+ hm->order, hm->tag);
+ err = -ENOMEM;
+ goto err_del;
+ }
+
+ hm->pa = dma_map_page(pdsc->dev, hm->pg, 0, hm->size,
+ DMA_BIDIRECTIONAL);
+ if (dma_mapping_error(pdsc->dev, hm->pa)) {
+ dev_err(pdsc->dev, "dma map failed for tag %d size %d\n",
+ hm->tag, hm->size);
+ __free_pages(hm->pg, hm->order);
+ hm->pg = NULL;
+ err = -EIO;
+ goto err_del;
+ }
+
+ /* Track this allocation so pdsc_host_mem_free() can clean it up */
+ pdsc->num_host_mem_reqs++;
+
+ memset(&cmd, 0, sizeof(cmd));
+ memset(&comp, 0, sizeof(comp));
+ cmd.host_mem.opcode = PDS_CORE_CMD_HOST_MEM;
+ cmd.host_mem.oper = PDS_CORE_HOST_MEM_ADD;
+ cmd.host_mem.tag = cpu_to_le16(hm->tag);
+ cmd.host_mem.size = cpu_to_le32(hm->size);
+ cmd.host_mem.buf_pa = cpu_to_le64(hm->pa);
+
+ dev_dbg(pdsc->dev, "Sending devcmd for mem add tag %d size %d pa %pad\n",
+ hm->tag, hm->size, &hm->pa);
+ err = pdsc_devcmd(pdsc, &cmd, &comp, pdsc->devcmd_timeout);
+ if (err || comp.status != PDS_RC_SUCCESS) {
+ dev_err(pdsc->dev, "mem add failed err %d status %d for tag %d\n",
+ err, comp.status, hm->tag);
+ err = err ? err : -EIO;
+ goto err_del;
+ }
+ dev_dbg(pdsc->dev, "mem add completed for tag %d\n", hm->tag);
+
+ return 0;
+
+err_del:
+ /* After MEM_QUERY succeeds, firmware expects MEM_ADD or MEM_DEL */
+ pdsc_host_mem_del_one(pdsc, hm->tag, PDS_RC_ENOMEM);
+ return err;
+}
+
+void pdsc_host_mem_add(struct pdsc *pdsc)
+{
+ union pds_core_dev_comp comp = {};
+ union pds_core_dev_cmd cmd = {};
+ u16 count;
+ int err;
+ int i;
+
+ if (!(pdsc->dev_ident.capabilities &
+ cpu_to_le64(PDS_CORE_DEV_CAP_HOST_MEM)))
+ return;
+
+ cmd.host_mem.opcode = PDS_CORE_CMD_HOST_MEM;
+ cmd.host_mem.oper = PDS_CORE_HOST_MEM_GET_COUNT;
+ cmd.host_mem.index = cpu_to_le16(PDSC_HOST_MEM_MAX_COUNT);
+ cmd.host_mem.max_contig = cpu_to_le32(PDSC_HOST_MEM_MAX_CONTIG);
+ dev_dbg(pdsc->dev, "Sending devcmd for mem get count max_contig %u\n",
+ PDSC_HOST_MEM_MAX_CONTIG);
+ err = pdsc_devcmd(pdsc, &cmd, &comp, pdsc->devcmd_timeout);
+ if (err || comp.status != PDS_RC_SUCCESS) {
+ dev_err(pdsc->dev, "mem get count failed err %d status %d\n",
+ err, comp.status);
+ return;
+ }
+
+ count = min(le16_to_cpu(comp.host_mem.count),
+ PDSC_HOST_MEM_MAX_COUNT);
+ dev_dbg(pdsc->dev, "mem get count returned count %d\n", count);
+ if (count == 0)
+ return;
+
+ pdsc->host_mem_reqs = kzalloc_objs(*pdsc->host_mem_reqs, count,
+ GFP_KERNEL);
+ if (!pdsc->host_mem_reqs) {
+ dev_err(pdsc->dev, "failed to alloc host_mem_reqs array\n");
+ return;
+ }
+
+ for (i = 0; i < count; i++) {
+ err = pdsc_host_mem_add_one(pdsc, i);
+ if (err)
+ break;
+ }
+}
+
+void pdsc_host_mem_free(struct pdsc *pdsc)
+{
+ int i;
+
+ if (!pdsc->host_mem_reqs)
+ return;
+
+ for (i = 0; i < pdsc->num_host_mem_reqs; i++) {
+ dma_unmap_page(pdsc->dev, pdsc->host_mem_reqs[i].pa,
+ pdsc->host_mem_reqs[i].size,
+ DMA_BIDIRECTIONAL);
+ __free_pages(pdsc->host_mem_reqs[i].pg,
+ pdsc->host_mem_reqs[i].order);
+ }
+
+ kfree(pdsc->host_mem_reqs);
+ pdsc->host_mem_reqs = NULL;
+ pdsc->num_host_mem_reqs = 0;
+}
diff --git a/drivers/net/ethernet/amd/pds_core/core.h b/drivers/net/ethernet/amd/pds_core/core.h
index 73356c74bb9f..085f2e988aa0 100644
--- a/drivers/net/ethernet/amd/pds_core/core.h
+++ b/drivers/net/ethernet/amd/pds_core/core.h
@@ -5,6 +5,7 @@
#define _PDSC_H_
#include <linux/debugfs.h>
+#include <linux/mmzone.h>
#include <net/devlink.h>
#include <linux/pds/pds_common.h>
@@ -23,6 +24,12 @@
#define PDSC_SETUP_RECOVERY false
#define PDSC_SETUP_INIT true
+/* Use fixed 4MB instead of PAGE_SIZE << MAX_PAGE_ORDER to avoid
+ * cpu_to_le32() truncation on large-page configs
+ */
+#define PDSC_HOST_MEM_MAX_CONTIG (4 * 1024 * 1024)
+#define PDSC_HOST_MEM_MAX_COUNT 256
+
struct pdsc_deferred_dma {
struct list_head list;
dma_addr_t dma_addr;
@@ -149,6 +156,14 @@ struct pdsc_viftype {
struct pds_auxiliary_dev *padev;
};
+struct pdsc_host_mem {
+ u32 size;
+ u16 tag;
+ u8 order;
+ struct page *pg;
+ dma_addr_t pa;
+};
+
/* No state flags set means we are in a steady running state */
enum pdsc_state_flags {
PDSC_S_FW_DEAD, /* stopped, wait on startup or recovery */
@@ -210,6 +225,9 @@ struct pdsc {
struct pdsc_viftype *viftype_status;
struct work_struct pci_reset_work;
+ struct pdsc_host_mem *host_mem_reqs;
+ u16 num_host_mem_reqs;
+
struct pds_core_component_list_info fw_components;
};
@@ -287,6 +305,7 @@ void pdsc_debugfs_add_viftype(struct pdsc *pdsc);
void pdsc_debugfs_add_irqs(struct pdsc *pdsc);
void pdsc_debugfs_add_qcq(struct pdsc *pdsc, struct pdsc_qcq *qcq);
void pdsc_debugfs_del_qcq(struct pdsc_qcq *qcq);
+void pdsc_debugfs_add_host_mem(struct pdsc *pdsc);
int pdsc_err_to_errno(enum pds_core_status_code code);
bool pdsc_is_fw_running(struct pdsc *pdsc);
@@ -346,6 +365,9 @@ void pdsc_fw_down(struct pdsc *pdsc);
void pdsc_fw_up(struct pdsc *pdsc);
void pdsc_pci_reset_thread(struct work_struct *work);
+void pdsc_host_mem_add(struct pdsc *pdsc);
+void pdsc_host_mem_free(struct pdsc *pdsc);
+
void pdsc_deferred_dma_add(struct pdsc *pdsc, struct pdsc_deferred_dma *entry,
dma_addr_t dma_addr, void *va, size_t size,
enum dma_data_direction dir);
diff --git a/drivers/net/ethernet/amd/pds_core/main.c b/drivers/net/ethernet/amd/pds_core/main.c
index 17b64177871a..bb619f360f3c 100644
--- a/drivers/net/ethernet/amd/pds_core/main.c
+++ b/drivers/net/ethernet/amd/pds_core/main.c
@@ -21,6 +21,8 @@ static const struct pci_device_id pdsc_id_table[] = {
};
MODULE_DEVICE_TABLE(pci, pdsc_id_table);
+static void pdsc_stop_health_thread(struct pdsc *pdsc);
+
static void pdsc_wdtimer_cb(struct timer_list *t)
{
struct pdsc *pdsc = timer_container_of(pdsc, t, wdtimer);
@@ -437,7 +439,7 @@ static void pdsc_remove(struct pci_dev *pdev)
pdsc_sriov_configure(pdev, 0);
pdsc_auxbus_dev_del(pdsc, pdsc, &pdsc->padev);
- timer_shutdown_sync(&pdsc->wdtimer);
+ pdsc_stop_health_thread(pdsc);
if (pdsc->wq)
destroy_workqueue(pdsc->wq);
diff --git a/include/linux/pds/pds_core_if.h b/include/linux/pds/pds_core_if.h
index 5a1fafaccf20..901e1e628f89 100644
--- a/include/linux/pds/pds_core_if.h
+++ b/include/linux/pds/pds_core_if.h
@@ -46,6 +46,7 @@ enum pds_core_cmd_opcode {
PDS_CORE_CMD_SEND_COMPONENT = 9,
PDS_CORE_CMD_FINALIZE_UPDATE = 10,
PDS_CORE_CMD_MATCH_RECORD_DESC = 11,
+ PDS_CORE_CMD_HOST_MEM = 12,
/* SR/IOV commands */
PDS_CORE_CMD_VF_GETATTR = 60,
@@ -110,9 +111,11 @@ struct pds_core_drv_identity {
/**
* enum pds_core_dev_capability - Device capabilities
* @PDS_CORE_DEV_CAP_PLDM_FW_UPDATE: Device only supports FW update via PLDM
+ * @PDS_CORE_DEV_CAP_HOST_MEM: Device supports host memory for fw use
*/
enum pds_core_dev_capability {
PDS_CORE_DEV_CAP_PLDM_FW_UPDATE = BIT(0),
+ PDS_CORE_DEV_CAP_HOST_MEM = BIT(1),
};
#define PDS_DEV_TYPE_MAX 16
@@ -837,6 +840,65 @@ struct pds_core_match_record_desc_comp {
u8 rsvd;
};
+/**
+ * enum pds_core_host_mem_oper - HOST_MEM sub-operations
+ * @PDS_CORE_HOST_MEM_GET_COUNT: Query number of memory requests
+ * @PDS_CORE_HOST_MEM_QUERY: Query details of a memory request
+ * @PDS_CORE_HOST_MEM_ADD: Provide allocated memory to firmware
+ * @PDS_CORE_HOST_MEM_DEL: Notify firmware of memory deallocation
+ */
+enum pds_core_host_mem_oper {
+ PDS_CORE_HOST_MEM_GET_COUNT = 0,
+ PDS_CORE_HOST_MEM_QUERY = 1,
+ PDS_CORE_HOST_MEM_ADD = 2,
+ PDS_CORE_HOST_MEM_DEL = 3,
+};
+
+/**
+ * struct pds_core_host_mem_cmd - HOST_MEM command
+ * @opcode: Opcode PDS_CORE_CMD_HOST_MEM
+ * @oper: Operation (enum pds_core_host_mem_oper)
+ * @index: Memory request index (GET_COUNT: max_count, QUERY: index)
+ * @tag: Tag for this memory request (ADD/DEL)
+ * @reason: Reason for deletion (DEL only)
+ * @rsvd: Reserved
+ * @max_contig: Maximum contiguous memory size (GET_COUNT only)
+ * @size: Size of memory in bytes (ADD only)
+ * @buf_pa: DMA address of memory (ADD only)
+ *
+ * Unified command for all host memory operations. Fields are reused
+ * across operations to minimize opcode space usage.
+ */
+struct pds_core_host_mem_cmd {
+ u8 opcode;
+ u8 oper;
+ __le16 index;
+ __le16 tag;
+ u8 reason;
+ u8 rsvd;
+ __le32 max_contig;
+ __le32 size;
+ __le64 buf_pa;
+};
+
+/**
+ * struct pds_core_host_mem_comp - HOST_MEM completion
+ * @status: Status of the command (enum pds_core_status_code)
+ * @oper: Operation that was performed
+ * @count: Number of memory requests (GET_COUNT)
+ * @size: Size of memory request in bytes (QUERY)
+ * @tag: Tag for this memory request (QUERY/DEL)
+ * @rsvd: Reserved
+ */
+struct pds_core_host_mem_comp {
+ u8 status;
+ u8 oper;
+ __le16 count;
+ __le32 size;
+ __le16 tag;
+ u8 rsvd[6];
+};
+
/*
* union pds_core_dev_cmd - Overlay of core device command structures
*/
@@ -860,6 +922,7 @@ union pds_core_dev_cmd {
struct pds_core_send_component_cmd send_component;
struct pds_core_finalize_update_cmd finalize_update;
struct pds_core_match_record_desc_cmd match_record_desc;
+ struct pds_core_host_mem_cmd host_mem;
};
/*
@@ -885,6 +948,7 @@ union pds_core_dev_comp {
struct pds_core_send_component_comp send_component;
struct pds_core_finalize_update_comp finalize_update;
struct pds_core_match_record_desc_comp match_record_desc;
+ struct pds_core_host_mem_comp host_mem;
};
/**
--
2.43.0
^ permalink raw reply related
* [PATCH 4/6] pds_core: add PLDM component info display
From: Nikhil P. Rao @ 2026-07-08 21:22 UTC (permalink / raw)
To: netdev
Cc: kuba, brett.creeley, eric.joyner, andrew+netdev, davem, edumazet,
pabeni, jacob.e.keller
In-Reply-To: <20260708212222.296202-1-nikhil.rao@amd.com>
From: Brett Creeley <brett.creeley@amd.com>
Add detailed component information display via devlink info. This
allows users to see individual firmware components and their versions.
Components are reported as fixed, running, or stored based on their
firmware-provided flags.
Example output:
$ devlink dev info pci/0000:00:05.0
versions:
fixed:
asic.id 0x0
asic.rev 0x0
running:
fw.bootloader 1.2.3
fw.uboot 1.60.0-73
fw 1.60.0-73
fw.cpld 3.18
stored:
fw.bootloader 1.2.3
fw.uboot 1.60.0-73
fw.uboot.gold 1.50.0-22
fw.gold 1.50.0-22
fw 1.60.0-73
fw.cpld 3.18
Signed-off-by: Brett Creeley <brett.creeley@amd.com>
---
drivers/net/ethernet/amd/pds_core/core.c | 2 +
drivers/net/ethernet/amd/pds_core/core.h | 1 +
drivers/net/ethernet/amd/pds_core/devlink.c | 145 +++++++++++++++++++-
drivers/net/ethernet/amd/pds_core/fw.c | 12 +-
4 files changed, 153 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/amd/pds_core/core.c b/drivers/net/ethernet/amd/pds_core/core.c
index 6c62ff7a32f0..a7a0bcf98ed3 100644
--- a/drivers/net/ethernet/amd/pds_core/core.c
+++ b/drivers/net/ethernet/amd/pds_core/core.c
@@ -589,6 +589,8 @@ void pdsc_fw_up(struct pdsc *pdsc)
return;
}
+ pdsc_fw_components_invalidate(pdsc);
+
err = pdsc_setup(pdsc, PDSC_SETUP_RECOVERY);
if (err)
goto err_out;
diff --git a/drivers/net/ethernet/amd/pds_core/core.h b/drivers/net/ethernet/amd/pds_core/core.h
index c686f0bbbaeb..73356c74bb9f 100644
--- a/drivers/net/ethernet/amd/pds_core/core.h
+++ b/drivers/net/ethernet/amd/pds_core/core.h
@@ -340,6 +340,7 @@ int pdsc_firmware_update(struct pdsc *pdsc,
struct netlink_ext_ack *extack);
int pdsc_get_component_info(struct pdsc *pdsc);
const char *pdsc_fw_type_to_name(u8 type);
+void pdsc_fw_components_invalidate(struct pdsc *pdsc);
void pdsc_fw_down(struct pdsc *pdsc);
void pdsc_fw_up(struct pdsc *pdsc);
diff --git a/drivers/net/ethernet/amd/pds_core/devlink.c b/drivers/net/ethernet/amd/pds_core/devlink.c
index 3b763ee1715e..63fe45e91f71 100644
--- a/drivers/net/ethernet/amd/pds_core/devlink.c
+++ b/drivers/net/ethernet/amd/pds_core/devlink.c
@@ -93,14 +93,120 @@ int pdsc_dl_flash_update(struct devlink *dl,
return pdsc_firmware_update(pdsc, params, extack);
}
+static int pdsc_dl_report_component(struct devlink_info_req *req,
+ struct pds_core_fw_component_info *info)
+{
+ enum devlink_info_version_type ver_type;
+ u16 flags = le16_to_cpu(info->flags);
+ char *ver = info->version;
+ const char *name;
+ char buf[32];
+
+ /* Main firmware is reported as generic "fw" */
+ if (info->component_type == PDS_CORE_FW_TYPE_MAIN) {
+ if (info->slot_id == PDS_CORE_FW_SLOT_GOLD)
+ snprintf(buf, sizeof(buf), "fw.gold");
+ else
+ snprintf(buf, sizeof(buf), "fw");
+ } else {
+ name = pdsc_fw_type_to_name(info->component_type);
+ if (!name)
+ return 0;
+
+ if (info->slot_id == PDS_CORE_FW_SLOT_GOLD)
+ snprintf(buf, sizeof(buf), "fw.%s.gold", name);
+ else
+ snprintf(buf, sizeof(buf), "fw.%s", name);
+ }
+
+ ver_type = DEVLINK_INFO_VERSION_TYPE_NONE;
+ if (flags & PDS_CORE_FW_COMPONENT_INFO_F_UPDATE_BY_NAME)
+ ver_type = DEVLINK_INFO_VERSION_TYPE_COMPONENT;
+
+ if (flags & PDS_CORE_FW_COMPONENT_INFO_F_FIXED) {
+ int err;
+
+ err = devlink_info_version_fixed_put(req, buf, ver);
+ if (err)
+ return err;
+ }
+
+ if (flags & PDS_CORE_FW_COMPONENT_INFO_F_RUNNING) {
+ int err;
+
+ err = devlink_info_version_running_put_ext(req, buf,
+ ver, ver_type);
+ if (err)
+ return err;
+ }
+
+ if (flags & PDS_CORE_FW_COMPONENT_INFO_F_STARTUP) {
+ int err;
+
+ err = devlink_info_version_stored_put_ext(req, buf,
+ ver, ver_type);
+ if (err)
+ return err;
+ }
+
+ return 0;
+}
+
+static int pdsc_dl_report_fw_ver(struct devlink_info_req *req, char *fw_ver)
+{
+ return devlink_info_version_running_put(req,
+ DEVLINK_INFO_VERSION_GENERIC_FW,
+ fw_ver);
+}
+
+static int pdsc_dl_component_info_get(struct devlink *dl,
+ struct devlink_info_req *req,
+ struct netlink_ext_ack *extack)
+{
+ struct pdsc *pdsc = devlink_priv(dl);
+ u8 num_components;
+ int err;
+ int i;
+
+ /* Pairs with WRITE_ONCE in pdsc_fw_components_invalidate().
+ * Use READ_ONCE to get a consistent snapshot of num_components.
+ * pdsc_fw_components_invalidate() can zero it concurrently during
+ * firmware recovery; using the local copy avoids iterating zero
+ * times when we already decided the cache was valid.
+ */
+ num_components = READ_ONCE(pdsc->fw_components.num_components);
+ if (!num_components) {
+ err = pdsc_get_component_info(pdsc);
+ if (err)
+ return pdsc_dl_report_fw_ver(req,
+ pdsc->dev_info.fw_version);
+ num_components = READ_ONCE(pdsc->fw_components.num_components);
+ if (!num_components)
+ return pdsc_dl_report_fw_ver(req,
+ pdsc->dev_info.fw_version);
+ }
+
+ num_components = min_t(u16, num_components,
+ le16_to_cpu(pdsc->dev_ident.max_fw_slots));
+ for (i = 0; i < num_components; i++) {
+ err = pdsc_dl_report_component(req,
+ &pdsc->fw_components.info[i]);
+ if (err)
+ return err;
+ }
+
+ return 0;
+}
+
static char *fw_slotnames[] = {
"fw.goldfw",
"fw.mainfwa",
"fw.mainfwb",
};
-int pdsc_dl_info_get(struct devlink *dl, struct devlink_info_req *req,
- struct netlink_ext_ack *extack)
+static int pdsc_dl_fw_list_info_get(struct devlink *dl,
+ struct devlink_info_req *req,
+ struct netlink_ext_ack *extack)
{
union pds_core_dev_cmd cmd = {
.fw_control.opcode = PDS_CORE_CMD_FW_CONTROL,
@@ -134,12 +240,41 @@ int pdsc_dl_info_get(struct devlink *dl, struct devlink_info_req *req,
return err;
}
- err = devlink_info_version_running_put(req,
- DEVLINK_INFO_VERSION_GENERIC_FW,
- pdsc->dev_info.fw_version);
+ return 0;
+}
+
+static int pdsc_dl_info_get_v1(struct devlink *dl,
+ struct devlink_info_req *req,
+ struct netlink_ext_ack *extack)
+{
+ struct pdsc *pdsc = devlink_priv(dl);
+ int err;
+
+ err = pdsc_dl_fw_list_info_get(dl, req, extack);
if (err)
return err;
+ /* Version 1: report fw from dev_info (running only) */
+ return pdsc_dl_report_fw_ver(req, pdsc->dev_info.fw_version);
+}
+
+int pdsc_dl_info_get(struct devlink *dl, struct devlink_info_req *req,
+ struct netlink_ext_ack *extack)
+{
+ struct pdsc *pdsc = devlink_priv(dl);
+ char buf[32];
+ int err;
+
+ if (pdsc->dev_ident.version >= PDS_CORE_IDENTITY_VERSION_2) {
+ err = pdsc_dl_component_info_get(dl, req, extack);
+ if (err)
+ return err;
+ } else {
+ err = pdsc_dl_info_get_v1(dl, req, extack);
+ if (err)
+ return err;
+ }
+
snprintf(buf, sizeof(buf), "0x%x", pdsc->dev_info.asic_type);
err = devlink_info_version_fixed_put(req,
DEVLINK_INFO_VERSION_GENERIC_ASIC_ID,
diff --git a/drivers/net/ethernet/amd/pds_core/fw.c b/drivers/net/ethernet/amd/pds_core/fw.c
index dc793005ec70..ae39f684c3b8 100644
--- a/drivers/net/ethernet/amd/pds_core/fw.c
+++ b/drivers/net/ethernet/amd/pds_core/fw.c
@@ -42,6 +42,12 @@ const char *pdsc_fw_type_to_name(u8 type)
return NULL;
}
+void pdsc_fw_components_invalidate(struct pdsc *pdsc)
+{
+ /* Pairs with READ_ONCE in pdsc_dl_component_info_get() */
+ WRITE_ONCE(pdsc->fw_components.num_components, 0);
+}
+
static u8 pdsc_name_to_fw_type(const char *name)
{
size_t prefix_len;
@@ -765,7 +771,9 @@ static int pdsc_flash_component(struct pldmfw *context,
if (component_type) {
const char *type_name = pdsc_fw_type_to_name(component_type);
- if (type_name) {
+ if (component_type == PDS_CORE_FW_TYPE_MAIN) {
+ component_name = "fw";
+ } else if (type_name) {
snprintf(component_name_buf, sizeof(component_name_buf),
"%s%s", PDSC_FW_COMPONENT_PREFIX, type_name);
component_name = component_name_buf;
@@ -966,7 +974,7 @@ int pdsc_firmware_update(struct pdsc *pdsc,
err = pdsc_legacy_firmware_update(pdsc, params, extack);
/* Invalidate cached component info so next info_get refreshes */
- pdsc->fw_components.num_components = 0;
+ pdsc_fw_components_invalidate(pdsc);
return err;
}
--
2.43.0
^ permalink raw reply related
* Re: [PATCH 02/15] dt-bindings: clock: mediatek: regroup MT8188 dt-bindings into MT8186
From: Rob Herring @ 2026-07-08 21:34 UTC (permalink / raw)
To: Louis-Alexis Eyraud
Cc: Michael Turquette, Stephen Boyd, Brian Masney,
Krzysztof Kozlowski, Conor Dooley, Matthias Brugger,
AngeloGioacchino Del Regno, Chun-Jie Chen, Philipp Zabel,
Edward-JW Yang, Richard Cochran, kernel, linux-clk, devicetree,
linux-kernel, linux-arm-kernel, linux-mediatek, netdev
In-Reply-To: <d1e37bd4f2a05fed6c7bfdc5d9a0fa90c892d608.camel@collabora.com>
On Wed, Jul 8, 2026 at 8:45 AM Louis-Alexis Eyraud
<louisalexis.eyraud@collabora.com> wrote:
>
> Hello Rob,
>
> On Wed, 2026-07-01 at 14:33 -0500, Rob Herring wrote:
> > On Wed, Jul 01, 2026 at 03:11:07PM +0200, Louis-Alexis Eyraud wrote:
> > > Regroup the MT8188 clock and system clock dt-bindings into MT8186
> > > ones
> > > to ease maintainability and have common files for several currently
> > > supported SoC or new future ones, that have the same kind of clock
> > > controller design.
> > >
> > > Note:
> > > The `#clock-cells` property is a required property for all
> > > compatibles
> > > declared in MT8188 clock and system clock dt-bindings but not in
> > > MT8186
> > > ones.
> > > To avoid ABI breakage, conditional blocks to check this requirement
> > > for MT8188 compatibles are added, rather than enforcing it for
> > > MT8186
> > > compatibles.
> >
> > If the existing DTs are just wrong, then I would just make #clock-
> > cells
> > required. But please update the .dts files so the warnings don't
> > grow.
> >
> I've tested to make the #clock-cells required for the MT8186, MT8192
> and MT8195 system and functional clock controllers.
> I did not see new warnings, so no extra dts patches would be needed.
>
> I'll add new patches (one per SoC) in the next revision of the series
> for this, as it simplifies the grouping patches (no more if/then to
> require #clock-cells for the MT8188/MT8189 clock controllers) and the
> note in commit message could be removed.
>
> > The grouping I would do here is:
> >
> > - clock controller only
> > - reset controller only
> > - both clock and reset controller
> >
> > That should avoid any if/then schemas.
> >
>
> By this grouping, I understand you suggest having separate dt-bindings
> files, that could look like:
> - mediatek,mt8186-clock.yaml: clock controllers
> - <name to be found>: reset controllers
> - <name to be found>: clock controllers with reset controller
> - mediatek,mt8186-sys-clock.yaml: system clock controllers.
> - <name to be found>: system clock controllers with reset controller
>
> Is that what you meant?
I think so, but not sure I understand the distinction with clock
controllers and system clock controllers.
> There is no pure reset controllers for those SoC so no dedicated file
> would needed at the moment.
> The system clock controllers all have reset-controllers, even they may
> currently be not all implemented, so no separate files for system clock
> controllers would needed as well.
>
> Also, from what I see the current dt-bindings, the system clocks
> controllers for the MT8186/MT8188/MT8192/MT8195 SoC have the #reset-
> cells property but it is not required for them (examples:
> mediatek,mt8188-infracfg-ao or mediatek,mt8195-infracfg_ao).
>
> With the patches to make the #clock-cells property required, I already
> removed the biggest if/else block in mediatek,mt8186-clock.yaml, so
> only the one regarding #reset-cells property remains.
>
> So, should I create separate files, following the grouping suggestion,
> for the v2 of this patch?
Shrug. There's no hard rule here, it's a judgment call. With one
if/then block dropped, it's a bit more tolerable to keep it as-is. If
the if/then schemas are as long as the rest of the schema (minus any
example), then I would say to split the schemas.
Rob
^ permalink raw reply
* Re: [PATCH 3/3] net: ipa: Add IPA v5.1 data
From: Esteban Urrutia @ 2026-07-08 21:35 UTC (permalink / raw)
To: Alex Elder, Bjorn Andersson, Konrad Dybcio, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Alex Elder
Cc: linux-arm-msm, devicetree, linux-kernel, netdev
In-Reply-To: <b810c574-0f60-4d3d-ad5a-4205a119fe00@ieee.org>
On 7/8/26 4:06 PM, Alex Elder wrote:
> I think the DDR values might be wrong, but it's difficult to be
> sure. In some cases, in arrays like this in the downstream code,
> if there is no entry found in an array, the *earlier* version
> values should be used. (Unless someone better informed states
> that this is wrong, I think it's fine as-is.)
>
> This information is found in the ipa3_qmb_outstanding[IPA_5_1][]
> array in the downstream code. However there is no entry for that
> version. Given that, all zeroes (as you have it) makes sense.
> But it's possible this applies instead:
>
> [IPA_5_0][IPA_QMB_INSTANCE_DDR] = {12, 12, 0},
> [IPA_5_0][IPA_QMB_INSTANCE_PCIE] = {0, 0, 0},
>
> I have no way of knowing; perhaps someone from Qualcomm can
> get confirmation that all zeroes is correct.
>
> (Note the order of values presented in the downstream code
> differs from upstream.)
In downstream ipa_utils.c there's a function called ipa3_cfg_qsb() which
is in charge of reading these values from ipa3_qmb_outstanding.
Since these values are not present for IPA v5.1, one would assume
they're not set and that, since this is the first time such behavior is
found, additional changes would need to be made to the IPA driver.
However, looking at this function, which I'll leave as a snippet below
given its shortness:
static void ipa3_cfg_qsb(void)
{
u8 hw_type_idx;
const struct ipa_qmb_outstanding *qmb_ot;
struct ipahal_reg_qsb_max_reads max_reads = { 0 };
struct ipahal_reg_qsb_max_writes max_writes = { 0 };
hw_type_idx = ipa3_ctx->hw_type_index;
/*
* Read the register values before writing to them to ensure
* other values are not overwritten
*/
ipahal_read_reg_fields(IPA_QSB_MAX_WRITES, &max_writes);
ipahal_read_reg_fields(IPA_QSB_MAX_READS, &max_reads);
qmb_ot = &(ipa3_qmb_outstanding[hw_type_idx][IPA_QMB_INSTANCE_DDR]);
max_reads.qmb_0_max_reads = qmb_ot->ot_reads;
max_writes.qmb_0_max_writes = qmb_ot->ot_writes;
max_reads.qmb_0_max_read_beats = qmb_ot->ot_read_beats;
qmb_ot = &(ipa3_qmb_outstanding[hw_type_idx][IPA_QMB_INSTANCE_PCIE]);
max_reads.qmb_1_max_reads = qmb_ot->ot_reads;
max_writes.qmb_1_max_writes = qmb_ot->ot_writes;
ipahal_write_reg_fields(IPA_QSB_MAX_WRITES, &max_writes);
ipahal_write_reg_fields(IPA_QSB_MAX_READS, &max_reads);
}
There are no conditions for writing ot_reads, ot_writes and
ot_read_beats, which would correspond to max_reads, max_writes and
max_reads_beats in upstream.
Since hw_type_idx is set to IPA_5_1, this should give a null pointer.
With this info, there are two possibilities:
1. Null pointer dereference, resulting in a kernel oops downstream.
2. qmb_ot is set with all values to 0.
I have never seen a null pointer dereference downstream, so I'm more
inclined to believe option 2 is what's actually happening.
IPA v5.0 also zeroes these values, but I wasn't able to actually confirm
this.
This because in downstream, IPA versions are split into subversions,
which are:
1. Normal IPA (IPA_X_Y)
2. MHI IPA (IPA_X_Y_MHI)
3. APQ IPA (IPA_X_Y_APQ)
Data for IPA v5.0 seems to be of the MHI type, since it's only used in
the SDX65 SoC, which I believe is mostly used in 5G modems.
I realized this while cross-checking since some values didn't really
match, so I had to cross-check with different ipa_data-vX.Y.c files
because of this.
> And although ipa_gsi_ep_config is not defined in this code
> base, here is what it looks like:
>
> struct ipa_gsi_ep_config {
> int ipa_ep_num;
> int ipa_gsi_chan_num;
> int ipa_if_tlv;
> int ipa_if_aos;
> int ee;
> enum gsi_prefetch_mode prefetch_mode;
> uint8_t prefetch_threshold;
> };
>
> This might not be current; I'm using code found here:
> https://git.codelinaro.org/clo/la/kernel/msm-5.15.git
Many thanks for providing the declaration for this struct.
> In the downstream code--confusingly--ipa_gsi_setup_channel()
> doubles the desc_fifo_sz value (for GSI, versus the older BAM
> interface). So the ring size becomes 4096 bytes, and that
> works out to 256 16-byte GSI TRE entries. I'm not sure why
> 512 is used for IPA v3.5.1, but it probably just means it's
> bigger than it needs to be.
>
> The event_count should be the same as the tre_count. Again
> I no longer know why that's not the case for IPA v3.5.1.
For the record (since this is off-topic). I tried to get the modem up in
a device whose SoC was using IPA v3.5.1 and I was experimenting weird
behavior, such as IPA crashing the SoC when removing the module or when
it automatically loaded at boot.
The reason I mention this is because a warning similar to "channel 4
limited to 256 TREs" appeared whenever IPA was loaded. That may be the
reason I was experimenting those issues.
>> +static const struct ipa_mem ipa_mem_local_data[] = {
>
> IPA has local memory that is partitioned as defined by this
> array. The regions are used by IPA/GSI firmware and/or
> hardware. The configuration defined here is sent to
> the modem in an ipa_init_modem_driver_req QMI message
> so both the modem and AP have a consistent view of
> how the memory is used.
>
> Many memory regions are preceded by 0-2 "canaries", which
> are 32-byte values initialized to IPA_MEM_CANARY_VAL.
>
> In the downstream code there is structure ipa3_mem_partition
> that defines these things, and structures of this type are
> defined in "ipa_utils.c". For IPA v5.1, ipa_5_1_mem_part
> defines them all. The mapping between downstream and
> upstream is not trivial and direct, but it should be
> obvious how they get translated.
>
>
> With two exceptions, what I see here looks like you
> correctly transferred everything. (The two exceptions
> are entries that from what I can tell, should not be
> present.)
[...]
> The next two entries look wrong to me. Can you explain where
> you got these offsets and sizes? Is it from "ipa_data-v5.0.c"?
>
> Here are the relevant entries I see in ipa_5_1_mem_part
> in the downstream code:
> .stats_flt_v4_ofst = 0,
> .stats_flt_v4_size = 0,
> .stats_flt_v6_ofst = 0,
> .stats_flt_v6_size = 0,
> .stats_rt_v4_ofst = 0,
> .stats_rt_v4_size = 0,
> .stats_rt_v6_ofst = 0,
> .stats_rt_v6_size = 0,
> (Since their size is zero, their entries can be omitted.)
>
>> + {
>> + .id = IPA_MEM_AP_V4_FILTER,
>> + .offset = 0x29b8,
>> + .size = 0x0188,
>> + .canary_count = 2,
>> + },
>> + {
>> + .id = IPA_MEM_AP_V6_FILTER,
>> + .offset = 0x2b40,
>> + .size = 0x0228,
>> + .canary_count = 0,
>> + },
>
> The remaining entries (below) look good.
While cross-referencing IPA data files upstream, I found these two
regions to be present in data for IPA v5.5, even though they aren't
defined in ipa_5_5_mem_part. At the start I assumed these were correct
since they were present upstream, but I took a closer look at that file
and I believe data for this version was directly added without going
through a proper review process.
The reason why I used IPA v5.5 memory regions in IPA v5.1 is because
their memory partitions are identical.
Now, with this information, I would like to ask whether both of these
memory regions are correct for both IPA v5.1 and v5.5 data files.
>> +/* Memory configuration data for an SoC having IPA v5.1 */
>> +static const struct ipa_mem_data ipa_mem_data = {
>> + .local_count = ARRAY_SIZE(ipa_mem_local_data),
>> + .local = ipa_mem_local_data,
>> + .imem_addr = 0x146a8000,
>
> I think I needed to look up the imem offset value
> in Qualcomm documentation I no longer have access
> to. Perhaps someone from there could confirm you
> are using the right values here.
After cross-checking I believe this may be the qcom,additional-mapping
property downstream, which specifies the IMEM starting address and size.
I'll leave (2) and (3) for reference.
(2) corresponds to SM8450, while (3) corresponds to SM8475.
>
>> + .imem_size = 0x00002000,
>> + /*
>> + * While this value is 0xb000 on SM8450 and 0x9000 on SM8475,
>> + * it has been left set to 0x9000 for compatibility with SM8475
>> + */
>
> As I said earlier, I'm not completely sure this will still
> work on the SM8450. Someone should confirm this, and it
> really ought to be tested somehow.
I have clarified this in my previous email (4), so I'll skip this part.
>
>> + .smem_size = 0x00009000,
>> +};
>> +
>> +/* Interconnect rates are in 1000 byte/second units */
>> +static const struct ipa_interconnect_data ipa_interconnect_data[] = {
>> + {
>> + .name = "memory",
>> + .peak_bandwidth = 1900000, /* 1.9 GBps */
>> + .average_bandwidth = 590000, /* 590 MBps */
>
> I no longer recall where to get these bandwidth values
> for the interconnects. Perhaps someone from Qualcomm
> can find this out/confirm what you have.
This was a tricky part. These seem to come from the qcom,svs2 property
which seems to be mapped to the interconnects specified downstream.
Since the IPA interconnects declared in device trees are different in
both downstream and upstream I had to make some adjustments, such as
using the minimum value between both ipa_to_llcc and llcc_to_ebi1
interconnects.
An example of this can be seen in (5), which corresponds to the SM8350
SoC using IPA v4.9.
Again, thanks for taking the time to properly explain things.
(1) https://github.com/LineageOS/android_kernel_qcom_sm8450-modules/blob/lineage-20/qcom/opensource/dataipa/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c#L7881
https://github.com/LineageOS/android_kernel_qcom_sm8450-devicetrees/blob/lineage-20/qcom/waipio.dtsi#L3404
https://github.com/LineageOS/android_kernel_qcom_sm8450-devicetrees/blob/lineage-20/qcom/cape.dtsi#L2723
(4) https://lore.kernel.org/all/3e70d77e-6bec-4e16-ae88-a4f5161f182e@proton.me/
(5) https://github.com/LineageOS/android_kernel_motorola_sm7325/blob/lineage-23.2/arch/arm64/boot/dts/vendor/qcom/lahaina.dtsi#L4683
Regards,
Esteban
^ permalink raw reply
* Re: [PATCH net] macsec: fix promiscuity refcount leak in macsec_dev_open()
From: Sabrina Dubroca @ 2026-07-08 21:47 UTC (permalink / raw)
To: James Raphael Tiovalen
Cc: netdev, stable, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Antoine Tenart, linux-kernel
In-Reply-To: <20260705113629.187490-1-jamestiotio@gmail.com>
2026-07-05, 19:36:29 +0800, James Raphael Tiovalen wrote:
> When a MACsec interface with IFF_PROMISC set is brought up on top of a
> device that has hardware offload enabled, macsec_dev_open() first calls
> dev_set_promiscuity(real_dev, 1) and then propagates the open to the
> offload device. If that propagation fails, the error path jumps to the
> clear_allmulti label, which only reverts allmulti and the unicast
> address. The promiscuity taken on the lower device is never dropped, so
> real_dev is left permanently stuck in promiscuous mode. Its promiscuity
> count can no longer be balanced from software.
>
> Add a clear_promisc label that drops the promiscuity reference and
> route the two offload failure paths to it. The dev_set_promiscuity()
> failure itself still jumps to clear_allmulti, since on that failure the
> count was not incremented.
>
> Fixes: 3cf3227a21d1 ("net: macsec: hardware offloading infrastructure")
> Cc: stable@vger.kernel.org
> Signed-off-by: James Raphael Tiovalen <jamestiotio@gmail.com>
> ---
> drivers/net/macsec.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
--
Sabrina
^ permalink raw reply
* Re: [PATCH net v3] tipc: fix u16 MTU truncation in media and bearer MTU validation
From: Cen Zhang (Microsoft) @ 2026-07-08 22:41 UTC (permalink / raw)
To: vadim.fedorenko
Cc: AutonomousCodeSecurity, blbllhy, davem, edumazet, horms, jmaloy,
kuba, kys, linux-kernel, netdev, pabeni, tgopinath,
tipc-discussion, tung.quang.nguyen
In-Reply-To: <7a6d7de8-7c33-42fd-a0f3-68bc1911b0e5@linux.dev>
Sadly NLA_POLICY_MAX() cannot be used here -- its .max field
is s16 instead of u16 in struct nla_policy, which will
overflow to -1 during my testing.
Please let me know if we have any other better choices.
Otherwise, I'll prepare a patch adding .min check (
TIPC_MIN_BEARER_MTU).
^ permalink raw reply
* Re: [PATCH] net: usb: sr9700: validate receive packet extent
From: Ethan Nelson-Moore @ 2026-07-08 22:44 UTC (permalink / raw)
To: Pengpeng Hou
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Peter Korsgaard, Simon Horman, linux-usb, netdev,
linux-kernel
In-Reply-To: <20260705083724.24494-1-pengpeng@iscas.ac.cn>
On Sun, Jul 5, 2026 at 1:37 AM Pengpeng Hou <pengpeng@iscas.ac.cn> wrote:
>
> sr9700_rx_fixup() copies len bytes from skb->data + SR_RX_OVERHEAD when
> a URB contains multiple packets. The old check compared len against
> skb->len, but the source pointer has already skipped SR_RX_OVERHEAD
> bytes.
>
> Validate len against the remaining bytes after SR_RX_OVERHEAD before the
> copy and cursor advance.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
> --- a/drivers/net/usb/sr9700.c
> +++ b/drivers/net/usb/sr9700.c
> @@ -355,7 +355,8 @@
> /* ignore the CRC length */
> len = (skb->data[1] | (skb->data[2] << 8)) - 4;
>
> - if (len > ETH_FRAME_LEN || len > skb->len || len < 0)
> + if (len > ETH_FRAME_LEN || len < 0 ||
> + len > skb->len - SR_RX_OVERHEAD)
> return 0;
>
> /* the last packet of current skb */
>
Hi, Pengpeng,
Other than the subject needing to be clarified, as Andrew mentioned,
the patch looks good to me. Thank you for noticing this issue.
Reviewed-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Tested-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Ethan
^ permalink raw reply
* [PATCH] ovpn: prevent UAF re-add to by_transp_addr on float-vs-delete race
From: Ibrahim Hashimov @ 2026-07-08 22:46 UTC (permalink / raw)
To: Antonio Quartulli, Andrew Lunn, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni
Cc: Sabrina Dubroca, netdev, linux-kernel, stable
ovpn_peer_endpoints_update() reacts to a data-channel "float" (a
peer's packets arriving from a new source transport address) by
first committing the new endpoint under peer->lock, then dropping
peer->lock, and only afterwards re-acquiring peer->ovpn->lock and
peer->lock to rehash the peer into peers->by_transp_addr:
spin_unlock_bh(&peer->lock);
ovpn_nl_peer_float_notify(peer, &ss);
if (peer->ovpn->mode == OVPN_MODE_MP) {
spin_lock_bh(&peer->ovpn->lock);
spin_lock_bh(&peer->lock);
bind = rcu_dereference_protected(peer->bind, ...);
if (unlikely(!bind)) {
... return;
}
...
hlist_nulls_del_init_rcu(&peer->hash_entry_transp_addr);
nhead = ovpn_get_hash_head(peer->ovpn->peers->by_transp_addr, ...);
hlist_nulls_add_head_rcu(&peer->hash_entry_transp_addr, nhead);
...
}
Between the spin_unlock_bh(&peer->lock) and the re-acquire of
peer->ovpn->lock, this thread holds *no* lock on the peer at all. If
an OVPN_CMD_PEER_DEL arrives in that window, ovpn_peer_remove()
(which only requires peer->ovpn->lock) runs to completion: it
unhashes the peer from every table, including by_transp_addr, and
queues it on the release list. peer->bind is only cleared much
later, when the peer is actually released, so the
"if (unlikely(!bind))" check performed after re-acquiring the locks
does *not* observe that the peer has already been removed.
ovpn_peer_endpoints_update() then proceeds to unconditionally re-add
hash_entry_transp_addr, resurrecting the already-removed peer in the
by_transp_addr hash table. Because ovpn_peer_remove() itself guards
against a double remove with
"if (hlist_unhashed(&peer->hash_entry_id)) return;", nothing ever
unhashes the peer a second time. Once the in-flight RX packet that
triggered the float drops its reference and the refcount reaches
zero, the peer is kfree()'d via RCU while still linked in
by_transp_addr. The next matching lookup in
ovpn_peer_get_by_transp_addr() walks that bucket and calls
ovpn_peer_transp_match(), dereferencing the freed peer's ->bind
*before* ovpn_peer_hold() is attempted -- a slab-use-after-free read
on the RX softirq path, runtime-confirmed under KASAN (715
independent "slab-use-after-free in ovpn_peer_get_by_transp_addr"
reports, kmalloc-1k / struct ovpn_peer, freed by the RCU callback,
read from udp_queue_rcv_one_skb -> ovpn_udp_encap_recv ->
ovpn_peer_get_by_transp_addr).
Fix it the same way ovpn_peer_remove() protects itself against a
racing double-remove: after re-acquiring peer->ovpn->lock, check
hlist_unhashed(&peer->hash_entry_id) before touching
hash_entry_transp_addr. ovpn_peer_remove() only mutates the peer's
hashtable membership while holding peer->ovpn->lock, and this check
is performed while we hold that same lock, so the observation is
race-free: either the remove has already happened and hash_entry_id
is unhashed (in which case we must not resurrect the peer and simply
return), or it has not happened yet and cannot happen until we
release peer->ovpn->lock (by which point the rehash under this lock
has already completed). This mirrors the existing double-remove
idiom in ovpn_peer_remove() (drivers/net/ovpn/peer.c) rather than
introducing a new locking primitive.
This is a minimal, targeted fix for the float-vs-delete race; it
does not attempt to shrink the lock-free window itself (peer->lock
is still dropped around ovpn_nl_peer_float_notify()), only to stop
the rehash path from acting on a peer it can no longer safely assume
is still part of the peer tables.
Runtime-verified on a v6.19 KASAN-instrumented kernel: a reproducer
that races authenticated-peer float traffic against a concurrent
OVPN_CMD_PEER_DEL reliably trips a KASAN slab-use-after-free read in
ovpn_peer_get_by_transp_addr() before this fix, and the same
reproducer no longer triggers it once this fix is applied.
Fixes: f0281c1d3732 ("ovpn: add support for updating local or remote UDP endpoint")
Cc: stable@vger.kernel.org
Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
Assisted-by: AuditCode-AI:2026.07
---
drivers/net/ovpn/peer.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/drivers/net/ovpn/peer.c b/drivers/net/ovpn/peer.c
index a09d61296425..aeb69f0b06fa 100644
--- a/drivers/net/ovpn/peer.c
+++ b/drivers/net/ovpn/peer.c
@@ -307,6 +307,28 @@ void ovpn_peer_endpoints_update(struct ovpn_peer *peer, struct sk_buff *skb)
return;
}
+ /* Guard against a peer that was concurrently removed (e.g.
+ * OVPN_CMD_PEER_DEL -> ovpn_peer_remove()) while we held neither
+ * peer->lock nor ovpn->lock, i.e. in the window opened by the
+ * spin_unlock_bh(&peer->lock) above. ovpn_peer_remove() only
+ * unhashes the peer and queues it for release: peer->bind is
+ * not cleared until the peer is actually released, so the
+ * !bind check we just did above does not catch this case.
+ * Blindly re-adding hash_entry_transp_addr below would
+ * resurrect an already-removed (and soon to be freed) peer in
+ * the by_transp_addr table, causing a use-after-free the next
+ * time that table is walked. Reuse the same
+ * hlist_unhashed(&peer->hash_entry_id) test ovpn_peer_remove()
+ * itself uses to detect a duplicate removal: ovpn->lock is
+ * held here too, so this observation is race-free with any
+ * in-flight or future removal.
+ */
+ if (unlikely(hlist_unhashed(&peer->hash_entry_id))) {
+ spin_unlock_bh(&peer->lock);
+ spin_unlock_bh(&peer->ovpn->lock);
+ return;
+ }
+
/* This function may be invoked concurrently, therefore another
* float may have happened in parallel: perform rehashing
* using the peer->bind->remote directly as key
--
2.50.1 (Apple Git-155)
^ permalink raw reply related
* [PATCH net-next v5 0/3] net: devmem: allow rx-buf-size > PAGE_SIZE per binding
From: Bobby Eshleman @ 2026-07-08 22:55 UTC (permalink / raw)
To: Donald Hunter, Jakub Kicinski, David S. Miller, Eric Dumazet,
Paolo Abeni, Simon Horman, Andrew Lunn, Gerd Hoffmann,
Vivek Kasireddy, Sumit Semwal, Christian König, Shuah Khan
Cc: netdev, linux-kernel, dri-devel, linux-media, linaro-mm-sig,
linux-kselftest, sdf, razor, daniel, almasrymina, matttbe,
skhawaja, dw, Joe Damato, Bobby Eshleman
Every devmem dmabuf binding hands the page_pool PAGE_SIZE niovs today.
On NICs that consume one descriptor per netmem, this caps a single RX
descriptor at PAGE_SIZE and burns CPU on buffer churn.
In this series, we add a bind-time netlink attribute,
NETDEV_A_DMABUF_RX_BUF_SIZE, that lets userspace request a larger niov
size (power of two >= PAGE_SIZE). Drivers must opt in via
queue_mgmt_ops.QCFG_RX_PAGE_SIZE.
Measurements:
Setup: kperf devmem RX/TX cuda, 4 flows, 64 MB messages, 60s, dctcp,
num-rx-queues=4, dmabuf-rx/tx-size-mb=2048, 10 runs per niov size,
mlx5.
niov RX dev Gbps RX flow avg Gbps app sys %
----- ---------------- ----------------- ----------------
4K 300.63 +/- 53.21 75.16 +/- 13.30 54.15 +/- 10.23
16K 321.35 +/- 28.20 80.34 +/- 7.05 41.05 +/- 8.87
32K 347.63 +/- 2.20 86.91 +/- 0.55 44.54 +/- 3.51
64K 332.11 +/- 14.26 83.03 +/- 3.56 35.47 +/- 3.11
RX app sys % drops ~19% from 4K to 64K.
kperf support (not yet merged):
https://github.com/facebookexperimental/kperf/commit/8837577f920876bce6986ec18869ac04439ebcd2
Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
---
Changes in v5:
- removed unnecessary change from ssize_t to size_t (Mina)
- removed '--------' lines in the commit message (Paolo)
- removed commit msg about CONFIG_HUGETLB since that change was already
merged
- Link to v4: https://lore.kernel.org/r/20260701-tcpdm-large-niovs-v4-0-ca4654f37570@meta.com
Changes in v4:
- ncdevmem: fix the possible overflow in ncdevmem (Sashiko)
- drop the udmabuf patch because the fix is now already in net-next
- silenced two pylint complaints in devmem_lib.py
- Link to v3: https://lore.kernel.org/r/20260612-tcpdm-large-niovs-v3-0-a3b693e76fcb@meta.com
Changes in v3:
- fix a bunch of non-reverse christmas tree declarations (Stan)
- remove extra uint32 cast for getpagesize() (Stan)
- remove overzealous strtoul checking (Stan)
- remove value checks that the kernel already performs on rx_buf_size
(Stan)
- Link to v2: https://lore.kernel.org/r/20260611-tcpdm-large-niovs-v2-0-ee2bf15e7523@meta.com
Changes in v2:
- Use NL_SET_ERR_MSG_FMT for sg alignment failure details (Stan)
- Keep -E2BIG (not a direct ask, but seemed preferred, Stan)
- Update udmabuf commit message and comments explaining why
"one sg ent per folio" is useful (Christian)
- Set/restore nr_hugepages in py harness (Stan)
- Link to v1: https://lore.kernel.org/r/20260603-tcpdm-large-niovs-v1-0-f37a4ac6726c@meta.com
---
Bobby Eshleman (3):
net: devmem: allow rx-buf-size > PAGE_SIZE per dmabuf binding
selftests/net: ncdevmem: add -b option to set rx-buf-size on bind
selftests/net: devmem.py: add check_rx_large_niov
Documentation/netlink/specs/netdev.yaml | 8 +++
include/uapi/linux/netdev.h | 1 +
net/core/devmem.c | 51 +++++++++++--------
net/core/devmem.h | 13 +++--
net/core/netdev-genl-gen.c | 5 +-
net/core/netdev-genl.c | 19 ++++++-
tools/include/uapi/linux/netdev.h | 1 +
tools/testing/selftests/drivers/net/hw/devmem.py | 12 ++++-
.../testing/selftests/drivers/net/hw/devmem_lib.py | 59 +++++++++++++++++++++-
tools/testing/selftests/drivers/net/hw/ncdevmem.c | 36 +++++++++++--
.../testing/selftests/drivers/net/hw/nk_devmem.py | 11 +++-
11 files changed, 178 insertions(+), 38 deletions(-)
---
base-commit: 474cff6868129755cf889edf40d7f491729fc588
change-id: 20260602-tcpdm-large-niovs-56523a3a1077
Best regards,
--
Bobby Eshleman <bobbyeshleman@meta.com>
^ permalink raw reply
* [PATCH net-next v5 1/3] net: devmem: allow rx-buf-size > PAGE_SIZE per dmabuf binding
From: Bobby Eshleman @ 2026-07-08 22:55 UTC (permalink / raw)
To: Donald Hunter, Jakub Kicinski, David S. Miller, Eric Dumazet,
Paolo Abeni, Simon Horman, Andrew Lunn, Gerd Hoffmann,
Vivek Kasireddy, Sumit Semwal, Christian König, Shuah Khan
Cc: netdev, linux-kernel, dri-devel, linux-media, linaro-mm-sig,
linux-kselftest, sdf, razor, daniel, almasrymina, matttbe,
skhawaja, dw, Joe Damato, Bobby Eshleman
In-Reply-To: <20260708-tcpdm-large-niovs-v5-0-34bf6fac941b@meta.com>
From: Bobby Eshleman <bobbyeshleman@meta.com>
Every devmem dmabuf binding today hands the page_pool PAGE_SIZE niovs.
This caps a single RX descriptor at PAGE_SIZE, burning CPU on buffer
churn for large flows.
Add a bind-time netlink attribute, NETDEV_A_DMABUF_RX_BUF_SIZE, that
lets userspace request a larger niov size. The value must be a power of
two >= PAGE_SIZE.
Measurements:
Setup: kperf in devmem RX/TX cuda mode, 4 flows, 64 MB messages, 60s,
dctcp, num-rx-queues=4, dmabuf-rx/tx-size-mb=2048, 10 runs per niov
size, mlx5.
CPU Util:
niov net sirq % net idle % app sys % app idle %
----- ---------------- ---------------- ---------------- ----------------
4K 62.38 +/- 8.27 33.40 +/- 7.51 54.15 +/- 10.23 43.67 +/- 10.53
16K 58.91 +/- 5.35 35.23 +/- 5.88 41.05 +/- 8.87 56.42 +/- 9.24
32K 64.12 +/- 0.68 31.09 +/- 1.48 44.54 +/- 3.51 52.63 +/- 3.65
64K 54.69 +/- 5.54 39.67 +/- 5.81 35.47 +/- 3.11 61.97 +/- 3.27
RX app sys % drops ~19% from 4K to 64K.
Throughput:
niov RX dev Gbps RX flow avg Gbps
----- ---------------- -----------------
4K 300.63 +/- 53.21 75.16 +/- 13.30
16K 321.35 +/- 28.20 80.34 +/- 7.05
32K 347.63 +/- 2.20 86.91 +/- 0.55
64K 332.11 +/- 14.26 83.03 +/- 3.56
Throughput seems to increase, but the stdev is pretty wide so could just
be noise.
kperf support (not yet merged):
https://github.com/facebookexperimental/kperf/commit/8837577f920876bce6986ec18869ac04439ebcd2
Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Reviewed-by: Mina Almasry <almasrymina@google.com>
---
Documentation/netlink/specs/netdev.yaml | 8 ++++++
include/uapi/linux/netdev.h | 1 +
net/core/devmem.c | 51 +++++++++++++++++++--------------
net/core/devmem.h | 13 ++++++---
net/core/netdev-genl-gen.c | 5 ++--
net/core/netdev-genl.c | 19 ++++++++++--
tools/include/uapi/linux/netdev.h | 1 +
7 files changed, 69 insertions(+), 29 deletions(-)
diff --git a/Documentation/netlink/specs/netdev.yaml b/Documentation/netlink/specs/netdev.yaml
index 5f143da7458c..70b902008bd3 100644
--- a/Documentation/netlink/specs/netdev.yaml
+++ b/Documentation/netlink/specs/netdev.yaml
@@ -598,6 +598,13 @@ attribute-sets:
type: u32
checks:
min: 1
+ -
+ name: rx-buf-size
+ doc: |
+ Size in bytes of each RX buffer the NIC writes into from the bound
+ dmabuf. Must be a power of two and >= PAGE_SIZE; defaults to
+ PAGE_SIZE.
+ type: u32
operations:
list:
@@ -812,6 +819,7 @@ operations:
- ifindex
- fd
- queues
+ - rx-buf-size
reply:
attributes:
- id
diff --git a/include/uapi/linux/netdev.h b/include/uapi/linux/netdev.h
index 2f3ab75e8cc0..85e1d20c6268 100644
--- a/include/uapi/linux/netdev.h
+++ b/include/uapi/linux/netdev.h
@@ -219,6 +219,7 @@ enum {
NETDEV_A_DMABUF_QUEUES,
NETDEV_A_DMABUF_FD,
NETDEV_A_DMABUF_ID,
+ NETDEV_A_DMABUF_RX_BUF_SIZE,
__NETDEV_A_DMABUF_MAX,
NETDEV_A_DMABUF_MAX = (__NETDEV_A_DMABUF_MAX - 1)
diff --git a/net/core/devmem.c b/net/core/devmem.c
index 957d6b96216b..3ce3cc14bec0 100644
--- a/net/core/devmem.c
+++ b/net/core/devmem.c
@@ -46,7 +46,7 @@ static dma_addr_t net_devmem_get_dma_addr(const struct net_iov *niov)
owner = net_devmem_iov_to_chunk_owner(niov);
return owner->base_dma_addr +
- ((dma_addr_t)net_iov_idx(niov) << PAGE_SHIFT);
+ ((dma_addr_t)net_iov_idx(niov) << owner->binding->niov_shift);
}
static void net_devmem_dmabuf_binding_release(struct percpu_ref *ref)
@@ -93,13 +93,14 @@ net_devmem_alloc_dmabuf(struct net_devmem_dmabuf_binding *binding)
ssize_t offset;
ssize_t index;
- dma_addr = gen_pool_alloc_owner(binding->chunk_pool, PAGE_SIZE,
+ dma_addr = gen_pool_alloc_owner(binding->chunk_pool,
+ 1UL << binding->niov_shift,
(void **)&owner);
if (!dma_addr)
return NULL;
offset = dma_addr - owner->base_dma_addr;
- index = offset / PAGE_SIZE;
+ index = offset >> binding->niov_shift;
niov = &owner->area.niovs[index];
niov->desc.pp_magic = 0;
@@ -113,12 +114,13 @@ void net_devmem_free_dmabuf(struct net_iov *niov)
{
struct net_devmem_dmabuf_binding *binding = net_devmem_iov_binding(niov);
unsigned long dma_addr = net_devmem_get_dma_addr(niov);
+ size_t niov_size = 1UL << binding->niov_shift;
if (WARN_ON(!gen_pool_has_addr(binding->chunk_pool, dma_addr,
- PAGE_SIZE)))
+ niov_size)))
return;
- gen_pool_free(binding->chunk_pool, dma_addr, PAGE_SIZE);
+ gen_pool_free(binding->chunk_pool, dma_addr, niov_size);
}
void net_devmem_unbind_dmabuf(struct net_devmem_dmabuf_binding *binding)
@@ -163,6 +165,9 @@ int net_devmem_bind_dmabuf_to_queue(struct net_device *dev, u32 rxq_idx,
u32 xa_idx;
int err;
+ if (binding->niov_shift != PAGE_SHIFT)
+ mp_params.rx_page_size = 1U << binding->niov_shift;
+
err = netif_mp_open_rxq(dev, rxq_idx, &mp_params, extack);
if (err)
return err;
@@ -184,14 +189,16 @@ struct net_devmem_dmabuf_binding *
net_devmem_bind_dmabuf(struct net_device *dev, void *vdev,
struct device *dma_dev,
enum dma_data_direction direction,
- unsigned int dmabuf_fd, struct netdev_nl_sock *priv,
+ unsigned int dmabuf_fd, unsigned int niov_shift,
+ struct netdev_nl_sock *priv,
struct netlink_ext_ack *extack)
{
struct net_devmem_dmabuf_binding *binding;
+ size_t niov_size = 1UL << niov_shift;
static u32 id_alloc_next;
+ unsigned int sg_idx, i;
struct scatterlist *sg;
struct dma_buf *dmabuf;
- unsigned int sg_idx, i;
unsigned long virtual;
int err;
@@ -213,6 +220,7 @@ net_devmem_bind_dmabuf(struct net_device *dev, void *vdev,
binding->dev = dev;
binding->vdev = vdev;
+ binding->niov_shift = niov_shift;
xa_init_flags(&binding->bound_rxqs, XA_FLAGS_ALLOC);
err = percpu_ref_init(&binding->ref,
@@ -248,18 +256,14 @@ net_devmem_bind_dmabuf(struct net_device *dev, void *vdev,
goto err_unmap;
}
binding->tx_vec = kvmalloc_objs(struct net_iov *,
- dmabuf->size / PAGE_SIZE);
+ dmabuf->size >> niov_shift);
if (!binding->tx_vec) {
err = -ENOMEM;
goto err_unmap;
}
}
- /* For simplicity we expect to make PAGE_SIZE allocations, but the
- * binding can be much more flexible than that. We may be able to
- * allocate MTU sized chunks here. Leave that for future work...
- */
- binding->chunk_pool = gen_pool_create(PAGE_SHIFT,
+ binding->chunk_pool = gen_pool_create(niov_shift,
dev_to_node(&dev->dev));
if (!binding->chunk_pool) {
err = -ENOMEM;
@@ -273,9 +277,12 @@ net_devmem_bind_dmabuf(struct net_device *dev, void *vdev,
size_t len = sg_dma_len(sg);
struct net_iov *niov;
- if (!IS_ALIGNED(len, PAGE_SIZE)) {
+ if (!IS_ALIGNED(dma_addr, niov_size) ||
+ !IS_ALIGNED(len, niov_size)) {
err = -EINVAL;
- NL_SET_ERR_MSG(extack, "dma-buf SG length must be PAGE_SIZE aligned");
+ NL_SET_ERR_MSG_FMT(extack,
+ "dmabuf sg entry (addr=%pad, len=%zu) not aligned to niov size %zu",
+ &dma_addr, len, niov_size);
goto err_free_chunks;
}
@@ -288,7 +295,7 @@ net_devmem_bind_dmabuf(struct net_device *dev, void *vdev,
owner->area.base_virtual = virtual;
owner->base_dma_addr = dma_addr;
- owner->area.num_niovs = len / PAGE_SIZE;
+ owner->area.num_niovs = len >> niov_shift;
owner->binding = binding;
err = gen_pool_add_owner(binding->chunk_pool, dma_addr,
@@ -313,7 +320,7 @@ net_devmem_bind_dmabuf(struct net_device *dev, void *vdev,
page_pool_set_dma_addr_netmem(net_iov_to_netmem(niov),
net_devmem_get_dma_addr(niov));
if (direction == DMA_TO_DEVICE)
- binding->tx_vec[owner->area.base_virtual / PAGE_SIZE + i] = niov;
+ binding->tx_vec[(owner->area.base_virtual >> niov_shift) + i] = niov;
}
virtual += len;
@@ -430,13 +437,15 @@ struct net_iov *
net_devmem_get_niov_at(struct net_devmem_dmabuf_binding *binding,
size_t virt_addr, size_t *off, size_t *size)
{
+ size_t niov_size = 1UL << binding->niov_shift;
+
if (virt_addr >= binding->dmabuf->size)
return NULL;
- *off = virt_addr % PAGE_SIZE;
- *size = PAGE_SIZE - *off;
+ *off = virt_addr & (niov_size - 1);
+ *size = niov_size - *off;
- return binding->tx_vec[virt_addr / PAGE_SIZE];
+ return binding->tx_vec[virt_addr >> binding->niov_shift];
}
/*** "Dmabuf devmem memory provider" ***/
@@ -454,7 +463,7 @@ int mp_dmabuf_devmem_init(struct page_pool *pool)
pool->dma_sync = false;
pool->dma_sync_for_cpu = false;
- if (pool->p.order != 0)
+ if (pool->p.order != binding->niov_shift - PAGE_SHIFT)
return -E2BIG;
net_devmem_dmabuf_binding_get(binding);
diff --git a/net/core/devmem.h b/net/core/devmem.h
index 3852a56036cb..4a293a7d1149 100644
--- a/net/core/devmem.h
+++ b/net/core/devmem.h
@@ -71,6 +71,8 @@ struct net_devmem_dmabuf_binding {
*/
struct net_iov **tx_vec;
+ unsigned int niov_shift;
+
struct work_struct unbind_w;
};
@@ -93,7 +95,8 @@ struct net_devmem_dmabuf_binding *
net_devmem_bind_dmabuf(struct net_device *dev, void *vdev,
struct device *dma_dev,
enum dma_data_direction direction,
- unsigned int dmabuf_fd, struct netdev_nl_sock *priv,
+ unsigned int dmabuf_fd, unsigned int niov_shift,
+ struct netdev_nl_sock *priv,
struct netlink_ext_ack *extack);
struct net_devmem_dmabuf_binding *net_devmem_lookup_dmabuf(u32 id);
void net_devmem_unbind_dmabuf(struct net_devmem_dmabuf_binding *binding);
@@ -122,10 +125,11 @@ static inline u32 net_devmem_iov_binding_id(const struct net_iov *niov)
static inline unsigned long net_iov_virtual_addr(const struct net_iov *niov)
{
- struct net_iov_area *owner = net_iov_owner(niov);
+ struct dmabuf_genpool_chunk_owner *co =
+ net_devmem_iov_to_chunk_owner(niov);
- return owner->base_virtual +
- ((unsigned long)net_iov_idx(niov) << PAGE_SHIFT);
+ return net_iov_owner(niov)->base_virtual +
+ ((unsigned long)net_iov_idx(niov) << co->binding->niov_shift);
}
static inline bool
@@ -175,6 +179,7 @@ net_devmem_bind_dmabuf(struct net_device *dev, void *vdev,
struct device *dma_dev,
enum dma_data_direction direction,
unsigned int dmabuf_fd,
+ unsigned int niov_shift,
struct netdev_nl_sock *priv,
struct netlink_ext_ack *extack)
{
diff --git a/net/core/netdev-genl-gen.c b/net/core/netdev-genl-gen.c
index d18c89b5a6c7..447ed06d8c74 100644
--- a/net/core/netdev-genl-gen.c
+++ b/net/core/netdev-genl-gen.c
@@ -106,10 +106,11 @@ static const struct nla_policy netdev_qstats_get_nl_policy[NETDEV_A_QSTATS_SCOPE
};
/* NETDEV_CMD_BIND_RX - do */
-static const struct nla_policy netdev_bind_rx_nl_policy[NETDEV_A_DMABUF_FD + 1] = {
+static const struct nla_policy netdev_bind_rx_nl_policy[NETDEV_A_DMABUF_RX_BUF_SIZE + 1] = {
[NETDEV_A_DMABUF_IFINDEX] = NLA_POLICY_MIN(NLA_U32, 1),
[NETDEV_A_DMABUF_FD] = { .type = NLA_U32, },
[NETDEV_A_DMABUF_QUEUES] = NLA_POLICY_NESTED(netdev_queue_id_nl_policy),
+ [NETDEV_A_DMABUF_RX_BUF_SIZE] = { .type = NLA_U32, },
};
/* NETDEV_CMD_NAPI_SET - do */
@@ -219,7 +220,7 @@ static const struct genl_split_ops netdev_nl_ops[] = {
.cmd = NETDEV_CMD_BIND_RX,
.doit = netdev_nl_bind_rx_doit,
.policy = netdev_bind_rx_nl_policy,
- .maxattr = NETDEV_A_DMABUF_FD,
+ .maxattr = NETDEV_A_DMABUF_RX_BUF_SIZE,
.flags = GENL_UNS_ADMIN_PERM | GENL_CMD_CAP_DO,
},
{
diff --git a/net/core/netdev-genl.c b/net/core/netdev-genl.c
index c15d8d4ca1f8..82089dac000f 100644
--- a/net/core/netdev-genl.c
+++ b/net/core/netdev-genl.c
@@ -1013,6 +1013,7 @@ netdev_nl_get_dma_dev(struct net_device *netdev, unsigned long *rxq_bitmap,
int netdev_nl_bind_rx_doit(struct sk_buff *skb, struct genl_info *info)
{
struct net_devmem_dmabuf_binding *binding;
+ unsigned int niov_shift = PAGE_SHIFT;
u32 ifindex, dmabuf_fd, rxq_idx;
struct netdev_nl_sock *priv;
struct net_device *netdev;
@@ -1030,6 +1031,19 @@ int netdev_nl_bind_rx_doit(struct sk_buff *skb, struct genl_info *info)
ifindex = nla_get_u32(info->attrs[NETDEV_A_DEV_IFINDEX]);
dmabuf_fd = nla_get_u32(info->attrs[NETDEV_A_DMABUF_FD]);
+ if (info->attrs[NETDEV_A_DMABUF_RX_BUF_SIZE]) {
+ u32 rx_buf_size = nla_get_u32(info->attrs[NETDEV_A_DMABUF_RX_BUF_SIZE]);
+
+ if (!rx_buf_size || !is_power_of_2(rx_buf_size) ||
+ rx_buf_size < PAGE_SIZE) {
+ NL_SET_ERR_MSG_FMT(info->extack,
+ "rx_buf_size %u must be a power of 2 >= page size (%lu)",
+ rx_buf_size, PAGE_SIZE);
+ return -EINVAL;
+ }
+ niov_shift = ilog2(rx_buf_size);
+ }
+
priv = genl_sk_priv_get(&netdev_nl_family, NETLINK_CB(skb).sk);
if (IS_ERR(priv))
return PTR_ERR(priv);
@@ -1080,7 +1094,8 @@ int netdev_nl_bind_rx_doit(struct sk_buff *skb, struct genl_info *info)
}
binding = net_devmem_bind_dmabuf(netdev, NULL, dma_dev, DMA_FROM_DEVICE,
- dmabuf_fd, priv, info->extack);
+ dmabuf_fd, niov_shift, priv,
+ info->extack);
if (IS_ERR(binding)) {
err = PTR_ERR(binding);
goto err_rxq_bitmap;
@@ -1221,7 +1236,7 @@ int netdev_nl_bind_tx_doit(struct sk_buff *skb, struct genl_info *info)
binding = net_devmem_bind_dmabuf(bind_dev,
bind_dev != netdev ? netdev : NULL,
dma_dev, DMA_TO_DEVICE, dmabuf_fd,
- priv, info->extack);
+ PAGE_SHIFT, priv, info->extack);
if (IS_ERR(binding)) {
err = PTR_ERR(binding);
goto err_unlock_bind_dev;
diff --git a/tools/include/uapi/linux/netdev.h b/tools/include/uapi/linux/netdev.h
index 2f3ab75e8cc0..85e1d20c6268 100644
--- a/tools/include/uapi/linux/netdev.h
+++ b/tools/include/uapi/linux/netdev.h
@@ -219,6 +219,7 @@ enum {
NETDEV_A_DMABUF_QUEUES,
NETDEV_A_DMABUF_FD,
NETDEV_A_DMABUF_ID,
+ NETDEV_A_DMABUF_RX_BUF_SIZE,
__NETDEV_A_DMABUF_MAX,
NETDEV_A_DMABUF_MAX = (__NETDEV_A_DMABUF_MAX - 1)
--
2.53.0-Meta
^ permalink raw reply related
* [PATCH net-next v5 2/3] selftests/net: ncdevmem: add -b option to set rx-buf-size on bind
From: Bobby Eshleman @ 2026-07-08 22:55 UTC (permalink / raw)
To: Donald Hunter, Jakub Kicinski, David S. Miller, Eric Dumazet,
Paolo Abeni, Simon Horman, Andrew Lunn, Gerd Hoffmann,
Vivek Kasireddy, Sumit Semwal, Christian König, Shuah Khan
Cc: netdev, linux-kernel, dri-devel, linux-media, linaro-mm-sig,
linux-kselftest, sdf, razor, daniel, almasrymina, matttbe,
skhawaja, dw, Joe Damato, Bobby Eshleman
In-Reply-To: <20260708-tcpdm-large-niovs-v5-0-34bf6fac941b@meta.com>
From: Bobby Eshleman <bobbyeshleman@meta.com>
Add -b <bytes> to request a non-default niov size via
NETDEV_A_DMABUF_RX_BUF_SIZE. When the value exceeds PAGE_SIZE,
udmabuf_alloc() switches to an MFD_HUGETLB-backed memfd so each 2 MB
hugepage produces one naturally-aligned sg entry.
Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
---
tools/testing/selftests/drivers/net/hw/ncdevmem.c | 36 +++++++++++++++++++++--
1 file changed, 33 insertions(+), 3 deletions(-)
diff --git a/tools/testing/selftests/drivers/net/hw/ncdevmem.c b/tools/testing/selftests/drivers/net/hw/ncdevmem.c
index d96e8a3b5a65..a16e55af51ee 100644
--- a/tools/testing/selftests/drivers/net/hw/ncdevmem.c
+++ b/tools/testing/selftests/drivers/net/hw/ncdevmem.c
@@ -40,6 +40,7 @@
#include <linux/uio.h>
#include <stdarg.h>
+#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
@@ -61,6 +62,7 @@
#include <sys/time.h>
#include <linux/memfd.h>
+#include <sys/param.h>
#include <linux/dma-buf.h>
#include <linux/errqueue.h>
#include <linux/udmabuf.h>
@@ -79,6 +81,7 @@
#define PAGE_SHIFT 12
#define TEST_PREFIX "ncdevmem"
#define NUM_PAGES 16000
+#define MB(x) ((x) << 20)
#ifndef MSG_SOCK_DEVMEM
#define MSG_SOCK_DEVMEM 0x2000000
@@ -100,6 +103,7 @@ static unsigned int dmabuf_id;
static uint32_t tx_dmabuf_id;
static int waittime_ms = 500;
static bool fail_on_linear;
+static uint32_t rx_buf_size;
/* System state loaded by current_config_load() */
#define MAX_FLOWS 8
@@ -142,6 +146,7 @@ static struct memory_buffer *udmabuf_alloc(size_t size)
{
struct udmabuf_create create;
struct memory_buffer *ctx;
+ unsigned int memfd_flags;
int ret;
ctx = malloc(sizeof(*ctx));
@@ -156,9 +161,14 @@ static struct memory_buffer *udmabuf_alloc(size_t size)
goto err_free_ctx;
}
- ctx->memfd = memfd_create("udmabuf-test", MFD_ALLOW_SEALING);
+ memfd_flags = MFD_ALLOW_SEALING;
+ if (rx_buf_size > getpagesize())
+ memfd_flags |= MFD_HUGETLB | MFD_HUGE_2MB;
+
+ ctx->memfd = memfd_create("udmabuf-test", memfd_flags);
if (ctx->memfd < 0) {
- pr_err("[skip,no-memfd]");
+ pr_err("[skip,no-memfd%s]",
+ (memfd_flags & MFD_HUGETLB) ? " (need hugepages)" : "");
goto err_close_dev;
}
@@ -168,6 +178,11 @@ static struct memory_buffer *udmabuf_alloc(size_t size)
goto err_close_memfd;
}
+ if (memfd_flags & MFD_HUGETLB) {
+ size = roundup(size, MB(2));
+ ctx->size = size;
+ }
+
ret = ftruncate(ctx->memfd, size);
if (ret == -1) {
pr_err("[FAIL,memfd-truncate]");
@@ -699,6 +714,8 @@ static int bind_rx_queue(unsigned int ifindex, unsigned int dmabuf_fd,
netdev_bind_rx_req_set_ifindex(req, ifindex);
netdev_bind_rx_req_set_fd(req, dmabuf_fd);
__netdev_bind_rx_req_set_queues(req, queues, n_queue_index);
+ if (rx_buf_size)
+ netdev_bind_rx_req_set_rx_buf_size(req, rx_buf_size);
rsp = netdev_bind_rx(*ys, req);
if (!rsp) {
@@ -1411,7 +1428,7 @@ int main(int argc, char *argv[])
int is_server = 0, opt;
int ret, err = 1;
- while ((opt = getopt(argc, argv, "Lls:c:p:v:q:t:f:z:n")) != -1) {
+ while ((opt = getopt(argc, argv, "Lls:c:p:v:q:t:f:z:nb:")) != -1) {
switch (opt) {
case 'L':
fail_on_linear = true;
@@ -1446,6 +1463,19 @@ int main(int argc, char *argv[])
case 'n':
skip_config = 1;
break;
+ case 'b': {
+ unsigned long val;
+
+ errno = 0;
+ val = strtoul(optarg, NULL, 0);
+ if ((val == ULONG_MAX && errno == ERANGE) ||
+ val > UINT32_MAX) {
+ pr_err("invalid rx_buf_size: %s", optarg);
+ return 1;
+ }
+ rx_buf_size = val;
+ break;
+ }
case '?':
fprintf(stderr, "unknown option: %c\n", optopt);
break;
--
2.53.0-Meta
^ permalink raw reply related
* [PATCH net-next v5 3/3] selftests/net: devmem.py: add check_rx_large_niov
From: Bobby Eshleman @ 2026-07-08 22:55 UTC (permalink / raw)
To: Donald Hunter, Jakub Kicinski, David S. Miller, Eric Dumazet,
Paolo Abeni, Simon Horman, Andrew Lunn, Gerd Hoffmann,
Vivek Kasireddy, Sumit Semwal, Christian König, Shuah Khan
Cc: netdev, linux-kernel, dri-devel, linux-media, linaro-mm-sig,
linux-kselftest, sdf, razor, daniel, almasrymina, matttbe,
skhawaja, dw, Joe Damato, Bobby Eshleman
In-Reply-To: <20260708-tcpdm-large-niovs-v5-0-34bf6fac941b@meta.com>
From: Bobby Eshleman <bobbyeshleman@meta.com>
Add a new devmem test case for binding the dmabuf with rx-buf-size=16K.
The test sweeps RX payload sizes straddling the niov boundary to cover
the sub-niov, exact-niov, and multi-niov RX paths.
Silence pylint invalid-name (`with open() as f`) and too-many-arguments
(ncdevmem_rx grew to 6 args) at file scope.
Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
---
tools/testing/selftests/drivers/net/hw/devmem.py | 12 ++++-
.../testing/selftests/drivers/net/hw/devmem_lib.py | 59 +++++++++++++++++++++-
.../testing/selftests/drivers/net/hw/nk_devmem.py | 11 +++-
3 files changed, 76 insertions(+), 6 deletions(-)
diff --git a/tools/testing/selftests/drivers/net/hw/devmem.py b/tools/testing/selftests/drivers/net/hw/devmem.py
index 031cf9905f65..47b54e18e7a6 100755
--- a/tools/testing/selftests/drivers/net/hw/devmem.py
+++ b/tools/testing/selftests/drivers/net/hw/devmem.py
@@ -2,7 +2,8 @@
# SPDX-License-Identifier: GPL-2.0
from os import path
-from devmem_lib import setup_test, run_rx, run_tx, run_tx_chunks, run_rx_hds
+from devmem_lib import (setup_test, run_rx, run_tx, run_tx_chunks, run_rx_hds,
+ run_rx_large_niov)
from lib.py import ksft_run, ksft_exit, ksft_disruptive
from lib.py import NetDrvEpEnv
@@ -30,11 +31,18 @@ def check_rx_hds(cfg) -> None:
run_rx_hds(cfg)
+@ksft_disruptive
+def check_rx_large_niov(cfg) -> None:
+ """Run the devmem RX test with rx-buf-size = 16 KiB."""
+ run_rx_large_niov(cfg)
+
+
def main() -> None:
"""Run the devmem test cases."""
with NetDrvEpEnv(__file__) as cfg:
setup_test(cfg, path.abspath(path.dirname(__file__) + "/ncdevmem"))
- ksft_run([check_rx, check_tx, check_tx_chunks, check_rx_hds],
+ ksft_run([check_rx, check_tx, check_tx_chunks, check_rx_hds,
+ check_rx_large_niov],
args=(cfg,))
ksft_exit()
diff --git a/tools/testing/selftests/drivers/net/hw/devmem_lib.py b/tools/testing/selftests/drivers/net/hw/devmem_lib.py
index 0921ff03eb81..7b8557959c40 100644
--- a/tools/testing/selftests/drivers/net/hw/devmem_lib.py
+++ b/tools/testing/selftests/drivers/net/hw/devmem_lib.py
@@ -1,4 +1,5 @@
# SPDX-License-Identifier: GPL-2.0
+# pylint: disable=invalid-name,too-many-arguments
"""Shared helpers for devmem TCP selftests."""
import re
@@ -8,7 +9,7 @@ from lib.py import (bkg, cmd, defer, ethtool, rand_port, wait_port_listen,
NetdevFamily)
-def require_devmem(cfg):
+def require_devmem(cfg, rx_buf_size=0):
"""Probe ncdevmem on cfg.ifname and SKIP the test if devmem isn't supported."""
if not hasattr(cfg, "devmem_probed"):
probe_command = f"{cfg.bin_local} -f {cfg.ifname}"
@@ -18,6 +19,19 @@ def require_devmem(cfg):
if not cfg.devmem_supported:
raise KsftSkipEx("Test requires devmem support")
+ if rx_buf_size > 0:
+ if not hasattr(cfg, "devmem_rx_buf_size_probed"):
+ cfg.devmem_rx_buf_size_probed = {}
+
+ if rx_buf_size not in cfg.devmem_rx_buf_size_probed:
+ probe_command = f"{cfg.bin_local} -f {cfg.ifname} -b {rx_buf_size}"
+ cfg.devmem_rx_buf_size_probed[rx_buf_size] = \
+ cmd(probe_command, fail=False, shell=True).ret == 0
+
+ if not cfg.devmem_rx_buf_size_probed[rx_buf_size]:
+ raise KsftSkipEx(
+ f"Test requires devmem rx-buf-size={rx_buf_size} support")
+
def configure_nic(cfg):
"""Channels, rings, RSS, queue lease for netkit devmem."""
@@ -76,7 +90,8 @@ def set_flow_rule(cfg, port):
return int(re.search(r'ID (\d+)', output).group(1))
-def ncdevmem_rx(cfg, port, verify=True, fail_on_linear=False, flow_steer=False):
+def ncdevmem_rx(cfg, port, verify=True, fail_on_linear=False, flow_steer=False,
+ rx_buf_size=0):
"""Build the ncdevmem RX listener command."""
if hasattr(cfg, 'netns'):
flow_rule_id = set_flow_rule(cfg, port)
@@ -96,6 +111,8 @@ def ncdevmem_rx(cfg, port, verify=True, fail_on_linear=False, flow_steer=False):
extras.append("-v 7")
if fail_on_linear:
extras.append("-L")
+ if rx_buf_size > 0:
+ extras.append(f"-b {rx_buf_size}")
parts = [cfg.bin_local, "-l", f"-f {ifname}", f"-s {addr}",
f"-p {port}", *extras]
@@ -202,6 +219,44 @@ def run_tx_chunks(cfg):
ksft_eq(socat.stdout.strip(), "hello\nworld")
+def _restore_nr_hugepages(hp_file, nr_hugepages):
+ with open(hp_file, 'w', encoding='utf-8') as f:
+ f.write(str(nr_hugepages))
+
+
+def run_rx_large_niov(cfg):
+ """Run the devmem RX test with a large niov (rx-buf-size > PAGE_SIZE).
+
+ Sweep payload sizes that straddle the niov boundary: below, equal to,
+ and above rx_buf_size, to exercise sub-niov, exact-niov, and multi-niov
+ RX paths.
+ """
+ hp_file = "/proc/sys/vm/nr_hugepages"
+ with open(hp_file, 'r+', encoding='utf-8') as f:
+ nr_hugepages = int(f.read().strip())
+ if nr_hugepages < 64:
+ f.seek(0)
+ f.write("64")
+ defer(_restore_nr_hugepages, hp_file, nr_hugepages)
+ require_devmem(cfg, rx_buf_size=16384)
+ configure_nic(cfg)
+ netns = getattr(cfg, "netns", None)
+
+ for size in [1024, 4096, 8192, 16384, 32768, 65536]:
+ port = rand_port()
+ socat = socat_send(cfg, port)
+ listen_cmd = ncdevmem_rx(cfg, port,
+ flow_steer=not netns,
+ rx_buf_size=16384)
+ data_pipe = (f"yes $(echo -e \x01\x02\x03\x04\x05\x06) | "
+ f"head -c {size} | {socat}")
+ with bkg(listen_cmd, exit_wait=True, ns=netns) as ncdevmem:
+ wait_port_listen(port, proto="tcp", ns=netns)
+ cmd(data_pipe, host=cfg.remote, shell=True)
+ ksft_eq(ncdevmem.ret, 0,
+ f"large-niov failed for payload size {size}")
+
+
def run_rx_hds(cfg):
"""Run the HDS test by running devmem RX across a segment size sweep."""
require_devmem(cfg)
diff --git a/tools/testing/selftests/drivers/net/hw/nk_devmem.py b/tools/testing/selftests/drivers/net/hw/nk_devmem.py
index 300ed2a70ab4..7f1867e4ff32 100755
--- a/tools/testing/selftests/drivers/net/hw/nk_devmem.py
+++ b/tools/testing/selftests/drivers/net/hw/nk_devmem.py
@@ -3,7 +3,8 @@
"""Test devmem TCP with netkit."""
import os
-from devmem_lib import setup_test, run_rx, run_tx, run_tx_chunks, run_rx_hds
+from devmem_lib import (setup_test, run_rx, run_tx, run_tx_chunks, run_rx_hds,
+ run_rx_large_niov)
from lib.py import ksft_run, ksft_exit, ksft_disruptive
from lib.py import NetDrvContEnv
@@ -31,6 +32,12 @@ def check_nk_rx_hds(cfg) -> None:
run_rx_hds(cfg)
+@ksft_disruptive
+def check_nk_rx_large_niov(cfg) -> None:
+ """Run the devmem RX large-niov test through netkit."""
+ run_rx_large_niov(cfg)
+
+
def main() -> None:
"""Run the netkit devmem test cases."""
with NetDrvContEnv(__file__, rxqueues=2, primary_rx_redirect=True) as cfg:
@@ -38,7 +45,7 @@ def main() -> None:
os.path.join(os.path.dirname(os.path.abspath(__file__)),
"ncdevmem"))
ksft_run([check_nk_rx, check_nk_tx, check_nk_tx_chunks,
- check_nk_rx_hds], args=(cfg,))
+ check_nk_rx_hds, check_nk_rx_large_niov], args=(cfg,))
ksft_exit()
--
2.53.0-Meta
^ permalink raw reply related
* Re: [PATCH RFC net-next 2/3] net: dsa: mxl862xx: add SMDIO clause-22 register access
From: Andrew Lunn @ 2026-07-08 23:15 UTC (permalink / raw)
To: Daniel Golle
Cc: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, linux-kernel, netdev
In-Reply-To: <ak6o7Ovekjb_evPs@makrotopia.org>
On Wed, Jul 08, 2026 at 09:45:48PM +0200, Daniel Golle wrote:
> On Wed, Jul 08, 2026 at 07:22:49PM +0200, Andrew Lunn wrote:
> > On Tue, Jul 07, 2026 at 04:16:07PM +0200, Daniel Golle wrote:
> > > Add mxl862xx_smdio_read() and mxl862xx_smdio_write() for clause-22
> > > SMDIO register access. MCUboot rescue mode only exposes clause-22
> > > registers; the existing clause-45 MMD interface is unavailable during
> > > firmware transfer. The MDIO bus lock is held per-transaction (not
> > > across polls) so that SB PDI polling during flash erase does not
> > > starve other MDIO users.
> >
> > What other MDIO users are there? It sounds like once the switch is in
> > rescue mode, switch management is dead. So how can there be users?
>
> The MDIO bus lock refers to the host bus which is used to connect
> the switch management interface. The same bus can also be used to
> connect other unrelated PHYs (eg. to provide a WAN or management
> interface independent of the switch).
Thanks for the explanation. Maybe 'does not starve other non-switch
MDIO users'?
I've not got to the rest of the patch yet, but i wondered if phylib
might still be trying to poll the switches PHYs.
Andrew
^ permalink raw reply
* Re: [PATCH RFC net-next 3/3] net: dsa: mxl862xx: add devlink flash_update and info_get
From: Andrew Lunn @ 2026-07-08 23:24 UTC (permalink / raw)
To: Daniel Golle
Cc: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, linux-kernel, netdev
In-Reply-To: <ak6s363rweBPZhQZ@makrotopia.org>
On Wed, Jul 08, 2026 at 10:02:39PM +0200, Daniel Golle wrote:
> On Wed, Jul 08, 2026 at 07:27:21PM +0200, Andrew Lunn wrote:
> > > + * The flash process takes approximately 15 minutes. Progress is
> > > + * reported via devlink status notifications. After a successful (or
> > > + * failed) flash the driver reprobes the device automatically.
> >
> > Have you tested the failed use case?
> >
> > I assume if the firmware in the flash is invalid, the bootloader does
> > not boot it, and it remains in the bootloader waiting for another
> > attempt. Does this DSA driver still load, so devlink can be used to
> > try again?
>
> No. Without a running the firmware the driver doesn't probe and only
> a special rescue tool allows to recover the hardware.
> Having the DSA driver detect the presence of the switch stuck in
> mcuboot mode and probe without registering any user or CPU ports
> also isn't straight forward.
And that special rescue tool exists?
Why not wrap it in a script which unloads the DSA driver, let it do
its thing, and then reload the DSA driver?
All the other users of devlink flash that i know of can operate while
the device is still running. So it makes sense for it to be part of
the driver, it is something just going on in the background. This
device is different, so i don't really see the advantage of making it
part of the driver.
Andrew
^ permalink raw reply
* Re: [PATCH iproute] ss: Don't re-print an SCTP listen socket as an assoc
From: Xin Long @ 2026-07-08 23:33 UTC (permalink / raw)
To: Jamie Bainbridge; +Cc: netdev, Stephen Hemminger, Phil Sutter, Rustam Kovhaev
In-Reply-To: <4d56e7ac2502cd92d4837d9fb16b9228aa17d599.1783406660.git.jamie.bainbridge@gmail.com>
On Tue, Jul 7, 2026 at 2:48 AM Jamie Bainbridge
<jamie.bainbridge@gmail.com> wrote:
>
> "ss -Sa" prints a LISTEN-state SCTP sock once as a non-assoc when
> is_sctp_assoc() correctly returns false, then again when we have cached
> the inode in sctp_ino, so is_sctp_assoc() returns true.
>
> On the second pass, we try to print the socket state with
> sctp_sstate_name[s->state], but s->state == 10 (SCTP_SS_LISTENING)
> but sctp_sstate_name[] only has 8 entries, so we illegally access beyond
> the end of the name array.
>
> If you are lucky, the space beyond the array is NULL and the argument to
> the print format is printed as "(null)" by the C library:
>
> $ ./misc/ss -San
> State Recv-Q Send-Q Local Address:Port Peer Address:Port
> LISTEN 0 5 192.0.2.10:9001 0.0.0.0:*
> `- (null) 0 5 192.0.2.10:9001 0.0.0.0:*
> `- ESTAB 0 0 192.0.2.10%net1:9001 192.0.2.9:11111
>
> If you are unlucky, the space beyond the array is non-NULL and you
> pass an invalid address to the print format:
>
> $ ./misc/ss -San
> Segmentation fault (core dumped)
>
> The inode is correctly cached at the bottom of inet_show_sock(), so
> check if we've already processed this SCTP LISTEN inode and exit early.
>
> $ ./misc/ss -San
> State Recv-Q Send-Q Local Address:Port Peer Address:Port
> LISTEN 0 5 192.0.2.10:9001 0.0.0.0:*
> `- ESTAB 0 0 192.0.2.10%net1:9001 192.0.2.9:11111
>
> We cannot exit later than this (eg: in sock_state_print()) because by
> then we're already halfway through a new line in inet_stats_print().
>
> Keep the existing check in is_sctp_assoc() because that is needed to
> differentiate related assocs from new endpoints.
>
> Note: there is still a chance of double-printing a listen socket (now
> with the correct format if netlink delivers us listen sockets and their
> assocs with something else in between:
>
> $ ./misc/ss -Sane
> State Recv-Q Send-Q Local Address:Port Peer Address:Port
> > LISTEN 0 5 192.0.2.10:9001 0.0.0.0:* ino:36518
> LISTEN 0 5 192.0.2.10:9002 0.0.0.0:* ino:44485
> `- ESTAB 0 0 192.0.2.10%net1:9002 192.0.2.9:22222 ino:44485
> > LISTEN 0 5 192.0.2.10:9001 0.0.0.0:* ino:36518
> `- ESTAB 0 0 192.0.2.10%net1:9001 122.0.2.9:11111 ino:36518
>
> This behaviour existed before this commit. I don't see a way around this
> except to pre-sort the results from netlink which seems unrealistic.
>
> Fixes: f89d46ad63f6f ("ss: Add support for SCTP protocol")
> Reported-by: Rustam Kovhaev <rkovhaev@gmail.com>
> Signed-off-by: Jamie Bainbridge <jamie.bainbridge@gmail.com>
> ---
> misc/ss.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/misc/ss.c b/misc/ss.c
> index 14e9f27a75321556240a5f290b8bcf51c605a4c2..7e94160f7590c35aa187fe00902be8def7593608 100644
> --- a/misc/ss.c
> +++ b/misc/ss.c
> @@ -3764,6 +3764,14 @@ static bool bpf_map_opts_is_enabled(void)
> static int inet_show_sock(struct nlmsghdr *nlh,
> struct sockstat *s)
> {
> + /* SCTP assocs share the same inode number with their parent endpoint.
> + * If we've seen a LISTEN socket inode before, we've already printed it
> + * and cached the inode at the bottom of this function. We don't want
> + * to re-print the LISTEN socket again. so exit early.
> + */
> + if (s->type == IPPROTO_SCTP && s->state == SS_LISTEN && sctp_ino == s->ino)
> + return 0;
> +
> struct rtattr *tb[INET_DIAG_MAX+1];
> struct inet_diag_msg *r = NLMSG_DATA(nlh);
> unsigned char v6only = 0;
> --
> 2.47.3
>
Hi, Jamie, thanks for identifying the issue.
The same listen was dumped twice continuously, which is abnormal.
I think the issue was introduced in kernel by:
1ba8d77f410d ("sctp_diag: Respect ss adding TCPF_CLOSE to idiag_states")
where the check against TCPF_LISTEN in sctp_ep_dump() is incorrect.
and got fixed (unintentionally) by:
7d8297e26b4e ("sctp: hold socket lock when dumping endpoints in sctp_diag")
Thanks.
^ permalink raw reply
* Re: [PATCH net-next 4/5] net: phy: mediatek: add calibration logic for AN7581
From: Wayen Yan @ 2026-07-08 16:30 UTC (permalink / raw)
To: netdev
Cc: lorenzo, horms, pabeni, kuba, edumazet, andrew+netdev,
angelogioacchino.delregno, matthias.bgg, linux-arm-kernel,
linux-mediatek, Andrew Lunn, Heiner Kallweit, Russell King,
David S. Miller, Daniel Golle, Qingfang Deng, SkyLake Huang,
linux-kernel
In-Reply-To: <20260708102341.53919-5-ansuelsmth@gmail.com>
Hi Christian,
Thanks for working on this. One critical bug found that will crash
on probe, plus a couple of minor issues.
1) Uninitialized shared pointer in an7581_phy_probe()
The local variable `shared` is declared but never assigned before
use:
static int an7581_phy_probe(struct phy_device *phydev)
{
struct airoha_socphy_shared *shared; /* not initialized */
...
ret = devm_phy_package_join(&phydev->mdio.dev, phydev, 0,
sizeof(struct airoha_socphy_shared));
if (ret)
return ret;
...
if (phydev->mdio.addr == AIROHA_DEFAULT_PORT0_ADDR)
shared->phydev_p0 = phydev; /* writing to uninitialized pointer */
devm_phy_package_join() allocates the shared priv data internally
(accessible via phydev->shared->priv), but the local variable
`shared` itself is never populated. You need to call
phy_package_get_priv(phydev) after the join succeeds before
accessing any shared fields.
Fix:
shared = phy_package_get_priv(phydev);
should be added right after devm_phy_package_join() succeeds.
Without this fix, the first PHY to probe (addr == 0x9) will crash,
and all subsequent PHYs' config_init will dereference an
uninitialized phydev_p0 in every calibration function.
2) Typo: mdi_resister_type -> mdi_resistor_type
The field name "resister" appears in multiple places (enum, struct
field, config_init, FIXME comments). It should be "resistor".
This will be baked into the ABI once merged so worth fixing now:
- enum airoha_mdi_resister_type -> airoha_mdi_resistor_type
- shared->mdi_resister_type -> shared->mdi_resistor_type
- FIXME comment: "MDI Resister Type" -> "MDI Resistor Type"
3) Observation: mdi_resister_type is always MDI_5R but tables have
MDI_0R data
Currently the code hardcodes mdi_resister_type = MDI_5R, so the
MDI_0R entries in an7581_tx_amp_compensation_tbl[] are dead data.
The FIXME suggests this should be read from SCU registers
eventually. Consider adding the MDI_0R branch now (or at minimum
an else) so the code structure is ready when the SCU read is
implemented, and avoid shipping dead table data.
Best,
Wayen
^ permalink raw reply
* Re: [PATCH net-next 5/5] net: phy: mediatek: add calibration logic for AN7583
From: Wayen Yan @ 2026-07-08 16:31 UTC (permalink / raw)
To: netdev
Cc: lorenzo, horms, pabeni, kuba, edumazet, andrew+netdev,
angelogioacchino.delregno, matthias.bgg, linux-arm-kernel,
linux-mediatek, Andrew Lunn, Heiner Kallweit, Russell King,
David S. Miller, Daniel Golle, Qingfang Deng, SkyLake Huang,
linux-kernel
In-Reply-To: <20260708102341.53919-6-ansuelsmth@gmail.com>
Hi Christian,
A few issues in an7583_phy_config_init():
1) Redundant double assignment of mdi_resister_type
shared->mdi_resister_type = MDI_5R;
shared->mdi_resister_type = MDI_5R; /* duplicate */
if (shared->mdi_resister_type == MDI_0R)
shared->r50_cal_tbl = an7583_zcal_to_r50ohm_0R;
if (shared->mdi_resister_type == MDI_5R)
shared->r50_cal_tbl = an7583_zcal_to_r50ohm_5R;
The first assignment is immediately overwritten by the second
identical one. Also the two `if` blocks should be `else if` --
currently both conditions are checked independently and the
MDI_0R branch is dead code (since the value is hardcoded to
MDI_5R).
If the intent is to default to MDI_5R and later read from SoC,
the structure should be:
shared->mdi_resister_type = MDI_5R; /* FIXME: read from SCU */
if (shared->mdi_resister_type == MDI_0R)
shared->r50_cal_tbl = an7583_zcal_to_r50ohm_0R;
else
shared->r50_cal_tbl = an7583_zcal_to_r50ohm_5R;
2) Typo: mdi_resister_type -> mdi_resistor_type (same as patch 4/5)
Also the FIXME comment says "MDI Resister Type" -- should be
"Resistor Type".
3) Dependency on patch 4/5 probe fix
an7583_phy_config_init() uses shared->phydev_p0 which is set in
an7581_phy_probe(). If the probe function from patch 4/5 is not
fixed (missing shared = phy_package_get_priv(phydev)), this will
deref NULL/garbage:
phydev_p0 = shared->phydev_p0;
phy_offset = phydev->mdio.addr - phydev_p0->mdio.addr;
This highlights that patch 4/5's probe fix is a blocker for both
AN7581 and AN7583.
Best,
Wayen
^ permalink raw reply
* Re: [PATCH net-next 3/5] net: phy: mediatek: split Airoha code to dedicated source
From: Wayen Yan @ 2026-07-08 16:32 UTC (permalink / raw)
To: netdev
Cc: lorenzo, horms, pabeni, kuba, edumazet, andrew+netdev,
angelogioacchino.delregno, matthias.bgg, linux-arm-kernel,
linux-mediatek, Andrew Lunn, Heiner Kallweit, Russell King,
David S. Miller, Daniel Golle, Qingfang Deng, SkyLake Huang,
linux-kernel
In-Reply-To: <20260708102341.53919-4-ansuelsmth@gmail.com>
Hi Christian,
One minor typo in the new Kconfig help text:
In drivers/net/phy/mediatek/Kconfig, the help text for
AIROHA_GE_SOC_PHY has a leftover "d":
Include support for built-in Ethernet PHYs which are present in
the AN7581 and AN7583 SoCs. These PHYs d will dynamically
^
calibrate during startup.
Should be: "These PHYs will dynamically calibrate during startup."
Otherwise the code split looks clean.
Best,
Wayen
^ permalink raw reply
* Re: [PATCH net-next 2/5] net: phy: mediatek: move MTK GE SoC registers define to dedicated header
From: Andrew Lunn @ 2026-07-08 23:44 UTC (permalink / raw)
To: Christian Marangi
Cc: Heiner Kallweit, Russell King, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Daniel Golle, Qingfang Deng,
SkyLake Huang, Matthias Brugger, AngeloGioacchino Del Regno,
linux-kernel, netdev, linux-arm-kernel, linux-mediatek
In-Reply-To: <20260708102341.53919-3-ansuelsmth@gmail.com>
On Wed, Jul 08, 2026 at 12:23:28PM +0200, Christian Marangi wrote:
> In preparation for support of special Software Calibration for Airoha
> PHY, move the MTK GE SoC registers define to a dedicated header.
>
> It's also needed to generalize the cal_cycle function as Airoha needs
> only part of its logic (the wait logic) to complete a calibration cycle.
Can this be two patches?
Andrew
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox