* [PATCH net v3] vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
From: Harshaka Narayana @ 2026-07-13 14:09 UTC (permalink / raw)
To: davem, kuba, pabeni, netdev
Cc: ronak.doshi, bcm-kernel-feedback-list, andrew+netdev, edumazet,
linux-kernel, guolin.yang, harshaka.narayana,
sankararaman.jayaraman
vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the
outer header, but for a Geneve-encapsulated packet the device can set
them based on the inner header instead, signalled by the
VMXNET3_RCD_HDR_INNER_SHIFT bit in the completion descriptor. Since the
function never skips the outer encapsulation, this mismatch triggers:
- BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP), because the outer
protocol is UDP (Geneve), not TCP.
- BUG_ON(hdr.eth->h_proto != ...), when the tunnel's outer and inner
IP versions differ (e.g. outer IPv6/inner IPv4 or vice versa).
Check VMXNET3_RCD_HDR_INNER_SHIFT up front and bail out, since the
function cannot locate the inner header it would need to parse. Also
convert the remaining BUG_ON()s in this function to return 0
defensively.
Fixes: 45dac1d6ea04 ("vmxnet3: Changes for vmxnet3 adapter version 2 (fwd)")
Signed-off-by: Harshaka Narayana <harshaka.narayana@broadcom.com>
Reviewed-by: Ronak Doshi <ronak.doshi@broadcom.com>
Reviewed-by: Sankararaman Jayaraman <sankararaman.jayaraman@broadcom.com>
---
v3:
- Combined the two early return-0 checks into one condition
- Replaced stacked Signed-off-by tags with Reviewed-by for Ronak
Doshi and Sankararaman Jayaraman
v2: https://lore.kernel.org/netdev/20260709201654.4108084-1-harshaka.narayana@broadcom.com/
- Check VMXNET3_RCD_HDR_INNER_SHIFT up front to catch the Geneve
inner-header case directly, and convert the remaining
BUG_ON(hdr.eth->h_proto != ...) checks to return 0
- Reworded commit message to describe the root cause via
VMXNET3_RCD_HDR_INNER_SHIFT
v1: https://lore.kernel.org/netdev/20260707165248.1859188-1-harshaka.narayana@broadcom.com/
---
drivers/net/vmxnet3/vmxnet3_drv.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 40522afc0532..f8df83f9965d 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1530,7 +1530,11 @@ vmxnet3_get_hdr_len(struct vmxnet3_adapter *adapter, struct sk_buff *skb,
struct ipv6hdr *ipv6;
struct tcphdr *tcp;
} hdr;
- BUG_ON(gdesc->rcd.tcp == 0);
+
+ /* v4/v6/tcp then describe the inner header, which we can't locate. */
+ if ((le32_to_cpu(gdesc->dword[0]) & (1UL << VMXNET3_RCD_HDR_INNER_SHIFT)) ||
+ gdesc->rcd.tcp == 0)
+ return 0;
maplen = skb_headlen(skb);
if (unlikely(sizeof(struct iphdr) + sizeof(struct tcphdr) > maplen))
@@ -1544,15 +1548,21 @@ vmxnet3_get_hdr_len(struct vmxnet3_adapter *adapter, struct sk_buff *skb,
hdr.eth = eth_hdr(skb);
if (gdesc->rcd.v4) {
- BUG_ON(hdr.eth->h_proto != htons(ETH_P_IP) &&
- hdr.veth->h_vlan_encapsulated_proto != htons(ETH_P_IP));
+ if (hdr.eth->h_proto != htons(ETH_P_IP) &&
+ hdr.veth->h_vlan_encapsulated_proto != htons(ETH_P_IP))
+ return 0;
+
hdr.ptr += hlen;
- BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP);
+ if (hdr.ipv4->protocol != IPPROTO_TCP)
+ return 0;
+
hlen = hdr.ipv4->ihl << 2;
hdr.ptr += hdr.ipv4->ihl << 2;
} else if (gdesc->rcd.v6) {
- BUG_ON(hdr.eth->h_proto != htons(ETH_P_IPV6) &&
- hdr.veth->h_vlan_encapsulated_proto != htons(ETH_P_IPV6));
+ if (hdr.eth->h_proto != htons(ETH_P_IPV6) &&
+ hdr.veth->h_vlan_encapsulated_proto != htons(ETH_P_IPV6))
+ return 0;
+
hdr.ptr += hlen;
/* Use an estimated value, since we also need to handle
* TSO case.
--
2.52.0
^ permalink raw reply related
* Re: [PATCH iwl-net v2 2/2] ice: fix stats array overflow via proper realloc
From: Simon Horman @ 2026-07-13 14:04 UTC (permalink / raw)
To: Przemek Kitszel
Cc: intel-wired-lan, Michal Schmidt, Jakub Kicinski, netdev,
Tony Nguyen, Aleksandr Loktionov, Andrew Lunn, David S. Miller,
Eric Dumazet, Paolo Abeni, Jedrzej Jagielski, Piotr Kwapulinski,
Marcin Szycik
In-Reply-To: <20260706224346.22546-2-przemyslaw.kitszel@intel.com>
On Tue, Jul 07, 2026 at 12:43:31AM +0200, Przemek Kitszel wrote:
> Integrate ice_vsi_alloc_stat_arrays() with realloc variant.
>
> Instead of keeping two functions for stat arrays allocation, change the
> ice_vsi_realloc_stat_arrays() to handle initial condition (no vsi_stat
> entry) and replace ice_vsi_alloc_stat_arrays() by the more generic
> ice_vsi_realloc_stat_arrays().
>
> Note that VSIs of ICE_VSI_CHNL type are ignored in realloc variant as they
> were in the replaced ice_vsi_alloc_stat_arrays().
>
> This is a fix for stats array overflow that occurs when VF is given more
> queues (an operation that will be more frequent, and by bigger increase,
> when we will merge my "XLVF" series).
>
> Splat for increasing number of queues thanks to Michal Schmidt:
> KASAN detects the bug:
...
> Fixes: 2a2cb4c6c181 ("ice: replace ice_vf_recreate_vsi() with ice_vf_reconfig_vsi()")
> Closes: https://redhat.atlassian.net/browse/RHEL-164321
> Reviewed-by: Marcin Szycik <marcin.szycik@linux.intel.com>
> Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
> ---
> This is an alternative to the fix [1] by Michal Schmidt, which were
> blocked due to AI feedback. My fix was already developed before Michal's,
> just not public back then. We have agreed to go on with my version.
>
> [1] https://lore.kernel.org/netdev/20260520183501.3360810-3-anthony.l.nguyen@intel.com
Reviewed-by: Simon Horman <horms@kernel.org>
...
^ permalink raw reply
* Re: [PATCH 11/13 RFC net-next] net: cipso: guard IPv4 packet manipulation functions
From: Fernando Fernandez Mancera @ 2026-07-13 14:03 UTC (permalink / raw)
To: Paul Moore
Cc: netdev, davem, edumazet, kuba, pabeni, dsahern, horms, idosch,
linux-security-module, linux-kernel
In-Reply-To: <CAHC9VhTA8Y+BLOcLcv6X9u3nRU=X7NQz-u4kZuVNL-Yz1mWKxw@mail.gmail.com>
On 7/12/26 6:22 PM, Paul Moore wrote:
> On Sat, Jul 11, 2026 at 9:41 PM Fernando Fernandez Mancera
> <fmancera@suse.de> wrote:
>>
>> To enable compiling the network stack without IPv4, the CIPSO functions
>> that manipulate IPv4 options and generate ICMP errors must be bypassed.
>>
>> Ideally, CIPSO should not be compiled when IPv4 is disabled but
>> currently it is too integrated within netlabel, so let's just bypassed
>> the relevant functions.
>>
>> Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
>> ---
>> net/ipv4/cipso_ipv4.c | 10 ++++++++++
>> 1 file changed, 10 insertions(+)
>
> I think I would prefer to make CONFIG_NETLABEL dependent on
> CONFIG_IPV4 at this point in time. This will keep the code cleaner
> and allow time to do the proper work of wrapping the CIPSO code with
> CONFIG_CIPSO (or similar) and making that dependent on CONFIG_IPV4.
>
Fair, that works for me too. I am gonna drop this on the v1.
Thank you!
Fernando.
^ permalink raw reply
* Re: [PATCH iwl-net v2 1/2] ice: move ice_vsi_realloc_stat_arrays() up
From: Simon Horman @ 2026-07-13 14:03 UTC (permalink / raw)
To: Przemek Kitszel
Cc: intel-wired-lan, Michal Schmidt, Jakub Kicinski, netdev,
Tony Nguyen, Aleksandr Loktionov, Andrew Lunn, David S. Miller,
Eric Dumazet, Paolo Abeni, Jedrzej Jagielski, Piotr Kwapulinski,
Marcin Szycik
In-Reply-To: <20260706224346.22546-1-przemyslaw.kitszel@intel.com>
On Tue, Jul 07, 2026 at 12:43:30AM +0200, Przemek Kitszel wrote:
> Move ice_vsi_realloc_stat_arrays() up, to allow calling it from
> ice_vsi_cfg_def() by the next commit.
>
> Fix kdoc for touched code. One line break removed, "int i" scope
> minimized to the loop, no changes otherwise.
>
> Reviewed-by: Marcin Szycik <marcin.szycik@linux.intel.com>
> Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
> ---
> v2: no changes
Reviewed-by: Simon Horman <horms@kernel.org>
^ permalink raw reply
* Re: [PATCH 01/13 RFC net-next] net: ipv4: introduce CONFIG_IPV4 to decouple the IPv4 stack
From: Fernando Fernandez Mancera @ 2026-07-13 14:00 UTC (permalink / raw)
To: Arnd Bergmann, Netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
David Ahern, Simon Horman, Ido Schimmel, Jason Gunthorpe,
Leon Romanovsky, Andrew Lunn, Anthony L Nguyen, Przemek Kitszel,
Elad Nachman, Saeed Mahameed, Tariq Toukan, Mark Bloch,
Petr Machata, Edward Cree, Maxime Coquelin, Alexandre Torgue,
Arend van Spriel, Miri Korenblit, Keith Busch, Jens Axboe,
Christoph Hellwig, Sagi Grimberg, Chaitanya Kulkarni,
Saurav Kashyap, Javed Hasan, GR-QLogic-Storage-Upstream,
James E . J . Bottomley, Martin K. Petersen, Nilesh Javali,
Manish Rangankar, Varun Prakash, Alexander Viro,
Christian Brauner, Jan Kara, David Howells, Marc Dionne,
Trond Myklebust, Anna Schumaker, Chuck Lever, Jeff Layton,
NeilBrown, Olga Kornievskaia, Dai Ngo, Tom Talpey, Marek Lindner,
Simon Wunderlich, Antonio Quartulli, Sven Eckelmann,
Nikolay Aleksandrov, Pablo Neira Ayuso, Florian Westphal,
Phil Sutter, Johannes Berg, Matthieu Baerts, Mat Martineau,
Geliang Tang, Julian Anastasov, Aaron Conole, Eelco Chaudron,
Ilya Maximets, Allison Henderson, Jamal Hadi Salim, Jiri Pirko,
Marcelo Ricardo Leitner, Xin Long, D. Wythe, Dust Li,
Sidraya Jayagond, Wenjia Zhang, Mahanta Jambigi, Tony Lu, Wen Gu,
Jon Maloy, Steffen Klassert, Herbert Xu, Vikas Gupta,
Rajashekar Hudumula, Justin Chen, Bhargava Marreddy,
Nicolai Buchwitz, Florian Fainelli, Heiner Kallweit,
Krzysztof Kozlowski, Russell King, Yao Zi, Yanteng Si,
Maxime Chevallier, Julian Braha, Joey Lu, Shangjuan Wei,
Chen-Yu Tsai, Inochi Amaoto, Lad, Prabhakar, Qingfang Deng,
Greg Kroah-Hartman, Eric Biggers, Ethan Nelson-Moore,
Ard Biesheuvel, Dmitry Safonov, Kuniyuki Iwashima, Alyssa Ross,
linux-rdma, linux-kernel, intel-wired-lan@lists.osuosl.org,
open list:NETRONOME ETHERNET DRIVERS, linux-net-drivers,
linux-stm32, linux-arm-kernel, linux-wireless, brcm80211,
brcm80211-dev-list.pdl, linux-nvme, linux-scsi, target-devel,
linux-fsdevel, linux-afs, linux-nfs, b.a.t.m.a.n,
open list:ETHERNET BRIDGE, netfilter-devel, coreteam, mptcp,
lvs-devel, dev, rds-devel, linux-sctp, linux-s390,
open list:TIPC NETWORK LAYER
In-Reply-To: <12ffac6a-649a-4e4a-8d12-0b48171e1d95@app.fastmail.com>
On 7/12/26 1:01 PM, Arnd Bergmann wrote:
> On Sun, Jul 12, 2026, at 03:38, Fernando Fernandez Mancera wrote:
>> Historically, the IPv4 protocol has been linked to the core INET
>> subsystem. Because shared infrastructure like the TCP/UDP engine,
>> routing or INET hashtables live inside net/ipv4/, it has been impossible
>> to compile a kernel with only IPv6 support.
>>
>> This patch introduces the CONFIG_IPV4 Kconfig symbol, which is set to
>> 'def_bool y' for now. This does not allow to completely disable the
>> IPv4 stack yet but it lays the necessary build-system work for that
>> goal.
>
> I expect this will cause additional (trivial) build regression in the
> next step when randconfig builds run into obscure corner cases, either
> with INET=y IPV4=n IPV6=y or with INET=y IPV4=n IPV6=n.
>
> I can probably give your patch (with IPV4 visible or disabled) an
> early go on the randconfig tree to find these more quickly.
> If I run into regressions, should I just add more 'depends on IPV4',
> or do you have other plans?
>
Yes, I have a job running randconfig and verifying nothing breaks. If
something breaks and it isn't core networking stack I would just make
the Kconfig symbol depend on IPv4.
Then later we will have more time to write a dedicate patch so it does
not depend on IPv4.
> Should we have some logic to ensure that at least one of IPV4 or
> IPV6 is enabled? I think this would work
>
> config IPV4
> bool "The IPv4 protocol" if IPV6
> default INET
>
> which only allows turning IPV4 off if IPV6 has enabled.
>
I do wonder, should we? I mean, I didn't try it off but I don't see why
we should not allow a pure L2 system..
Thanks,
Fernando.
^ permalink raw reply
* [PATCH net-next v2] mptcp: sockopt: implement IPV6_TCLASS
From: David 'equinox' Lamparter @ 2026-07-13 13:51 UTC (permalink / raw)
To: Matthieu Baerts, Mat Martineau, Geliang Tang
Cc: netdev, mptcp, David 'equinox' Lamparter
The IPV6_TCLASS setsockopt just needs to be forwarded to the individual
TCP sockets, like IP_TOS is already handled for IPv4. The code here is
pretty much identical, except there's no helper for IPv6 like IPv4's
__ip_sock_set_tos().
Coincidentally, ssh uses this sockopt and prints an error in the middle
of your ongoing SSH session when it doesn't work (very annoying when
doing SCP/SFTP on a multiplexed session.)
Signed-off-by: David 'equinox' Lamparter <equinox@diac24.net>
Cc: Matthieu Baerts <matttbe@kernel.org>
Cc: Mat Martineau <martineau@kernel.org>
Cc: Geliang Tang <geliang@kernel.org>
---
[v2: added guard for CONFIG_IPV6=n. I could also add a stub for
ipv6_setsockopt() in include/net/ipv6.h, that might be prettier?]
---
net/mptcp/sockopt.c | 38 ++++++++++++++++++++++++++++++++++++++
1 file changed, 38 insertions(+)
diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c
index fcf6feb2a9eb..1b83bba0b58e 100644
--- a/net/mptcp/sockopt.c
+++ b/net/mptcp/sockopt.c
@@ -394,6 +394,39 @@ static int mptcp_setsockopt_sol_socket(struct mptcp_sock *msk, int optname,
return -EOPNOTSUPP;
}
+static int mptcp_setsockopt_v6_set_tclass(struct mptcp_sock *msk, int optname,
+ sockptr_t optval, unsigned int optlen)
+{
+#if !IS_ENABLED(CONFIG_IPV6)
+ return -EOPNOTSUPP;
+#else
+ struct mptcp_subflow_context *subflow;
+ struct sock *sk = (struct sock *)msk;
+ int err, val;
+
+ err = ipv6_setsockopt(sk, SOL_IPV6, optname, optval, optlen);
+
+ if (err != 0)
+ return err;
+
+ lock_sock(sk);
+ sockopt_seq_inc(msk);
+ val = READ_ONCE(inet6_sk(sk)->tclass);
+ mptcp_for_each_subflow(msk, subflow) {
+ struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
+ bool slow;
+
+ slow = lock_sock_fast(ssk);
+ inet6_sk(ssk)->tclass = val;
+ sk_dst_reset(ssk);
+ unlock_sock_fast(ssk, slow);
+ }
+ release_sock(sk);
+
+ return 0;
+#endif
+}
+
static int mptcp_setsockopt_v6(struct mptcp_sock *msk, int optname,
sockptr_t optval, unsigned int optlen)
{
@@ -436,6 +469,8 @@ static int mptcp_setsockopt_v6(struct mptcp_sock *msk, int optname,
release_sock(sk);
break;
+ case IPV6_TCLASS:
+ return mptcp_setsockopt_v6_set_tclass(msk, optname, optval, optlen);
}
return ret;
@@ -1485,6 +1520,9 @@ static int mptcp_getsockopt_v6(struct mptcp_sock *msk, int optname,
struct sock *sk = (void *)msk;
switch (optname) {
+ case IPV6_TCLASS:
+ return mptcp_put_int_option(msk, optval, optlen,
+ READ_ONCE(inet6_sk(sk)->tclass));
case IPV6_V6ONLY:
return mptcp_put_int_option(msk, optval, optlen,
sk->sk_ipv6only);
--
2.53.0
^ permalink raw reply related
* Re: [PATCH net-next] mptcp: sockopt: implement IPV6_TCLASS
From: David 'equinox' Lamparter @ 2026-07-13 13:49 UTC (permalink / raw)
To: netdev, mptcp; +Cc: Matthieu Baerts, Mat Martineau, Geliang Tang
In-Reply-To: <202607132109.n8GCw6cD-lkp@intel.com>
On Mon, Jul 13, 2026 at 09:24:52PM +0800, kernel test robot wrote:
> sparc-linux-ld: net/mptcp/sockopt.o: in function `mptcp_setsockopt_v6':
> >> sockopt.c:(.text+0x908): undefined reference to `ipv6_setsockopt'
Oops. Forgot IPv6 can still be disabled. v2 in a few minutes.
^ permalink raw reply
* Re: [PATCH net v2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list
From: Simon Horman @ 2026-07-13 13:46 UTC (permalink / raw)
To: bestswngs
Cc: Simon Horman, jmaloy, netdev, tipc-discussion, davem, edumazet,
kuba, pabeni, hoang.h.le, xmei5, linux-kernel, tung.quang.nguyen
In-Reply-To: <20260706163024.1205930-2-bestswngs@gmail.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
Full review at: https://sashiko.dev
---
tipc: fix NULL deref in tipc_named_node_up() on empty publication list
This commit fixes a NULL pointer dereference in tipc_named_node_up() that
occurs when the cluster_scope publication list is empty. The fix introduces
an early return to avoid calling named_distribute() with an empty list.
> diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
> index ba4f4906e13b7..60ccaa862162c 100644
> --- a/net/tipc/name_distr.c
> +++ b/net/tipc/name_distr.c
> @@ -218,6 +218,10 @@ void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
> spin_unlock_bh(&tn->nametbl_lock);
>
> read_lock_bh(&nt->cluster_scope_lock);
> + if (list_empty(&nt->cluster_scope)) {
> + read_unlock_bh(&nt->cluster_scope_lock);
> + return;
> + }
[Severity: Critical]
Does this early return prevent the transmission of the last_bulk
synchronization message to the peer node?
In tipc_named_dequeue(), the peer node sets *open = true only when receiving
a message where msg_is_last_bulk(hdr) is true:
net/tipc/name_distr.c:tipc_named_dequeue() {
...
if (*open && (*rcv_nxt == seqno)) {
(*rcv_nxt)++;
__skb_unlink(skb, namedq);
...
return skb;
}
...
}
If *open is false, all subsequent non-bulk name publications will fail this
sequence check and remain in the namedq indefinitely.
Without sending the last_bulk message, could this cause a permanent stall
of name table updates and an unbounded memory leak of socket buffers on the
peer node?
> named_distribute(net, &head, dnode, &nt->cluster_scope, seqno);
[Severity: High]
This isn't a bug introduced by this patch, but looking at named_distribute()
called here, what happens if buffer allocation fails during the loop?
Inside named_distribute():
net/tipc/name_distr.c:named_distribute() {
...
if (!skb) {
skb = named_prepare_buf(net, PUBLICATION, msg_rem, dnode);
if (!skb) {
pr_warn("Bulk publication failure\n");
return;
}
...
}
If the function returns early due to allocation failure, the messages
already added to the queue are transmitted by tipc_node_xmit(), but none
of them will have the last_bulk flag set since that happens at the very end
of the function.
Could this also prevent the receiving node from transitioning its named_open
state to true, leading to the exact same permanent stall and memory leak of
subsequent normal name publications?
> tipc_node_xmit(net, &head, dnode, 0);
> read_unlock_bh(&nt->cluster_scope_lock);
--
pw-bot: changes-requested
^ permalink raw reply
* Re: [PATCH net v2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list
From: Simon Horman @ 2026-07-13 13:35 UTC (permalink / raw)
To: bestswngs
Cc: Simon Horman, jmaloy, netdev, tipc-discussion, davem, edumazet,
kuba, pabeni, hoang.h.le, xmei5, linux-kernel, tung.quang.nguyen
In-Reply-To: <20260706163024.1205930-2-bestswngs@gmail.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
Full review at: https://sashiko.dev
---
tipc: fix NULL deref in tipc_named_node_up() on empty publication list
This commit fixes a NULL pointer dereference in tipc_named_node_up() that
occurs when the cluster_scope publication list is empty. The fix introduces
an early return to avoid calling named_distribute() with an empty list.
> diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
> index ba4f4906e13b7..60ccaa862162c 100644
> --- a/net/tipc/name_distr.c
> +++ b/net/tipc/name_distr.c
> @@ -218,6 +218,10 @@ void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
> spin_unlock_bh(&tn->nametbl_lock);
>
> read_lock_bh(&nt->cluster_scope_lock);
> + if (list_empty(&nt->cluster_scope)) {
> + read_unlock_bh(&nt->cluster_scope_lock);
> + return;
> + }
[Severity: Critical]
Does this early return prevent the transmission of the last_bulk
synchronization message to the peer node?
In tipc_named_dequeue(), the peer node sets *open = true only when receiving
a message where msg_is_last_bulk(hdr) is true:
net/tipc/name_distr.c:tipc_named_dequeue() {
...
if (*open && (*rcv_nxt == seqno)) {
(*rcv_nxt)++;
__skb_unlink(skb, namedq);
...
return skb;
}
...
}
If *open is false, all subsequent non-bulk name publications will fail this
sequence check and remain in the namedq indefinitely.
Without sending the last_bulk message, could this cause a permanent stall
of name table updates and an unbounded memory leak of socket buffers on the
peer node?
> named_distribute(net, &head, dnode, &nt->cluster_scope, seqno);
[Severity: High]
This isn't a bug introduced by this patch, but looking at named_distribute()
called here, what happens if buffer allocation fails during the loop?
Inside named_distribute():
net/tipc/name_distr.c:named_distribute() {
...
if (!skb) {
skb = named_prepare_buf(net, PUBLICATION, msg_rem, dnode);
if (!skb) {
pr_warn("Bulk publication failure\n");
return;
}
...
}
If the function returns early due to allocation failure, the messages
already added to the queue are transmitted by tipc_node_xmit(), but none
of them will have the last_bulk flag set since that happens at the very end
of the function.
Could this also prevent the receiving node from transitioning its named_open
state to true, leading to the exact same permanent stall and memory leak of
subsequent normal name publications?
> tipc_node_xmit(net, &head, dnode, 0);
> read_unlock_bh(&nt->cluster_scope_lock);
^ permalink raw reply
* Re: [PATCH net-next v4 13/15] ixd: add reset checks and initialize the mailbox
From: Larysa Zaremba @ 2026-07-13 13:34 UTC (permalink / raw)
To: Tony Nguyen
Cc: davem, kuba, pabeni, edumazet, andrew+netdev, netdev,
przemyslaw.kitszel, aleksander.lobakin, sridhar.samudrala,
anjali.singhai, michal.swiatkowski, maciej.fijalkowski,
emil.s.tantilov, madhu.chittim, joshua.a.hay, jacob.e.keller,
jayaprakash.shanmugam, jiri, horms, corbet, richardcochran,
linux-doc, Aleksandr Loktionov, Bharath R
In-Reply-To: <20260710215313.1475803-14-anthony.l.nguyen@intel.com>
Below is an answer to concerns from Sashiko:
> --- Patch [13]: [PATCH net-next v4 13/15] ixd: add reset checks and initialize the mailbox ---
> commit 7fa1c35636d0bae10b336e706045a6dfd122058d
> Author: Larysa Zaremba <larysa.zaremba@intel.com>
> ixd: add reset checks and initialize the mailbox
> This commit adds hardware reset triggering and mailbox initialization
> for the ixd driver, including a delayed work task to verify the reset
> completion during probe.
> [ ... ]
> > diff --git a/drivers/net/ethernet/intel/ixd/ixd_main.c b/drivers/net/ethernet/intel/ixd/ixd_main.c
> > index 75ee53152e614..35d0ff5c8d983 100644
> > --- a/drivers/net/ethernet/intel/ixd/ixd_main.c
> > +++ b/drivers/net/ethernet/intel/ixd/ixd_main.c
> [ ... ]
> > @@ -16,7 +17,15 @@ static void ixd_remove(struct pci_dev *pdev)
> > {
> > struct ixd_adapter *adapter = pci_get_drvdata(pdev);
> >
> > - libie_pci_unmap_all_mmio_regions(&adapter->hw);
> > + /* Do not mix removal with (re)initialization */
> > + cancel_delayed_work_sync(&adapter->init_task.init_work);
> > + /* Leave the device clean on exit */
> > + if (adapter->xnm)
> > + libie_ctlq_xn_shutdown(adapter->xnm);
> > + ixd_trigger_reset(adapter);
> > + ixd_deinit_dflt_mbx(adapter);
> Could this cause memory corruption or IOMMU faults?
> In ixd_remove(), ixd_trigger_reset() issues a reset but does not wait
> for it to complete. Immediately after, ixd_deinit_dflt_mbx() is called,
> which unmaps and frees the DMA rings.
> If the hardware is still actively bus mastering before the reset fully
> takes effect, could it perform DMA into memory that has already been
> unmapped? Does this path need to wait for the reset to complete using
> ixd_check_reset_complete() before freeing the mailbox resources?
>
No, ixd_check_reset_complete() is not needed here, triggering is enough
>
> > +
> > + libie_pci_unmap_all_mmio_regions(&adapter->cp_ctx.mmio_info);
> > }
>
^ permalink raw reply
* RE: [PATCH net] tipc: cap number of nodes per net namespace
From: Tung Quang Nguyen @ 2026-07-13 13:34 UTC (permalink / raw)
To: Ibrahim Hashimov
Cc: Simon Horman, netdev@vger.kernel.org,
tipc-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org, stable@vger.kernel.org, Jon Maloy,
David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni
In-Reply-To: <20260710150324.32134-1-security@auditcode.ai>
>Subject: [PATCH net] tipc: cap number of nodes per net namespace
>
>tipc_node_create() allocates a new struct tipc_node (plus a broadcast receive
>link, a unicast link slot and a keepalive timer) for every previously unseen
>(addr, node_id) pair carried in an inbound TIPC LINK_CONFIG discovery frame:
>
> n = tipc_node_find(net, addr) ?:
> tipc_node_find_by_id(net, peer_id);
> if (n) {
> ...
> }
> n = kzalloc_obj(*n, GFP_ATOMIC);
> ...
> n->delete_at = jiffies + msecs_to_jiffies(NODE_CLEANUP_AFTER);
>
>Both addr (msg_prevnode) and peer_id (msg_node_id) come straight out of
>the discovery frame and are fully attacker controlled, and the dedup key above
>is keyed on exactly those two values. There is no cap on how many distinct
>nodes a net namespace may hold and no rate limit on the create path, so an
>unauthenticated peer on an enabled TIPC bearer (L2 or UDP) can flood
>LINK_CONFIG frames with a fresh (addr,
>node_id) in each one and force the kernel to keep minting new, distinct struct
>tipc_node objects without bound. A link-less spoofed node is only reclaimed
>after NODE_CLEANUP_AFTER (300 s), so at typical discovery rates the live node
>table, and the memory pinned by it, grows roughly linearly with attacker-
>supplied identities for the duration of the flood. This is (uncontrolled resource
>consumption), reachable by any unauthenticated network-adjacent host once
>tipc.ko is loaded and a bearer is enabled.
>
>Bound this the same way net/core/neighbour.c bounds the ARP/ND neighbour
>table against unauthenticated on-link input: reject new entries once a hard
>ceiling is hit instead of letting the table grow without limit. struct tipc_net
>already carries a num_nodes counter that is declared but never read or
>written anywhere in net/tipc/; wire it up on the create and delete paths and
>add a single bounds check on it in tipc_node_create(), guarded by the same tn-
>>node_list_lock spinlock that already serializes every call site of
>tipc_node_create(), tipc_node_delete_from_list(), tipc_node_delete() and
>tipc_node_stop(). No new locking, no new data structures, and no change to
>the node table's data layout or lookup semantics; legitimate peers are still
>admitted exactly as before, up to the cap.
>
>TIPC_MAX_NODES is set to 8192, well above any realistic TIPC cluster size,
>bounding worst-case pinned memory to a fixed multiple of one node's
>footprint instead of unbounded growth. It is intentionally not tuned tight;
>exposing it as a sysctl (mirroring
>net.ipv4.neigh.default.gc_thresh3) would be a reasonable follow-up but is left
>out to keep this fix minimal.
I do not see any issue with current code that requires this patch.
>
>Verified on a v6.19 KASAN build: flooding spoofed (addr, node_id) peers past
>the cap makes the patched kernel log "Too many TIPC nodes (8192)" and drop
>further peers, where the same flood grew the live node table without bound
>before this patch.
Can you provide your C reproducer and the stack trace you observed (on latest net-tree) ?
>
>Cc: stable@vger.kernel.org
>Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
>Assisted-by: AuditCode-AI:2026.07
>---
> net/tipc/node.c | 17 +++++++++++++++++
> 1 file changed, 17 insertions(+)
>
>diff --git a/net/tipc/node.c b/net/tipc/node.c index
>8e4ef2630ae4..bb41f3231ce1 100644
>--- a/net/tipc/node.c
>+++ b/net/tipc/node.c
>@@ -49,6 +49,16 @@
> #define INVALID_NODE_SIG 0x10000
> #define NODE_CLEANUP_AFTER 300000
>
>+/* Hard cap on the number of live struct tipc_node entries a single net
>+ * namespace will hold. Every entry (preliminary or not) also pins a
>+ * broadcast-receive link, a unicast link slot and a keepalive timer,
>+so
>+ * this bounds worst-case memory from unauthenticated LINK_CONFIG
>+discovery
>+ * traffic the same way neigh_alloc()'s gc_thresh3 bounds the ARP/ND
>+table
>+ * (see net/core/neighbour.c). 8192 is far above any realistic TIPC
>+cluster
>+ * size and is not meant to be tight -- it only stops unbounded growth.
>+ */
>+#define TIPC_MAX_NODES 8192
>+
> /* Flags used to take different actions according to flag type
> * TIPC_NOTIFY_NODE_DOWN: notify node is down
> * TIPC_NOTIFY_NODE_UP: notify node is up @@ -535,6 +545,11 @@ struct
>tipc_node *tipc_node_create(struct net *net, u32 addr, u8 *peer_id,
>
> goto exit;
> }
>+ if (tn->num_nodes >= TIPC_MAX_NODES) {
>+ pr_warn_ratelimited("Too many TIPC nodes (%u), dropping
>new peer %x\n",
>+ tn->num_nodes, addr);
>+ goto exit;
>+ }
> n = kzalloc_obj(*n, GFP_ATOMIC);
> if (!n) {
> pr_warn("Node creation failed, no memory\n"); @@ -598,6
>+613,7 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u8
>*peer_id,
> break;
> }
> list_add_tail_rcu(&n->list, &temp_node->list);
>+ tn->num_nodes++;
> /* Calculate cluster capabilities */
> tn->capabilities = TIPC_NODE_CAPABILITIES;
> list_for_each_entry_rcu(temp_node, &tn->node_list, list) { @@ -630,6
>+646,7 @@ static void tipc_node_delete_from_list(struct tipc_node *node)
>#endif
> list_del_rcu(&node->list);
> hlist_del_rcu(&node->hash);
>+ tipc_net(node->net)->num_nodes--;
> tipc_node_put(node);
> }
>
>--
>2.50.1 (Apple Git-155)
>
^ permalink raw reply
* Re: [PATCH net-next v4 15/15] ixd: add devlink support
From: Larysa Zaremba @ 2026-07-13 13:29 UTC (permalink / raw)
To: Tony Nguyen
Cc: davem, kuba, pabeni, edumazet, andrew+netdev, netdev,
przemyslaw.kitszel, aleksander.lobakin, sridhar.samudrala,
anjali.singhai, michal.swiatkowski, maciej.fijalkowski,
emil.s.tantilov, madhu.chittim, joshua.a.hay, jacob.e.keller,
jayaprakash.shanmugam, jiri, horms, corbet, richardcochran,
linux-doc, Bharath R
In-Reply-To: <20260710215313.1475803-16-anthony.l.nguyen@intel.com>
Below is the answer to Sashiko feedback for this patch.
Sashiko says:
> commit d1a5268fa124e852cecef1e844a5c981bd3df46c
> Author: Amritha Nambiar <amritha.nambiar@intel.com>
> ixd: add devlink support
> This patch adds initial devlink support to the ixd driver, allocating a
> devlink instance per PCIe function and exposing serial number, device
> type, and virtchnl version through the info_get callback. Registration
> happens from the asynchronous init_task work item after virtchnl device
> init succeeds.
> > diff --git a/drivers/net/ethernet/intel/ixd/ixd.h b/drivers/net/ethernet/intel/ixd/ixd.h
> > index 8e3cd5bc5a84..343c5053045f 100644
> > --- a/drivers/net/ethernet/intel/ixd/ixd.h
> > +++ b/drivers/net/ethernet/intel/ixd/ixd.h
> > @@ -23,6 +23,7 @@ struct ixd_adapter {
> > struct delayed_work init_work;
> > u8 reset_retries;
> > u8 vc_retries;
> > + bool success;
> > } init_task;
> Is encoding devlink registration state via this new success flag the
> right approach?
> The flag only exists to gate ixd_devlink_unregister():
> static inline void ixd_devlink_unregister(struct ixd_adapter *adapter)
> {
> if (!adapter->init_task.success)
> return;
> devlink_unregister(priv_to_devlink(adapter));
> }
> Devlink core already tracks registration state (devl_is_registered(),
> ASSERT_DEVLINK_NOT_REGISTERED). Any future code path that adds another
> devlink_register()/devlink_unregister() call site (for example a reset
> recovery or renegotiation flow) would have to remember to keep this
> flag in sync, and 'init succeeded' and 'devlink registered' may
> otherwise diverge over time.
> Would relying on the devlink core's own registration tracking be
> preferable here?
>
devl_is_registered() is not accessible to drivers.
The idea here is that init_task can stop working correctly at any stage.
Once remove() cancels it, we should establish, what parts need to be undone.
In the future, enum could be of use for the consecutive stage, but a binary flag in enough for now.
>
> > diff --git a/drivers/net/ethernet/intel/ixd/ixd_lib.c b/drivers/net/ethernet/intel/ixd/ixd_lib.c
> > index ce870aba143d..6f2b39cd985c 100644
> > --- a/drivers/net/ethernet/intel/ixd/ixd_lib.c
> > +++ b/drivers/net/ethernet/intel/ixd/ixd_lib.c
> > @@ -154,6 +155,8 @@ void ixd_init_task(struct work_struct *work)
> >
> > if (!ixd_vc_dev_init(adapter)) {
> > adapter->init_task.vc_retries = 0;
> > + adapter->init_task.success = true;
> > + ixd_devlink_register(adapter);
> > return;
> > }
> Should devlink registration really be deferred to this asynchronous work
> callback and gated on virtchnl init success?
> If the device fails initialization permanently (reset never completes
> within 10 retries, or the virtchnl handshake fails after 5 retries in
> ixd_init_task()), the PCI device remains bound to the driver but no
> devlink instance is ever exposed. Users lose devlink dev show and
> devlink dev info visibility precisely in the failure modes where such
> diagnostics would be most useful.
> Sibling Intel drivers such as i40e and ice register devlink
> synchronously from probe() so the device is always visible.
> ixd_fill_device_name() already handles the uninitialized case by
> falling back to "UNKNOWN":
> if (adapter->caps.device_type == cpu_to_le32(VIRTCHNL2_MEV_DEVICE))
> snprintf(buf, buf_size, "%s", "MEV");
> else
> snprintf(buf, buf_size, "%s", "UNKNOWN");
> Could ixd_devlink_register() be moved into ixd_probe() so failed
> devices remain visible to devlink?
>
We have nothing to expose, if have not yet initialized basic HW communication
ixd and idpf utilize async initialization, because e.g. after power cycle,
control plane can be unresponsive for some time
^ permalink raw reply
* Re: [PATCH net-next] mptcp: sockopt: implement IPV6_TCLASS
From: kernel test robot @ 2026-07-13 13:24 UTC (permalink / raw)
To: David 'equinox' Lamparter, Matthieu Baerts, Mat Martineau,
Geliang Tang
Cc: oe-kbuild-all, netdev, mptcp, David 'equinox' Lamparter
In-Reply-To: <20260713080634.296011-1-equinox@diac24.net>
Hi David,
kernel test robot noticed the following build errors:
[auto build test ERROR on net-next/main]
url: https://github.com/intel-lab-lkp/linux/commits/David-equinox-Lamparter/mptcp-sockopt-implement-IPV6_TCLASS/20260713-162825
base: net-next/main
patch link: https://lore.kernel.org/r/20260713080634.296011-1-equinox%40diac24.net
patch subject: [PATCH net-next] mptcp: sockopt: implement IPV6_TCLASS
config: sparc-randconfig-001 (https://download.01.org/0day-ci/archive/20260713/202607132109.n8GCw6cD-lkp@intel.com/config)
compiler: sparc-linux-gcc (GCC) 16.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260713/202607132109.n8GCw6cD-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202607132109.n8GCw6cD-lkp@intel.com/
All errors (new ones prefixed by >>):
sparc-linux-ld: net/mptcp/sockopt.o: in function `mptcp_setsockopt_v6':
>> sockopt.c:(.text+0x908): undefined reference to `ipv6_setsockopt'
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* [PATCH net-next v13 10/10] net: stmmac: qcom-ethqos: add support for sa8255p
From: Bartosz Golaszewski @ 2026-07-13 13:20 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Maxime Coquelin, Alexandre Torgue,
Vinod Koul, Giuseppe Cavallaro, Chen-Yu Tsai, Jernej Skrabec,
Neil Armstrong, Kevin Hilman, Jerome Brunet, Shawn Guo,
Fabio Estevam, Jan Petrous, s32, Mohd Ayaan Anwar, Romain Gantois,
Geert Uytterhoeven, Magnus Damm, Maxime Ripard,
Christophe Roullier, Bartosz Golaszewski, Radu Rendec
Cc: linux-arm-msm, devicetree, linux-kernel, netdev, linux-stm32,
linux-arm-kernel, Drew Fustini, linux-sunxi, linux-amlogic,
linux-mips, imx, linux-renesas-soc, linux-rockchip, sophgo,
linux-riscv, brgl, Bartosz Golaszewski, Bartosz Golaszewski
In-Reply-To: <20260713-qcom-sa8255p-emac-v13-0-119f8699ef8e@oss.qualcomm.com>
Extend the driver to support a new model - sa8255p. Unlike the previously
supported variants, this one's power management is done in the firmware
over SCMI. This is modeled in linux using power domains so add a new
emac data variant and a separate setup callback.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
.../ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 90 ++++++++++++++++++++++
1 file changed, 90 insertions(+)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
index 3af1608fc21cc7cf6b0ad31952b9f59d6f00a2b1..d34f20f868138c4e81ce85364cc97d47c445238f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
@@ -98,6 +98,11 @@ struct ethqos_emac_driver_data {
const char *link_clk_name;
struct dwmac4_addrs dwmac4_addrs;
bool needs_sgmii_loopback;
+ /* Fixed PTP reference clock rate, used on SCMI platforms where
+ * firmware does not implement the clock protocol allowing linux to
+ * query it.
+ */
+ unsigned long ptp_clk_rate;
int (*setup)(struct qcom_ethqos *ethqos,
struct plat_stmmacenet_data *plat_dat);
};
@@ -108,6 +113,7 @@ struct qcom_ethqos {
struct clk *link_clk;
struct phy *serdes_phy;
phy_interface_t phy_mode;
+ struct dev_pm_domain_list *pds;
const struct ethqos_emac_driver_data *data;
};
@@ -207,6 +213,8 @@ static void ethqos_set_func_clk_en(struct qcom_ethqos *ethqos)
static int ethqos_hlos_setup(struct qcom_ethqos *ethqos,
struct plat_stmmacenet_data *plat_dat);
+static int ethqos_scmi_setup(struct qcom_ethqos *ethqos,
+ struct plat_stmmacenet_data *plat_dat);
static const struct ethqos_emac_por emac_v2_3_0_por[] = {
{ .offset = RGMII_IO_MACRO_CONFIG, .value = 0x00C01343 },
@@ -311,6 +319,30 @@ static const struct ethqos_emac_driver_data emac_v4_0_0_data = {
.setup = ethqos_hlos_setup,
};
+static const struct ethqos_emac_driver_data emac_v4_0_0_scmi_data = {
+ .has_emac_ge_3 = true,
+ .needs_sgmii_loopback = true,
+ .dma_addr_width = 36,
+ .ptp_clk_rate = 230400000,
+ .dwmac4_addrs = {
+ .dma_chan = 0x00008100,
+ .dma_chan_offset = 0x1000,
+ .mtl_chan = 0x00008000,
+ .mtl_chan_offset = 0x1000,
+ .mtl_ets_ctrl = 0x00008010,
+ .mtl_ets_ctrl_offset = 0x1000,
+ .mtl_txq_weight = 0x00008018,
+ .mtl_txq_weight_offset = 0x1000,
+ .mtl_send_slp_cred = 0x0000801c,
+ .mtl_send_slp_cred_offset = 0x1000,
+ .mtl_high_cred = 0x00008020,
+ .mtl_high_cred_offset = 0x1000,
+ .mtl_low_cred = 0x00008024,
+ .mtl_low_cred_offset = 0x1000,
+ },
+ .setup = ethqos_scmi_setup,
+};
+
static int ethqos_dll_configure(struct qcom_ethqos *ethqos)
{
struct device *dev = ðqos->pdev->dev;
@@ -756,6 +788,63 @@ static int ethqos_hlos_setup(struct qcom_ethqos *ethqos,
return 0;
}
+static const char *const ethqos_scmi_pd_names[] = { "core", "mdio" };
+
+static int ethqos_scmi_setup(struct qcom_ethqos *ethqos,
+ struct plat_stmmacenet_data *plat_dat)
+{
+ const struct dev_pm_domain_attach_data pd_data = {
+ .pd_names = ethqos_scmi_pd_names,
+ .num_pd_names = ARRAY_SIZE(ethqos_scmi_pd_names),
+ .pd_flags = PD_FLAG_DEV_LINK_ON,
+ };
+
+ struct platform_device *pdev = ethqos->pdev;
+ struct device *dev = &pdev->dev;
+ int ret;
+
+ ret = devm_pm_domain_attach_list(dev, &pd_data, ðqos->pds);
+ if (ret < 0)
+ return dev_err_probe(dev, ret,
+ "Failed to attach power domains\n");
+
+ /*
+ * The SerDes lane, its clocks and the MAC AXI/AHB clocks are owned by
+ * firmware and brought up through the SCMI power domains above. The
+ * MAC wrapper itself, however is in the kernel's register space: the
+ * mux that feeds the SerDes recovered RX clock into the MAC's clk_rx_i
+ * is not configured by firmware. Without it, clk_rx_i never toggles
+ * and the DMA SW-reset polled in dwmac4_dma_reset() never completes.
+ *
+ * Map the wrapper and program the same loopback/functional clock bits
+ * the non-firmware platforms rely on (see ethqos_clks_config) so the
+ * RX clock is present by the time the DMA engine is reset.
+ */
+ ethqos->rgmii_base = devm_platform_ioremap_resource_byname(pdev, "rgmii");
+ if (IS_ERR(ethqos->rgmii_base))
+ return dev_err_probe(dev, PTR_ERR(ethqos->rgmii_base),
+ "Failed to map rgmii resource\n");
+
+ /*
+ * Run on every runtime resume, which stmmac performs after the power
+ * domains are on but before serdes_powerup() and the DMA reset, so the
+ * wrapper is always configured ahead of the reset.
+ */
+ plat_dat->clks_config = ethqos_clks_config;
+ plat_dat->clk_ptp_rate = ethqos->data->ptp_clk_rate;
+
+ switch (ethqos->phy_mode) {
+ case PHY_INTERFACE_MODE_2500BASEX:
+ case PHY_INTERFACE_MODE_SGMII:
+ plat_dat->fix_mac_speed = ethqos_fix_mac_speed_sgmii;
+ break;
+ default:
+ break;
+ }
+
+ return 0;
+}
+
static int qcom_ethqos_probe(struct platform_device *pdev)
{
struct device_node *np = pdev->dev.of_node;
@@ -843,6 +932,7 @@ static int qcom_ethqos_probe(struct platform_device *pdev)
static const struct of_device_id qcom_ethqos_match[] = {
{ .compatible = "qcom,qcs404-ethqos", .data = &emac_v2_3_0_data},
+ { .compatible = "qcom,sa8255p-ethqos", .data = &emac_v4_0_0_scmi_data},
{ .compatible = "qcom,sa8775p-ethqos", .data = &emac_v4_0_0_data},
{ .compatible = "qcom,sc8280xp-ethqos", .data = &emac_v3_0_0_data},
{ .compatible = "qcom,sm8150-ethqos", .data = &emac_v2_1_0_data},
--
2.47.3
^ permalink raw reply related
* [PATCH net-next v13 09/10] net: stmmac: qcom-ethqos: factor out linux-level setup into a separate function
From: Bartosz Golaszewski @ 2026-07-13 13:20 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Maxime Coquelin, Alexandre Torgue,
Vinod Koul, Giuseppe Cavallaro, Chen-Yu Tsai, Jernej Skrabec,
Neil Armstrong, Kevin Hilman, Jerome Brunet, Shawn Guo,
Fabio Estevam, Jan Petrous, s32, Mohd Ayaan Anwar, Romain Gantois,
Geert Uytterhoeven, Magnus Damm, Maxime Ripard,
Christophe Roullier, Bartosz Golaszewski, Radu Rendec
Cc: linux-arm-msm, devicetree, linux-kernel, netdev, linux-stm32,
linux-arm-kernel, Drew Fustini, linux-sunxi, linux-amlogic,
linux-mips, imx, linux-renesas-soc, linux-rockchip, sophgo,
linux-riscv, brgl, Bartosz Golaszewski, Bartosz Golaszewski
In-Reply-To: <20260713-qcom-sa8255p-emac-v13-0-119f8699ef8e@oss.qualcomm.com>
Ahead of adding support for firmware-controlled EMAC variants, extend
the ethqos_emac_driver_data structure with a setup() callback, implement
it for the existing models and move all operations not required in SCMI
mode into it.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
.../ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 99 +++++++++++++++-------
1 file changed, 68 insertions(+), 31 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
index 43384960278b87a95f14f23c45442d2bbf75d882..3af1608fc21cc7cf6b0ad31952b9f59d6f00a2b1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
@@ -5,6 +5,7 @@
#include <linux/of.h>
#include <linux/of_net.h>
#include <linux/platform_device.h>
+#include <linux/pm_domain.h>
#include <linux/phy.h>
#include <linux/phy/phy.h>
@@ -81,6 +82,8 @@
#define SGMII_10M_RX_CLK_DVDR 0x31
+struct qcom_ethqos;
+
struct ethqos_emac_por {
unsigned int offset;
unsigned int value;
@@ -95,6 +98,8 @@ struct ethqos_emac_driver_data {
const char *link_clk_name;
struct dwmac4_addrs dwmac4_addrs;
bool needs_sgmii_loopback;
+ int (*setup)(struct qcom_ethqos *ethqos,
+ struct plat_stmmacenet_data *plat_dat);
};
struct qcom_ethqos {
@@ -200,6 +205,9 @@ static void ethqos_set_func_clk_en(struct qcom_ethqos *ethqos)
rgmii_setmask(ethqos, RGMII_CONFIG_FUNC_CLK_EN, RGMII_IO_MACRO_CONFIG);
}
+static int ethqos_hlos_setup(struct qcom_ethqos *ethqos,
+ struct plat_stmmacenet_data *plat_dat);
+
static const struct ethqos_emac_por emac_v2_3_0_por[] = {
{ .offset = RGMII_IO_MACRO_CONFIG, .value = 0x00C01343 },
{ .offset = SDCC_HC_REG_DLL_CONFIG, .value = 0x2004642C },
@@ -214,6 +222,7 @@ static const struct ethqos_emac_driver_data emac_v2_3_0_data = {
.num_rgmii_por = ARRAY_SIZE(emac_v2_3_0_por),
.rgmii_config_loopback_en = true,
.has_emac_ge_3 = false,
+ .setup = ethqos_hlos_setup,
};
static const struct ethqos_emac_por emac_v2_1_0_por[] = {
@@ -230,6 +239,7 @@ static const struct ethqos_emac_driver_data emac_v2_1_0_data = {
.num_rgmii_por = ARRAY_SIZE(emac_v2_1_0_por),
.rgmii_config_loopback_en = false,
.has_emac_ge_3 = false,
+ .setup = ethqos_hlos_setup,
};
static const struct ethqos_emac_por emac_v3_0_0_por[] = {
@@ -262,6 +272,7 @@ static const struct ethqos_emac_driver_data emac_v3_0_0_data = {
.mtl_low_cred = 0x00008024,
.mtl_low_cred_offset = 0x1000,
},
+ .setup = ethqos_hlos_setup,
};
static const struct ethqos_emac_por emac_v4_0_0_por[] = {
@@ -297,6 +308,7 @@ static const struct ethqos_emac_driver_data emac_v4_0_0_data = {
.mtl_low_cred = 0x00008024,
.mtl_low_cred_offset = 0x1000,
},
+ .setup = ethqos_hlos_setup,
};
static int ethqos_dll_configure(struct qcom_ethqos *ethqos)
@@ -692,6 +704,58 @@ static void ethqos_ptp_clk_freq_config(struct stmmac_priv *priv)
netdev_dbg(priv->dev, "PTP rate %lu\n", plat_dat->clk_ptp_rate);
}
+static int ethqos_hlos_setup(struct qcom_ethqos *ethqos,
+ struct plat_stmmacenet_data *plat_dat)
+{
+ struct platform_device *pdev = ethqos->pdev;
+ struct device *dev = &pdev->dev;
+ int ret;
+
+ ethqos->rgmii_base = devm_platform_ioremap_resource_byname(pdev, "rgmii");
+ if (IS_ERR(ethqos->rgmii_base))
+ return dev_err_probe(dev, PTR_ERR(ethqos->rgmii_base),
+ "Failed to map rgmii resource\n");
+
+ ethqos->link_clk = devm_clk_get(dev, ethqos->data->link_clk_name ?: "rgmii");
+ if (IS_ERR(ethqos->link_clk))
+ return dev_err_probe(dev, PTR_ERR(ethqos->link_clk),
+ "Failed to get link_clk\n");
+
+ plat_dat->clks_config = ethqos_clks_config;
+
+ ret = ethqos_clks_config(ethqos, true);
+ if (ret)
+ return ret;
+
+ ret = devm_add_action_or_reset(dev, ethqos_clks_disable, ethqos);
+ if (ret)
+ return ret;
+
+ ethqos_set_clk_tx_rate(ethqos, NULL, plat_dat->phy_interface, SPEED_1000);
+ qcom_ethqos_set_sgmii_loopback(ethqos, true);
+ ethqos_set_func_clk_en(ethqos);
+
+ switch (ethqos->phy_mode) {
+ case PHY_INTERFACE_MODE_RGMII:
+ case PHY_INTERFACE_MODE_RGMII_ID:
+ case PHY_INTERFACE_MODE_RGMII_RXID:
+ case PHY_INTERFACE_MODE_RGMII_TXID:
+ plat_dat->fix_mac_speed = ethqos_fix_mac_speed_rgmii;
+ break;
+ case PHY_INTERFACE_MODE_2500BASEX:
+ case PHY_INTERFACE_MODE_SGMII:
+ plat_dat->fix_mac_speed = ethqos_fix_mac_speed_sgmii;
+ break;
+ default:
+ break;
+ }
+
+ plat_dat->set_clk_tx_rate = ethqos_set_clk_tx_rate;
+ plat_dat->dump_debug_regs = rgmii_dump;
+
+ return 0;
+}
+
static int qcom_ethqos_probe(struct platform_device *pdev)
{
struct device_node *np = pdev->dev.of_node;
@@ -713,23 +777,20 @@ static int qcom_ethqos_probe(struct platform_device *pdev)
"dt configuration failed\n");
}
- plat_dat->clks_config = ethqos_clks_config;
-
ethqos = devm_kzalloc(dev, sizeof(*ethqos), GFP_KERNEL);
if (!ethqos)
return -ENOMEM;
ethqos->phy_mode = plat_dat->phy_interface;
+
switch (ethqos->phy_mode) {
case PHY_INTERFACE_MODE_RGMII:
case PHY_INTERFACE_MODE_RGMII_ID:
case PHY_INTERFACE_MODE_RGMII_RXID:
case PHY_INTERFACE_MODE_RGMII_TXID:
- plat_dat->fix_mac_speed = ethqos_fix_mac_speed_rgmii;
break;
case PHY_INTERFACE_MODE_2500BASEX:
case PHY_INTERFACE_MODE_SGMII:
- plat_dat->fix_mac_speed = ethqos_fix_mac_speed_sgmii;
plat_dat->mac_finish = ethqos_mac_finish_serdes;
break;
default:
@@ -739,24 +800,13 @@ static int qcom_ethqos_probe(struct platform_device *pdev)
}
ethqos->pdev = pdev;
- ethqos->rgmii_base = devm_platform_ioremap_resource_byname(pdev, "rgmii");
- if (IS_ERR(ethqos->rgmii_base))
- return dev_err_probe(dev, PTR_ERR(ethqos->rgmii_base),
- "Failed to map rgmii resource\n");
-
data = of_device_get_match_data(dev);
ethqos->data = data;
- ethqos->link_clk = devm_clk_get(dev, data->link_clk_name ?: "rgmii");
- if (IS_ERR(ethqos->link_clk))
- return dev_err_probe(dev, PTR_ERR(ethqos->link_clk),
- "Failed to get link_clk\n");
-
- ret = ethqos_clks_config(ethqos, true);
- if (ret)
- return ret;
+ if (WARN_ON(!data->setup))
+ return -EINVAL;
- ret = devm_add_action_or_reset(dev, ethqos_clks_disable, ethqos);
+ ret = data->setup(ethqos, plat_dat);
if (ret)
return ret;
@@ -765,21 +815,8 @@ static int qcom_ethqos_probe(struct platform_device *pdev)
return dev_err_probe(dev, PTR_ERR(ethqos->serdes_phy),
"Failed to get serdes phy\n");
- ethqos_set_clk_tx_rate(ethqos, NULL, plat_dat->phy_interface,
- SPEED_1000);
-
- qcom_ethqos_set_sgmii_loopback(ethqos, true);
- ethqos_set_func_clk_en(ethqos);
-
- /* The clocks are controlled by firmware, so we don't know for certain
- * what clock rate is being used. Hardware documentation mentions that
- * the AHB slave clock will be in the range of 50 to 100MHz, which
- * equates to a MDC between 1.19 and 2.38MHz.
- */
plat_dat->clk_csr = STMMAC_CSR_60_100M;
plat_dat->bsp_priv = ethqos;
- plat_dat->set_clk_tx_rate = ethqos_set_clk_tx_rate;
- plat_dat->dump_debug_regs = rgmii_dump;
plat_dat->ptp_clk_freq_config = ethqos_ptp_clk_freq_config;
plat_dat->core_type = DWMAC_CORE_GMAC4;
if (data->has_emac_ge_3)
--
2.47.3
^ permalink raw reply related
* [PATCH net-next v13 08/10] net: stmmac: qcom-ethqos: reuse the address of ethqos_emac_driver_data
From: Bartosz Golaszewski @ 2026-07-13 13:20 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Maxime Coquelin, Alexandre Torgue,
Vinod Koul, Giuseppe Cavallaro, Chen-Yu Tsai, Jernej Skrabec,
Neil Armstrong, Kevin Hilman, Jerome Brunet, Shawn Guo,
Fabio Estevam, Jan Petrous, s32, Mohd Ayaan Anwar, Romain Gantois,
Geert Uytterhoeven, Magnus Damm, Maxime Ripard,
Christophe Roullier, Bartosz Golaszewski, Radu Rendec
Cc: linux-arm-msm, devicetree, linux-kernel, netdev, linux-stm32,
linux-arm-kernel, Drew Fustini, linux-sunxi, linux-amlogic,
linux-mips, imx, linux-renesas-soc, linux-rockchip, sophgo,
linux-riscv, brgl, Bartosz Golaszewski, Bartosz Golaszewski
In-Reply-To: <20260713-qcom-sa8255p-emac-v13-0-119f8699ef8e@oss.qualcomm.com>
Instead of needlessly copying the fields of ethqos_emac_driver_data into
struct qcom_ethqos, just use the address of the former as a reference.
It's .rodata after all. This is done in order to avoid having either two
calls to of_device_get_match_data() or having to extend the latter with
another field when adding support for SCMI.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
.../ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 37 ++++++++--------------
1 file changed, 14 insertions(+), 23 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
index e083d7d55782ec8310e9375e466be00213667457..43384960278b87a95f14f23c45442d2bbf75d882 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
@@ -103,12 +103,7 @@ struct qcom_ethqos {
struct clk *link_clk;
struct phy *serdes_phy;
phy_interface_t phy_mode;
-
- const struct ethqos_emac_por *rgmii_por;
- unsigned int num_rgmii_por;
- bool rgmii_config_loopback_en;
- bool has_emac_ge_3;
- bool needs_sgmii_loopback;
+ const struct ethqos_emac_driver_data *data;
};
static u32 rgmii_readl(struct qcom_ethqos *ethqos, unsigned int offset)
@@ -189,7 +184,7 @@ static int ethqos_set_clk_tx_rate(void *bsp_priv, struct clk *clk_tx_i,
static void
qcom_ethqos_set_sgmii_loopback(struct qcom_ethqos *ethqos, bool enable)
{
- if (!ethqos->needs_sgmii_loopback ||
+ if (!ethqos->data->needs_sgmii_loopback ||
(ethqos->phy_mode != PHY_INTERFACE_MODE_2500BASEX &&
ethqos->phy_mode != PHY_INTERFACE_MODE_SGMII))
return;
@@ -323,7 +318,7 @@ static int ethqos_dll_configure(struct qcom_ethqos *ethqos)
/* Set DLL_EN */
rgmii_setmask(ethqos, SDCC_DLL_CONFIG_DLL_EN, SDCC_HC_REG_DLL_CONFIG);
- if (!ethqos->has_emac_ge_3) {
+ if (!ethqos->data->has_emac_ge_3) {
rgmii_clrmask(ethqos, SDCC_DLL_MCLK_GATING_EN,
SDCC_HC_REG_DLL_CONFIG);
@@ -353,7 +348,7 @@ static int ethqos_dll_configure(struct qcom_ethqos *ethqos)
rgmii_setmask(ethqos, SDCC_DLL_CONFIG2_DDR_CAL_EN,
SDCC_HC_REG_DLL_CONFIG2);
- if (!ethqos->has_emac_ge_3) {
+ if (!ethqos->data->has_emac_ge_3) {
rgmii_clrmask(ethqos, SDCC_DLL_CONFIG2_DLL_CLOCK_DIS,
SDCC_HC_REG_DLL_CONFIG2);
@@ -433,7 +428,7 @@ static int ethqos_rgmii_macro_init(struct qcom_ethqos *ethqos, int speed)
rgmii_clrmask(ethqos, RGMII_CONFIG2_RSVD_CONFIG15,
RGMII_IO_MACRO_CONFIG2);
- if (speed == SPEED_1000 || ethqos->has_emac_ge_3)
+ if (speed == SPEED_1000 || ethqos->data->has_emac_ge_3)
rgmii_setmask(ethqos, RGMII_CONFIG2_RX_PROG_SWAP,
RGMII_IO_MACRO_CONFIG2);
else
@@ -457,7 +452,7 @@ static int ethqos_rgmii_macro_init(struct qcom_ethqos *ethqos, int speed)
* in practice this becomes PRG_RCLK_DLY = 52 * 4 /
* (2 * RX delay ns)
*/
- if (ethqos->has_emac_ge_3) {
+ if (ethqos->data->has_emac_ge_3) {
/* 0.9 ns */
prg_rclk_dly = 115;
} else {
@@ -473,7 +468,7 @@ static int ethqos_rgmii_macro_init(struct qcom_ethqos *ethqos, int speed)
SDCC_HC_REG_DDR_CONFIG);
}
- if (ethqos->rgmii_config_loopback_en)
+ if (ethqos->data->rgmii_config_loopback_en)
loopback = RGMII_CONFIG_LOOPBACK_EN;
else
loopback = 0;
@@ -496,9 +491,9 @@ static void ethqos_fix_mac_speed_rgmii(void *bsp_priv,
dev = ðqos->pdev->dev;
/* Reset to POR values and enable clk */
- for (i = 0; i < ethqos->num_rgmii_por; i++)
- rgmii_writel(ethqos, ethqos->rgmii_por[i].value,
- ethqos->rgmii_por[i].offset);
+ for (i = 0; i < ethqos->data->num_rgmii_por; i++)
+ rgmii_writel(ethqos, ethqos->data->rgmii_por[i].value,
+ ethqos->data->rgmii_por[i].offset);
ethqos_set_func_clk_en(ethqos);
@@ -512,7 +507,7 @@ static void ethqos_fix_mac_speed_rgmii(void *bsp_priv,
rgmii_setmask(ethqos, SDCC_DLL_CONFIG_PDN,
SDCC_HC_REG_DLL_CONFIG);
- if (ethqos->has_emac_ge_3) {
+ if (ethqos->data->has_emac_ge_3) {
if (speed == SPEED_1000) {
rgmii_writel(ethqos, 0x1800000, SDCC_TEST_CTL);
rgmii_writel(ethqos, 0x2C010800, SDCC_USR_CTL);
@@ -539,7 +534,7 @@ static void ethqos_fix_mac_speed_rgmii(void *bsp_priv,
SDCC_HC_REG_DLL_CONFIG);
/* Set USR_CTL bit 26 with mask of 3 bits */
- if (!ethqos->has_emac_ge_3)
+ if (!ethqos->data->has_emac_ge_3)
rgmii_updatel(ethqos, GENMASK(26, 24), BIT(26),
SDCC_USR_CTL);
@@ -750,11 +745,7 @@ static int qcom_ethqos_probe(struct platform_device *pdev)
"Failed to map rgmii resource\n");
data = of_device_get_match_data(dev);
- ethqos->rgmii_por = data->rgmii_por;
- ethqos->num_rgmii_por = data->num_rgmii_por;
- ethqos->rgmii_config_loopback_en = data->rgmii_config_loopback_en;
- ethqos->has_emac_ge_3 = data->has_emac_ge_3;
- ethqos->needs_sgmii_loopback = data->needs_sgmii_loopback;
+ ethqos->data = data;
ethqos->link_clk = devm_clk_get(dev, data->link_clk_name ?: "rgmii");
if (IS_ERR(ethqos->link_clk))
@@ -791,7 +782,7 @@ static int qcom_ethqos_probe(struct platform_device *pdev)
plat_dat->dump_debug_regs = rgmii_dump;
plat_dat->ptp_clk_freq_config = ethqos_ptp_clk_freq_config;
plat_dat->core_type = DWMAC_CORE_GMAC4;
- if (ethqos->has_emac_ge_3)
+ if (data->has_emac_ge_3)
plat_dat->dwmac4_addrs = &data->dwmac4_addrs;
plat_dat->pmt = true;
if (of_property_read_bool(np, "snps,tso"))
--
2.47.3
^ permalink raw reply related
* [PATCH net-next v13 07/10] net: stmmac: qcom-ethqos: fix SGMII loopback not set on resume after speed change
From: Bartosz Golaszewski @ 2026-07-13 13:20 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Maxime Coquelin, Alexandre Torgue,
Vinod Koul, Giuseppe Cavallaro, Chen-Yu Tsai, Jernej Skrabec,
Neil Armstrong, Kevin Hilman, Jerome Brunet, Shawn Guo,
Fabio Estevam, Jan Petrous, s32, Mohd Ayaan Anwar, Romain Gantois,
Geert Uytterhoeven, Magnus Damm, Maxime Ripard,
Christophe Roullier, Bartosz Golaszewski, Radu Rendec
Cc: linux-arm-msm, devicetree, linux-kernel, netdev, linux-stm32,
linux-arm-kernel, Drew Fustini, linux-sunxi, linux-amlogic,
linux-mips, imx, linux-renesas-soc, linux-rockchip, sophgo,
linux-riscv, brgl, Bartosz Golaszewski, Bartosz Golaszewski
In-Reply-To: <20260713-qcom-sa8255p-emac-v13-0-119f8699ef8e@oss.qualcomm.com>
The loopback in the MAC wrapper feeds the TX clock back into the RX path,
while the SerDes is being powered up. Without it, dwmac4_dma_reset()
polls a clock that never toggles and times out.
qcom_ethqos_set_sgmii_loopback() gates this on phy_mode being 2500BASEX.
mac_finish() now updates phy_mode to the runtime-resolved interface, any
subsequent resume with a 1G SGMII link skips the loopback setup and the
DMA reset hangs.
Extend the guard to include PHY_INTERFACE_MODE_SGMII.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
index 9d19203ae4bd7dc17aca068f5eb88ff830e4e906..e083d7d55782ec8310e9375e466be00213667457 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
@@ -190,7 +190,8 @@ static void
qcom_ethqos_set_sgmii_loopback(struct qcom_ethqos *ethqos, bool enable)
{
if (!ethqos->needs_sgmii_loopback ||
- ethqos->phy_mode != PHY_INTERFACE_MODE_2500BASEX)
+ (ethqos->phy_mode != PHY_INTERFACE_MODE_2500BASEX &&
+ ethqos->phy_mode != PHY_INTERFACE_MODE_SGMII))
return;
rgmii_updatel(ethqos,
--
2.47.3
^ permalink raw reply related
* [PATCH net-next v13 06/10] net: stmmac: qcom-ethqos: update phy_mode to the resolved interface in mac_finish()
From: Bartosz Golaszewski @ 2026-07-13 13:20 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Maxime Coquelin, Alexandre Torgue,
Vinod Koul, Giuseppe Cavallaro, Chen-Yu Tsai, Jernej Skrabec,
Neil Armstrong, Kevin Hilman, Jerome Brunet, Shawn Guo,
Fabio Estevam, Jan Petrous, s32, Mohd Ayaan Anwar, Romain Gantois,
Geert Uytterhoeven, Magnus Damm, Maxime Ripard,
Christophe Roullier, Bartosz Golaszewski, Radu Rendec
Cc: linux-arm-msm, devicetree, linux-kernel, netdev, linux-stm32,
linux-arm-kernel, Drew Fustini, linux-sunxi, linux-amlogic,
linux-mips, imx, linux-renesas-soc, linux-rockchip, sophgo,
linux-riscv, brgl, Bartosz Golaszewski, Bartosz Golaszewski
In-Reply-To: <20260713-qcom-sa8255p-emac-v13-0-119f8699ef8e@oss.qualcomm.com>
ethqos->phy_mode is read by serdes_powerup() and
qcom_ethqos_set_sgmii_loopback() to configure the SerDes and its
wrapper for the correct interface. It is set once at probe from the DT
phy-mode property and never updated.
phylink resolves the actual runtime interface and passes it to the
mac_finish() callback. On platforms that only ever operate at one speed
these two values are always the same, but when the interface changes
at runtime - for example switching between SGMII and 2500BASE-X — the
stored value becomes stale. The next serdes_powerup() call, on
a subsequent link cycle, then reinitialises the SerDes to the wrong mode.
Update ethqos->phy_mode from the interface argument in
ethqos_mac_finish_serdes() so that it always reflects the last
resolved interface.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
index 47b70b5e706f221c01f1c0ae3b1acafae6641165..9d19203ae4bd7dc17aca068f5eb88ff830e4e906 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
@@ -632,6 +632,12 @@ static int ethqos_mac_finish_serdes(struct net_device *ndev, void *priv,
struct qcom_ethqos *ethqos = priv;
int ret = 0;
+ /* The interface mode is only known once phylink has resolved it and
+ * may change at runtime, so keep it in sync for later
+ * serdes_powerup()/serdes_powerdown() calls.
+ */
+ ethqos->phy_mode = interface;
+
qcom_ethqos_set_sgmii_loopback(ethqos, false);
if (interface == PHY_INTERFACE_MODE_SGMII ||
--
2.47.3
^ permalink raw reply related
* Re: [PATCH nf] netfilter: ipset: do not update comments from kernel-side hash adds
From: Jozsef Kadlecsik @ 2026-07-13 13:12 UTC (permalink / raw)
To: David Lee
Cc: Pablo Neira Ayuso, Florian Westphal, Jozsef Kadlecsik,
Phil Sutter, Dominik 'Disconnect3d' Czarnota,
netfilter-devel, coreteam, netdev, linux-kernel, stable
In-Reply-To: <20260713095918.173450-1-david.lee@trailofbits.com>
Hi,
On Mon, 13 Jul 2026, David Lee wrote:
> mtype_resize() copies comment pointers with memcpy(), not the comment objects
> themselves. During the window after an entry has been copied but before the
> table swap and backlog replay, the old table is still published for
> packet-side updates while the replacement-table entry already holds the same
> ip_set_comment_rcu pointer.
>
> If xt_SET --add-set ... --exist hits that old entry in this window,
> mtype_add() calls ip_set_init_comment() even though packet-side adds carry no
> comment payload. That call frees the shared comment through the old entry, so
> the replacement-table entry now holds a stale pointer. When the queued add is
> replayed on the new table, mtype_add() calls ip_set_init_comment() again and
> strlen() dereferences the stale pointer.
>
> Fix this in mtype_add() by skipping ip_set_init_comment() when ext->target
> marks a packet-side add. Userspace adds still update comments, while
> packet-side adds can no longer free comment storage shared with a resize copy.
>
> Fixes: f66ee0410b1c ("netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports")
> Cc: stable@vger.kernel.org
> Signed-off-by: David Lee <david.lee@trailofbits.com>
> Assisted-by: Codex:gpt-5.5
> ---
> A reproducer triggers a KASAN slab-use-after-free in strlen() from
> ip_set_init_comment() during hash_ip4_resize().
>
> Trail of Bits has a privilege escalation PoC for this bug on a
> custom kernel, which can be shared further if needed.
>
> net/netfilter/ipset/ip_set_hash_gen.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
> index 8231317b0f1f..b2d77973272d 100644
> --- a/net/netfilter/ipset/ip_set_hash_gen.h
> +++ b/net/netfilter/ipset/ip_set_hash_gen.h
> @@ -1005,7 +1005,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
> #endif
> if (SET_WITH_COUNTER(set))
> ip_set_init_counter(ext_counter(data, set), ext);
> - if (SET_WITH_COMMENT(set))
> + if (SET_WITH_COMMENT(set) && !ext->target)
> ip_set_init_comment(set, ext_comment(data, set), ext);
> if (SET_WITH_SKBINFO(set))
> ip_set_init_skbinfo(ext_skbinfo(data, set), ext);
> --
Thanks! Resize is a can of worms for edge cases and hopefully all of them
caught one by one.
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Best regards,
Jozsef
^ permalink raw reply
* [PATCH net-next v13 05/10] net: stmmac: qcom-ethqos: set serdes mode before powerup
From: Bartosz Golaszewski @ 2026-07-13 13:20 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Maxime Coquelin, Alexandre Torgue,
Vinod Koul, Giuseppe Cavallaro, Chen-Yu Tsai, Jernej Skrabec,
Neil Armstrong, Kevin Hilman, Jerome Brunet, Shawn Guo,
Fabio Estevam, Jan Petrous, s32, Mohd Ayaan Anwar, Romain Gantois,
Geert Uytterhoeven, Magnus Damm, Maxime Ripard,
Christophe Roullier, Bartosz Golaszewski, Radu Rendec
Cc: linux-arm-msm, devicetree, linux-kernel, netdev, linux-stm32,
linux-arm-kernel, Drew Fustini, linux-sunxi, linux-amlogic,
linux-mips, imx, linux-renesas-soc, linux-rockchip, sophgo,
linux-riscv, brgl, Bartosz Golaszewski, Bartosz Golaszewski
In-Reply-To: <20260713-qcom-sa8255p-emac-v13-0-119f8699ef8e@oss.qualcomm.com>
Call phy_set_mode_ext() before phy_power_on() in
qcom_ethqos_serdes_powerup(). This is harmless for existing users but on
SCMI systems this is required for the PHY driver to select the right
performance level - which translates to the link speed. This is done
ahead of adding support for the firmware-managed EMAC on Qualcomm sa8255p.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
index ac7d6d3e205a1ab5b391def879d6f1033a0961b6..47b70b5e706f221c01f1c0ae3b1acafae6641165 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
@@ -601,10 +601,19 @@ static int qcom_ethqos_serdes_powerup(struct net_device *ndev, void *priv)
if (ret)
return ret;
+ ret = phy_set_mode_ext(ethqos->serdes_phy, PHY_MODE_ETHERNET,
+ ethqos->phy_mode);
+ if (ret)
+ goto err_out;
+
ret = phy_power_on(ethqos->serdes_phy);
if (ret)
- phy_exit(ethqos->serdes_phy);
+ goto err_out;
+ return 0;
+
+err_out:
+ phy_exit(ethqos->serdes_phy);
return ret;
}
--
2.47.3
^ permalink raw reply related
* [PATCH net-next v13 04/10] dt-bindings: net: qcom: document the ethqos device for SCMI-based systems
From: Bartosz Golaszewski @ 2026-07-13 13:20 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Maxime Coquelin, Alexandre Torgue,
Vinod Koul, Giuseppe Cavallaro, Chen-Yu Tsai, Jernej Skrabec,
Neil Armstrong, Kevin Hilman, Jerome Brunet, Shawn Guo,
Fabio Estevam, Jan Petrous, s32, Mohd Ayaan Anwar, Romain Gantois,
Geert Uytterhoeven, Magnus Damm, Maxime Ripard,
Christophe Roullier, Bartosz Golaszewski, Radu Rendec
Cc: linux-arm-msm, devicetree, linux-kernel, netdev, linux-stm32,
linux-arm-kernel, Drew Fustini, linux-sunxi, linux-amlogic,
linux-mips, imx, linux-renesas-soc, linux-rockchip, sophgo,
linux-riscv, brgl, Bartosz Golaszewski, Bartosz Golaszewski,
Martin Blumenstingl, Krzysztof Kozlowski, Lad Prabhakar
In-Reply-To: <20260713-qcom-sa8255p-emac-v13-0-119f8699ef8e@oss.qualcomm.com>
From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Describe the firmware-managed variant of the QCom DesignWare MAC. As the
properties here differ a lot from the HLOS-managed variant, lets put it
in a separate file. Since we need to update the maximum number of power
domains, let's update existing bindings referencing the top-level
snps,dwmac.yaml and limit their maxItems for power-domains to 1.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Romain Gantois <romain.gantois@bootlin.com> # For RZ/N1
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
.../bindings/net/allwinner,sun7i-a20-gmac.yaml | 3 +
.../bindings/net/altr,socfpga-stmmac.yaml | 3 +
.../bindings/net/amlogic,meson-dwmac.yaml | 3 +
.../devicetree/bindings/net/eswin,eic7700-eth.yaml | 3 +
.../devicetree/bindings/net/intel,dwmac-plat.yaml | 3 +
.../bindings/net/loongson,ls1b-gmac.yaml | 3 +
.../bindings/net/loongson,ls1c-emac.yaml | 3 +
.../devicetree/bindings/net/nxp,dwmac-imx.yaml | 3 +
.../devicetree/bindings/net/nxp,lpc1850-dwmac.yaml | 3 +
.../devicetree/bindings/net/nxp,s32-dwmac.yaml | 3 +
.../devicetree/bindings/net/qcom,ethqos.yaml | 3 +
.../bindings/net/qcom,sa8255p-ethqos.yaml | 107 +++++++++++++++++++++
.../devicetree/bindings/net/renesas,rzn1-gmac.yaml | 3 +
.../bindings/net/renesas,rzv2h-gbeth.yaml | 3 +
.../devicetree/bindings/net/rockchip-dwmac.yaml | 3 +
.../devicetree/bindings/net/snps,dwmac.yaml | 5 +-
.../bindings/net/sophgo,cv1800b-dwmac.yaml | 3 +
.../bindings/net/sophgo,sg2044-dwmac.yaml | 3 +
.../bindings/net/starfive,jh7110-dwmac.yaml | 3 +
.../devicetree/bindings/net/stm32-dwmac.yaml | 3 +
.../devicetree/bindings/net/tesla,fsd-ethqos.yaml | 3 +
.../devicetree/bindings/net/thead,th1520-gmac.yaml | 3 +
.../bindings/net/toshiba,visconti-dwmac.yaml | 3 +
MAINTAINERS | 1 +
24 files changed, 175 insertions(+), 1 deletion(-)
diff --git a/Documentation/devicetree/bindings/net/allwinner,sun7i-a20-gmac.yaml b/Documentation/devicetree/bindings/net/allwinner,sun7i-a20-gmac.yaml
index 23e92be33ac8609a16db530782989caed22a5730..b12632545673b2ad0148a677f45a7447309a43cd 100644
--- a/Documentation/devicetree/bindings/net/allwinner,sun7i-a20-gmac.yaml
+++ b/Documentation/devicetree/bindings/net/allwinner,sun7i-a20-gmac.yaml
@@ -40,6 +40,9 @@ properties:
description:
PHY regulator
+ power-domains:
+ maxItems: 1
+
required:
- compatible
- reg
diff --git a/Documentation/devicetree/bindings/net/altr,socfpga-stmmac.yaml b/Documentation/devicetree/bindings/net/altr,socfpga-stmmac.yaml
index fc445ad5a1f1ac490e921696d6f7ca83d15de459..448e617cddc4cda8dbc77e83324495ffd5dfb9be 100644
--- a/Documentation/devicetree/bindings/net/altr,socfpga-stmmac.yaml
+++ b/Documentation/devicetree/bindings/net/altr,socfpga-stmmac.yaml
@@ -140,6 +140,9 @@ properties:
- description: offset of the control register
- description: shift within the control register
+ power-domains:
+ maxItems: 1
+
patternProperties:
"^mdio[0-9]$":
type: object
diff --git a/Documentation/devicetree/bindings/net/amlogic,meson-dwmac.yaml b/Documentation/devicetree/bindings/net/amlogic,meson-dwmac.yaml
index 5c91716d1f21e617543b03c5a90b993f8aee053c..9c9cc3ef384da0270489c21b3426572ea46d9499 100644
--- a/Documentation/devicetree/bindings/net/amlogic,meson-dwmac.yaml
+++ b/Documentation/devicetree/bindings/net/amlogic,meson-dwmac.yaml
@@ -158,6 +158,9 @@ properties:
interrupt-names:
const: macirq
+ power-domains:
+ maxItems: 1
+
required:
- compatible
- reg
diff --git a/Documentation/devicetree/bindings/net/eswin,eic7700-eth.yaml b/Documentation/devicetree/bindings/net/eswin,eic7700-eth.yaml
index 65882ff79d8d7e3227e31415676639dd86f7098f..081a21174fd42bc4925d1850b1147545e111363c 100644
--- a/Documentation/devicetree/bindings/net/eswin,eic7700-eth.yaml
+++ b/Documentation/devicetree/bindings/net/eswin,eic7700-eth.yaml
@@ -95,6 +95,9 @@ properties:
- description: Optional offset of register controlling TXD delay
- description: Optional offset of register controlling RXD delay
+ power-domains:
+ maxItems: 1
+
required:
- compatible
- reg
diff --git a/Documentation/devicetree/bindings/net/intel,dwmac-plat.yaml b/Documentation/devicetree/bindings/net/intel,dwmac-plat.yaml
index 62c1da36a2b5a29290e5e01be87c48158c4adf89..e41851931b947559c89b0cd6f4756f71046f9594 100644
--- a/Documentation/devicetree/bindings/net/intel,dwmac-plat.yaml
+++ b/Documentation/devicetree/bindings/net/intel,dwmac-plat.yaml
@@ -47,6 +47,9 @@ properties:
interrupt-names:
const: macirq
+ power-domains:
+ maxItems: 1
+
required:
- compatible
- clocks
diff --git a/Documentation/devicetree/bindings/net/loongson,ls1b-gmac.yaml b/Documentation/devicetree/bindings/net/loongson,ls1b-gmac.yaml
index c4f3224bad387b87a5b4a3049dabd75f2c4bd42f..c9a131b8d8304c41559a416b324df749c0a87d14 100644
--- a/Documentation/devicetree/bindings/net/loongson,ls1b-gmac.yaml
+++ b/Documentation/devicetree/bindings/net/loongson,ls1b-gmac.yaml
@@ -66,6 +66,9 @@ properties:
- mii
- rgmii-id
+ power-domains:
+ maxItems: 1
+
required:
- compatible
- reg
diff --git a/Documentation/devicetree/bindings/net/loongson,ls1c-emac.yaml b/Documentation/devicetree/bindings/net/loongson,ls1c-emac.yaml
index 99001b940b8361f69bb917617f857ee99f4b3fa5..49db18423dd807683b9bb297978f5da8ea6cee3d 100644
--- a/Documentation/devicetree/bindings/net/loongson,ls1c-emac.yaml
+++ b/Documentation/devicetree/bindings/net/loongson,ls1c-emac.yaml
@@ -65,6 +65,9 @@ properties:
- mii
- rmii
+ power-domains:
+ maxItems: 1
+
required:
- compatible
- reg
diff --git a/Documentation/devicetree/bindings/net/nxp,dwmac-imx.yaml b/Documentation/devicetree/bindings/net/nxp,dwmac-imx.yaml
index e5db346beca9649be4f97727b78fda8973095912..b240c76e7dd5254d0c3752610c4aa848a3c3d65b 100644
--- a/Documentation/devicetree/bindings/net/nxp,dwmac-imx.yaml
+++ b/Documentation/devicetree/bindings/net/nxp,dwmac-imx.yaml
@@ -83,6 +83,9 @@ properties:
description:
To select RMII reference clock from external.
+ power-domains:
+ maxItems: 1
+
required:
- compatible
- clocks
diff --git a/Documentation/devicetree/bindings/net/nxp,lpc1850-dwmac.yaml b/Documentation/devicetree/bindings/net/nxp,lpc1850-dwmac.yaml
index 05acd9bc7616356e68090ebdd4df20e42f70dd7e..f61188ab0dbe3c0cec5b10f7a65dfaff4dc3898f 100644
--- a/Documentation/devicetree/bindings/net/nxp,lpc1850-dwmac.yaml
+++ b/Documentation/devicetree/bindings/net/nxp,lpc1850-dwmac.yaml
@@ -51,6 +51,9 @@ properties:
items:
- const: stmmaceth
+ power-domains:
+ maxItems: 1
+
required:
- compatible
- reg
diff --git a/Documentation/devicetree/bindings/net/nxp,s32-dwmac.yaml b/Documentation/devicetree/bindings/net/nxp,s32-dwmac.yaml
index 753a04941659b82b655dad1439ff66f8b37fa18b..fcad2274302d9cff36760184b74918a9835906f7 100644
--- a/Documentation/devicetree/bindings/net/nxp,s32-dwmac.yaml
+++ b/Documentation/devicetree/bindings/net/nxp,s32-dwmac.yaml
@@ -81,6 +81,9 @@ properties:
- const: rx
- const: ptp_ref
+ power-domains:
+ maxItems: 1
+
required:
- clocks
- clock-names
diff --git a/Documentation/devicetree/bindings/net/qcom,ethqos.yaml b/Documentation/devicetree/bindings/net/qcom,ethqos.yaml
index 423959cb928d945aa3e758a3c803d12bd61ec42b..ef520f8105773e22c0536ff419dad55fe316e1bd 100644
--- a/Documentation/devicetree/bindings/net/qcom,ethqos.yaml
+++ b/Documentation/devicetree/bindings/net/qcom,ethqos.yaml
@@ -86,6 +86,9 @@ properties:
phy-names:
const: serdes
+ power-domains:
+ maxItems: 1
+
required:
- compatible
- clocks
diff --git a/Documentation/devicetree/bindings/net/qcom,sa8255p-ethqos.yaml b/Documentation/devicetree/bindings/net/qcom,sa8255p-ethqos.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..5158481e5e5b0feed5b3dcd2cda2f593b7ff62e4
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/qcom,sa8255p-ethqos.yaml
@@ -0,0 +1,107 @@
+# SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/net/qcom,sa8255p-ethqos.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm Ethernet ETHQOS device (firmware managed)
+
+maintainers:
+ - Bjorn Andersson <andersson@kernel.org>
+ - Konrad Dybcio <konradybcio@kernel.org>
+ - Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+description:
+ dwmac based Qualcomm ethernet devices which support Gigabit
+ ethernet (version v2.3.0 and onwards) with clocks, interconnects, etc.
+ managed by firmware
+
+allOf:
+ - $ref: snps,dwmac.yaml#
+
+properties:
+ compatible:
+ const: qcom,sa8255p-ethqos
+
+ reg:
+ maxItems: 2
+
+ reg-names:
+ items:
+ - const: stmmaceth
+ - const: rgmii
+
+ interrupts:
+ items:
+ - description: Combined signal for various interrupt events
+ - description: The interrupt that occurs when HW safety error triggered
+
+ interrupt-names:
+ items:
+ - const: macirq
+ - const: sfty
+
+ power-domains:
+ minItems: 2
+ maxItems: 2
+
+ power-domain-names:
+ items:
+ - const: core
+ - const: mdio
+
+ phys:
+ maxItems: 1
+
+ phy-names:
+ items:
+ - const: serdes
+
+ iommus:
+ maxItems: 1
+
+ dma-coherent: true
+
+required:
+ - compatible
+ - reg-names
+ - power-domains
+ - power-domain-names
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ #include <dt-bindings/interrupt-controller/arm-gic.h>
+
+ ethernet: ethernet@23040000 {
+ compatible = "qcom,sa8255p-ethqos";
+ reg = <0x23040000 0x10000>,
+ <0x23056000 0x100>;
+ reg-names = "stmmaceth", "rgmii";
+
+ iommus = <&apps_smmu 0x120 0x7>;
+
+ interrupts = <GIC_SPI 946 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 782 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "macirq", "sfty";
+
+ dma-coherent;
+
+ snps,tso;
+ snps,pbl = <32>;
+ rx-fifo-depth = <16384>;
+ tx-fifo-depth = <16384>;
+
+ phy-handle = <ðernet_phy>;
+ phy-mode = "2500base-x";
+
+ snps,mtl-rx-config = <&mtl_rx_setup1>;
+ snps,mtl-tx-config = <&mtl_tx_setup1>;
+
+ power-domains = <&scmi8_pd 0>, <&scmi8_pd 1>;
+ power-domain-names = "core", "mdio";
+
+ phys = <&serdes1>;
+ phy-names = "serdes";
+ };
diff --git a/Documentation/devicetree/bindings/net/renesas,rzn1-gmac.yaml b/Documentation/devicetree/bindings/net/renesas,rzn1-gmac.yaml
index 16dd7a2631abf6fb7dc8e0c90755ab1e81915b38..ed0d10a19ca4c47c05f6873c64b0537b90acd15a 100644
--- a/Documentation/devicetree/bindings/net/renesas,rzn1-gmac.yaml
+++ b/Documentation/devicetree/bindings/net/renesas,rzn1-gmac.yaml
@@ -44,6 +44,9 @@ properties:
phandle pointing to a PCS sub-node compatible with
renesas,rzn1-miic.yaml#
+ power-domains:
+ maxItems: 1
+
required:
- compatible
diff --git a/Documentation/devicetree/bindings/net/renesas,rzv2h-gbeth.yaml b/Documentation/devicetree/bindings/net/renesas,rzv2h-gbeth.yaml
index 2125b5ddf73dadd8b0d372e83a6b5c4624f5e648..8338834f49cd21df6c697a1f52a8b195c0208c23 100644
--- a/Documentation/devicetree/bindings/net/renesas,rzv2h-gbeth.yaml
+++ b/Documentation/devicetree/bindings/net/renesas,rzv2h-gbeth.yaml
@@ -154,6 +154,9 @@ properties:
Documentation/devicetree/bindings/net/pcs/renesas,rzn1-miic.yaml#
(Refer RZ/T2H portion in the DT-binding file)
+ power-domains:
+ maxItems: 1
+
required:
- compatible
- reg
diff --git a/Documentation/devicetree/bindings/net/rockchip-dwmac.yaml b/Documentation/devicetree/bindings/net/rockchip-dwmac.yaml
index 80c252845349c4533deff85b052157984d0e2f23..3ec3f6dc2a125908ba98f20b1120311de8967954 100644
--- a/Documentation/devicetree/bindings/net/rockchip-dwmac.yaml
+++ b/Documentation/devicetree/bindings/net/rockchip-dwmac.yaml
@@ -123,6 +123,9 @@ properties:
phy-supply:
description: PHY regulator
+ power-domains:
+ maxItems: 1
+
required:
- compatible
- clocks
diff --git a/Documentation/devicetree/bindings/net/snps,dwmac.yaml b/Documentation/devicetree/bindings/net/snps,dwmac.yaml
index 2449311c6d28ed3fbf8c92526ce8b872900653f4..d3aff1df3070d1b22198766ee2e0131dcf925287 100644
--- a/Documentation/devicetree/bindings/net/snps,dwmac.yaml
+++ b/Documentation/devicetree/bindings/net/snps,dwmac.yaml
@@ -72,6 +72,7 @@ properties:
- nuvoton,ma35d1-dwmac
- nxp,s32g2-dwmac
- qcom,qcs404-ethqos
+ - qcom,sa8255p-ethqos
- qcom,sa8775p-ethqos
- qcom,sc8280xp-ethqos
- qcom,sm8150-ethqos
@@ -185,7 +186,8 @@ properties:
- const: ahb
power-domains:
- maxItems: 1
+ minItems: 1
+ maxItems: 2
mac-mode:
$ref: ethernet-controller.yaml#/properties/phy-connection-type
@@ -630,6 +632,7 @@ allOf:
- ingenic,x1830-mac
- ingenic,x2000-mac
- qcom,qcs404-ethqos
+ - qcom,sa8255p-ethqos
- qcom,sa8775p-ethqos
- qcom,sc8280xp-ethqos
- qcom,sm8150-ethqos
diff --git a/Documentation/devicetree/bindings/net/sophgo,cv1800b-dwmac.yaml b/Documentation/devicetree/bindings/net/sophgo,cv1800b-dwmac.yaml
index b89456f0ef830991135bd17626da98661429596c..e78cbf594c695204040a53ab1e367daa9e12246b 100644
--- a/Documentation/devicetree/bindings/net/sophgo,cv1800b-dwmac.yaml
+++ b/Documentation/devicetree/bindings/net/sophgo,cv1800b-dwmac.yaml
@@ -49,6 +49,9 @@ properties:
reset-names:
const: stmmaceth
+ power-domains:
+ maxItems: 1
+
required:
- compatible
- reg
diff --git a/Documentation/devicetree/bindings/net/sophgo,sg2044-dwmac.yaml b/Documentation/devicetree/bindings/net/sophgo,sg2044-dwmac.yaml
index e8d3814db0e94fdcd0f3ab2a9fa8bab972a97ab5..845e2c67d20037496bb1eec6eb73c99cde74e944 100644
--- a/Documentation/devicetree/bindings/net/sophgo,sg2044-dwmac.yaml
+++ b/Documentation/devicetree/bindings/net/sophgo,sg2044-dwmac.yaml
@@ -52,6 +52,9 @@ properties:
interrupt-names:
maxItems: 1
+ power-domains:
+ maxItems: 1
+
resets:
maxItems: 1
diff --git a/Documentation/devicetree/bindings/net/starfive,jh7110-dwmac.yaml b/Documentation/devicetree/bindings/net/starfive,jh7110-dwmac.yaml
index fdcc61c65f87d1dc15a17b9486cde032ffa7798b..c424e77973921e1f9f18135c3106f1c270c9ac87 100644
--- a/Documentation/devicetree/bindings/net/starfive,jh7110-dwmac.yaml
+++ b/Documentation/devicetree/bindings/net/starfive,jh7110-dwmac.yaml
@@ -75,6 +75,9 @@ properties:
The argument one is the offset of phy mode selection, the
argument two is the shift of phy mode selection.
+ power-domains:
+ maxItems: 1
+
required:
- compatible
- reg
diff --git a/Documentation/devicetree/bindings/net/stm32-dwmac.yaml b/Documentation/devicetree/bindings/net/stm32-dwmac.yaml
index 987254900d0da7aab81237f20b1540ad8a17bd21..29b878079ff0c1a0ef95fc63f2035f478ee039b2 100644
--- a/Documentation/devicetree/bindings/net/stm32-dwmac.yaml
+++ b/Documentation/devicetree/bindings/net/stm32-dwmac.yaml
@@ -121,6 +121,9 @@ properties:
minItems: 1
maxItems: 2
+ power-domains:
+ maxItems: 1
+
required:
- compatible
- clocks
diff --git a/Documentation/devicetree/bindings/net/tesla,fsd-ethqos.yaml b/Documentation/devicetree/bindings/net/tesla,fsd-ethqos.yaml
index dd7481bb16e59982c26c1a54ae82b8cff85fdfe0..ad635529d676ed6b752ab3bde5152d5cbddcb519 100644
--- a/Documentation/devicetree/bindings/net/tesla,fsd-ethqos.yaml
+++ b/Documentation/devicetree/bindings/net/tesla,fsd-ethqos.yaml
@@ -67,6 +67,9 @@ properties:
- rgmii-rxid
- rgmii-txid
+ power-domains:
+ maxItems: 1
+
required:
- compatible
- reg
diff --git a/Documentation/devicetree/bindings/net/thead,th1520-gmac.yaml b/Documentation/devicetree/bindings/net/thead,th1520-gmac.yaml
index b3492a9aa4effa73fadf92a63a76ba8bb65a8769..c859f8bb5d582af8b8782f2f89ab5e6ee3d7a46c 100644
--- a/Documentation/devicetree/bindings/net/thead,th1520-gmac.yaml
+++ b/Documentation/devicetree/bindings/net/thead,th1520-gmac.yaml
@@ -78,6 +78,9 @@ properties:
items:
- const: macirq
+ power-domains:
+ maxItems: 1
+
required:
- clocks
- clock-names
diff --git a/Documentation/devicetree/bindings/net/toshiba,visconti-dwmac.yaml b/Documentation/devicetree/bindings/net/toshiba,visconti-dwmac.yaml
index f0f32e18fc8550e6f63b87b60a095972453836c9..efa39eab0256a1102b01872bd848749788c9b4e8 100644
--- a/Documentation/devicetree/bindings/net/toshiba,visconti-dwmac.yaml
+++ b/Documentation/devicetree/bindings/net/toshiba,visconti-dwmac.yaml
@@ -48,6 +48,9 @@ properties:
interrupt-names:
const: macirq
+ power-domains:
+ maxItems: 1
+
required:
- compatible
- reg
diff --git a/MAINTAINERS b/MAINTAINERS
index 806bd2d80d153537393761df322165f683954d50..86e67aa4fb9dd187905a0291c09fdbd5d39379c0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -22185,6 +22185,7 @@ L: netdev@vger.kernel.org
L: linux-arm-msm@vger.kernel.org
S: Maintained
F: Documentation/devicetree/bindings/net/qcom,ethqos.yaml
+F: Documentation/devicetree/bindings/net/qcom,sa8255p-ethqos.yaml
F: drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
QUALCOMM FASTRPC DRIVER
--
2.47.3
^ permalink raw reply related
* [PATCH net-next v13 03/10] phy: qcom: add the SGMII SerDes PHY driver for SCMI systems
From: Bartosz Golaszewski @ 2026-07-13 13:20 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Maxime Coquelin, Alexandre Torgue,
Vinod Koul, Giuseppe Cavallaro, Chen-Yu Tsai, Jernej Skrabec,
Neil Armstrong, Kevin Hilman, Jerome Brunet, Shawn Guo,
Fabio Estevam, Jan Petrous, s32, Mohd Ayaan Anwar, Romain Gantois,
Geert Uytterhoeven, Magnus Damm, Maxime Ripard,
Christophe Roullier, Bartosz Golaszewski, Radu Rendec
Cc: linux-arm-msm, devicetree, linux-kernel, netdev, linux-stm32,
linux-arm-kernel, Drew Fustini, linux-sunxi, linux-amlogic,
linux-mips, imx, linux-renesas-soc, linux-rockchip, sophgo,
linux-riscv, brgl, Bartosz Golaszewski, Bartosz Golaszewski
In-Reply-To: <20260713-qcom-sa8255p-emac-v13-0-119f8699ef8e@oss.qualcomm.com>
Implement support for the firmware-managed SGMII/SerDes PHY present on
Qualcomm platforms. Do this as a separate driver from the HLOS-managed
variant as they don't share almost any code.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
drivers/phy/qualcomm/Kconfig | 11 ++
drivers/phy/qualcomm/Makefile | 1 +
drivers/phy/qualcomm/phy-qcom-sgmii-eth-scmi.c | 165 +++++++++++++++++++++++++
3 files changed, 177 insertions(+)
diff --git a/drivers/phy/qualcomm/Kconfig b/drivers/phy/qualcomm/Kconfig
index 60a0ead127fa9f08749e1bc686e15cc5eb341c28..a7cf348f6a7aa18e8b3f39f109b02ea672ae4177 100644
--- a/drivers/phy/qualcomm/Kconfig
+++ b/drivers/phy/qualcomm/Kconfig
@@ -232,3 +232,14 @@ config PHY_QCOM_SGMII_ETH
help
Enable this to support the internal SerDes/SGMII PHY on various
Qualcomm chipsets.
+
+config PHY_QCOM_SGMII_ETH_SCMI
+ tristate "Qualcomm DWMAC SGMII SerDes/PHY driver (firmware managed)"
+ depends on OF && (ARCH_QCOM || COMPILE_TEST)
+ select GENERIC_PHY
+ select PM
+ select PM_GENERIC_DOMAINS
+ help
+ Enable this to support the internal SerDes/SGMII PHY on Qualcomm
+ chipsets where the SerDes hardware (clocks and registers) is owned
+ by the firmware.
diff --git a/drivers/phy/qualcomm/Makefile b/drivers/phy/qualcomm/Makefile
index b71a6a0bed3f1489b1d07664ecd728f1db145986..032e582f2e1af96687484ce28aaba0c2ef73e754 100644
--- a/drivers/phy/qualcomm/Makefile
+++ b/drivers/phy/qualcomm/Makefile
@@ -25,3 +25,4 @@ obj-$(CONFIG_PHY_QCOM_USB_SS) += phy-qcom-usb-ss.o
obj-$(CONFIG_PHY_QCOM_USB_SNPS_FEMTO_V2)+= phy-qcom-snps-femto-v2.o
obj-$(CONFIG_PHY_QCOM_IPQ806X_USB) += phy-qcom-ipq806x-usb.o
obj-$(CONFIG_PHY_QCOM_SGMII_ETH) += phy-qcom-sgmii-eth.o
+obj-$(CONFIG_PHY_QCOM_SGMII_ETH_SCMI) += phy-qcom-sgmii-eth-scmi.o
diff --git a/drivers/phy/qualcomm/phy-qcom-sgmii-eth-scmi.c b/drivers/phy/qualcomm/phy-qcom-sgmii-eth-scmi.c
new file mode 100644
index 0000000000000000000000000000000000000000..aa7ce9393b2853ee1bb248f4a5738974d41556ef
--- /dev/null
+++ b/drivers/phy/qualcomm/phy-qcom-sgmii-eth-scmi.c
@@ -0,0 +1,165 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ *
+ * Firmware-managed variant of the Qualcomm DWMAC SGMII SerDes/PHY driver.
+ */
+
+#include <linux/delay.h>
+#include <linux/device-id/of.h>
+#include <linux/ethtool.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/phy.h>
+#include <linux/phy/phy.h>
+#include <linux/platform_device.h>
+#include <linux/pm_domain.h>
+#include <linux/pm_runtime.h>
+
+struct qcom_dwmac_sgmii_phy_scmi {
+ unsigned int perf_state;
+};
+
+static int qcom_dwmac_sgmii_phy_scmi_power_on(struct phy *phy)
+{
+ struct qcom_dwmac_sgmii_phy_scmi *priv = phy_get_drvdata(phy);
+ struct device *dev = phy->dev.parent;
+ int ret;
+
+ ret = pm_runtime_resume_and_get(dev);
+ if (ret)
+ return ret;
+
+ ret = dev_pm_genpd_set_performance_state(dev, priv->perf_state);
+ if (ret) {
+ pm_runtime_put(dev);
+ return ret;
+ }
+
+ usleep_range(5000, 10000);
+
+ return 0;
+}
+
+static int qcom_dwmac_sgmii_phy_scmi_power_off(struct phy *phy)
+{
+ struct device *dev = phy->dev.parent;
+
+ dev_pm_genpd_set_performance_state(dev, 0);
+ pm_runtime_put(dev);
+
+ return 0;
+}
+
+static int qcom_dwmac_sgmii_phy_scmi_validate(struct phy *phy, enum phy_mode mode,
+ int submode,
+ union phy_configure_opts *opts)
+{
+ if (mode != PHY_MODE_ETHERNET)
+ return -EINVAL;
+
+ switch (submode) {
+ case PHY_INTERFACE_MODE_SGMII:
+ case PHY_INTERFACE_MODE_1000BASEX:
+ case PHY_INTERFACE_MODE_2500BASEX:
+ return 0;
+ default:
+ return -EINVAL;
+ }
+}
+
+static int qcom_dwmac_sgmii_phy_scmi_set_mode(struct phy *phy, enum phy_mode mode,
+ int submode)
+{
+ struct qcom_dwmac_sgmii_phy_scmi *priv = phy_get_drvdata(phy);
+ struct device *dev = phy->dev.parent;
+ int ret;
+
+ ret = qcom_dwmac_sgmii_phy_scmi_validate(phy, mode, submode, NULL);
+ if (ret)
+ return ret;
+
+ priv->perf_state = (submode == PHY_INTERFACE_MODE_2500BASEX) ?
+ SPEED_2500 : SPEED_1000;
+
+ if (phy->power_count == 0)
+ return 0;
+
+ return dev_pm_genpd_set_performance_state(dev, priv->perf_state);
+}
+
+static const struct phy_ops qcom_dwmac_sgmii_phy_scmi_ops = {
+ .power_on = qcom_dwmac_sgmii_phy_scmi_power_on,
+ .power_off = qcom_dwmac_sgmii_phy_scmi_power_off,
+ .set_mode = qcom_dwmac_sgmii_phy_scmi_set_mode,
+ .validate = qcom_dwmac_sgmii_phy_scmi_validate,
+ .owner = THIS_MODULE,
+};
+
+static void qcom_dwmac_sgmii_phy_scmi_runtime_disable(void *data)
+{
+ struct device *dev = data;
+
+ pm_runtime_disable(dev);
+}
+
+static int qcom_dwmac_sgmii_phy_scmi_probe(struct platform_device *pdev)
+{
+ struct qcom_dwmac_sgmii_phy_scmi *priv;
+ struct device *dev = &pdev->dev;
+ struct phy_provider *provider;
+ struct phy *phy;
+ int ret;
+
+ priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+ return -ENOMEM;
+
+ priv->perf_state = SPEED_1000;
+
+ /*
+ * Enable runtime PM on the provider before creating the PHY so that the
+ * PHY core enables runtime PM on the PHY device too. The single SCMI
+ * power domain has already been attached to this device by the driver
+ * core, so runtime PM votes propagate to firmware through the genpd
+ * device link. No register or clock access is done here - firmware owns
+ * the SerDes.
+ */
+ pm_runtime_enable(dev);
+
+ ret = devm_add_action_or_reset(dev, qcom_dwmac_sgmii_phy_scmi_runtime_disable, dev);
+ if (ret)
+ return ret;
+
+ phy = devm_phy_create(dev, NULL, &qcom_dwmac_sgmii_phy_scmi_ops);
+ if (IS_ERR(phy))
+ return dev_err_probe(dev, PTR_ERR(phy), "failed to create the phy\n");
+
+ phy_set_drvdata(phy, priv);
+
+ provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
+ if (IS_ERR(provider))
+ return dev_err_probe(dev, PTR_ERR(provider),
+ "failed to register the PHY provider\n");
+
+ return 0;
+}
+
+static const struct of_device_id qcom_dwmac_sgmii_phy_scmi_of_match[] = {
+ { .compatible = "qcom,sa8255p-dwmac-sgmii-phy" },
+ { }
+};
+MODULE_DEVICE_TABLE(of, qcom_dwmac_sgmii_phy_scmi_of_match);
+
+static struct platform_driver qcom_dwmac_sgmii_phy_scmi_driver = {
+ .probe = qcom_dwmac_sgmii_phy_scmi_probe,
+ .driver = {
+ .name = "qcom-dwmac-sgmii-phy-scmi",
+ .of_match_table = qcom_dwmac_sgmii_phy_scmi_of_match,
+ },
+};
+module_platform_driver(qcom_dwmac_sgmii_phy_scmi_driver);
+
+MODULE_DESCRIPTION("Qualcomm DWMAC SGMII PHY driver (firmware managed)");
+MODULE_AUTHOR("Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>");
+MODULE_LICENSE("GPL");
--
2.47.3
^ permalink raw reply related
* [PATCH net-next v13 02/10] dt-bindings: phy: document the serdes PHY on sa8255p
From: Bartosz Golaszewski @ 2026-07-13 13:20 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Maxime Coquelin, Alexandre Torgue,
Vinod Koul, Giuseppe Cavallaro, Chen-Yu Tsai, Jernej Skrabec,
Neil Armstrong, Kevin Hilman, Jerome Brunet, Shawn Guo,
Fabio Estevam, Jan Petrous, s32, Mohd Ayaan Anwar, Romain Gantois,
Geert Uytterhoeven, Magnus Damm, Maxime Ripard,
Christophe Roullier, Bartosz Golaszewski, Radu Rendec
Cc: linux-arm-msm, devicetree, linux-kernel, netdev, linux-stm32,
linux-arm-kernel, Drew Fustini, linux-sunxi, linux-amlogic,
linux-mips, imx, linux-renesas-soc, linux-rockchip, sophgo,
linux-riscv, brgl, Bartosz Golaszewski, Bartosz Golaszewski,
Krzysztof Kozlowski
In-Reply-To: <20260713-qcom-sa8255p-emac-v13-0-119f8699ef8e@oss.qualcomm.com>
Describe the SGMII/SerDes PHY present on the Qualcomm sa8255p platforms.
This is essentially the same hardware as sa8775p rev3 but the PHY is
managed by firmware over SCMI.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
.../bindings/phy/qcom,sa8255p-dwmac-sgmii-phy.yaml | 50 ++++++++++++++++++++++
1 file changed, 50 insertions(+)
diff --git a/Documentation/devicetree/bindings/phy/qcom,sa8255p-dwmac-sgmii-phy.yaml b/Documentation/devicetree/bindings/phy/qcom,sa8255p-dwmac-sgmii-phy.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..9e846e381555514bb32177f884abf0cf2c942948
--- /dev/null
+++ b/Documentation/devicetree/bindings/phy/qcom,sa8255p-dwmac-sgmii-phy.yaml
@@ -0,0 +1,50 @@
+# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/phy/qcom,sa8255p-dwmac-sgmii-phy.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm SerDes/SGMII ethernet PHY controller (firmware managed)
+
+maintainers:
+ - Bartosz Golaszewski <brgl@kernel.org>
+
+description:
+ The SerDes PHY sits between the MAC and the external PHY and provides
+ separate Rx Tx lines.
+
+properties:
+ compatible:
+ const: qcom,sa8255p-dwmac-sgmii-phy
+
+ reg:
+ items:
+ - description: serdes
+
+ power-domains:
+ maxItems: 1
+
+ power-domain-names:
+ maxItems: 1
+
+ "#phy-cells":
+ const: 0
+
+required:
+ - compatible
+ - reg
+ - "#phy-cells"
+ - power-domains
+ - power-domain-names
+
+additionalProperties: false
+
+examples:
+ - |
+ phy@8901000 {
+ compatible = "qcom,sa8255p-dwmac-sgmii-phy";
+ reg = <0x08901000 0xe10>;
+ #phy-cells = <0>;
+ power-domains = <&scmi7_dvfs 0>;
+ power-domain-names = "serdes";
+ };
--
2.47.3
^ permalink raw reply related
* [PATCH net-next v13 01/10] net: phy: aquantia: fix system interface type not updated in forced mode
From: Bartosz Golaszewski @ 2026-07-13 13:20 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Maxime Coquelin, Alexandre Torgue,
Vinod Koul, Giuseppe Cavallaro, Chen-Yu Tsai, Jernej Skrabec,
Neil Armstrong, Kevin Hilman, Jerome Brunet, Shawn Guo,
Fabio Estevam, Jan Petrous, s32, Mohd Ayaan Anwar, Romain Gantois,
Geert Uytterhoeven, Magnus Damm, Maxime Ripard,
Christophe Roullier, Bartosz Golaszewski, Radu Rendec
Cc: linux-arm-msm, devicetree, linux-kernel, netdev, linux-stm32,
linux-arm-kernel, Drew Fustini, linux-sunxi, linux-amlogic,
linux-mips, imx, linux-renesas-soc, linux-rockchip, sophgo,
linux-riscv, brgl, Bartosz Golaszewski, Bartosz Golaszewski,
stable
In-Reply-To: <20260713-qcom-sa8255p-emac-v13-0-119f8699ef8e@oss.qualcomm.com>
aqr_gen1_read_status() decodes the MDIO_PHYXS_VEND_IF_STATUS register
to determine which SerDes interface the PHY is currently using on its
system side and stores the result in phydev->interface. phylink relies
on this value to configure the MAC.
The autoneg == AUTONEG_DISABLE check is not correct:
MDIO_PHYXS_VEND_IF_STATUS is set by the PHY firmware based on the
negotiated link speed, not based on whether autoneg was used to reach
it. When the link comes up at 1G in forced mode, the register correctly
reads SGMII, but the early return prevents phydev->interface from being
updated. It stays at whatever value it held before (typically 2500BASE-X
from the initial autoneg run), so phylink configures the MAC for the
wrong interface and the link cannot come up.
Remove the autoneg guard so that the system interface type is always
decoded when the link is up.
Cc: stable@vger.kernel.org
Fixes: 110a2432c520 ("net: phy: aquantia: add downshift support")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
drivers/net/phy/aquantia/aquantia_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/phy/aquantia/aquantia_main.c b/drivers/net/phy/aquantia/aquantia_main.c
index e95d391a6dc233879ae1fb2a97758b3df9600ce5..b720e4e9028cc20823297e8bbd239121aeafa09f 100644
--- a/drivers/net/phy/aquantia/aquantia_main.c
+++ b/drivers/net/phy/aquantia/aquantia_main.c
@@ -544,7 +544,7 @@ static int aqr_gen1_read_status(struct phy_device *phydev)
if (ret)
return ret;
- if (!phydev->link || phydev->autoneg == AUTONEG_DISABLE)
+ if (!phydev->link)
return 0;
/* The status register is not immediately correct on line side link up.
--
2.47.3
^ permalink raw reply related
* [PATCH net-next v13 00/10] net: stmmac: qcom-ethqos: add support for SCMI power domains
From: Bartosz Golaszewski @ 2026-07-13 13:20 UTC (permalink / raw)
To: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Maxime Coquelin, Alexandre Torgue,
Vinod Koul, Giuseppe Cavallaro, Chen-Yu Tsai, Jernej Skrabec,
Neil Armstrong, Kevin Hilman, Jerome Brunet, Shawn Guo,
Fabio Estevam, Jan Petrous, s32, Mohd Ayaan Anwar, Romain Gantois,
Geert Uytterhoeven, Magnus Damm, Maxime Ripard,
Christophe Roullier, Bartosz Golaszewski, Radu Rendec
Cc: linux-arm-msm, devicetree, linux-kernel, netdev, linux-stm32,
linux-arm-kernel, Drew Fustini, linux-sunxi, linux-amlogic,
linux-mips, imx, linux-renesas-soc, linux-rockchip, sophgo,
linux-riscv, brgl, Bartosz Golaszewski, Bartosz Golaszewski,
stable, Krzysztof Kozlowski, Martin Blumenstingl, Lad Prabhakar
Add support for the firmware-managed variant of the DesignWare MAC on
the sa8255p platform. This series contains new DT bindings and driver
changes required to support the MAC in the STMMAC driver.
It also reorganizes the ethqos code quite a bit to make the introduction
of power domains into the driver a bit easier on the eye.
The DTS changes will go in separately.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
Changes in v13:
- Reapply OPP on speed change in the PHY driver
- Use linux/device-id/of.h instead of mod_devicetable.h
- Fix the "invalid PTP clock rate" warning on sa8255p
- Add commits necessary to allow correct link speed change with SCMI
- Link to v12: https://patch.msgid.link/20260706-qcom-sa8255p-emac-v12-0-e3ab1ecf2901@oss.qualcomm.com
Changes in v12:
- Drop the power-domain-names from the SGMII PHY DT bindings
- Add missing Kconfig dependency on PM for the new SGMII PHY driver
- Link to v11: https://patch.msgid.link/20260629-qcom-sa8255p-emac-v11-0-1b7fb95b51f9@oss.qualcomm.com
Changes in v11:
- Take a new approach: add a dedicated driver for the firmware-managed
SGMII PHY and simplify changes made to the MAC driver
- Link to v10: https://patch.msgid.link/20260323-qcom-sa8255p-emac-v10-0-79302b238a16@oss.qualcomm.com
Changes in v10:
- Fix unit address in DT example
- Link to v9: https://patch.msgid.link/20260316-qcom-sa8255p-emac-v9-0-c58934e76ff2@oss.qualcomm.com
Changes in v9:
- Rebase on top of current linux-next again
- Link to v8: https://patch.msgid.link/20260311-qcom-sa8255p-emac-v8-0-58227bcf1018@oss.qualcomm.com
Changes in v8:
- Rebase on top of recent changes in linux-next which required an
extensive rework
- Drop partial R-b tags
- Link to v7: https://patch.msgid.link/20260306-qcom-sa8255p-emac-v7-0-d6a3013094b7@oss.qualcomm.com
Changes in v7:
- Restored the correct authorship after learning git uses .mailmap for
the --author switch
- Rebased on top of changes from Russell
- Fixed resource management issues in error paths
- Link to v6: https://lore.kernel.org/r/20260112-qcom-sa8255p-emac-v6-0-86a3d4b2ad83@oss.qualcomm.com
Changes in v6:
- Fix $id value in the bindings
- Drop patch 3/8 from the series
- Update init/exit callback signatures
- Link to v5: https://lore.kernel.org/r/20251107-qcom-sa8255p-emac-v5-0-01d3e3aaf388@linaro.org
- Link to v6: https://lore.kernel.org/r/20251219-qcom-sa8255p-emac-v6-0-487f1082461e@oss.qualcomm.com
Changes in v5:
- Name the DT binding document after the new compatbile
- Add missing space
- Make the power-domains limits stricter
- Link to v4: https://lore.kernel.org/r/20251104-qcom-sa8255p-emac-v4-0-f76660087cea@linaro.org
Changes in v4:
- Remove the phys property from the SCMI bindings
- Mark the power-domain-names property as required
- Set maxItems for power-domains to 1 for all existing bindings to
maintain the current requirements after modifying the value in the
top-level document
- Link to v3: https://lore.kernel.org/r/20251027-qcom-sa8255p-emac-v3-0-75767b9230ab@linaro.org
Changes in v3:
- Drop 'power' and 'perf' prefixes from power domain names
- Rebase on top of Russell's changes to dwmac
- Rebase on top of even more changes from Russell that are not yet
in next (E1vB6ld-0000000BIPy-2Qi4@rmk-PC.armlinux.org.uk)
- Link to v2: https://lore.kernel.org/all/20251008-qcom-sa8255p-emac-v2-0-92bc29309fce@linaro.org/
Changes in v2:
- Fix the power-domains property in DT bindings
- Rework the DT bindings example
- Drop the DTS patch, it will go upstream separately
- Link to v1: https://lore.kernel.org/r/20250910-qcom-sa8255p-emac-v1-0-32a79cf1e668@linaro.org
---
Bartosz Golaszewski (10):
net: phy: aquantia: fix system interface type not updated in forced mode
dt-bindings: phy: document the serdes PHY on sa8255p
phy: qcom: add the SGMII SerDes PHY driver for SCMI systems
dt-bindings: net: qcom: document the ethqos device for SCMI-based systems
net: stmmac: qcom-ethqos: set serdes mode before powerup
net: stmmac: qcom-ethqos: update phy_mode to the resolved interface in mac_finish()
net: stmmac: qcom-ethqos: fix SGMII loopback not set on resume after speed change
net: stmmac: qcom-ethqos: reuse the address of ethqos_emac_driver_data
net: stmmac: qcom-ethqos: factor out linux-level setup into a separate function
net: stmmac: qcom-ethqos: add support for sa8255p
.../bindings/net/allwinner,sun7i-a20-gmac.yaml | 3 +
.../bindings/net/altr,socfpga-stmmac.yaml | 3 +
.../bindings/net/amlogic,meson-dwmac.yaml | 3 +
.../devicetree/bindings/net/eswin,eic7700-eth.yaml | 3 +
.../devicetree/bindings/net/intel,dwmac-plat.yaml | 3 +
.../bindings/net/loongson,ls1b-gmac.yaml | 3 +
.../bindings/net/loongson,ls1c-emac.yaml | 3 +
.../devicetree/bindings/net/nxp,dwmac-imx.yaml | 3 +
.../devicetree/bindings/net/nxp,lpc1850-dwmac.yaml | 3 +
.../devicetree/bindings/net/nxp,s32-dwmac.yaml | 3 +
.../devicetree/bindings/net/qcom,ethqos.yaml | 3 +
.../bindings/net/qcom,sa8255p-ethqos.yaml | 107 +++++++++
.../devicetree/bindings/net/renesas,rzn1-gmac.yaml | 3 +
.../bindings/net/renesas,rzv2h-gbeth.yaml | 3 +
.../devicetree/bindings/net/rockchip-dwmac.yaml | 3 +
.../devicetree/bindings/net/snps,dwmac.yaml | 5 +-
.../bindings/net/sophgo,cv1800b-dwmac.yaml | 3 +
.../bindings/net/sophgo,sg2044-dwmac.yaml | 3 +
.../bindings/net/starfive,jh7110-dwmac.yaml | 3 +
.../devicetree/bindings/net/stm32-dwmac.yaml | 3 +
.../devicetree/bindings/net/tesla,fsd-ethqos.yaml | 3 +
.../devicetree/bindings/net/thead,th1520-gmac.yaml | 3 +
.../bindings/net/toshiba,visconti-dwmac.yaml | 3 +
.../bindings/phy/qcom,sa8255p-dwmac-sgmii-phy.yaml | 50 +++++
MAINTAINERS | 1 +
.../ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c | 246 ++++++++++++++++-----
drivers/net/phy/aquantia/aquantia_main.c | 2 +-
drivers/phy/qualcomm/Kconfig | 11 +
drivers/phy/qualcomm/Makefile | 1 +
drivers/phy/qualcomm/phy-qcom-sgmii-eth-scmi.c | 165 ++++++++++++++
30 files changed, 593 insertions(+), 58 deletions(-)
---
base-commit: 141ee96ad5c69b9d33b2b50ddd49315671023726
change-id: 20250704-qcom-sa8255p-emac-8460235ac512
Best regards,
--
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox