* [PATCH v4 net-next 6/9] octeontx2-pf: switch: Register notifiers for switch offload
From: Ratheesh Kannoth @ 2026-07-21 8:18 UTC (permalink / raw)
To: linux-kernel, netdev
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, sgoutham,
Ratheesh Kannoth
In-Reply-To: <20260721081824.1430607-1-rkannoth@marvell.com>
The representor enables switch mode via devlink; register and unregister
the switch notifier blocks when that mode is turned on or off so the PF
can observe FIB routes, neighbour updates, IPv4/IPv6 address changes,
netdev state, and switchdev FDB notifications.
Add sw_nb_v4.c and sw_nb_v6.c for IPv4 and IPv6-specific handling, build
sw_nb_v6.o only when CONFIG_IPV6 is set, and extend sw_nb.c with device
filtering for Cavium ports behind bridges and VLANs.
Initialize and tear down the existing sw_fdb, sw_fib, and sw_fl helpers
together with notifier registration.
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
---
.../ethernet/marvell/octeontx2/nic/Makefile | 6 +-
.../net/ethernet/marvell/octeontx2/nic/rep.c | 38 +-
.../marvell/octeontx2/nic/switch/sw_nb.c | 502 +++++++++++++++++-
.../marvell/octeontx2/nic/switch/sw_nb.h | 37 +-
.../marvell/octeontx2/nic/switch/sw_nb_v4.c | 358 +++++++++++++
.../marvell/octeontx2/nic/switch/sw_nb_v4.h | 21 +
.../marvell/octeontx2/nic/switch/sw_nb_v6.c | 292 ++++++++++
.../marvell/octeontx2/nic/switch/sw_nb_v6.h | 21 +
8 files changed, 1266 insertions(+), 9 deletions(-)
create mode 100644 drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v4.c
create mode 100644 drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v4.h
create mode 100644 drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v6.c
create mode 100644 drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v6.h
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/Makefile b/drivers/net/ethernet/marvell/octeontx2/nic/Makefile
index 123b0af23abd..02ab0634f58f 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/Makefile
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/Makefile
@@ -11,7 +11,11 @@ rvu_nicpf-y := otx2_pf.o otx2_common.o otx2_txrx.o otx2_ethtool.o \
otx2_flows.o otx2_tc.o cn10k.o cn20k.o otx2_dmac_flt.o \
otx2_devlink.o qos_sq.o qos.o otx2_xsk.o \
switch/sw_fdb.o switch/sw_fl.o
-rvu_nicpf-$(CONFIG_OCTEONTX_SWITCH) += switch/sw_nb.o switch/sw_fib.o
+rvu_nicpf-$(CONFIG_OCTEONTX_SWITCH) += switch/sw_nb.o switch/sw_fib.o \
+ switch/sw_nb_v4.o
+ifneq ($(CONFIG_IPV6),)
+rvu_nicpf-$(CONFIG_OCTEONTX_SWITCH) += switch/sw_nb_v6.o
+endif
rvu_nicvf-y := otx2_vf.o
rvu_rep-y := rep.o
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/rep.c b/drivers/net/ethernet/marvell/octeontx2/nic/rep.c
index 257a2ae6a53e..1900235fabc5 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/rep.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/rep.c
@@ -15,6 +15,7 @@
#include "cn10k.h"
#include "otx2_reg.h"
#include "rep.h"
+#include "switch/sw_nb.h"
#define DRV_NAME "rvu_rep"
#define DRV_STRING "Marvell RVU Representor Driver"
@@ -399,22 +400,55 @@ static void rvu_rep_get_stats64(struct net_device *dev,
static int rvu_eswitch_config(struct otx2_nic *priv, u8 ena)
{
+#if IS_ENABLED(CONFIG_OCTEONTX_SWITCH)
+ struct net_device *netdev = priv->netdev;
+#endif
struct devlink_port_attrs attrs = {};
struct esw_cfg_req *req;
+ int mbox_err;
+#if IS_ENABLED(CONFIG_OCTEONTX_SWITCH)
+ int err;
+#endif
rvu_rep_devlink_set_switch_id(priv, &attrs.switch_id);
+#if IS_ENABLED(CONFIG_OCTEONTX_SWITCH)
+ if (ena) {
+ err = sw_nb_register(netdev);
+ if (err)
+ return err;
+ }
+#endif
+
mutex_lock(&priv->mbox.lock);
req = otx2_mbox_alloc_msg_esw_cfg(&priv->mbox);
if (!req) {
mutex_unlock(&priv->mbox.lock);
+#if IS_ENABLED(CONFIG_OCTEONTX_SWITCH)
+ if (ena)
+ sw_nb_unregister(netdev);
+#endif
return -ENOMEM;
}
req->ena = ena;
memcpy(req->switch_id, attrs.switch_id.id, attrs.switch_id.id_len);
- otx2_sync_mbox_msg(&priv->mbox);
+ mbox_err = otx2_sync_mbox_msg(&priv->mbox);
mutex_unlock(&priv->mbox.lock);
- return 0;
+
+#if IS_ENABLED(CONFIG_OCTEONTX_SWITCH)
+ if (ena && mbox_err) {
+ sw_nb_unregister(netdev);
+ return mbox_err;
+ }
+
+ if (!ena) {
+ err = sw_nb_unregister(netdev);
+ if (err && !mbox_err)
+ return err;
+ }
+#endif
+
+ return mbox_err;
}
static netdev_tx_t rvu_rep_xmit(struct sk_buff *skb, struct net_device *dev)
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.c b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.c
index 243611835e3a..8a09876e8297 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.c
@@ -4,18 +4,516 @@
* Copyright (C) 2026 Marvell.
*
*/
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <net/switchdev.h>
+#include <net/netevent.h>
+#include <net/arp.h>
+#include <net/route.h>
+#include <linux/inetdevice.h>
+#include <net/addrconf.h>
+
+#include "../otx2_reg.h"
+#include "../otx2_common.h"
+#include "../otx2_struct.h"
+#include "../cn10k.h"
#include "sw_nb.h"
+#include "sw_fdb.h"
+#include "sw_fib.h"
+#include "sw_fl.h"
+#include "sw_nb_v4.h"
+#include "sw_nb_v6.h"
#if IS_ENABLED(CONFIG_OCTEONTX_SWITCH)
-int sw_nb_unregister(void)
+/* PF netdev for netdev_* logging when notifier info has no device */
+static struct net_device *sw_nb_pf_netdev;
+/* Notifier registration is only toggled from rvu_eswitch_config(), which is
+ * reached exclusively via otx2_devlink_eswitch_mode_set() on the RVU
+ * representor devlink (otx2_rep_dev()). Devlink holds the per-instance
+ * devlink->lock for the full DEVLINK_CMD_ESWITCH_SET handler (pre_doit
+ * through post_doit), serializing register/unregister on that devlink.
+ * Regular netdev PFs return -EOPNOTSUPP from eswitch_mode_set and never
+ * invoke these helpers, so concurrent devlink changes on other PFs cannot
+ * race on this state.
+ */
+static bool sw_nb_registered;
+
+static const char *sw_nb_cmd2str[OTX2_CMD_MAX] = {
+ [OTX2_DEV_UP] = "OTX2_DEV_UP",
+ [OTX2_DEV_DOWN] = "OTX2_DEV_DOWN",
+ [OTX2_DEV_CHANGE] = "OTX2_DEV_CHANGE",
+ [OTX2_NEIGH_UPDATE] = "OTX2_NEIGH_UPDATE",
+ [OTX2_FIB_ENTRY_REPLACE] = "OTX2_FIB_ENTRY_REPLACE",
+ [OTX2_FIB_ENTRY_ADD] = "OTX2_FIB_ENTRY_ADD",
+ [OTX2_FIB_ENTRY_DEL] = "OTX2_FIB_ENTRY_DEL",
+ [OTX2_FIB_ENTRY_APPEND] = "OTX2_FIB_ENTRY_APPEND",
+};
+
+const char *sw_nb_get_cmd2str(int cmd)
+{
+ return sw_nb_cmd2str[cmd];
+}
+EXPORT_SYMBOL(sw_nb_get_cmd2str);
+
+bool sw_nb_is_cavium_dev(struct net_device *netdev)
+{
+ struct pci_dev *pdev;
+ struct device *dev;
+
+ dev = netdev->dev.parent;
+ if (!dev || dev->bus != &pci_bus_type)
+ return false;
+
+ pdev = to_pci_dev(dev);
+ if (pdev->vendor != PCI_VENDOR_ID_CAVIUM)
+ return false;
+
+ return true;
+}
+
+/* Resolve the Cavium PF netdev used to reach the switch AF for offload.
+ *
+ * For a bridge master netdev, any Cavium netdev enslaved to the bridge is
+ * sufficient: callers only need a PF netdev to obtain the switch AF mailbox
+ * context (pcifunc). Bridge-specific information is tagged separately in
+ * the offload entry (entry->bridge), so walking every lower netdev is not
+ * required here.
+ */
+struct net_device *sw_nb_resolve_pf_dev(struct net_device *dev)
{
+ struct net_device *pf_dev = dev;
+ struct list_head *iter;
+
+ rcu_read_lock();
+
+ if (netif_is_bridge_master(dev)) {
+ iter = &dev->adj_list.lower;
+ pf_dev = netdev_next_lower_dev_rcu(dev, &iter);
+ if (!pf_dev)
+ pf_dev = dev;
+ } else if (is_vlan_dev(dev)) {
+ pf_dev = vlan_dev_real_dev(dev);
+ }
+
+ rcu_read_unlock();
+
+ if (!sw_nb_is_cavium_dev(pf_dev))
+ return NULL;
+
+ return pf_dev;
+}
+
+static int sw_nb_check_slaves(struct net_device *dev,
+ struct netdev_nested_priv *priv)
+{
+ int *cnt;
+
+ if (!priv->flags)
+ return 0;
+
+ priv->flags &= sw_nb_is_cavium_dev(dev);
+ if (priv->flags) {
+ cnt = priv->data;
+ (*cnt)++;
+ }
+
return 0;
}
-int sw_nb_register(void)
+bool sw_nb_is_valid_dev(struct net_device *netdev)
+{
+ struct netdev_nested_priv priv;
+ struct net_device *br;
+ int cnt = 0;
+ bool valid;
+
+ priv.flags = true;
+ priv.data = &cnt;
+
+ rcu_read_lock();
+
+ if (netif_is_bridge_master(netdev) || is_vlan_dev(netdev)) {
+ netdev_walk_all_lower_dev_rcu(netdev, sw_nb_check_slaves, &priv);
+ valid = priv.flags && cnt;
+ rcu_read_unlock();
+ return valid;
+ }
+
+ if (netif_is_bridge_port(netdev)) {
+ br = netdev_master_upper_dev_get_rcu(netdev);
+ if (!br) {
+ rcu_read_unlock();
+ return false;
+ }
+ netdev_walk_all_lower_dev_rcu(br, sw_nb_check_slaves, &priv);
+ valid = priv.flags && cnt;
+ rcu_read_unlock();
+ return valid;
+ }
+
+ rcu_read_unlock();
+
+ return sw_nb_is_cavium_dev(netdev);
+}
+
+static int sw_nb_fdb_event(struct notifier_block *unused,
+ unsigned long event, void *ptr)
+{
+ struct net_device *dev = switchdev_notifier_info_to_dev(ptr);
+ struct switchdev_notifier_fdb_info *fdb_info = ptr;
+
+ if (!sw_nb_is_valid_dev(dev))
+ return NOTIFY_DONE;
+
+ switch (event) {
+ case SWITCHDEV_FDB_ADD_TO_DEVICE:
+ if (fdb_info->is_local)
+ break;
+ break;
+
+ case SWITCHDEV_FDB_DEL_TO_DEVICE:
+ if (fdb_info->is_local)
+ break;
+ break;
+
+ default:
+ return NOTIFY_DONE;
+ }
+
+ return NOTIFY_DONE;
+}
+
+static struct notifier_block sw_nb_fdb = {
+ .notifier_call = sw_nb_fdb_event,
+};
+
+static void __maybe_unused
+sw_nb_fib_event_dump(unsigned long event, void *ptr)
+{
+ struct fib_entry_notifier_info *fen_info = ptr;
+ struct net_device *log_dev;
+ struct fib_nh *fib_nh;
+ struct fib_info *fi;
+ int i;
+
+ fi = fen_info->fi;
+ log_dev = (fi && fi->fib_nhs) ? fi->fib_nh->fib_nh_dev : sw_nb_pf_netdev;
+ if (log_dev)
+ netdev_info(log_dev, "%s: FIB event=%lu dst=%pI4 dstlen=%u type=%u\n",
+ __func__, event, (const __be32 *)&fen_info->dst,
+ fen_info->dst_len, fen_info->type);
+
+ if (!fi)
+ return;
+
+ fib_nh = fi->fib_nh;
+ for (i = 0; i < fi->fib_nhs; i++, fib_nh++) {
+ if (!fib_nh->fib_nh_dev)
+ continue;
+ netdev_info(fib_nh->fib_nh_dev,
+ "%s: dev=%s saddr=%pI4 gw=%pI4\n",
+ __func__, fib_nh->fib_nh_dev->name,
+ &fib_nh->nh_saddr, &fib_nh->fib_nh_gw4);
+ }
+}
+
+#define SWITCH_NB_FIB_EVENT_DUMP(...) \
+ sw_nb_fib_event_dump(__VA_ARGS__)
+
+int sw_nb_fib_event_to_otx2_event(int event, struct net_device *netdev)
+{
+ switch (event) {
+ case FIB_EVENT_ENTRY_REPLACE:
+ return OTX2_FIB_ENTRY_REPLACE;
+ case FIB_EVENT_ENTRY_ADD:
+ return OTX2_FIB_ENTRY_ADD;
+ case FIB_EVENT_ENTRY_DEL:
+ return OTX2_FIB_ENTRY_DEL;
+ default:
+ break;
+ }
+
+ netdev_err(netdev, "Wrong FIB event %d\n", event);
+ return -1;
+}
+
+static int sw_nb_fib_event(struct notifier_block *nb,
+ unsigned long event, void *ptr)
+{
+ struct fib_notifier_info *info = ptr;
+
+ switch (event) {
+ case FIB_EVENT_ENTRY_REPLACE:
+ case FIB_EVENT_ENTRY_ADD:
+ case FIB_EVENT_ENTRY_DEL:
+ break;
+ default:
+ if (sw_nb_pf_netdev)
+ netdev_dbg(sw_nb_pf_netdev,
+ "%s: Won't process FIB event %lu\n",
+ __func__, event);
+ return NOTIFY_DONE;
+ }
+
+ switch (info->family) {
+ case AF_INET:
+ return sw_nb_v4_fib_event(nb, event, ptr);
+#if IS_ENABLED(CONFIG_IPV6)
+ case AF_INET6:
+ return sw_nb_v6_fib_event(nb, event, ptr);
+#endif
+ default:
+ break;
+ }
+ return NOTIFY_DONE;
+}
+
+static struct notifier_block sw_nb_fib = {
+ .notifier_call = sw_nb_fib_event,
+};
+
+static int sw_nb_net_event(struct notifier_block *nb,
+ unsigned long event, void *ptr)
+{
+ struct neighbour *n = ptr;
+
+ if (!sw_nb_is_valid_dev(n->dev))
+ return NOTIFY_DONE;
+
+ if (event != NETEVENT_NEIGH_UPDATE)
+ return NOTIFY_DONE;
+
+ switch (n->tbl->family) {
+ case AF_INET:
+ return sw_nb_net_v4_neigh_update(nb, event, ptr);
+#if IS_ENABLED(CONFIG_IPV6)
+ case AF_INET6:
+ return sw_nb_net_v6_neigh_update(nb, event, ptr);
+#endif
+ default:
+ break;
+ }
+ return NOTIFY_DONE;
+}
+
+static struct notifier_block sw_nb_netevent = {
+ .notifier_call = sw_nb_net_event,
+
+};
+
+int sw_nb_inetaddr_event_to_otx2_event(int event, struct net_device *netdev)
+{
+ switch (event) {
+ case NETDEV_CHANGE:
+ return OTX2_DEV_CHANGE;
+ case NETDEV_UP:
+ return OTX2_DEV_UP;
+ case NETDEV_DOWN:
+ return OTX2_DEV_DOWN;
+ default:
+ break;
+ }
+ netdev_dbg(netdev, "%s: Wrong interaddr event %d\n",
+ __func__, event);
+ return -1;
+}
+
+static struct notifier_block sw_nb_v4_inetaddr = {
+ .notifier_call = sw_nb_v4_inetaddr_event,
+};
+
+#if IS_ENABLED(CONFIG_IPV6)
+static struct notifier_block sw_nb_v6_inetaddr = {
+ .notifier_call = sw_nb_v6_inetaddr_event,
+};
+#endif
+
+static int sw_nb_netdev_event(struct notifier_block *unused,
+ unsigned long event, void *ptr)
{
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+ struct in_device *idev;
+ struct inet6_dev *i6dev;
+
+ if (event != NETDEV_CHANGE &&
+ event != NETDEV_UP &&
+ event != NETDEV_DOWN) {
+ return NOTIFY_DONE;
+ }
+
+ if (!sw_nb_is_valid_dev(dev))
+ return NOTIFY_DONE;
+
+ idev = __in_dev_get_rtnl(dev);
+ if (idev)
+ sw_nb_v4_netdev_event(unused, event, ptr);
+
+#if IS_ENABLED(CONFIG_IPV6)
+ i6dev = __in6_dev_get(dev);
+ if (i6dev)
+ sw_nb_v6_netdev_event(unused, event, ptr);
+#endif
+
+ return NOTIFY_DONE;
+}
+
+static struct notifier_block sw_nb_netdev = {
+ .notifier_call = sw_nb_netdev_event,
+};
+
+int sw_nb_unregister(struct net_device *netdev)
+{
+ int err, ret = 0;
+
+ if (!sw_nb_registered)
+ return 0;
+
+ err = unregister_switchdev_notifier(&sw_nb_fdb);
+ if (err) {
+ netdev_err(netdev, "Failed to unregister switchdev nb\n");
+ ret = err;
+ }
+
+ err = unregister_fib_notifier(&init_net, &sw_nb_fib);
+ if (err) {
+ netdev_err(netdev, "Failed to unregister fib nb\n");
+ if (!ret)
+ ret = err;
+ }
+
+ err = unregister_netevent_notifier(&sw_nb_netevent);
+ if (err) {
+ netdev_err(netdev, "Failed to unregister netevent\n");
+ if (!ret)
+ ret = err;
+ }
+
+ err = unregister_inetaddr_notifier(&sw_nb_v4_inetaddr);
+ if (err) {
+ netdev_err(netdev, "Failed to unregister addr event\n");
+ if (!ret)
+ ret = err;
+ }
+
+#if IS_ENABLED(CONFIG_IPV6)
+ err = unregister_inet6addr_notifier(&sw_nb_v6_inetaddr);
+ if (err) {
+ netdev_err(netdev, "Failed to unregister addr event\n");
+ if (!ret)
+ ret = err;
+ }
+#endif
+
+ err = unregister_netdevice_notifier(&sw_nb_netdev);
+ if (err) {
+ netdev_err(netdev, "Failed to unregister netdev notifier\n");
+ if (!ret)
+ ret = err;
+ }
+
+ sw_fl_deinit();
+ sw_fib_deinit();
+ sw_fdb_deinit();
+
+ sw_nb_pf_netdev = NULL;
+ sw_nb_registered = false;
+
+ return ret;
+}
+EXPORT_SYMBOL(sw_nb_unregister);
+
+int sw_nb_register(struct net_device *netdev)
+{
+ int err;
+
+ if (sw_nb_registered)
+ return -EBUSY;
+
+ sw_nb_pf_netdev = netdev;
+
+ err = sw_fdb_init();
+ if (err)
+ goto err_clear;
+
+ err = sw_fib_init();
+ if (err)
+ goto err_fdb;
+
+ err = sw_fl_init();
+ if (err)
+ goto err_fib;
+
+ err = register_switchdev_notifier(&sw_nb_fdb);
+ if (err) {
+ netdev_err(netdev, "Failed to register switchdev nb\n");
+ goto err_helpers;
+ }
+
+ err = register_fib_notifier(&init_net, &sw_nb_fib, NULL, NULL);
+ if (err) {
+ netdev_err(netdev, "Failed to register fb notifier block\n");
+ goto err1;
+ }
+
+ err = register_netevent_notifier(&sw_nb_netevent);
+ if (err) {
+ netdev_err(netdev, "Failed to register netevent\n");
+ goto err2;
+ }
+
+#if IS_ENABLED(CONFIG_IPV6)
+ err = register_inet6addr_notifier(&sw_nb_v6_inetaddr);
+ if (err) {
+ netdev_err(netdev, "Failed to register addr event\n");
+ goto err3;
+ }
+#endif
+
+ err = register_inetaddr_notifier(&sw_nb_v4_inetaddr);
+ if (err) {
+ netdev_err(netdev, "Failed to register addr event\n");
+ goto err4;
+ }
+
+ err = register_netdevice_notifier(&sw_nb_netdev);
+ if (err) {
+ netdev_err(netdev, "Failed to register netdevice nb\n");
+ goto err5;
+ }
+
+ sw_nb_registered = true;
+
return 0;
+
+err5:
+ unregister_inetaddr_notifier(&sw_nb_v4_inetaddr);
+
+err4:
+#if IS_ENABLED(CONFIG_IPV6)
+ unregister_inet6addr_notifier(&sw_nb_v6_inetaddr);
+
+err3:
+#endif
+ unregister_netevent_notifier(&sw_nb_netevent);
+
+err2:
+ unregister_fib_notifier(&init_net, &sw_nb_fib);
+
+err1:
+ unregister_switchdev_notifier(&sw_nb_fdb);
+
+err_helpers:
+ sw_fl_deinit();
+err_fib:
+ sw_fib_deinit();
+err_fdb:
+ sw_fdb_deinit();
+err_clear:
+ sw_nb_pf_netdev = NULL;
+ return err;
}
+EXPORT_SYMBOL(sw_nb_register);
#endif
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.h b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.h
index 73cc1e99b8ec..e995c0e6046b 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.h
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.h
@@ -9,12 +9,41 @@
#include <linux/kconfig.h>
+struct net_device;
+struct otx2_nic;
+struct af2pf_fdb_refresh_req;
+struct msg_rsp;
+
#if IS_ENABLED(CONFIG_OCTEONTX_SWITCH)
-int sw_nb_register(void);
-int sw_nb_unregister(void);
+enum {
+ OTX2_DEV_UP = 1,
+ OTX2_DEV_DOWN,
+ OTX2_DEV_CHANGE,
+ OTX2_NEIGH_UPDATE,
+ OTX2_FIB_ENTRY_REPLACE,
+ OTX2_FIB_ENTRY_ADD,
+ OTX2_FIB_ENTRY_DEL,
+ OTX2_FIB_ENTRY_APPEND,
+ OTX2_CMD_MAX,
+};
+
+int sw_nb_register(struct net_device *netdev);
+int sw_nb_unregister(struct net_device *netdev);
+bool sw_nb_is_valid_dev(struct net_device *netdev);
+struct net_device *sw_nb_resolve_pf_dev(struct net_device *dev);
+
+int otx2_mbox_up_handler_af2pf_fdb_refresh(struct otx2_nic *pf,
+ struct af2pf_fdb_refresh_req *req,
+ struct msg_rsp *rsp);
+
+bool sw_nb_is_cavium_dev(struct net_device *netdev);
+int sw_nb_fib_event_to_otx2_event(int event, struct net_device *netdev);
+int sw_nb_inetaddr_event_to_otx2_event(int event, struct net_device *netdev);
+
+const char *sw_nb_get_cmd2str(int cmd);
#else
-static inline int sw_nb_register(void) { return 0; }
-static inline int sw_nb_unregister(void) { return 0; }
+static inline int sw_nb_register(struct net_device *netdev) { return 0; }
+static inline int sw_nb_unregister(struct net_device *netdev) { return 0; }
#endif
#endif /* SW_NB_H_ */
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v4.c b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v4.c
new file mode 100644
index 000000000000..c773fce1bc50
--- /dev/null
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v4.c
@@ -0,0 +1,358 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Marvell RVU switch driver
+ *
+ * Copyright (C) 2026 Marvell.
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <net/switchdev.h>
+#include <net/netevent.h>
+#include <net/arp.h>
+#include <net/route.h>
+#include <linux/inetdevice.h>
+
+#include "../otx2_reg.h"
+#include "../otx2_common.h"
+#include "../otx2_struct.h"
+#include "../cn10k.h"
+#include "sw_nb.h"
+#include "sw_fdb.h"
+#include "sw_fib.h"
+#include "sw_fl.h"
+#include "sw_nb_v4.h"
+
+#if IS_ENABLED(CONFIG_OCTEONTX_SWITCH)
+
+int sw_nb_v4_netdev_event(struct notifier_block *unused,
+ unsigned long event, void *ptr)
+{
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+ struct netdev_hw_addr *dev_addr;
+ struct net_device *pf_dev;
+ struct in_device *idev;
+ struct in_ifaddr *ifa;
+ struct fib_entry *entry;
+ struct otx2_nic *pf;
+
+ idev = __in_dev_get_rtnl(dev);
+ if (!idev || !idev->ifa_list)
+ return NOTIFY_DONE;
+
+ /* Switch offload supports a single IPv4 address per interface for now. */
+ ifa = rtnl_dereference(idev->ifa_list);
+
+ entry = kcalloc(1, sizeof(*entry), GFP_KERNEL);
+ if (!entry)
+ return NOTIFY_DONE;
+
+ entry->cmd = sw_nb_inetaddr_event_to_otx2_event(event, dev);
+ entry->dst = ifa->ifa_address;
+ entry->dst_len = 32;
+ entry->mac_valid = 1;
+ entry->host = 1;
+
+ pf_dev = sw_nb_resolve_pf_dev(dev);
+ if (!pf_dev) {
+ kfree(entry);
+ return NOTIFY_DONE;
+ }
+
+ if (netif_is_bridge_master(dev)) {
+ entry->bridge = 1;
+ } else if (is_vlan_dev(dev)) {
+ entry->vlan_valid = 1;
+ entry->vlan_tag = cpu_to_be16(vlan_dev_vlan_id(dev));
+ }
+
+ pf = netdev_priv(pf_dev);
+ entry->port_id = pf->pcifunc;
+
+ for_each_dev_addr(dev, dev_addr) {
+ ether_addr_copy(entry->mac, dev_addr->addr);
+ break;
+ }
+
+ netdev_dbg(dev, "%s: pushing netdev event from HOST interface address %pI4, %pM, dev=%s\n",
+ __func__, &entry->dst, entry->mac, dev->name);
+ kfree(entry);
+
+ return NOTIFY_DONE;
+}
+
+int sw_nb_v4_inetaddr_event(struct notifier_block *nb,
+ unsigned long event, void *ptr)
+{
+ struct in_ifaddr *ifa = (struct in_ifaddr *)ptr;
+ struct net_device *dev = ifa->ifa_dev->dev;
+ struct netdev_hw_addr *dev_addr;
+ struct net_device *pf_dev;
+ struct in_device *idev;
+ struct fib_entry *entry;
+ struct otx2_nic *pf;
+
+ if (event != NETDEV_CHANGE &&
+ event != NETDEV_UP &&
+ event != NETDEV_DOWN) {
+ return NOTIFY_DONE;
+ }
+
+ if (!sw_nb_is_valid_dev(dev))
+ return NOTIFY_DONE;
+
+ idev = __in_dev_get_rtnl(dev);
+ if (!idev || !idev->ifa_list)
+ return NOTIFY_DONE;
+
+ entry = kcalloc(1, sizeof(*entry), GFP_ATOMIC);
+ if (!entry)
+ return NOTIFY_DONE;
+
+ entry->cmd = sw_nb_inetaddr_event_to_otx2_event(event, dev);
+ entry->dst = ifa->ifa_address;
+ entry->dst_len = 32;
+ entry->mac_valid = 1;
+ entry->host = 1;
+
+ pf_dev = sw_nb_resolve_pf_dev(dev);
+ if (!pf_dev) {
+ kfree(entry);
+ return NOTIFY_DONE;
+ }
+
+ if (netif_is_bridge_master(dev)) {
+ entry->bridge = 1;
+ } else if (is_vlan_dev(dev)) {
+ entry->vlan_valid = 1;
+ entry->vlan_tag = cpu_to_be16(vlan_dev_vlan_id(dev));
+ }
+
+ pf = netdev_priv(pf_dev);
+ entry->port_id = pf->pcifunc;
+
+ for_each_dev_addr(dev, dev_addr) {
+ ether_addr_copy(entry->mac, dev_addr->addr);
+ break;
+ }
+
+ netdev_dbg(dev, "%s: pushing inetaddr event from HOST interface address %pI4, %pM, %s\n",
+ __func__, &entry->dst, entry->mac, dev->name);
+
+ kfree(entry);
+ return NOTIFY_DONE;
+}
+
+int sw_nb_v4_fib_event(struct notifier_block *nb,
+ unsigned long event, void *ptr)
+{
+ struct net_device *dev, *pf_dev = NULL, *nh_pf_dev;
+ struct fib_entry_notifier_info *fen_info = ptr;
+ struct fib_entry *entries, *iter;
+ struct netdev_hw_addr *dev_addr;
+ struct neighbour *neigh;
+ struct fib_nh *fib_nh;
+ struct fib_info *fi;
+ struct otx2_nic *pf;
+ __be32 *haddr;
+ int hcnt = 0;
+ int cnt, i;
+
+ /* Process only UNICAST routes add or del */
+ if (fen_info->type != RTN_UNICAST)
+ return NOTIFY_DONE;
+
+ fi = fen_info->fi;
+ if (!fi)
+ return NOTIFY_DONE;
+
+ if (fi->fib_nh_is_v6) {
+ struct net_device *log_dev = (fi->fib_nhs > 0) ?
+ fi->fib_nh->fib_nh_dev : NULL;
+
+ if (log_dev)
+ netdev_dbg(log_dev, "%s: Received v6 notification\n",
+ __func__);
+ return NOTIFY_DONE;
+ }
+
+ entries = kcalloc(fi->fib_nhs, sizeof(*entries), GFP_ATOMIC);
+ if (!entries)
+ return NOTIFY_DONE;
+
+ haddr = kcalloc(fi->fib_nhs, sizeof(*haddr), GFP_ATOMIC);
+ if (!haddr) {
+ kfree(entries);
+ return NOTIFY_DONE;
+ }
+
+ iter = entries;
+ fib_nh = fi->fib_nh;
+ for (i = 0; i < fi->fib_nhs; i++, fib_nh++) {
+ dev = fib_nh->fib_nh_dev;
+
+ if (!dev)
+ continue;
+
+ if (dev->type != ARPHRD_ETHER)
+ continue;
+
+ if (!sw_nb_is_valid_dev(dev))
+ continue;
+
+ iter->cmd = sw_nb_fib_event_to_otx2_event(event, dev);
+ iter->dst = (__force __be32)fen_info->dst;
+ iter->dst_len = fen_info->dst_len;
+ iter->gw = fib_nh->fib_nh_gw4;
+
+ netdev_dbg(dev, "%s: FIB route Rule cmd=%llu dst=%pI4 dst_len=%u gw=%pI4\n",
+ __func__, iter->cmd, &iter->dst, iter->dst_len, &iter->gw);
+
+ nh_pf_dev = sw_nb_resolve_pf_dev(dev);
+ if (!nh_pf_dev) {
+ iter++;
+ continue;
+ }
+ pf_dev = nh_pf_dev;
+
+ if (netif_is_bridge_master(dev)) {
+ iter->bridge = 1;
+ } else if (is_vlan_dev(dev)) {
+ iter->vlan_valid = 1;
+ iter->vlan_tag = cpu_to_be16(vlan_dev_vlan_id(dev));
+ }
+
+ pf = netdev_priv(pf_dev);
+ iter->port_id = pf->pcifunc;
+
+ /* Point-to-point routes, including default routes with no
+ * gateway, are not supported for switch offload.
+ */
+ if (!fib_nh->fib_nh_gw4) {
+ if (iter->dst || iter->dst_len)
+ iter++;
+
+ continue;
+ }
+ iter->gw_valid = 1;
+
+ if (fib_nh->nh_saddr)
+ haddr[hcnt++] = fib_nh->nh_saddr;
+
+ rcu_read_lock();
+ neigh = ip_neigh_gw4(fib_nh->fib_nh_dev, fib_nh->fib_nh_gw4);
+ if (!neigh) {
+ rcu_read_unlock();
+ iter++;
+ continue;
+ }
+
+ if (is_valid_ether_addr(neigh->ha)) {
+ iter->mac_valid = 1;
+ neigh_ha_snapshot(iter->mac, neigh, fib_nh->fib_nh_dev);
+ }
+
+ iter++;
+ rcu_read_unlock();
+ }
+
+ cnt = iter - entries;
+ if (!cnt) {
+ kfree(entries);
+ kfree(haddr);
+ return NOTIFY_DONE;
+ }
+
+ if (pf_dev)
+ netdev_dbg(pf_dev, "pf_dev is %s cnt=%d\n", pf_dev->name, cnt);
+ kfree(entries);
+
+ if (!hcnt) {
+ kfree(haddr);
+ return NOTIFY_DONE;
+ }
+
+ if (!pf_dev) {
+ kfree(haddr);
+ return NOTIFY_DONE;
+ }
+
+ entries = kcalloc(hcnt, sizeof(*entries), GFP_ATOMIC);
+ if (!entries) {
+ kfree(haddr);
+ return NOTIFY_DONE;
+ }
+
+ iter = entries;
+
+ /* Host routes reuse pf_dev/pf from the last resolved Cavium netdev:
+ * pf_dev only identifies the switch AF mailbox context for switchdev
+ * programming; any previously resolved Cavium netdev is sufficient.
+ */
+ for (i = 0; i < hcnt; i++, iter++) {
+ iter->cmd = sw_nb_fib_event_to_otx2_event(event, pf_dev);
+ iter->dst = haddr[i];
+ iter->dst_len = 32;
+ iter->mac_valid = 1;
+ iter->host = 1;
+ iter->port_id = pf->pcifunc;
+
+ rcu_read_lock();
+ for_each_dev_addr(pf_dev, dev_addr) {
+ ether_addr_copy(iter->mac, dev_addr->addr);
+ break;
+ }
+ rcu_read_unlock();
+
+ netdev_dbg(pf_dev, "%s: FIB host Rule cmd=%llu dst=%pI4 dst_len=%u gw=%pI4 %s\n",
+ __func__, iter->cmd, &iter->dst, iter->dst_len, &iter->gw,
+ pf_dev->name);
+ }
+ kfree(entries);
+ kfree(haddr);
+ return NOTIFY_DONE;
+}
+
+int sw_nb_net_v4_neigh_update(struct notifier_block *nb,
+ unsigned long event, void *ptr)
+{
+ struct net_device *pf_dev;
+ struct neighbour *n = ptr;
+ struct fib_entry *entry;
+ struct otx2_nic *pf;
+
+ if (n->tbl != &arp_tbl)
+ return NOTIFY_DONE;
+
+ entry = kcalloc(1, sizeof(*entry), GFP_ATOMIC);
+ if (!entry)
+ return NOTIFY_DONE;
+
+ entry->cmd = OTX2_NEIGH_UPDATE;
+ entry->dst = *(__be32 *)n->primary_key;
+ entry->dst_len = n->tbl->key_len * 8;
+ entry->mac_valid = 1;
+ entry->nud_state = n->nud_state;
+ neigh_ha_snapshot(entry->mac, n, n->dev);
+
+ pf_dev = sw_nb_resolve_pf_dev(n->dev);
+ if (!pf_dev) {
+ kfree(entry);
+ return NOTIFY_DONE;
+ }
+
+ if (netif_is_bridge_master(n->dev)) {
+ entry->bridge = 1;
+ } else if (is_vlan_dev(n->dev)) {
+ entry->vlan_valid = 1;
+ entry->vlan_tag = cpu_to_be16(vlan_dev_vlan_id(n->dev));
+ }
+
+ pf = netdev_priv(pf_dev);
+ entry->port_id = pf->pcifunc;
+
+ kfree(entry);
+ return NOTIFY_DONE;
+}
+
+#endif
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v4.h b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v4.h
new file mode 100644
index 000000000000..c6dbf4b93a9a
--- /dev/null
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v4.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Marvell switch driver
+ *
+ * Copyright (C) 2026 Marvell.
+ *
+ */
+#ifndef SW_NB_V4_H_
+#define SW_NB_V4_H_
+
+int sw_nb_v4_fib_event(struct notifier_block *nb,
+ unsigned long event, void *ptr);
+
+int sw_nb_net_v4_neigh_update(struct notifier_block *nb,
+ unsigned long event, void *ptr);
+
+int sw_nb_v4_inetaddr_event(struct notifier_block *nb,
+ unsigned long event, void *ptr);
+
+int sw_nb_v4_netdev_event(struct notifier_block *unused,
+ unsigned long event, void *ptr);
+#endif // SW_NB_V4_H__
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v6.c b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v6.c
new file mode 100644
index 000000000000..62ab00658879
--- /dev/null
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v6.c
@@ -0,0 +1,292 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Marvell RVU switch driver
+ *
+ * Copyright (C) 2026 Marvell.
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <net/switchdev.h>
+#include <net/netevent.h>
+#include <net/arp.h>
+#include <net/route.h>
+#include <linux/inetdevice.h>
+#include <net/addrconf.h>
+#include <net/ip6_fib.h>
+#include <net/nexthop.h>
+
+#include "../otx2_reg.h"
+#include "../otx2_common.h"
+#include "../otx2_struct.h"
+#include "../cn10k.h"
+#include "sw_nb.h"
+#include "sw_fdb.h"
+#include "sw_fib.h"
+#include "sw_fl.h"
+#include "sw_nb_v6.h"
+
+#if IS_ENABLED(CONFIG_IPV6) && IS_ENABLED(CONFIG_OCTEONTX_SWITCH)
+
+int sw_nb_v6_netdev_event(struct notifier_block *unused,
+ unsigned long event, void *ptr)
+{
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+ struct netdev_hw_addr *dev_addr;
+ struct net_device *pf_dev;
+ struct inet6_ifaddr *ifp;
+ struct inet6_dev *i6dev;
+ struct fib_entry *entry;
+ struct in6_addr addr;
+ struct otx2_nic *pf;
+ u32 prefix_len;
+
+ i6dev = __in6_dev_get(dev);
+ if (!i6dev)
+ return NOTIFY_DONE;
+
+ /* Invoked from sw_nb_netdev_event() on NETDEV_UP/DOWN/CHANGE, which
+ * run with RTNL held. IPv6 address list updates are also serialized
+ * by RTNL, so addr_list cannot race with concurrent assignments.
+ */
+ rcu_read_lock();
+ /* Switch offload supports a single IPv6 address per interface for now. */
+ ifp = list_first_entry_or_null(&i6dev->addr_list,
+ struct inet6_ifaddr, if_list);
+ if (!ifp) {
+ rcu_read_unlock();
+ return NOTIFY_DONE;
+ }
+
+ if (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL) {
+ rcu_read_unlock();
+ return NOTIFY_DONE;
+ }
+
+ addr = ifp->addr;
+ prefix_len = ifp->prefix_len;
+ rcu_read_unlock();
+
+ entry = kcalloc(1, sizeof(*entry), GFP_KERNEL);
+ if (!entry)
+ return NOTIFY_DONE;
+
+ pf_dev = sw_nb_resolve_pf_dev(dev);
+ if (!pf_dev) {
+ kfree(entry);
+ return NOTIFY_DONE;
+ }
+
+ entry->cmd = sw_nb_inetaddr_event_to_otx2_event(event, dev);
+ memcpy(entry->dst6, &addr, sizeof(entry->dst6));
+ entry->dst6_plen = prefix_len;
+ entry->host = 1;
+ entry->ipv6 = 1;
+
+ pf = netdev_priv(pf_dev);
+ entry->port_id = pf->pcifunc;
+
+ for_each_dev_addr(dev, dev_addr) {
+ entry->mac_valid = 1;
+ ether_addr_copy(entry->mac, dev_addr->addr);
+ break;
+ }
+
+ netdev_dbg(dev, "netdev event addr=%pI6c plen=%u mac=%pM\n",
+ &addr, prefix_len, entry->mac);
+ kfree(entry);
+ return NOTIFY_DONE;
+}
+
+int sw_nb_v6_fib_event(struct notifier_block *nb,
+ unsigned long event, void *ptr)
+{
+ struct fib6_entry_notifier_info *f6_eni;
+ struct fib_notifier_info *info = ptr;
+ struct net_device *fib_dev, *pf_dev;
+ struct fib_entry *entry;
+ struct fib6_info *f6i;
+ struct neighbour *neigh;
+ struct fib6_nh *nh6;
+ struct rt6key *key;
+ struct otx2_nic *pf;
+
+ f6_eni = container_of(info, struct fib6_entry_notifier_info, info);
+ f6i = f6_eni->rt;
+
+ fib_dev = fib6_info_nh_dev(f6i);
+
+ if (!fib_dev)
+ return NOTIFY_DONE;
+
+ if (fib_dev->type != ARPHRD_ETHER)
+ return NOTIFY_DONE;
+
+ if (!sw_nb_is_valid_dev(fib_dev))
+ return NOTIFY_DONE;
+
+ if (f6i->fib6_type != RTN_UNICAST)
+ return NOTIFY_DONE;
+
+ key = &f6i->fib6_dst;
+ /* TODO: vlan and bridge support */
+ if (ipv6_addr_type(&key->addr) & IPV6_ADDR_LINKLOCAL)
+ return NOTIFY_DONE;
+
+ netdev_dbg(fib_dev, "fib6dst rt6key.addr=%pI6c len=%u\n", &key->addr,
+ key->plen);
+
+ netdev_dbg(fib_dev, "fib6flags=%#x proto=%u type=%u\n",
+ f6i->fib6_flags, f6i->fib6_protocol, f6i->fib6_type);
+
+ nh6 = f6i->nh ? nexthop_fib6_nh(f6i->nh) : f6i->fib6_nh;
+ netdev_dbg(nh6->fib_nh_dev ? nh6->fib_nh_dev : fib_dev,
+ "nh family=%u dev=%s gw=%pI6c gwfamily=%u\n",
+ nh6->fib_nh_family,
+ nh6->fib_nh_dev ? nh6->fib_nh_dev->name : "No dev",
+ &nh6->fib_nh_gw6, nh6->fib_nh_gw_family);
+
+ pf_dev = sw_nb_resolve_pf_dev(fib_dev);
+ if (!pf_dev)
+ return NOTIFY_DONE;
+
+ pf = netdev_priv(pf_dev);
+
+ entry = kcalloc(1, sizeof(*entry), GFP_ATOMIC);
+ if (!entry)
+ return NOTIFY_DONE;
+
+ entry->cmd = sw_nb_fib_event_to_otx2_event(event, fib_dev);
+ entry->ipv6 = 1;
+ entry->port_id = pf->pcifunc;
+ memcpy(entry->dst6, &key->addr, sizeof(entry->dst6));
+ entry->dst6_plen = key->plen;
+
+ memcpy(entry->gw6, &nh6->fib_nh_gw6, sizeof(nh6->fib_nh_gw6));
+ entry->gw_valid = !!(ipv6_addr_type(&nh6->fib_nh_gw6) & IPV6_ADDR_UNICAST);
+
+ /* TODO: No replay mechanism yet when the gateway neighbor is unresolved.
+ * If ip_neigh_gw6() returns NULL the route is skipped here; add replay
+ * from the neighbor update handler once nexthop resolution completes.
+ */
+ rcu_read_lock();
+ neigh = ip_neigh_gw6(fib_dev, &nh6->fib_nh_gw6);
+ if (!neigh) {
+ rcu_read_unlock();
+ kfree(entry);
+ return NOTIFY_DONE;
+ }
+
+ if (is_valid_ether_addr(neigh->ha)) {
+ entry->mac_valid = 1;
+ neigh_ha_snapshot(entry->mac, neigh, fib_dev);
+ netdev_dbg(fib_dev, "fib found MAC=%pM\n", entry->mac);
+ }
+
+ rcu_read_unlock();
+ kfree(entry);
+
+ return NOTIFY_DONE;
+}
+
+int sw_nb_net_v6_neigh_update(struct notifier_block *nb,
+ unsigned long event, void *ptr)
+{
+ struct net_device *pf_dev;
+ struct neighbour *n = ptr;
+ struct fib_entry *entry;
+ struct otx2_nic *pf;
+
+ if (n->tbl != &nd_tbl)
+ return NOTIFY_DONE;
+
+ if (ipv6_addr_type((struct in6_addr *)n->primary_key) & IPV6_ADDR_LINKLOCAL)
+ return NOTIFY_DONE;
+
+ entry = kcalloc(1, sizeof(*entry), GFP_ATOMIC);
+ if (!entry)
+ return NOTIFY_DONE;
+
+ pf_dev = sw_nb_resolve_pf_dev(n->dev);
+ if (!pf_dev) {
+ kfree(entry);
+ return NOTIFY_DONE;
+ }
+
+ pf = netdev_priv(pf_dev);
+
+ entry->cmd = OTX2_NEIGH_UPDATE;
+ entry->dst6_plen = n->tbl->key_len * 8;
+ memcpy(entry->dst6, (struct in6_addr *)n->primary_key,
+ sizeof(entry->dst6));
+ entry->ipv6 = 1;
+ entry->nud_state = n->nud_state;
+ neigh_ha_snapshot(entry->mac, n, n->dev);
+ entry->mac_valid = 1;
+ entry->port_id = pf->pcifunc;
+
+ netdev_dbg(n->dev, "v6 neigh update %pI6c mac=%pM plen=%u\n",
+ n->primary_key, entry->mac, n->tbl->key_len * 8);
+ kfree(entry);
+
+ return NOTIFY_DONE;
+}
+
+int sw_nb_v6_inetaddr_event(struct notifier_block *nb,
+ unsigned long event, void *ptr)
+{
+ struct inet6_ifaddr *ifa6 = (struct inet6_ifaddr *)ptr;
+ struct net_device *dev = ifa6->idev->dev;
+ struct netdev_hw_addr *dev_addr;
+ struct net_device *pf_dev;
+ struct fib_entry *entry;
+ struct otx2_nic *pf;
+
+ if (event != NETDEV_CHANGE &&
+ event != NETDEV_UP &&
+ event != NETDEV_DOWN) {
+ return NOTIFY_DONE;
+ }
+
+ if (dev->type != ARPHRD_ETHER)
+ return NOTIFY_DONE;
+
+ if (!sw_nb_is_valid_dev(dev))
+ return NOTIFY_DONE;
+
+ if (ipv6_addr_type(&ifa6->addr) & IPV6_ADDR_LINKLOCAL)
+ return NOTIFY_DONE;
+
+ entry = kcalloc(1, sizeof(*entry), GFP_ATOMIC);
+ if (!entry)
+ return NOTIFY_DONE;
+
+ pf_dev = sw_nb_resolve_pf_dev(dev);
+ if (!pf_dev) {
+ kfree(entry);
+ return NOTIFY_DONE;
+ }
+
+ pf = netdev_priv(pf_dev);
+
+ entry->cmd = sw_nb_inetaddr_event_to_otx2_event(event, dev);
+ memcpy(entry->dst6, &ifa6->addr, sizeof(entry->dst6));
+ entry->dst6_plen = ifa6->prefix_len;
+ entry->mac_valid = 1;
+ entry->host = 1;
+ entry->ipv6 = 1;
+ entry->port_id = pf->pcifunc;
+
+ for_each_dev_addr(dev, dev_addr) {
+ ether_addr_copy(entry->mac, dev_addr->addr);
+ entry->mac_valid = 1;
+ break;
+ }
+
+ netdev_dbg(dev, "inetaddr addr=%pI6c len=%u %pM\n",
+ &ifa6->addr, ifa6->prefix_len, entry->mac);
+ kfree(entry);
+
+ return NOTIFY_DONE;
+}
+#endif
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v6.h b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v6.h
new file mode 100644
index 000000000000..f73efc98c311
--- /dev/null
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v6.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Marvell switch driver
+ *
+ * Copyright (C) 2026 Marvell.
+ *
+ */
+#ifndef SW_NB_V6_H_
+#define SW_NB_V6_H_
+
+int sw_nb_v6_fib_event(struct notifier_block *nb,
+ unsigned long event, void *ptr);
+
+int sw_nb_net_v6_neigh_update(struct notifier_block *nb,
+ unsigned long event, void *ptr);
+
+int sw_nb_v6_inetaddr_event(struct notifier_block *nb,
+ unsigned long event, void *ptr);
+
+int sw_nb_v6_netdev_event(struct notifier_block *unused,
+ unsigned long event, void *ptr);
+#endif // SW_NB_V6_H__
--
2.43.0
^ permalink raw reply related
* [PATCH v4 net-next 7/9] octeontx2: switch: plumb bridge FDB updates through AF and switchdev
From: Ratheesh Kannoth @ 2026-07-21 8:18 UTC (permalink / raw)
To: linux-kernel, netdev
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, sgoutham,
Ratheesh Kannoth
In-Reply-To: <20260721081824.1430607-1-rkannoth@marvell.com>
Handle switchdev FDB add and delete notifications on the PF by queuing
work that sends fdb_notify mailbox messages to the AF. The AF queues
those updates and pushes L2 rules toward the switchdev image with
af2swdev notify messages when firmware is ready.
Teach the AF swdev2af path to initialize L2 offload workqueues on
firmware up/down and to accept refresh requests that enqueue FDB
entries for AF to PF mailbox delivery. Add an AF to PF (and VF) upstream
message for FDB refresh, handle it in the VF driver, and treat it like
the CGX link event when acknowledging mailbox completion in the AF.
On refresh, invoke the switchdev notifier so the host bridge can learn
the updated FDB entry.
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
---
.../net/ethernet/marvell/octeontx2/af/mbox.h | 2 +
.../net/ethernet/marvell/octeontx2/af/rvu.c | 2 +
.../marvell/octeontx2/af/switch/rvu_sw.c | 51 +-
.../marvell/octeontx2/af/switch/rvu_sw.h | 1 +
.../marvell/octeontx2/af/switch/rvu_sw_l2.c | 474 ++++++++++++++++++
.../marvell/octeontx2/af/switch/rvu_sw_l2.h | 3 +
.../ethernet/marvell/octeontx2/nic/otx2_pf.c | 2 +
.../ethernet/marvell/octeontx2/nic/otx2_vf.c | 44 ++
.../marvell/octeontx2/nic/switch/sw_fdb.c | 225 +++++++++
.../marvell/octeontx2/nic/switch/sw_fdb.h | 1 +
.../marvell/octeontx2/nic/switch/sw_nb.c | 12 +-
.../marvell/octeontx2/nic/switch/sw_nb.h | 8 +-
12 files changed, 816 insertions(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
index a63771d7b102..03ade6ead826 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
+++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
@@ -1996,6 +1996,7 @@ struct af2pf_fdb_refresh_req {
struct mbox_msghdr hdr;
u16 pcifunc;
u8 mac[6];
+ u64 flags;
};
struct iface_info {
@@ -2035,6 +2036,7 @@ struct fl_info {
struct swdev2af_notify_req {
struct mbox_msghdr hdr;
u64 msg_type;
+/* Mutually exclusive message selectors (not a combinable bitmask). */
#define SWDEV2AF_MSG_TYPE_FW_STATUS BIT_ULL(0)
#define SWDEV2AF_MSG_TYPE_REFRESH_FDB BIT_ULL(1)
#define SWDEV2AF_MSG_TYPE_REFRESH_FL BIT_ULL(2)
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
index 168a50655351..4b9453519ead 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
@@ -23,6 +23,7 @@
#include "cn20k/reg.h"
#include "cn20k/api.h"
#include "cn20k/npc.h"
+#include "switch/rvu_sw.h"
#define DRV_NAME "rvu_af"
#define DRV_STRING "Marvell OcteonTX2 RVU Admin Function Driver"
@@ -3850,6 +3851,7 @@ static void rvu_remove(struct pci_dev *pdev)
rvu_fwdata_exit(rvu);
rvu_mcs_exit(rvu);
rvu_mbox_destroy(&rvu->afpf_wq_info);
+ rvu_sw_shutdown();
rvu_disable_sriov(rvu);
rvu_reset_all_blocks(rvu);
rvu_free_hw_resources(rvu);
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw.c b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw.c
index 403d57870efe..b9cd7c7524b9 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw.c
@@ -9,6 +9,8 @@
#include "rvu.h"
#include "rvu_sw.h"
+#include "rvu_sw_l2.h"
+#include "rvu_sw_fl.h"
u32 rvu_sw_port_id(struct rvu *rvu, u16 pcifunc)
{
@@ -26,9 +28,56 @@ u32 rvu_sw_port_id(struct rvu *rvu, u16 pcifunc)
FIELD_PREP(GENMASK_ULL(15, 0), pcifunc);
}
+static bool rvu_sw_swdev2af_msg_valid(u64 msg_type)
+{
+ return msg_type == SWDEV2AF_MSG_TYPE_FW_STATUS ||
+ msg_type == SWDEV2AF_MSG_TYPE_REFRESH_FDB ||
+ msg_type == SWDEV2AF_MSG_TYPE_REFRESH_FL;
+}
+
+static int rvu_sw_swdev2af_sender_check(struct rvu *rvu,
+ struct swdev2af_notify_req *req,
+ u64 msg_type)
+{
+ u16 sender = req->hdr.pcifunc;
+
+ if (!rvu_sw_swdev2af_msg_valid(msg_type))
+ return -EINVAL;
+
+ if (!rvu_is_switch_pcifunc(rvu, sender))
+ return -EPERM;
+
+ return 0;
+}
+
int rvu_mbox_handler_swdev2af_notify(struct rvu *rvu,
struct swdev2af_notify_req *req,
struct msg_rsp *rsp)
{
- return 0;
+ int rc;
+
+ rc = rvu_sw_swdev2af_sender_check(rvu, req, req->msg_type);
+ if (rc)
+ return rc;
+
+ switch (req->msg_type) {
+ case SWDEV2AF_MSG_TYPE_FW_STATUS:
+ rc = rvu_sw_l2_init_offl_wq(rvu, req->hdr.pcifunc, req->fw_up);
+ break;
+
+ case SWDEV2AF_MSG_TYPE_REFRESH_FDB:
+ rc = rvu_sw_l2_fdb_list_entry_add(rvu, req->pcifunc, req->mac);
+ break;
+
+ default:
+ rc = -EOPNOTSUPP;
+ break;
+ }
+
+ return rc;
+}
+
+void rvu_sw_shutdown(void)
+{
+ rvu_sw_l2_shutdown();
}
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw.h b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw.h
index e9ad32c84576..a0cb2a9ce7ab 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw.h
+++ b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw.h
@@ -12,5 +12,6 @@
#define RVU_SW_INVALID_PORT_ID ((u32)~0U)
u32 rvu_sw_port_id(struct rvu *rvu, u16 pcifunc);
+void rvu_sw_shutdown(void);
#endif
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_l2.c b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_l2.c
index 5f805bfa81ed..2e6502d0c48d 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_l2.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_l2.c
@@ -4,11 +4,485 @@
* Copyright (C) 2026 Marvell.
*
*/
+
+#include <linux/bitfield.h>
#include "rvu.h"
+#include "rvu_sw.h"
+#include "rvu_sw_l2.h"
+
+#define M(_name, _id, _fn_name, _req_type, _rsp_type) \
+static struct _req_type __maybe_unused \
+*otx2_mbox_alloc_msg_ ## _fn_name(struct rvu *rvu, int devid) \
+{ \
+ struct _req_type *req; \
+ \
+ req = (struct _req_type *)otx2_mbox_alloc_msg_rsp( \
+ &rvu->afpf_wq_info.mbox_up, devid, sizeof(struct _req_type), \
+ sizeof(struct _rsp_type)); \
+ if (!req) \
+ return NULL; \
+ req->hdr.sig = OTX2_MBOX_REQ_SIG; \
+ req->hdr.id = _id; \
+ return req; \
+}
+MBOX_UP_AF2SWDEV_MESSAGES
+MBOX_UP_AF2PF_FDB_REFRESH_MESSAGES
+#undef M
+
+#define RVU_SW_L2_LIST_MAX 4096
+
+struct l2_entry {
+ struct list_head list;
+ u64 flags;
+ u32 port_id;
+ u8 mac[ETH_ALEN];
+};
+
+static DEFINE_MUTEX(l2_offl_list_lock);
+static LIST_HEAD(l2_offl_lh);
+static atomic_t l2_offl_list_cnt = ATOMIC_INIT(0);
+
+static DEFINE_MUTEX(fdb_refresh_list_lock);
+static LIST_HEAD(fdb_refresh_lh);
+static atomic_t fdb_refresh_list_cnt = ATOMIC_INIT(0);
+
+struct rvu_sw_l2_work {
+ struct rvu *rvu;
+ struct work_struct work;
+};
+
+/* Work queue for switchdev message handling. There is only one RVU AF
+ * and one switch block per SoC; rvu_probe() enforces a single AF bind via
+ * device_bound, so one global workqueue instance per type is sufficient.
+ */
+static struct rvu_sw_l2_work l2_offl_work;
+static struct workqueue_struct *rvu_sw_l2_offl_wq;
+
+static struct rvu_sw_l2_work fdb_refresh_work;
+static struct workqueue_struct *fdb_refresh_wq;
+
+static bool fw_is_up;
+static DEFINE_SPINLOCK(rvu_sw_l2_state_lock);
+
+static void rvu_sw_l2_list_cnt_warn(struct device *dev, atomic_t *cnt,
+ const char *name)
+{
+ int n = atomic_read(cnt);
+
+ if (n < 0)
+ dev_warn(dev, "L2 %s list count underflow: %d\n", name, n);
+ else if (n > RVU_SW_L2_LIST_MAX)
+ dev_warn(dev, "L2 %s list count overflow: %d (max %d)\n",
+ name, n, RVU_SW_L2_LIST_MAX);
+}
+
+static void rvu_sw_l2_list_cnt_inc(struct device *dev, atomic_t *cnt,
+ const char *name)
+{
+ atomic_inc(cnt);
+ rvu_sw_l2_list_cnt_warn(dev, cnt, name);
+}
+
+static void rvu_sw_l2_list_cnt_dec(struct device *dev, atomic_t *cnt,
+ const char *name)
+{
+ atomic_dec(cnt);
+ rvu_sw_l2_list_cnt_warn(dev, cnt, name);
+}
+
+static void rvu_sw_l2_destroy_wqs(struct rvu *rvu)
+{
+ struct workqueue_struct *offl_wq, *refresh_wq;
+ struct l2_entry *entry;
+
+ spin_lock_bh(&rvu_sw_l2_state_lock);
+ rvu->rswitch.flags &= ~RVU_SWITCH_FLAG_FW_READY;
+ rvu->rswitch.pcifunc = 0;
+ fw_is_up = false;
+ spin_unlock_bh(&rvu_sw_l2_state_lock);
+
+ mutex_lock(&fdb_refresh_list_lock);
+ refresh_wq = fdb_refresh_wq;
+ fdb_refresh_wq = NULL;
+ mutex_unlock(&fdb_refresh_list_lock);
+
+ if (refresh_wq) {
+ cancel_work_sync(&fdb_refresh_work.work);
+ destroy_workqueue(refresh_wq);
+
+ mutex_lock(&fdb_refresh_list_lock);
+ rvu_sw_l2_list_cnt_warn(rvu->dev, &fdb_refresh_list_cnt,
+ "fdb refresh");
+ while (1) {
+ entry = list_first_entry_or_null(&fdb_refresh_lh,
+ struct l2_entry, list);
+ if (!entry)
+ break;
+
+ list_del_init(&entry->list);
+ kfree(entry);
+ }
+ atomic_set(&fdb_refresh_list_cnt, 0);
+ mutex_unlock(&fdb_refresh_list_lock);
+ }
+
+ mutex_lock(&l2_offl_list_lock);
+ offl_wq = rvu_sw_l2_offl_wq;
+ rvu_sw_l2_offl_wq = NULL;
+ mutex_unlock(&l2_offl_list_lock);
+
+ if (offl_wq) {
+ cancel_work_sync(&l2_offl_work.work);
+ destroy_workqueue(offl_wq);
+
+ mutex_lock(&l2_offl_list_lock);
+ rvu_sw_l2_list_cnt_warn(rvu->dev, &l2_offl_list_cnt, "offload");
+ while (1) {
+ entry = list_first_entry_or_null(&l2_offl_lh,
+ struct l2_entry, list);
+ if (!entry)
+ break;
+
+ list_del_init(&entry->list);
+ kfree(entry);
+ }
+ atomic_set(&l2_offl_list_cnt, 0);
+ mutex_unlock(&l2_offl_list_lock);
+ }
+}
+
+/* High-frequency link state transitions or aggressive FDB
+ * aging intervals can induce rapid fdb churn. To prevent
+ * thrashing, inhibit hardware offloading of these transient
+ * forwarding states to the switching ASIC. Events are queued
+ * at the tail and processed from the head; when enqueueing a
+ * new operation, drop older pending opposite operations for the
+ * same MAC that have not yet reached hardware. When an opposite
+ * entry is removed, the new operation is dropped as well.
+ */
+static bool rvu_sw_l2_offl_coalesce_pending_locked(struct rvu *rvu,
+ struct l2_entry *new_entry)
+{
+ u64 opposite = (new_entry->flags & FDB_ADD) ? FDB_DEL : FDB_ADD;
+ struct l2_entry *entry, *tmp;
+ bool coalesced = false;
+
+ lockdep_assert_held(&l2_offl_list_lock);
+
+ list_for_each_entry_safe(entry, tmp, &l2_offl_lh, list) {
+ if (!ether_addr_equal(new_entry->mac, entry->mac))
+ continue;
+
+ if (!(entry->flags & opposite))
+ continue;
+
+ list_del_init(&entry->list);
+ rvu_sw_l2_list_cnt_dec(rvu->dev, &l2_offl_list_cnt, "offload");
+ kfree(entry);
+ coalesced = true;
+ }
+
+ return coalesced;
+}
+
+static int rvu_sw_l2_offl_rule_push(struct rvu *rvu, struct l2_entry *l2_entry)
+{
+ struct af2swdev_notify_req *req;
+ int swdev_pf;
+
+ swdev_pf = rvu_get_pf(rvu->pdev, rvu->rswitch.pcifunc);
+
+ mutex_lock(&rvu->mbox_lock);
+ req = otx2_mbox_alloc_msg_af2swdev_notify(rvu, swdev_pf);
+ if (!req) {
+ mutex_unlock(&rvu->mbox_lock);
+ return -ENOMEM;
+ }
+
+ ether_addr_copy(req->mac, l2_entry->mac);
+ req->flags = l2_entry->flags;
+ req->port_id = l2_entry->port_id;
+
+ otx2_mbox_wait_for_zero(&rvu->afpf_wq_info.mbox_up, swdev_pf);
+ otx2_mbox_msg_send_up(&rvu->afpf_wq_info.mbox_up, swdev_pf);
+
+ mutex_unlock(&rvu->mbox_lock);
+ return 0;
+}
+
+static int rvu_sw_l2_fdb_refresh_send(struct rvu *rvu, u16 pcifunc, u8 *mac)
+{
+ struct af2pf_fdb_refresh_req *req;
+ int pf, vf;
+
+ if (!is_pf_func_valid(rvu, pcifunc))
+ return -EINVAL;
+
+ pf = rvu_get_pf(rvu->pdev, pcifunc);
+ vf = (pcifunc & RVU_PFVF_FUNC_MASK) - 1;
+
+ mutex_lock(&rvu->mbox_lock);
+
+ if (!is_cgx_vf(rvu, pcifunc)) {
+ if (pf >= rvu->afpf_wq_info.mbox_up.ndevs) {
+ mutex_unlock(&rvu->mbox_lock);
+ return -EINVAL;
+ }
+
+ req = otx2_mbox_alloc_msg_af2pf_fdb_refresh(rvu, pf);
+ if (!req) {
+ mutex_unlock(&rvu->mbox_lock);
+ return -ENOMEM;
+ }
+
+ req->hdr.pcifunc = pcifunc;
+ ether_addr_copy(req->mac, mac);
+ req->pcifunc = pcifunc;
+ req->flags = FDB_ADD;
+
+ otx2_mbox_wait_for_zero(&rvu->afpf_wq_info.mbox_up, pf);
+ otx2_mbox_msg_send_up(&rvu->afpf_wq_info.mbox_up, pf);
+ } else {
+ if (vf < 0 || vf >= rvu->afvf_wq_info.mbox_up.ndevs) {
+ mutex_unlock(&rvu->mbox_lock);
+ return -EINVAL;
+ }
+
+ req = (struct af2pf_fdb_refresh_req *)
+ otx2_mbox_alloc_msg_rsp(&rvu->afvf_wq_info.mbox_up, vf,
+ sizeof(*req), sizeof(struct msg_rsp));
+ if (!req) {
+ mutex_unlock(&rvu->mbox_lock);
+ return -ENOMEM;
+ }
+ req->hdr.sig = OTX2_MBOX_REQ_SIG;
+ req->hdr.id = MBOX_MSG_AF2PF_FDB_REFRESH;
+
+ req->hdr.pcifunc = pcifunc;
+ ether_addr_copy(req->mac, mac);
+ req->pcifunc = pcifunc;
+ req->flags = FDB_ADD;
+
+ otx2_mbox_wait_for_zero(&rvu->afvf_wq_info.mbox_up, vf);
+ otx2_mbox_msg_send_up(&rvu->afvf_wq_info.mbox_up, vf);
+ }
+
+ mutex_unlock(&rvu->mbox_lock);
+
+ return 0;
+}
+
+static void rvu_sw_l2_fdb_refresh_wq_handler(struct work_struct *work)
+{
+ struct rvu_sw_l2_work *fdb_work;
+ struct l2_entry *l2_entry;
+
+ fdb_work = container_of(work, struct rvu_sw_l2_work, work);
+
+ while (1) {
+ mutex_lock(&fdb_refresh_list_lock);
+ l2_entry = list_first_entry_or_null(&fdb_refresh_lh,
+ struct l2_entry, list);
+ if (!l2_entry) {
+ mutex_unlock(&fdb_refresh_list_lock);
+ return;
+ }
+
+ list_del_init(&l2_entry->list);
+ rvu_sw_l2_list_cnt_dec(fdb_work->rvu->dev, &fdb_refresh_list_cnt,
+ "fdb refresh");
+ mutex_unlock(&fdb_refresh_list_lock);
+
+ rvu_sw_l2_fdb_refresh_send(fdb_work->rvu, l2_entry->port_id,
+ l2_entry->mac);
+ kfree(l2_entry);
+ }
+}
+
+static void rvu_sw_l2_offl_rule_wq_handler(struct work_struct *work)
+{
+ struct rvu_sw_l2_work *offl_work;
+ struct l2_entry *l2_entry;
+ int budget = 16;
+
+ offl_work = container_of(work, struct rvu_sw_l2_work, work);
+
+ while (budget--) {
+ mutex_lock(&l2_offl_list_lock);
+ l2_entry = list_first_entry_or_null(&l2_offl_lh, struct l2_entry, list);
+ if (!l2_entry) {
+ mutex_unlock(&l2_offl_list_lock);
+ return;
+ }
+
+ list_del_init(&l2_entry->list);
+ rvu_sw_l2_list_cnt_dec(offl_work->rvu->dev, &l2_offl_list_cnt,
+ "offload");
+ mutex_unlock(&l2_offl_list_lock);
+
+ if (rvu_sw_l2_offl_rule_push(offl_work->rvu, l2_entry))
+ dev_err(offl_work->rvu->dev,
+ "%s: Error to push l2 rule\n",
+ __func__);
+ kfree(l2_entry);
+ }
+
+ mutex_lock(&l2_offl_list_lock);
+ if (rvu_sw_l2_offl_wq && atomic_read(&l2_offl_list_cnt))
+ queue_work(rvu_sw_l2_offl_wq, &l2_offl_work.work);
+ mutex_unlock(&l2_offl_list_lock);
+}
+
+int rvu_sw_l2_init_offl_wq(struct rvu *rvu, u16 pcifunc, bool fw_up)
+{
+ struct rvu_switch *rswitch = &rvu->rswitch;
+
+ if (!fw_up) {
+ rvu_sw_l2_destroy_wqs(rvu);
+ return 0;
+ }
+
+ spin_lock_bh(&rvu_sw_l2_state_lock);
+ if (fw_is_up && rvu_sw_l2_offl_wq && fdb_refresh_wq) {
+ rswitch->pcifunc = pcifunc;
+ rswitch->flags |= RVU_SWITCH_FLAG_FW_READY;
+ spin_unlock_bh(&rvu_sw_l2_state_lock);
+ return 0;
+ }
+ spin_unlock_bh(&rvu_sw_l2_state_lock);
+
+ if (rvu_sw_l2_offl_wq || fdb_refresh_wq)
+ rvu_sw_l2_destroy_wqs(rvu);
+
+ l2_offl_work.rvu = rvu;
+ INIT_WORK(&l2_offl_work.work, rvu_sw_l2_offl_rule_wq_handler);
+ rvu_sw_l2_offl_wq = alloc_workqueue("swdev_rvu_sw_l2_offl_wq", 0, 0);
+ if (!rvu_sw_l2_offl_wq) {
+ dev_err(rvu->dev, "L2 offl workqueue allocation failed\n");
+ return -ENOMEM;
+ }
+
+ fdb_refresh_work.rvu = rvu;
+ INIT_WORK(&fdb_refresh_work.work, rvu_sw_l2_fdb_refresh_wq_handler);
+ fdb_refresh_wq = alloc_workqueue("swdev_fdb_refresh_wq", 0, 0);
+ if (!fdb_refresh_wq) {
+ dev_err(rvu->dev, "fdb refresh workqueue allocation failed\n");
+ destroy_workqueue(rvu_sw_l2_offl_wq);
+ rvu_sw_l2_offl_wq = NULL;
+ return -ENOMEM;
+ }
+
+ spin_lock_bh(&rvu_sw_l2_state_lock);
+ fw_is_up = true;
+ rswitch->pcifunc = pcifunc;
+ rswitch->flags |= RVU_SWITCH_FLAG_FW_READY;
+ spin_unlock_bh(&rvu_sw_l2_state_lock);
+
+ return 0;
+}
+
+int rvu_sw_l2_fdb_list_entry_add(struct rvu *rvu, u16 pcifunc, u8 *mac)
+{
+ struct workqueue_struct *wq;
+ struct l2_entry *l2_entry;
+
+ if (!is_pf_func_valid(rvu, pcifunc))
+ return -EINVAL;
+
+ if (atomic_read(&fdb_refresh_list_cnt) >= RVU_SW_L2_LIST_MAX) {
+ rvu_sw_l2_list_cnt_warn(rvu->dev, &fdb_refresh_list_cnt,
+ "fdb refresh");
+ return -ENOMEM;
+ }
+
+ l2_entry = kcalloc(1, sizeof(*l2_entry), GFP_KERNEL);
+ if (!l2_entry)
+ return -ENOMEM;
+
+ l2_entry->port_id = pcifunc;
+ ether_addr_copy(l2_entry->mac, mac);
+
+ mutex_lock(&fdb_refresh_list_lock);
+ wq = fdb_refresh_wq;
+ if (!wq) {
+ mutex_unlock(&fdb_refresh_list_lock);
+ kfree(l2_entry);
+ return -EINVAL;
+ }
+
+ if (atomic_read(&fdb_refresh_list_cnt) >= RVU_SW_L2_LIST_MAX) {
+ rvu_sw_l2_list_cnt_warn(rvu->dev, &fdb_refresh_list_cnt,
+ "fdb refresh");
+ mutex_unlock(&fdb_refresh_list_lock);
+ kfree(l2_entry);
+ return -ENOMEM;
+ }
+ list_add_tail(&l2_entry->list, &fdb_refresh_lh);
+ rvu_sw_l2_list_cnt_inc(rvu->dev, &fdb_refresh_list_cnt, "fdb refresh");
+ queue_work(wq, &fdb_refresh_work.work);
+ mutex_unlock(&fdb_refresh_list_lock);
+
+ return 0;
+}
int rvu_mbox_handler_fdb_notify(struct rvu *rvu,
struct fdb_notify_req *req,
struct msg_rsp *rsp)
{
+ struct workqueue_struct *wq;
+ struct l2_entry *l2_entry;
+
+ spin_lock_bh(&rvu_sw_l2_state_lock);
+ if (!(rvu->rswitch.flags & RVU_SWITCH_FLAG_FW_READY)) {
+ spin_unlock_bh(&rvu_sw_l2_state_lock);
+ return 0;
+ }
+ spin_unlock_bh(&rvu_sw_l2_state_lock);
+
+ if (atomic_read(&l2_offl_list_cnt) >= RVU_SW_L2_LIST_MAX) {
+ rvu_sw_l2_list_cnt_warn(rvu->dev, &l2_offl_list_cnt, "offload");
+ return -ENOMEM;
+ }
+
+ l2_entry = kcalloc(1, sizeof(*l2_entry), GFP_KERNEL);
+ if (!l2_entry)
+ return -ENOMEM;
+
+ l2_entry->port_id = rvu_sw_port_id(rvu, req->hdr.pcifunc);
+ ether_addr_copy(l2_entry->mac, req->mac);
+ l2_entry->flags = req->flags;
+
+ mutex_lock(&l2_offl_list_lock);
+ wq = rvu_sw_l2_offl_wq;
+ if (!wq) {
+ mutex_unlock(&l2_offl_list_lock);
+ kfree(l2_entry);
+ return 0;
+ }
+
+ if (atomic_read(&l2_offl_list_cnt) >= RVU_SW_L2_LIST_MAX) {
+ rvu_sw_l2_list_cnt_warn(rvu->dev, &l2_offl_list_cnt, "offload");
+ mutex_unlock(&l2_offl_list_lock);
+ kfree(l2_entry);
+ return -ENOMEM;
+ }
+ if (rvu_sw_l2_offl_coalesce_pending_locked(rvu, l2_entry)) {
+ mutex_unlock(&l2_offl_list_lock);
+ kfree(l2_entry);
+ return 0;
+ }
+ list_add_tail(&l2_entry->list, &l2_offl_lh);
+ rvu_sw_l2_list_cnt_inc(rvu->dev, &l2_offl_list_cnt, "offload");
+ queue_work(wq, &l2_offl_work.work);
+ mutex_unlock(&l2_offl_list_lock);
+
return 0;
}
+
+void rvu_sw_l2_shutdown(void)
+{
+ if (!fdb_refresh_wq && !rvu_sw_l2_offl_wq)
+ return;
+
+ rvu_sw_l2_destroy_wqs(l2_offl_work.rvu);
+}
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_l2.h b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_l2.h
index ff28612150c9..6685431d60a2 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_l2.h
+++ b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_l2.h
@@ -8,4 +8,7 @@
#ifndef RVU_SW_L2_H
#define RVU_SW_L2_H
+int rvu_sw_l2_init_offl_wq(struct rvu *rvu, u16 pcifunc, bool fw_up);
+int rvu_sw_l2_fdb_list_entry_add(struct rvu *rvu, u16 pcifunc, u8 *mac);
+void rvu_sw_l2_shutdown(void);
#endif
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
index 2e33b33ec993..0cd6049c637e 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
@@ -28,6 +28,7 @@
#include <rvu_trace.h>
#include "cn10k_ipsec.h"
#include "otx2_xsk.h"
+#include "switch/sw_nb.h"
#define DRV_NAME "rvu_nicpf"
#define DRV_STRING "Marvell RVU NIC Physical Function Driver"
@@ -993,6 +994,7 @@ static int otx2_process_mbox_msg_up(struct otx2_nic *pf,
MBOX_UP_CGX_MESSAGES
MBOX_UP_MCS_MESSAGES
MBOX_UP_REP_MESSAGES
+MBOX_UP_AF2PF_FDB_REFRESH_MESSAGES
#undef M
break;
default:
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
index b022f52c6845..6f2fc4caf70c 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
@@ -9,6 +9,7 @@
#include <linux/module.h>
#include <linux/pci.h>
#include <linux/net_tstamp.h>
+#include <net/switchdev.h>
#include "otx2_common.h"
#include "otx2_reg.h"
@@ -114,6 +115,33 @@ static void otx2vf_vfaf_mbox_handler(struct work_struct *work)
}
}
+#if IS_ENABLED(CONFIG_OCTEONTX_SWITCH)
+static int otx2vf_mbox_af2pf_fdb_refresh(struct otx2_nic *vf,
+ struct af2pf_fdb_refresh_req *req,
+ struct msg_rsp *rsp)
+{
+ struct switchdev_notifier_fdb_info item = {0};
+
+ item.addr = req->mac;
+ item.info.dev = vf->netdev;
+ if (req->flags & FDB_DEL)
+ call_switchdev_notifiers(SWITCHDEV_FDB_DEL_TO_BRIDGE,
+ item.info.dev, &item.info, NULL);
+ else
+ call_switchdev_notifiers(SWITCHDEV_FDB_ADD_TO_BRIDGE,
+ item.info.dev, &item.info, NULL);
+
+ return 0;
+}
+#else
+static int otx2vf_mbox_af2pf_fdb_refresh(struct otx2_nic *vf,
+ struct af2pf_fdb_refresh_req *req,
+ struct msg_rsp *rsp)
+{
+ return 0;
+}
+#endif
+
static int otx2vf_process_mbox_msg_up(struct otx2_nic *vf,
struct mbox_msghdr *req)
{
@@ -141,6 +169,22 @@ static int otx2vf_process_mbox_msg_up(struct otx2_nic *vf,
err = otx2_mbox_up_handler_cgx_link_event(
vf, (struct cgx_link_info_msg *)req, rsp);
return err;
+
+ case MBOX_MSG_AF2PF_FDB_REFRESH:
+ rsp = (struct msg_rsp *)otx2_mbox_alloc_msg(&vf->mbox.mbox_up, 0,
+ sizeof(struct msg_rsp));
+ if (!rsp)
+ return -ENOMEM;
+
+ rsp->hdr.id = MBOX_MSG_AF2PF_FDB_REFRESH;
+ rsp->hdr.sig = OTX2_MBOX_RSP_SIG;
+ rsp->hdr.pcifunc = req->pcifunc;
+ rsp->hdr.rc = 0;
+ err = otx2vf_mbox_af2pf_fdb_refresh(vf,
+ (struct af2pf_fdb_refresh_req *)req,
+ rsp);
+ return err;
+
default:
otx2_reply_invalid_msg(&vf->mbox.mbox_up, 0, 0, req->id);
return -ENODEV;
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fdb.c b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fdb.c
index 6842c8d91ffc..e9439219c091 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fdb.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fdb.c
@@ -4,13 +4,238 @@
* Copyright (C) 2026 Marvell.
*
*/
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <net/switchdev.h>
+#include <net/netevent.h>
+#include <net/arp.h>
+
+#include "../otx2_reg.h"
+#include "../otx2_common.h"
+#include "../otx2_struct.h"
+#include "../cn10k.h"
+#include "sw_nb.h"
#include "sw_fdb.h"
+#if !IS_ENABLED(CONFIG_OCTEONTX_SWITCH)
+
+int otx2_mbox_up_handler_af2pf_fdb_refresh(struct otx2_nic *pf,
+ struct af2pf_fdb_refresh_req *req,
+ struct msg_rsp *rsp)
+{
+ return 0;
+}
+
+#else
+
+#define SW_FDB_LIST_MAX 4096
+
+static DEFINE_SPINLOCK(sw_fdb_llock);
+static LIST_HEAD(sw_fdb_lh);
+static atomic_t sw_fdb_list_cnt = ATOMIC_INIT(0);
+
+struct sw_fdb_list_entry {
+ struct list_head list;
+ u64 flags;
+ struct otx2_nic *pf;
+ netdevice_tracker dev_tracker;
+ u8 mac[ETH_ALEN];
+ bool add_fdb;
+};
+
+static struct workqueue_struct *sw_fdb_wq;
+static struct work_struct sw_fdb_work;
+
+static void sw_fdb_list_cnt_warn(struct net_device *netdev)
+{
+ int n = atomic_read(&sw_fdb_list_cnt);
+
+ if (n < 0)
+ netdev_warn(netdev, "FDB list count underflow: %d\n", n);
+ else if (n > SW_FDB_LIST_MAX)
+ netdev_warn(netdev, "FDB list count overflow: %d (max %d)\n",
+ n, SW_FDB_LIST_MAX);
+}
+
+static int sw_fdb_list_count(void)
+{
+ return atomic_read(&sw_fdb_list_cnt);
+}
+
+static void sw_fdb_list_cnt_inc(struct net_device *netdev)
+{
+ atomic_inc(&sw_fdb_list_cnt);
+ sw_fdb_list_cnt_warn(netdev);
+}
+
+static void sw_fdb_list_cnt_dec(struct net_device *netdev)
+{
+ atomic_dec(&sw_fdb_list_cnt);
+ sw_fdb_list_cnt_warn(netdev);
+}
+
+static int sw_fdb_add_or_del(struct otx2_nic *pf,
+ const unsigned char *addr,
+ bool add_fdb)
+{
+ struct fdb_notify_req *req;
+ int rc;
+
+ mutex_lock(&pf->mbox.lock);
+ req = otx2_mbox_alloc_msg_fdb_notify(&pf->mbox);
+ if (!req) {
+ rc = -ENOMEM;
+ goto out;
+ }
+
+ ether_addr_copy(req->mac, addr);
+ req->flags = add_fdb ? FDB_ADD : FDB_DEL;
+
+ rc = otx2_sync_mbox_msg(&pf->mbox);
+out:
+ mutex_unlock(&pf->mbox.lock);
+ return rc;
+}
+
+static void sw_fdb_wq_handler(struct work_struct *work)
+{
+ struct sw_fdb_list_entry *entry;
+ struct workqueue_struct *wq;
+ LIST_HEAD(tlist);
+
+ spin_lock_bh(&sw_fdb_llock);
+ list_splice_init(&sw_fdb_lh, &tlist);
+ spin_unlock_bh(&sw_fdb_llock);
+
+ while ((entry =
+ list_first_entry_or_null(&tlist,
+ struct sw_fdb_list_entry,
+ list)) != NULL) {
+ list_del_init(&entry->list);
+ sw_fdb_list_cnt_dec(entry->pf->netdev);
+ if (sw_fdb_add_or_del(entry->pf, entry->mac, entry->add_fdb))
+ netdev_err(entry->pf->netdev,
+ "Error to add/del fdb %pM entry\n",
+ entry->mac);
+ netdev_put(entry->pf->netdev, &entry->dev_tracker);
+ kfree(entry);
+ }
+
+ spin_lock_bh(&sw_fdb_llock);
+ wq = sw_fdb_wq;
+ if (wq && !list_empty(&sw_fdb_lh))
+ queue_work(wq, &sw_fdb_work);
+ spin_unlock_bh(&sw_fdb_llock);
+}
+
+int sw_fdb_add_to_list(struct net_device *dev, u8 *mac, bool add_fdb)
+{
+ struct otx2_nic *pf = netdev_priv(dev);
+ struct sw_fdb_list_entry *entry;
+ struct workqueue_struct *wq;
+
+ spin_lock_bh(&sw_fdb_llock);
+ if (!sw_fdb_wq) {
+ spin_unlock_bh(&sw_fdb_llock);
+ return -EINVAL;
+ }
+ spin_unlock_bh(&sw_fdb_llock);
+
+ if (sw_fdb_list_count() >= SW_FDB_LIST_MAX)
+ return -ENOMEM;
+
+ entry = kcalloc(1, sizeof(*entry), GFP_ATOMIC);
+ if (!entry)
+ return -ENOMEM;
+
+ ether_addr_copy(entry->mac, mac);
+ entry->add_fdb = add_fdb;
+ entry->pf = pf;
+ netdev_hold(dev, &entry->dev_tracker, GFP_ATOMIC);
+
+ spin_lock_bh(&sw_fdb_llock);
+ wq = sw_fdb_wq;
+ if (wq) {
+ list_add_tail(&entry->list, &sw_fdb_lh);
+ sw_fdb_list_cnt_inc(dev);
+ queue_work(wq, &sw_fdb_work);
+ }
+ spin_unlock_bh(&sw_fdb_llock);
+
+ if (!wq) {
+ netdev_put(dev, &entry->dev_tracker);
+ kfree(entry);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
int sw_fdb_init(void)
{
+ INIT_WORK(&sw_fdb_work, sw_fdb_wq_handler);
+ sw_fdb_wq = alloc_workqueue("sw_fdb_wq", 0, 0);
+ if (!sw_fdb_wq)
+ return -ENOMEM;
+
return 0;
}
void sw_fdb_deinit(void)
{
+ struct sw_fdb_list_entry *entry;
+ struct workqueue_struct *wq;
+ LIST_HEAD(tlist);
+
+ spin_lock_bh(&sw_fdb_llock);
+ wq = sw_fdb_wq;
+ sw_fdb_wq = NULL;
+ spin_unlock_bh(&sw_fdb_llock);
+
+ if (!wq)
+ return;
+
+ cancel_work_sync(&sw_fdb_work);
+ destroy_workqueue(wq);
+
+ spin_lock_bh(&sw_fdb_llock);
+ list_splice_init(&sw_fdb_lh, &tlist);
+ spin_unlock_bh(&sw_fdb_llock);
+
+ while ((entry =
+ list_first_entry_or_null(&tlist,
+ struct sw_fdb_list_entry,
+ list)) != NULL) {
+ list_del_init(&entry->list);
+ sw_fdb_list_cnt_dec(entry->pf->netdev);
+ netdev_put(entry->pf->netdev, &entry->dev_tracker);
+ kfree(entry);
+ }
+}
+
+int otx2_mbox_up_handler_af2pf_fdb_refresh(struct otx2_nic *pf,
+ struct af2pf_fdb_refresh_req *req,
+ struct msg_rsp *rsp)
+{
+ struct switchdev_notifier_fdb_info item = {0};
+
+ /* FDB refresh is raised from the switch offload path (AF) after
+ * switchdev FDB updates and is delivered to the PF mailbox.
+ * Refreshes targeting the PF netdev are applied here on
+ * pf->netdev; VF-targeted refreshes are forwarded on the PF-VF
+ * mailbox and handled in otx2vf_mbox_af2pf_fdb_refresh() on
+ * vf->netdev (see rvu_sw_l2_fdb_refresh_send()).
+ */
+ item.addr = req->mac;
+ item.info.dev = pf->netdev;
+ if (req->flags & FDB_DEL)
+ call_switchdev_notifiers(SWITCHDEV_FDB_DEL_TO_BRIDGE,
+ item.info.dev, &item.info, NULL);
+ else
+ call_switchdev_notifiers(SWITCHDEV_FDB_ADD_TO_BRIDGE,
+ item.info.dev, &item.info, NULL);
+
+ return 0;
}
+#endif
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fdb.h b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fdb.h
index d4314d6d3ee4..3b06a77e6b56 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fdb.h
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fdb.h
@@ -7,6 +7,7 @@
#ifndef SW_FDB_H_
#define SW_FDB_H_
+int sw_fdb_add_to_list(struct net_device *dev, u8 *mac, bool add_fdb);
void sw_fdb_deinit(void);
int sw_fdb_init(void);
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.c b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.c
index 8a09876e8297..e908cc50a611 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.c
@@ -169,13 +169,17 @@ static int sw_nb_fdb_event(struct notifier_block *unused,
switch (event) {
case SWITCHDEV_FDB_ADD_TO_DEVICE:
- if (fdb_info->is_local)
- break;
- break;
-
case SWITCHDEV_FDB_DEL_TO_DEVICE:
if (fdb_info->is_local)
break;
+ /* dev is the bridge port that learned the FDB
+ * (SWITCHDEV_FDB_*_TO_DEVICE), not the bridge master.
+ * sw_nb_is_valid_dev() limits this to Cavium-offloaded
+ * setups; only Cavium PF/representor netdevs are supported
+ * as bridge ports today (VLAN/virt under bridge is TODO).
+ */
+ sw_fdb_add_to_list(dev, (u8 *)fdb_info->addr,
+ event == SWITCHDEV_FDB_ADD_TO_DEVICE);
break;
default:
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.h b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.h
index e995c0e6046b..a701574de1e4 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.h
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.h
@@ -14,6 +14,10 @@ struct otx2_nic;
struct af2pf_fdb_refresh_req;
struct msg_rsp;
+int otx2_mbox_up_handler_af2pf_fdb_refresh(struct otx2_nic *pf,
+ struct af2pf_fdb_refresh_req *req,
+ struct msg_rsp *rsp);
+
#if IS_ENABLED(CONFIG_OCTEONTX_SWITCH)
enum {
OTX2_DEV_UP = 1,
@@ -32,10 +36,6 @@ int sw_nb_unregister(struct net_device *netdev);
bool sw_nb_is_valid_dev(struct net_device *netdev);
struct net_device *sw_nb_resolve_pf_dev(struct net_device *dev);
-int otx2_mbox_up_handler_af2pf_fdb_refresh(struct otx2_nic *pf,
- struct af2pf_fdb_refresh_req *req,
- struct msg_rsp *rsp);
-
bool sw_nb_is_cavium_dev(struct net_device *netdev);
int sw_nb_fib_event_to_otx2_event(int event, struct net_device *netdev);
int sw_nb_inetaddr_event_to_otx2_event(int event, struct net_device *netdev);
--
2.43.0
^ permalink raw reply related
* [PATCH v4 net-next 8/9] octeontx2: switch: offload host FIB updates to switch via AF mailbox
From: Ratheesh Kannoth @ 2026-07-21 8:18 UTC (permalink / raw)
To: linux-kernel, netdev
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, sgoutham,
Ratheesh Kannoth
In-Reply-To: <20260721081824.1430607-1-rkannoth@marvell.com>
Queue IPv4/IPv6 FIB-derived updates from the switch notifier path
and handle fib_notify in the RVU AF by batching fib_entry
structures and sending them to the switch PF through the
AF-to-switchdev FIB_CMD. Require the switch firmware to
be ready before accepting offload work.
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
---
.../marvell/octeontx2/af/switch/rvu_sw.c | 3 +-
.../marvell/octeontx2/af/switch/rvu_sw_l3.c | 243 ++++++++++++++++++
.../marvell/octeontx2/af/switch/rvu_sw_l3.h | 1 +
.../marvell/octeontx2/nic/switch/sw_fib.c | 225 ++++++++++++++++
.../marvell/octeontx2/nic/switch/sw_fib.h | 14 +
.../marvell/octeontx2/nic/switch/sw_nb.c | 11 +-
.../marvell/octeontx2/nic/switch/sw_nb_v4.c | 192 +++++++-------
.../marvell/octeontx2/nic/switch/sw_nb_v6.c | 22 +-
.../marvell/octeontx2/nic/switch/sw_nb_v6.h | 31 ++-
9 files changed, 640 insertions(+), 102 deletions(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw.c b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw.c
index b9cd7c7524b9..1151ba47284b 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw.c
@@ -6,10 +6,10 @@
*/
#include <linux/bitfield.h>
-
#include "rvu.h"
#include "rvu_sw.h"
#include "rvu_sw_l2.h"
+#include "rvu_sw_l3.h"
#include "rvu_sw_fl.h"
u32 rvu_sw_port_id(struct rvu *rvu, u16 pcifunc)
@@ -80,4 +80,5 @@ int rvu_mbox_handler_swdev2af_notify(struct rvu *rvu,
void rvu_sw_shutdown(void)
{
rvu_sw_l2_shutdown();
+ rvu_sw_l3_shutdown();
}
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_l3.c b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_l3.c
index 2b798d5f0644..c47b93a66a3b 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_l3.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_l3.c
@@ -4,11 +4,254 @@
* Copyright (C) 2026 Marvell.
*
*/
+
+#include <linux/bitfield.h>
#include "rvu.h"
+#include "rvu_sw.h"
+#include "rvu_sw_l3.h"
+
+static struct af2swdev_notify_req __maybe_unused
+*otx2_mbox_alloc_msg_af2swdev_notify(struct rvu *rvu, int devid)
+{
+ struct af2swdev_notify_req *req;
+
+ req = (struct af2swdev_notify_req *)
+ otx2_mbox_alloc_msg_rsp(&rvu->afpf_wq_info.mbox_up, devid,
+ sizeof(*req), sizeof(struct msg_rsp));
+ if (!req)
+ return NULL;
+ req->hdr.sig = OTX2_MBOX_REQ_SIG;
+ req->hdr.id = MBOX_MSG_AF2SWDEV;
+ return req;
+}
+
+#define RVU_SW_L3_BATCH_MAX \
+ ((int)(sizeof_field(struct af2swdev_notify_req, entry) / \
+ sizeof(struct fib_entry)))
+
+struct l3_entry {
+ struct list_head list;
+ /* Always this AF driver's rvu; stored for clarity only (single RVU). */
+ struct rvu *rvu;
+ u32 port_id;
+ int cnt;
+ struct fib_entry entry[];
+};
+
+static DEFINE_MUTEX(l3_offl_llock);
+static LIST_HEAD(l3_offl_lh);
+
+static struct workqueue_struct *sw_l3_offl_wq;
+static void sw_l3_offl_work_handler(struct work_struct *work);
+static DECLARE_DELAYED_WORK(l3_offl_work, sw_l3_offl_work_handler);
+
+/*
+ * FIB offload to the switch ASIC: one octeontx2 AF driver instance, one
+ * switch PF (switchdev), and one sw_l3_offl_wq per SoC.
+ */
+
+static void rvu_sw_l3_drain_list(struct list_head *lh)
+{
+ struct l3_entry *entry;
+
+ while ((entry = list_first_entry_or_null(lh, struct l3_entry, list))) {
+ list_del(&entry->list);
+ kfree(entry);
+ }
+}
+
+static void rvu_sw_l3_queue_work(void)
+{
+ if (sw_l3_offl_wq)
+ queue_delayed_work(sw_l3_offl_wq, &l3_offl_work,
+ msecs_to_jiffies(10));
+}
+
+static int rvu_sw_l3_ensure_wq(void)
+{
+ if (sw_l3_offl_wq)
+ return 0;
+
+ sw_l3_offl_wq = alloc_workqueue("sw_af_fib_wq", 0, 0);
+ if (!sw_l3_offl_wq)
+ return -ENOMEM;
+
+ return 0;
+}
+
+static int rvu_sw_l3_offl_rule_push(struct list_head *lh)
+{
+ struct af2swdev_notify_req *req;
+ struct fib_entry *entry, *dst;
+ struct l3_entry *l3_entry;
+ struct rvu *rvu;
+ int tot_cnt = 0;
+ int swdev_pf;
+ int sz, cnt, i;
+ bool rc;
+
+ BUILD_BUG_ON(sizeof_field(struct af2swdev_notify_req, entry) !=
+ sizeof(struct fib_entry) * RVU_SW_L3_BATCH_MAX);
+
+ l3_entry = list_first_entry_or_null(lh, struct l3_entry, list);
+ if (!l3_entry)
+ return 0;
+
+ /*
+ * Octeontx2 has a single AF (one struct rvu) per RVU chip. All queued
+ * entries therefore share the same rvu and the same switch PF below.
+ * Host PF identity is carried per fib_entry (port_id), not by picking
+ * a different switch PF here.
+ */
+ rvu = l3_entry->rvu;
+ swdev_pf = rvu_get_pf(rvu->pdev, rvu->rswitch.pcifunc);
+
+ mutex_lock(&rvu->mbox_lock);
+ req = otx2_mbox_alloc_msg_af2swdev_notify(rvu, swdev_pf);
+ if (!req) {
+ mutex_unlock(&rvu->mbox_lock);
+ return -ENOMEM;
+ }
+
+ dst = &req->entry[0];
+ /*
+ * Batch fib_entry records from multiple host PF notifies into one
+ * af2swdev message. Safe on octeontx2: every l3_entry targets the
+ * same switch PF; egress port is encoded in each fib_entry.port_id.
+ *
+ * Entries are removed from lh and freed once copied into the mbox
+ * buffer, before the send attempt. If otx2_mbox_wait_for_zero() or
+ * the upstream send fails, that batch is lost with no replay path and
+ * the switch FIB may diverge from the host; tolerating that is a
+ * known limitation for now.
+ */
+ while ((l3_entry =
+ list_first_entry_or_null(lh,
+ struct l3_entry, list)) != NULL) {
+ entry = l3_entry->entry;
+ cnt = l3_entry->cnt;
+
+ /* af2swdev_notify_req.entry[] holds RVU_SW_L3_BATCH_MAX slots;
+ * stop before copying the next l3_entry when the mbox buffer
+ * would overflow. Leftovers stay on lh and are re-queued.
+ */
+ if (tot_cnt + cnt > RVU_SW_L3_BATCH_MAX)
+ break;
+
+ sz = sizeof(*entry) * cnt;
+
+ memcpy(dst, entry, sz);
+ for (i = 0; i < cnt; i++)
+ dst[i].port_id = l3_entry->port_id;
+ tot_cnt += cnt;
+ dst += cnt;
+
+ list_del_init(&l3_entry->list);
+ kfree(l3_entry);
+ }
+ if (!tot_cnt) {
+ mutex_unlock(&rvu->mbox_lock);
+ return -EINVAL;
+ }
+
+ req->flags = FIB_CMD;
+ req->cnt = tot_cnt;
+
+ rc = otx2_mbox_wait_for_zero(&rvu->afpf_wq_info.mbox_up, swdev_pf);
+ if (rc)
+ otx2_mbox_msg_send_up(&rvu->afpf_wq_info.mbox_up, swdev_pf);
+
+ mutex_unlock(&rvu->mbox_lock);
+ return rc ? 0 : -EFAULT;
+}
+
+static void sw_l3_offl_work_handler(struct work_struct *work)
+{
+ struct list_head l3lh;
+
+ INIT_LIST_HEAD(&l3lh);
+
+ mutex_lock(&l3_offl_llock);
+ if (list_empty(&l3_offl_lh)) {
+ mutex_unlock(&l3_offl_llock);
+ return;
+ }
+ list_splice_init(&l3_offl_lh, &l3lh);
+ mutex_unlock(&l3_offl_llock);
+
+ if (rvu_sw_l3_offl_rule_push(&l3lh))
+ pr_err("%s: Error to push rules\n", __func__);
+
+ /* rvu_sw_l3_offl_rule_push() may leave entries when a batch is full. */
+ if (!list_empty(&l3lh)) {
+ mutex_lock(&l3_offl_llock);
+ list_splice(&l3lh, &l3_offl_lh);
+ mutex_unlock(&l3_offl_llock);
+ if (sw_l3_offl_wq)
+ queue_delayed_work(sw_l3_offl_wq, &l3_offl_work,
+ msecs_to_jiffies(100));
+ return;
+ }
+
+ mutex_lock(&l3_offl_llock);
+ if (!list_empty(&l3_offl_lh))
+ rvu_sw_l3_queue_work();
+ mutex_unlock(&l3_offl_llock);
+}
int rvu_mbox_handler_fib_notify(struct rvu *rvu,
struct fib_notify_req *req,
struct msg_rsp *rsp)
{
+ struct l3_entry *l3_entry;
+ int sz, rc;
+
+ if (!(rvu->rswitch.flags & RVU_SWITCH_FLAG_FW_READY))
+ return -EAGAIN;
+
+ /* Reject single notifies larger than af2swdev_notify_req.entry[]. */
+ if (!req->cnt || req->cnt > RVU_SW_L3_BATCH_MAX)
+ return -EINVAL;
+
+ sz = req->cnt * sizeof(struct fib_entry);
+
+ l3_entry = kcalloc(1, sizeof(*l3_entry) + sz, GFP_KERNEL);
+ if (!l3_entry)
+ return -ENOMEM;
+
+ l3_entry->port_id = rvu_sw_port_id(rvu, req->hdr.pcifunc);
+ l3_entry->rvu = rvu;
+ l3_entry->cnt = req->cnt;
+ INIT_LIST_HEAD(&l3_entry->list);
+ memcpy(l3_entry->entry, req->entry, sz);
+
+ /* Host PFs on this RVU share one AF and one switch PF offload path. */
+ mutex_lock(&l3_offl_llock);
+ rc = rvu_sw_l3_ensure_wq();
+ if (rc) {
+ mutex_unlock(&l3_offl_llock);
+ kfree(l3_entry);
+ return rc;
+ }
+
+ list_add_tail(&l3_entry->list, &l3_offl_lh);
+ if (sw_l3_offl_wq)
+ rvu_sw_l3_queue_work();
+ mutex_unlock(&l3_offl_llock);
+
return 0;
}
+
+void rvu_sw_l3_shutdown(void)
+{
+ if (!sw_l3_offl_wq)
+ return;
+
+ cancel_delayed_work_sync(&l3_offl_work);
+ destroy_workqueue(sw_l3_offl_wq);
+ sw_l3_offl_wq = NULL;
+
+ mutex_lock(&l3_offl_llock);
+ rvu_sw_l3_drain_list(&l3_offl_lh);
+ mutex_unlock(&l3_offl_llock);
+}
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_l3.h b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_l3.h
index ac8c4f9ba5ac..153f1415466d 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_l3.h
+++ b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_l3.h
@@ -8,4 +8,5 @@
#ifndef RVU_SW_L3_H
#define RVU_SW_L3_H
+void rvu_sw_l3_shutdown(void);
#endif
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fib.c b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fib.c
index 41a9c5fb58fa..308ce3048a8d 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fib.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fib.c
@@ -8,13 +8,238 @@
#if IS_ENABLED(CONFIG_OCTEONTX_SWITCH)
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <net/switchdev.h>
+#include <net/netevent.h>
+#include <net/arp.h>
+#include <net/route.h>
+
+#include "../otx2_reg.h"
+#include "../otx2_common.h"
+#include "../otx2_struct.h"
+#include "../cn10k.h"
+#include "sw_nb.h"
+
+#define SW_FIB_BATCH_MAX 16
+#define SW_FIB_LIST_MAX 4096
+
+/*
+ * One switch PF registers notifiers via sw_nb_register(); a second call
+ * returns -EBUSY. A single sw_fib_wq therefore serves the one switchdev
+ * instance on octeontx2, matching the FDB offload path.
+ */
+static DEFINE_SPINLOCK(sw_fib_llock);
+static LIST_HEAD(sw_fib_lh);
+static atomic_t sw_fib_list_cnt = ATOMIC_INIT(0);
+
+static struct workqueue_struct *sw_fib_wq;
+static void sw_fib_work_handler(struct work_struct *work);
+static DECLARE_DELAYED_WORK(sw_fib_work, sw_fib_work_handler);
+
+struct sw_fib_list_entry {
+ struct list_head lh;
+ struct otx2_nic *pf;
+ netdevice_tracker dev_tracker;
+ int cnt;
+ struct fib_entry *entry;
+};
+
+static void sw_fib_list_cnt_warn(struct net_device *netdev)
+{
+ int n = atomic_read(&sw_fib_list_cnt);
+
+ if (n < 0)
+ netdev_warn(netdev, "FIB list count underflow: %d\n", n);
+ else if (n > SW_FIB_LIST_MAX)
+ netdev_warn(netdev, "FIB list count overflow: %d (max %d)\n",
+ n, SW_FIB_LIST_MAX);
+}
+
+static int sw_fib_list_count(void)
+{
+ return atomic_read(&sw_fib_list_cnt);
+}
+
+static void sw_fib_list_cnt_inc(struct net_device *netdev)
+{
+ atomic_inc(&sw_fib_list_cnt);
+ sw_fib_list_cnt_warn(netdev);
+}
+
+static void sw_fib_list_cnt_dec(struct net_device *netdev)
+{
+ atomic_dec(&sw_fib_list_cnt);
+ sw_fib_list_cnt_warn(netdev);
+}
+
+static int sw_fib_notify(struct otx2_nic *pf,
+ int cnt,
+ struct fib_entry *entry)
+{
+ struct fib_notify_req *req;
+ int rc;
+
+ if (cnt > SW_FIB_BATCH_MAX)
+ return -EINVAL;
+
+ mutex_lock(&pf->mbox.lock);
+ req = otx2_mbox_alloc_msg_fib_notify(&pf->mbox);
+ if (!req) {
+ rc = -ENOMEM;
+ goto out;
+ }
+
+ req->cnt = cnt;
+ memcpy(req->entry, entry, sizeof(*entry) * cnt);
+
+ rc = otx2_sync_mbox_msg(&pf->mbox);
+out:
+ mutex_unlock(&pf->mbox.lock);
+ return rc;
+}
+
+static void sw_fib_work_handler(struct work_struct *work)
+{
+ struct sw_fib_list_entry *lentry;
+ LIST_HEAD(tlist);
+
+ spin_lock_bh(&sw_fib_llock);
+ list_splice_init(&sw_fib_lh, &tlist);
+ spin_unlock_bh(&sw_fib_llock);
+
+ while ((lentry =
+ list_first_entry_or_null(&tlist,
+ struct sw_fib_list_entry, lh)) != NULL) {
+ list_del_init(&lentry->lh);
+ if (sw_fib_notify(lentry->pf, lentry->cnt, lentry->entry)) {
+ netdev_err(lentry->pf->netdev,
+ "Failed to notify FIB update to AF, will retry\n");
+ spin_lock_bh(&sw_fib_llock);
+ if (sw_fib_wq) {
+ list_add(&lentry->lh, &sw_fib_lh);
+ queue_delayed_work(sw_fib_wq, &sw_fib_work,
+ msecs_to_jiffies(100));
+ spin_unlock_bh(&sw_fib_llock);
+ continue;
+ }
+ spin_unlock_bh(&sw_fib_llock);
+ netdev_put(lentry->pf->netdev, &lentry->dev_tracker);
+ sw_fib_list_cnt_dec(lentry->pf->netdev);
+ kfree(lentry->entry);
+ kfree(lentry);
+ continue;
+ }
+ sw_fib_list_cnt_dec(lentry->pf->netdev);
+ netdev_put(lentry->pf->netdev, &lentry->dev_tracker);
+ kfree(lentry->entry);
+ kfree(lentry);
+ }
+
+ spin_lock_bh(&sw_fib_llock);
+ if (!list_empty(&sw_fib_lh) && sw_fib_wq)
+ queue_delayed_work(sw_fib_wq, &sw_fib_work,
+ msecs_to_jiffies(10));
+ spin_unlock_bh(&sw_fib_llock);
+}
+
+int sw_fib_add_to_list(struct net_device *dev,
+ struct fib_entry *entry, int cnt)
+{
+ struct otx2_nic *pf = netdev_priv(dev);
+ struct sw_fib_list_entry *lentry;
+ struct workqueue_struct *wq;
+
+ if (cnt <= 0 || cnt > SW_FIB_BATCH_MAX) {
+ kfree(entry);
+ return -EINVAL;
+ }
+
+ spin_lock_bh(&sw_fib_llock);
+ if (!sw_fib_wq) {
+ spin_unlock_bh(&sw_fib_llock);
+ kfree(entry);
+ return -EINVAL;
+ }
+ spin_unlock_bh(&sw_fib_llock);
+
+ if (sw_fib_list_count() >= SW_FIB_LIST_MAX) {
+ kfree(entry);
+ return -ENOMEM;
+ }
+
+ lentry = kcalloc(1, sizeof(*lentry), GFP_ATOMIC);
+ if (!lentry) {
+ kfree(entry);
+ return -ENOMEM;
+ }
+
+ lentry->pf = pf;
+ lentry->cnt = cnt;
+ lentry->entry = entry;
+ INIT_LIST_HEAD(&lentry->lh);
+ netdev_hold(dev, &lentry->dev_tracker, GFP_ATOMIC);
+
+ spin_lock_bh(&sw_fib_llock);
+ wq = sw_fib_wq;
+ if (wq) {
+ list_add_tail(&lentry->lh, &sw_fib_lh);
+ sw_fib_list_cnt_inc(dev);
+ queue_delayed_work(wq, &sw_fib_work,
+ msecs_to_jiffies(10));
+ }
+ spin_unlock_bh(&sw_fib_llock);
+
+ if (!wq) {
+ netdev_put(dev, &lentry->dev_tracker);
+ kfree(lentry);
+ kfree(entry);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
int sw_fib_init(void)
{
+ sw_fib_wq = alloc_workqueue("sw_pf_fib_wq", 0, 0);
+ if (!sw_fib_wq)
+ return -ENOMEM;
+
return 0;
}
void sw_fib_deinit(void)
{
+ struct sw_fib_list_entry *lentry;
+ struct workqueue_struct *wq;
+ LIST_HEAD(tlist);
+
+ spin_lock_bh(&sw_fib_llock);
+ wq = sw_fib_wq;
+ sw_fib_wq = NULL;
+ spin_unlock_bh(&sw_fib_llock);
+
+ if (!wq)
+ return;
+
+ cancel_delayed_work_sync(&sw_fib_work);
+ destroy_workqueue(wq);
+
+ spin_lock_bh(&sw_fib_llock);
+ list_splice_init(&sw_fib_lh, &tlist);
+ spin_unlock_bh(&sw_fib_llock);
+
+ while ((lentry =
+ list_first_entry_or_null(&tlist,
+ struct sw_fib_list_entry, lh)) != NULL) {
+ list_del_init(&lentry->lh);
+ sw_fib_list_cnt_dec(lentry->pf->netdev);
+ netdev_put(lentry->pf->netdev, &lentry->dev_tracker);
+ kfree(lentry->entry);
+ kfree(lentry);
+ }
}
#endif
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fib.h b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fib.h
index 9b72e95f2dd3..05a528931d14 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fib.h
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fib.h
@@ -8,11 +8,25 @@
#define SW_FIB_H_
#include <linux/kconfig.h>
+#include <linux/slab.h>
+
+struct fib_entry;
+struct net_device;
#if IS_ENABLED(CONFIG_OCTEONTX_SWITCH)
+int sw_fib_add_to_list(struct net_device *dev,
+ struct fib_entry *entry, int cnt);
void sw_fib_deinit(void);
int sw_fib_init(void);
#else
+static inline int sw_fib_add_to_list(struct net_device *dev,
+ struct fib_entry *entry, int cnt)
+{
+ (void)dev;
+ (void)cnt;
+ kfree(entry);
+ return 0;
+}
static inline void sw_fib_deinit(void) {}
static inline int sw_fib_init(void) { return 0; }
#endif
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.c b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.c
index e908cc50a611..f2597d413780 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb.c
@@ -163,6 +163,7 @@ static int sw_nb_fdb_event(struct notifier_block *unused,
{
struct net_device *dev = switchdev_notifier_info_to_dev(ptr);
struct switchdev_notifier_fdb_info *fdb_info = ptr;
+ int rc = 0;
if (!sw_nb_is_valid_dev(dev))
return NOTIFY_DONE;
@@ -178,14 +179,17 @@ static int sw_nb_fdb_event(struct notifier_block *unused,
* setups; only Cavium PF/representor netdevs are supported
* as bridge ports today (VLAN/virt under bridge is TODO).
*/
- sw_fdb_add_to_list(dev, (u8 *)fdb_info->addr,
- event == SWITCHDEV_FDB_ADD_TO_DEVICE);
+ rc = sw_fdb_add_to_list(dev, (u8 *)fdb_info->addr,
+ event == SWITCHDEV_FDB_ADD_TO_DEVICE);
break;
default:
return NOTIFY_DONE;
}
+ if (rc)
+ netdev_err(dev, "%s: Error to add to list\n", __func__);
+
return NOTIFY_DONE;
}
@@ -354,8 +358,8 @@ static int sw_nb_netdev_event(struct notifier_block *unused,
if (idev)
sw_nb_v4_netdev_event(unused, event, ptr);
-#if IS_ENABLED(CONFIG_IPV6)
i6dev = __in6_dev_get(dev);
+#if IS_ENABLED(CONFIG_IPV6)
if (i6dev)
sw_nb_v6_netdev_event(unused, event, ptr);
#endif
@@ -432,6 +436,7 @@ int sw_nb_register(struct net_device *netdev)
{
int err;
+ /* One switch PF / switchdev instance registers system-wide notifiers. */
if (sw_nb_registered)
return -EBUSY;
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v4.c b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v4.c
index c773fce1bc50..38d2e8da9d31 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v4.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v4.c
@@ -12,6 +12,7 @@
#include <net/arp.h>
#include <net/route.h>
#include <linux/inetdevice.h>
+#include <net/nexthop.h>
#include "../otx2_reg.h"
#include "../otx2_common.h"
@@ -40,7 +41,13 @@ int sw_nb_v4_netdev_event(struct notifier_block *unused,
if (!idev || !idev->ifa_list)
return NOTIFY_DONE;
- /* Switch offload supports a single IPv4 address per interface for now. */
+ if (!sw_nb_is_valid_dev(dev))
+ return NOTIFY_DONE;
+
+ /* Switch offload supports a single IPv4 address per interface for
+ * now. Only the head of ifa_list is offloaded on netdev events;
+ * secondary addresses are not supported by the hardware path.
+ */
ifa = rtnl_dereference(idev->ifa_list);
entry = kcalloc(1, sizeof(*entry), GFP_KERNEL);
@@ -66,6 +73,10 @@ int sw_nb_v4_netdev_event(struct notifier_block *unused,
entry->vlan_tag = cpu_to_be16(vlan_dev_vlan_id(dev));
}
+ /* Switch offload is only enabled on OcteonTX2/CN10K SoCs. pf_dev is an
+ * octeontx2 PF or representor netdev, so netdev_priv() is otx2_nic even
+ * though sw_nb_is_cavium_dev() matches the shared Cavium PCI vendor ID.
+ */
pf = netdev_priv(pf_dev);
entry->port_id = pf->pcifunc;
@@ -76,7 +87,7 @@ int sw_nb_v4_netdev_event(struct notifier_block *unused,
netdev_dbg(dev, "%s: pushing netdev event from HOST interface address %pI4, %pM, dev=%s\n",
__func__, &entry->dst, entry->mac, dev->name);
- kfree(entry);
+ sw_fib_add_to_list(pf_dev, entry, 1);
return NOTIFY_DONE;
}
@@ -88,7 +99,6 @@ int sw_nb_v4_inetaddr_event(struct notifier_block *nb,
struct net_device *dev = ifa->ifa_dev->dev;
struct netdev_hw_addr *dev_addr;
struct net_device *pf_dev;
- struct in_device *idev;
struct fib_entry *entry;
struct otx2_nic *pf;
@@ -101,10 +111,9 @@ int sw_nb_v4_inetaddr_event(struct notifier_block *nb,
if (!sw_nb_is_valid_dev(dev))
return NOTIFY_DONE;
- idev = __in_dev_get_rtnl(dev);
- if (!idev || !idev->ifa_list)
- return NOTIFY_DONE;
-
+ /* Use ifa from the notifier; idev->ifa_list is already empty when the
+ * final address is unlinked before NETDEV_DOWN is delivered.
+ */
entry = kcalloc(1, sizeof(*entry), GFP_ATOMIC);
if (!entry)
return NOTIFY_DONE;
@@ -139,24 +148,27 @@ int sw_nb_v4_inetaddr_event(struct notifier_block *nb,
netdev_dbg(dev, "%s: pushing inetaddr event from HOST interface address %pI4, %pM, %s\n",
__func__, &entry->dst, entry->mac, dev->name);
- kfree(entry);
+ sw_fib_add_to_list(pf_dev, entry, 1);
return NOTIFY_DONE;
}
int sw_nb_v4_fib_event(struct notifier_block *nb,
unsigned long event, void *ptr)
{
- struct net_device *dev, *pf_dev = NULL, *nh_pf_dev;
struct fib_entry_notifier_info *fen_info = ptr;
- struct fib_entry *entries, *iter;
+ struct net_device *host_pf_dev = NULL;
struct netdev_hw_addr *dev_addr;
+ struct net_device *nh_pf_dev;
+ struct fib_nh_common *nhc;
struct neighbour *neigh;
+ struct fib_entry *entry;
+ struct net_device *dev;
struct fib_nh *fib_nh;
struct fib_info *fi;
struct otx2_nic *pf;
+ int i, cnt, nhs;
__be32 *haddr;
int hcnt = 0;
- int cnt, i;
/* Process only UNICAST routes add or del */
if (fen_info->type != RTN_UNICAST)
@@ -166,29 +178,30 @@ int sw_nb_v4_fib_event(struct notifier_block *nb,
if (!fi)
return NOTIFY_DONE;
+ nhs = fib_info_num_path(fi);
+
if (fi->fib_nh_is_v6) {
- struct net_device *log_dev = (fi->fib_nhs > 0) ?
- fi->fib_nh->fib_nh_dev : NULL;
+ if (nhs > 0) {
+ nhc = fib_info_nhc(fi, 0);
- if (log_dev)
- netdev_dbg(log_dev, "%s: Received v6 notification\n",
- __func__);
+ if (nhc->nhc_dev)
+ netdev_dbg(nhc->nhc_dev,
+ "%s: Received v6 notification\n",
+ __func__);
+ }
return NOTIFY_DONE;
}
- entries = kcalloc(fi->fib_nhs, sizeof(*entries), GFP_ATOMIC);
- if (!entries)
+ if (!nhs)
return NOTIFY_DONE;
- haddr = kcalloc(fi->fib_nhs, sizeof(*haddr), GFP_ATOMIC);
- if (!haddr) {
- kfree(entries);
+ haddr = kcalloc(nhs, sizeof(*haddr), GFP_ATOMIC);
+ if (!haddr)
return NOTIFY_DONE;
- }
- iter = entries;
- fib_nh = fi->fib_nh;
- for (i = 0; i < fi->fib_nhs; i++, fib_nh++) {
+ for (i = 0; i < nhs; i++) {
+ nhc = fib_info_nhc(fi, i);
+ fib_nh = container_of(nhc, struct fib_nh, nh_common);
dev = fib_nh->fib_nh_dev;
if (!dev)
@@ -200,115 +213,111 @@ int sw_nb_v4_fib_event(struct notifier_block *nb,
if (!sw_nb_is_valid_dev(dev))
continue;
- iter->cmd = sw_nb_fib_event_to_otx2_event(event, dev);
- iter->dst = (__force __be32)fen_info->dst;
- iter->dst_len = fen_info->dst_len;
- iter->gw = fib_nh->fib_nh_gw4;
-
- netdev_dbg(dev, "%s: FIB route Rule cmd=%llu dst=%pI4 dst_len=%u gw=%pI4\n",
- __func__, iter->cmd, &iter->dst, iter->dst_len, &iter->gw);
-
nh_pf_dev = sw_nb_resolve_pf_dev(dev);
- if (!nh_pf_dev) {
- iter++;
+ if (!nh_pf_dev)
continue;
- }
- pf_dev = nh_pf_dev;
+
+ entry = kcalloc(1, sizeof(*entry), GFP_ATOMIC);
+ if (!entry)
+ break;
+
+ entry->cmd = sw_nb_fib_event_to_otx2_event(event, dev);
+ entry->dst = htonl(fen_info->dst);
+ entry->dst_len = fen_info->dst_len;
+ entry->gw = fib_nh->fib_nh_gw4;
if (netif_is_bridge_master(dev)) {
- iter->bridge = 1;
+ entry->bridge = 1;
} else if (is_vlan_dev(dev)) {
- iter->vlan_valid = 1;
- iter->vlan_tag = cpu_to_be16(vlan_dev_vlan_id(dev));
+ entry->vlan_valid = 1;
+ entry->vlan_tag = cpu_to_be16(vlan_dev_vlan_id(dev));
}
- pf = netdev_priv(pf_dev);
- iter->port_id = pf->pcifunc;
+ pf = netdev_priv(nh_pf_dev);
+ entry->port_id = pf->pcifunc;
/* Point-to-point routes, including default routes with no
* gateway, are not supported for switch offload.
*/
if (!fib_nh->fib_nh_gw4) {
- if (iter->dst || iter->dst_len)
- iter++;
-
+ if (!entry->dst && !entry->dst_len) {
+ kfree(entry);
+ continue;
+ }
+ sw_fib_add_to_list(nh_pf_dev, entry, 1);
continue;
}
- iter->gw_valid = 1;
+
+ entry->gw_valid = 1;
if (fib_nh->nh_saddr)
haddr[hcnt++] = fib_nh->nh_saddr;
rcu_read_lock();
neigh = ip_neigh_gw4(fib_nh->fib_nh_dev, fib_nh->fib_nh_gw4);
- if (!neigh) {
+ if (IS_ERR_OR_NULL(neigh)) {
rcu_read_unlock();
- iter++;
+ kfree(entry);
continue;
}
if (is_valid_ether_addr(neigh->ha)) {
- iter->mac_valid = 1;
- neigh_ha_snapshot(iter->mac, neigh, fib_nh->fib_nh_dev);
+ entry->mac_valid = 1;
+ neigh_ha_snapshot(entry->mac, neigh, fib_nh->fib_nh_dev);
}
-
- iter++;
rcu_read_unlock();
- }
- cnt = iter - entries;
- if (!cnt) {
- kfree(entries);
- kfree(haddr);
- return NOTIFY_DONE;
+ netdev_dbg(dev, "%s: FIB route Rule cmd=%llu dst=%pI4 dst_len=%u gw=%pI4\n",
+ __func__, entry->cmd, &entry->dst, entry->dst_len,
+ &entry->gw);
+ sw_fib_add_to_list(nh_pf_dev, entry, 1);
}
- if (pf_dev)
- netdev_dbg(pf_dev, "pf_dev is %s cnt=%d\n", pf_dev->name, cnt);
- kfree(entries);
-
if (!hcnt) {
kfree(haddr);
return NOTIFY_DONE;
}
- if (!pf_dev) {
- kfree(haddr);
- return NOTIFY_DONE;
- }
+ for (i = 0; i < hcnt; i++) {
+ host_pf_dev = NULL;
+ for (cnt = 0; cnt < nhs; cnt++) {
+ nhc = fib_info_nhc(fi, cnt);
+ fib_nh = container_of(nhc, struct fib_nh, nh_common);
+ if (fib_nh->nh_saddr == haddr[i]) {
+ host_pf_dev = sw_nb_resolve_pf_dev(fib_nh->fib_nh_dev);
+ break;
+ }
+ }
- entries = kcalloc(hcnt, sizeof(*entries), GFP_ATOMIC);
- if (!entries) {
- kfree(haddr);
- return NOTIFY_DONE;
- }
+ if (!host_pf_dev)
+ continue;
- iter = entries;
+ entry = kcalloc(1, sizeof(*entry), GFP_ATOMIC);
+ if (!entry)
+ break;
- /* Host routes reuse pf_dev/pf from the last resolved Cavium netdev:
- * pf_dev only identifies the switch AF mailbox context for switchdev
- * programming; any previously resolved Cavium netdev is sufficient.
- */
- for (i = 0; i < hcnt; i++, iter++) {
- iter->cmd = sw_nb_fib_event_to_otx2_event(event, pf_dev);
- iter->dst = haddr[i];
- iter->dst_len = 32;
- iter->mac_valid = 1;
- iter->host = 1;
- iter->port_id = pf->pcifunc;
+ pf = netdev_priv(host_pf_dev);
+ entry->cmd = sw_nb_fib_event_to_otx2_event(event, host_pf_dev);
+ entry->dst = haddr[i];
+ entry->dst_len = 32;
+ entry->mac_valid = 1;
+ entry->host = 1;
+ entry->port_id = pf->pcifunc;
rcu_read_lock();
- for_each_dev_addr(pf_dev, dev_addr) {
- ether_addr_copy(iter->mac, dev_addr->addr);
+ for_each_dev_addr(host_pf_dev, dev_addr) {
+ ether_addr_copy(entry->mac, dev_addr->addr);
break;
}
rcu_read_unlock();
- netdev_dbg(pf_dev, "%s: FIB host Rule cmd=%llu dst=%pI4 dst_len=%u gw=%pI4 %s\n",
- __func__, iter->cmd, &iter->dst, iter->dst_len, &iter->gw,
- pf_dev->name);
+ netdev_dbg(host_pf_dev,
+ "%s: FIB host Rule cmd=%llu dst=%pI4 dst_len=%u gw=%pI4 %s\n",
+ __func__, entry->cmd, &entry->dst, entry->dst_len,
+ &entry->gw, host_pf_dev->name);
+ sw_fib_add_to_list(host_pf_dev, entry, 1);
}
- kfree(entries);
+
kfree(haddr);
return NOTIFY_DONE;
}
@@ -324,6 +333,9 @@ int sw_nb_net_v4_neigh_update(struct notifier_block *nb,
if (n->tbl != &arp_tbl)
return NOTIFY_DONE;
+ if (!sw_nb_is_valid_dev(n->dev))
+ return NOTIFY_DONE;
+
entry = kcalloc(1, sizeof(*entry), GFP_ATOMIC);
if (!entry)
return NOTIFY_DONE;
@@ -351,7 +363,7 @@ int sw_nb_net_v4_neigh_update(struct notifier_block *nb,
pf = netdev_priv(pf_dev);
entry->port_id = pf->pcifunc;
- kfree(entry);
+ sw_fib_add_to_list(pf_dev, entry, 1);
return NOTIFY_DONE;
}
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v6.c b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v6.c
index 62ab00658879..0a2ad61412d6 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v6.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v6.c
@@ -45,12 +45,18 @@ int sw_nb_v6_netdev_event(struct notifier_block *unused,
if (!i6dev)
return NOTIFY_DONE;
+ if (!sw_nb_is_valid_dev(dev))
+ return NOTIFY_DONE;
+
/* Invoked from sw_nb_netdev_event() on NETDEV_UP/DOWN/CHANGE, which
* run with RTNL held. IPv6 address list updates are also serialized
* by RTNL, so addr_list cannot race with concurrent assignments.
*/
rcu_read_lock();
- /* Switch offload supports a single IPv6 address per interface for now. */
+ /* Switch offload supports a single IPv6 address per interface for
+ * now. Only the head of addr_list is offloaded on netdev events;
+ * secondary addresses are not supported by the hardware path.
+ */
ifp = list_first_entry_or_null(&i6dev->addr_list,
struct inet6_ifaddr, if_list);
if (!ifp) {
@@ -94,15 +100,15 @@ int sw_nb_v6_netdev_event(struct notifier_block *unused,
netdev_dbg(dev, "netdev event addr=%pI6c plen=%u mac=%pM\n",
&addr, prefix_len, entry->mac);
- kfree(entry);
+ sw_fib_add_to_list(pf_dev, entry, 1);
return NOTIFY_DONE;
}
int sw_nb_v6_fib_event(struct notifier_block *nb,
unsigned long event, void *ptr)
{
- struct fib6_entry_notifier_info *f6_eni;
struct fib_notifier_info *info = ptr;
+ struct fib6_entry_notifier_info *f6_eni;
struct net_device *fib_dev, *pf_dev;
struct fib_entry *entry;
struct fib6_info *f6i;
@@ -171,7 +177,7 @@ int sw_nb_v6_fib_event(struct notifier_block *nb,
*/
rcu_read_lock();
neigh = ip_neigh_gw6(fib_dev, &nh6->fib_nh_gw6);
- if (!neigh) {
+ if (IS_ERR_OR_NULL(neigh)) {
rcu_read_unlock();
kfree(entry);
return NOTIFY_DONE;
@@ -183,8 +189,8 @@ int sw_nb_v6_fib_event(struct notifier_block *nb,
netdev_dbg(fib_dev, "fib found MAC=%pM\n", entry->mac);
}
+ sw_fib_add_to_list(pf_dev, entry, 1);
rcu_read_unlock();
- kfree(entry);
return NOTIFY_DONE;
}
@@ -225,9 +231,10 @@ int sw_nb_net_v6_neigh_update(struct notifier_block *nb,
entry->mac_valid = 1;
entry->port_id = pf->pcifunc;
+ sw_fib_add_to_list(pf_dev, entry, 1);
+
netdev_dbg(n->dev, "v6 neigh update %pI6c mac=%pM plen=%u\n",
n->primary_key, entry->mac, n->tbl->key_len * 8);
- kfree(entry);
return NOTIFY_DONE;
}
@@ -283,9 +290,10 @@ int sw_nb_v6_inetaddr_event(struct notifier_block *nb,
break;
}
+ sw_fib_add_to_list(pf_dev, entry, 1);
+
netdev_dbg(dev, "inetaddr addr=%pI6c len=%u %pM\n",
&ifa6->addr, ifa6->prefix_len, entry->mac);
- kfree(entry);
return NOTIFY_DONE;
}
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v6.h b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v6.h
index f73efc98c311..78c0df5eb880 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v6.h
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_nb_v6.h
@@ -7,6 +7,9 @@
#ifndef SW_NB_V6_H_
#define SW_NB_V6_H_
+#include <linux/kconfig.h>
+
+#if IS_ENABLED(CONFIG_IPV6)
int sw_nb_v6_fib_event(struct notifier_block *nb,
unsigned long event, void *ptr);
@@ -18,4 +21,30 @@ int sw_nb_v6_inetaddr_event(struct notifier_block *nb,
int sw_nb_v6_netdev_event(struct notifier_block *unused,
unsigned long event, void *ptr);
-#endif // SW_NB_V6_H__
+#else
+static inline int sw_nb_v6_fib_event(struct notifier_block *nb,
+ unsigned long event, void *ptr)
+{
+ return NOTIFY_DONE;
+}
+
+static inline int sw_nb_net_v6_neigh_update(struct notifier_block *nb,
+ unsigned long event, void *ptr)
+{
+ return NOTIFY_DONE;
+}
+
+static inline int sw_nb_v6_inetaddr_event(struct notifier_block *nb,
+ unsigned long event, void *ptr)
+{
+ return NOTIFY_DONE;
+}
+
+static inline int sw_nb_v6_netdev_event(struct notifier_block *unused,
+ unsigned long event, void *ptr)
+{
+ return NOTIFY_DONE;
+}
+#endif
+
+#endif /* SW_NB_V6_H_ */
--
2.43.0
^ permalink raw reply related
* [PATCH v4 net-next 9/9] octeontx2: switch: add TC flow offload path for switch flows
From: Ratheesh Kannoth @ 2026-07-21 8:18 UTC (permalink / raw)
To: linux-kernel, netdev
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, sgoutham,
Ratheesh Kannoth
In-Reply-To: <20260721081824.1430607-1-rkannoth@marvell.com>
Register an ingress flow-table offload callback that translates TC
flower rules into fl_tuple state, resolves ingress and egress
pcifunc via FIB for accelerated ports, and notifies the RVU AF over
the PF mailbox. The AF forwards flow updates to switchdev and
keeps per-cookie packet counters in sync using NPC MCAM multi-stats
when the switch requests SWDEV2AF refresh.
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
---
.../marvell/octeontx2/af/switch/rvu_sw.c | 9 +-
.../marvell/octeontx2/af/switch/rvu_sw_fl.c | 327 +++++++
.../marvell/octeontx2/af/switch/rvu_sw_fl.h | 2 +
.../ethernet/marvell/octeontx2/nic/Makefile | 3 +-
.../marvell/octeontx2/nic/switch/sw_fl.c | 909 ++++++++++++++++++
.../marvell/octeontx2/nic/switch/sw_fl.h | 2 +
.../marvell/octeontx2/nic/switch/sw_trace.c | 11 +
.../marvell/octeontx2/nic/switch/sw_trace.h | 84 ++
8 files changed, 1345 insertions(+), 2 deletions(-)
create mode 100644 drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_trace.c
create mode 100644 drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_trace.h
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw.c b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw.c
index 1151ba47284b..f89633f4b821 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw.c
@@ -7,10 +7,10 @@
#include <linux/bitfield.h>
#include "rvu.h"
-#include "rvu_sw.h"
#include "rvu_sw_l2.h"
#include "rvu_sw_l3.h"
#include "rvu_sw_fl.h"
+#include "rvu_sw.h"
u32 rvu_sw_port_id(struct rvu *rvu, u16 pcifunc)
{
@@ -69,6 +69,12 @@ int rvu_mbox_handler_swdev2af_notify(struct rvu *rvu,
rc = rvu_sw_l2_fdb_list_entry_add(rvu, req->pcifunc, req->mac);
break;
+ case SWDEV2AF_MSG_TYPE_REFRESH_FL:
+ if (req->cnt <= 0 || req->cnt > ARRAY_SIZE(req->fl))
+ return -EINVAL;
+ rc = rvu_sw_fl_stats_sync2db(rvu, req->fl, req->cnt);
+ break;
+
default:
rc = -EOPNOTSUPP;
break;
@@ -81,4 +87,5 @@ void rvu_sw_shutdown(void)
{
rvu_sw_l2_shutdown();
rvu_sw_l3_shutdown();
+ rvu_sw_fl_shutdown();
}
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_fl.c b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_fl.c
index 1f8b82a84a5d..a75aa991d29e 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_fl.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_fl.c
@@ -4,12 +4,275 @@
* Copyright (C) 2026 Marvell.
*
*/
+
+#include <linux/bitfield.h>
#include "rvu.h"
+#include "rvu_sw.h"
+#include "rvu_sw_fl.h"
+
+static struct af2swdev_notify_req __maybe_unused
+*otx2_mbox_alloc_msg_af2swdev_notify(struct rvu *rvu, int devid)
+{
+ struct af2swdev_notify_req *req;
+
+ req = (struct af2swdev_notify_req *)
+ otx2_mbox_alloc_msg_rsp(&rvu->afpf_wq_info.mbox_up, devid,
+ sizeof(*req), sizeof(struct msg_rsp));
+ if (!req)
+ return NULL;
+ req->hdr.sig = OTX2_MBOX_REQ_SIG;
+ req->hdr.id = MBOX_MSG_AF2SWDEV;
+ return req;
+}
+
+#define RVU_SW_FL_REFRESH_MAX \
+ ((int)ARRAY_SIZE(((struct swdev2af_notify_req *)0)->fl))
+
+struct fl_entry {
+ struct list_head list;
+ struct rvu *rvu;
+ u32 port_id;
+ unsigned long cookie;
+ struct fl_tuple tuple;
+ u64 flags;
+ u64 features;
+};
+
+static DEFINE_MUTEX(fl_offl_llock);
+static LIST_HEAD(fl_offl_lh);
+
+static struct workqueue_struct *sw_fl_offl_wq;
+static void sw_fl_offl_work_handler(struct work_struct *work);
+static DECLARE_DELAYED_WORK(fl_offl_work, sw_fl_offl_work_handler);
+
+struct sw_fl_stats_node {
+ struct list_head list;
+ unsigned long cookie;
+ u16 mcam_idx[2];
+ u64 opkts, npkts;
+ bool uni_di;
+};
+
+static LIST_HEAD(sw_fl_stats_lh);
+static DEFINE_MUTEX(sw_fl_stats_lock);
+
+static void rvu_sw_fl_queue_work(void)
+{
+ if (sw_fl_offl_wq)
+ queue_delayed_work(sw_fl_offl_wq, &fl_offl_work,
+ msecs_to_jiffies(10));
+}
+
+static int rvu_sw_fl_ensure_wq(void)
+{
+ if (sw_fl_offl_wq)
+ return 0;
+
+ sw_fl_offl_wq = alloc_workqueue("sw_af_fl_wq", 0, 0);
+ if (!sw_fl_offl_wq)
+ return -ENOMEM;
+
+ return 0;
+}
+
+static int
+rvu_sw_fl_stats_sync2db_one_entry(unsigned long cookie, u8 disabled,
+ u16 mcam_idx[2], bool uni_di, u64 pkts)
+{
+ struct sw_fl_stats_node *snode, *tmp;
+
+ mutex_lock(&sw_fl_stats_lock);
+ list_for_each_entry_safe(snode, tmp, &sw_fl_stats_lh, list) {
+ if (snode->cookie != cookie)
+ continue;
+
+ if (disabled) {
+ list_del_init(&snode->list);
+ mutex_unlock(&sw_fl_stats_lock);
+ kfree(snode);
+ return 0;
+ }
+
+ if (snode->uni_di != uni_di) {
+ snode->uni_di = uni_di;
+ snode->mcam_idx[1] = mcam_idx[1];
+ }
+
+ if (snode->opkts == pkts) {
+ mutex_unlock(&sw_fl_stats_lock);
+ return 0;
+ }
+
+ snode->npkts = pkts;
+ mutex_unlock(&sw_fl_stats_lock);
+ return 0;
+ }
+
+ if (disabled) {
+ mutex_unlock(&sw_fl_stats_lock);
+ return 0;
+ }
+
+ snode = kcalloc(1, sizeof(*snode), GFP_KERNEL);
+ if (!snode) {
+ mutex_unlock(&sw_fl_stats_lock);
+ return -ENOMEM;
+ }
+
+ snode->cookie = cookie;
+ snode->mcam_idx[0] = mcam_idx[0];
+ if (!uni_di)
+ snode->mcam_idx[1] = mcam_idx[1];
+
+ snode->npkts = pkts;
+ snode->uni_di = uni_di;
+ INIT_LIST_HEAD(&snode->list);
+
+ list_add_tail(&snode->list, &sw_fl_stats_lh);
+ mutex_unlock(&sw_fl_stats_lock);
+
+ return 0;
+}
+
+int rvu_sw_fl_stats_sync2db(struct rvu *rvu, struct fl_info *fl, int cnt)
+{
+ struct npc_mcam_get_mul_stats_req *req = NULL;
+ struct npc_mcam_get_mul_stats_rsp *rsp = NULL;
+ int i, idx;
+ int rc = 0;
+ u64 pkts;
+
+ if (cnt <= 0 || cnt > RVU_SW_FL_REFRESH_MAX)
+ return -EINVAL;
+
+ req = kcalloc(1, sizeof(*req), GFP_KERNEL);
+ if (!req) {
+ rc = -ENOMEM;
+ goto fail;
+ }
+
+ rsp = kcalloc(1, sizeof(*rsp), GFP_KERNEL);
+ if (!rsp) {
+ rc = -ENOMEM;
+ goto fail;
+ }
+
+ idx = 0;
+ for (i = 0; i < cnt; i++) {
+ req->entry[idx++] = fl[i].mcam_idx[0];
+ if (!fl[i].uni_di)
+ req->entry[idx++] = fl[i].mcam_idx[1];
+ }
+ req->cnt = idx;
+
+ if (idx > 256) {
+ rc = -EINVAL;
+ goto fail;
+ }
+
+ if (rvu_mbox_handler_npc_mcam_mul_stats(rvu, req, rsp)) {
+ dev_err(rvu->dev, "Error to get multiple stats\n");
+ rc = -EFAULT;
+ goto fail;
+ }
+
+ idx = 0;
+ for (i = 0; i < cnt; i++) {
+ pkts = rsp->stat[idx++];
+ if (!fl[i].uni_di)
+ pkts += rsp->stat[idx++];
+
+ rc |= rvu_sw_fl_stats_sync2db_one_entry(fl[i].cookie, fl[i].dis,
+ fl[i].mcam_idx,
+ fl[i].uni_di, pkts);
+ }
+
+fail:
+ kfree(req);
+ kfree(rsp);
+ return rc;
+}
+
+static int rvu_sw_fl_offl_rule_push(struct fl_entry *fl_entry)
+{
+ struct af2swdev_notify_req *req;
+ struct rvu *rvu;
+ int swdev_pf;
+
+ rvu = fl_entry->rvu;
+ swdev_pf = rvu_get_pf(rvu->pdev, rvu->rswitch.pcifunc);
+
+ mutex_lock(&rvu->mbox_lock);
+ req = otx2_mbox_alloc_msg_af2swdev_notify(rvu, swdev_pf);
+ if (!req) {
+ mutex_unlock(&rvu->mbox_lock);
+ return -ENOMEM;
+ }
+
+ req->tuple = fl_entry->tuple;
+ req->flags = fl_entry->flags;
+ req->cookie = fl_entry->cookie;
+ req->features = fl_entry->features;
+
+ if (!otx2_mbox_wait_for_zero(&rvu->afpf_wq_info.mbox_up, swdev_pf)) {
+ mutex_unlock(&rvu->mbox_lock);
+ return -EBUSY;
+ }
+
+ otx2_mbox_msg_send_up(&rvu->afpf_wq_info.mbox_up, swdev_pf);
+
+ mutex_unlock(&rvu->mbox_lock);
+ return 0;
+}
+
+static void sw_fl_offl_work_handler(struct work_struct *work)
+{
+ struct fl_entry *fl_entry;
+
+ mutex_lock(&fl_offl_llock);
+ fl_entry = list_first_entry_or_null(&fl_offl_lh, struct fl_entry, list);
+ if (!fl_entry) {
+ mutex_unlock(&fl_offl_llock);
+ return;
+ }
+
+ list_del_init(&fl_entry->list);
+ mutex_unlock(&fl_offl_llock);
+
+ if (rvu_sw_fl_offl_rule_push(fl_entry)) {
+ mutex_lock(&fl_offl_llock);
+ list_add_tail(&fl_entry->list, &fl_offl_lh);
+ mutex_unlock(&fl_offl_llock);
+ if (sw_fl_offl_wq)
+ queue_delayed_work(sw_fl_offl_wq, &fl_offl_work,
+ msecs_to_jiffies(100));
+ return;
+ }
+
+ kfree(fl_entry);
+
+ mutex_lock(&fl_offl_llock);
+ if (!list_empty(&fl_offl_lh))
+ rvu_sw_fl_queue_work();
+ mutex_unlock(&fl_offl_llock);
+}
int rvu_mbox_handler_fl_get_stats(struct rvu *rvu,
struct fl_get_stats_req *req,
struct fl_get_stats_rsp *rsp)
{
+ struct sw_fl_stats_node *snode, *tmp;
+
+ mutex_lock(&sw_fl_stats_lock);
+ list_for_each_entry_safe(snode, tmp, &sw_fl_stats_lh, list) {
+ if (snode->cookie != req->cookie)
+ continue;
+
+ rsp->pkts_diff = snode->npkts - snode->opkts;
+ snode->opkts = snode->npkts;
+ break;
+ }
+ mutex_unlock(&sw_fl_stats_lock);
return 0;
}
@@ -17,5 +280,69 @@ int rvu_mbox_handler_fl_notify(struct rvu *rvu,
struct fl_notify_req *req,
struct msg_rsp *rsp)
{
+ struct fl_entry *fl_entry;
+ int rc;
+
+ if (!(rvu->rswitch.flags & RVU_SWITCH_FLAG_FW_READY))
+ return -EAGAIN;
+
+ fl_entry = kcalloc(1, sizeof(*fl_entry), GFP_KERNEL);
+ if (!fl_entry)
+ return -ENOMEM;
+
+ fl_entry->port_id = rvu_sw_port_id(rvu, req->hdr.pcifunc);
+ fl_entry->rvu = rvu;
+ INIT_LIST_HEAD(&fl_entry->list);
+ fl_entry->tuple = req->tuple;
+ fl_entry->cookie = req->cookie;
+ fl_entry->flags = req->flags;
+ fl_entry->features = req->features;
+
+ mutex_lock(&fl_offl_llock);
+ rc = rvu_sw_fl_ensure_wq();
+ if (rc) {
+ mutex_unlock(&fl_offl_llock);
+ kfree(fl_entry);
+ return rc;
+ }
+
+ list_add_tail(&fl_entry->list, &fl_offl_lh);
+ rvu_sw_fl_queue_work();
+ mutex_unlock(&fl_offl_llock);
+
return 0;
}
+
+void rvu_sw_fl_shutdown(void)
+{
+ struct sw_fl_stats_node *snode, *tmp;
+ struct workqueue_struct *wq;
+ struct fl_entry *entry;
+
+ mutex_lock(&sw_fl_stats_lock);
+ list_for_each_entry_safe(snode, tmp, &sw_fl_stats_lh, list) {
+ list_del_init(&snode->list);
+ kfree(snode);
+ }
+ mutex_unlock(&sw_fl_stats_lock);
+
+ if (!sw_fl_offl_wq)
+ return;
+
+ cancel_delayed_work_sync(&fl_offl_work);
+ wq = sw_fl_offl_wq;
+ sw_fl_offl_wq = NULL;
+ destroy_workqueue(wq);
+
+ mutex_lock(&fl_offl_llock);
+ while (1) {
+ entry = list_first_entry_or_null(&fl_offl_lh,
+ struct fl_entry, list);
+ if (!entry)
+ break;
+
+ list_del_init(&entry->list);
+ kfree(entry);
+ }
+ mutex_unlock(&fl_offl_llock);
+}
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_fl.h b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_fl.h
index cf3e5b884f77..f117a96fc33e 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_fl.h
+++ b/drivers/net/ethernet/marvell/octeontx2/af/switch/rvu_sw_fl.h
@@ -7,5 +7,7 @@
#ifndef RVU_SW_FL_H
#define RVU_SW_FL_H
+int rvu_sw_fl_stats_sync2db(struct rvu *rvu, struct fl_info *fl, int cnt);
+void rvu_sw_fl_shutdown(void);
#endif
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/Makefile b/drivers/net/ethernet/marvell/octeontx2/nic/Makefile
index 02ab0634f58f..917a34a32ca8 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/Makefile
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/Makefile
@@ -10,7 +10,7 @@ obj-$(CONFIG_RVU_ESWITCH) += rvu_rep.o
rvu_nicpf-y := otx2_pf.o otx2_common.o otx2_txrx.o otx2_ethtool.o \
otx2_flows.o otx2_tc.o cn10k.o cn20k.o otx2_dmac_flt.o \
otx2_devlink.o qos_sq.o qos.o otx2_xsk.o \
- switch/sw_fdb.o switch/sw_fl.o
+ switch/sw_fdb.o switch/sw_fl.o switch/sw_trace.o
rvu_nicpf-$(CONFIG_OCTEONTX_SWITCH) += switch/sw_nb.o switch/sw_fib.o \
switch/sw_nb_v4.o
ifneq ($(CONFIG_IPV6),)
@@ -25,3 +25,4 @@ rvu_nicpf-$(CONFIG_MACSEC) += cn10k_macsec.o
rvu_nicpf-$(CONFIG_XFRM_OFFLOAD) += cn10k_ipsec.o
ccflags-y += -I$(srctree)/drivers/net/ethernet/marvell/octeontx2/af
+ccflags-y += -I$(src)/switch/
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fl.c b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fl.c
index 36a2359a0a48..7c7d4f788442 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fl.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fl.c
@@ -4,13 +4,922 @@
* Copyright (C) 2026 Marvell.
*
*/
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/mutex.h>
+#include <linux/refcount.h>
+#include <net/switchdev.h>
+#include <net/netevent.h>
+#include <net/arp.h>
+#include <net/nexthop.h>
+#include <net/netfilter/nf_flow_table.h>
+
+#include "../otx2_reg.h"
+#include "../otx2_common.h"
+#include "../otx2_struct.h"
+#include "../cn10k.h"
+#include "sw_nb.h"
+#include "sw_trace.h"
#include "sw_fl.h"
+#if !IS_ENABLED(CONFIG_OCTEONTX_SWITCH)
+int sw_fl_setup_ft_block_ingress_cb(enum tc_setup_type type,
+ void *type_data, void *cb_priv)
+{
+ return -EOPNOTSUPP;
+}
+
+#else
+
+static DEFINE_SPINLOCK(sw_fl_lock);
+static LIST_HEAD(sw_fl_lh);
+
+struct sw_fl_list_entry {
+ struct list_head list;
+ u64 flags;
+ unsigned long cookie;
+ struct otx2_nic *pf;
+ netdevice_tracker dev_tracker;
+ struct fl_tuple tuple;
+};
+
+static struct workqueue_struct *sw_fl_wq;
+static void sw_fl_wq_handler(struct work_struct *work);
+static DECLARE_DELAYED_WORK(sw_fl_work, sw_fl_wq_handler);
+
+struct sw_fl_ct_cb {
+ struct list_head list;
+ struct nf_flowtable *ft;
+ struct otx2_nic *nic;
+ refcount_t ref;
+};
+
+struct sw_fl_ct_cookie {
+ struct list_head list;
+ unsigned long cookie;
+ struct nf_flowtable *ft;
+ struct otx2_nic *nic;
+};
+
+struct sw_fl_ct_drain {
+ struct list_head list;
+ struct nf_flowtable *ft;
+ struct otx2_nic *nic;
+};
+
+static LIST_HEAD(sw_fl_ct_cb_list);
+static LIST_HEAD(sw_fl_ct_drain_list);
+static DEFINE_MUTEX(sw_fl_ct_cb_lock);
+static LIST_HEAD(sw_fl_ct_cookie_list);
+static DEFINE_MUTEX(sw_fl_ct_cookie_lock);
+
+static struct sw_fl_ct_cb *sw_fl_ct_cb_find(struct nf_flowtable *ft,
+ struct otx2_nic *nic)
+{
+ struct sw_fl_ct_cb *entry;
+
+ list_for_each_entry(entry, &sw_fl_ct_cb_list, list) {
+ if (entry->ft == ft && entry->nic == nic)
+ return entry;
+ }
+
+ return NULL;
+}
+
+static bool sw_fl_ct_draining(struct nf_flowtable *ft, struct otx2_nic *nic)
+{
+ struct sw_fl_ct_drain *drain;
+
+ list_for_each_entry(drain, &sw_fl_ct_drain_list, list) {
+ if (drain->ft == ft && drain->nic == nic)
+ return true;
+ }
+
+ return false;
+}
+
+static int sw_fl_ct_cb_get(struct nf_flowtable *ft, struct otx2_nic *nic)
+{
+ struct sw_fl_ct_cb *entry;
+ int err;
+
+ mutex_lock(&sw_fl_ct_cb_lock);
+ if (sw_fl_ct_draining(ft, nic)) {
+ mutex_unlock(&sw_fl_ct_cb_lock);
+ return -EBUSY;
+ }
+ entry = sw_fl_ct_cb_find(ft, nic);
+ if (entry) {
+ refcount_inc(&entry->ref);
+ mutex_unlock(&sw_fl_ct_cb_lock);
+ return 0;
+ }
+ mutex_unlock(&sw_fl_ct_cb_lock);
+
+ err = nf_flow_table_offload_add_cb(ft, sw_fl_setup_ft_block_ingress_cb, nic);
+ if (err && err != -EEXIST)
+ return err;
+
+ mutex_lock(&sw_fl_ct_cb_lock);
+ if (sw_fl_ct_draining(ft, nic)) {
+ mutex_unlock(&sw_fl_ct_cb_lock);
+ if (!err)
+ nf_flow_table_offload_del_cb(ft,
+ sw_fl_setup_ft_block_ingress_cb,
+ nic);
+ return -EBUSY;
+ }
+ entry = sw_fl_ct_cb_find(ft, nic);
+ if (entry) {
+ refcount_inc(&entry->ref);
+ mutex_unlock(&sw_fl_ct_cb_lock);
+ if (!err)
+ nf_flow_table_offload_del_cb(ft,
+ sw_fl_setup_ft_block_ingress_cb,
+ nic);
+ return 0;
+ }
+
+ entry = kzalloc_obj(*entry, GFP_KERNEL);
+ if (!entry) {
+ mutex_unlock(&sw_fl_ct_cb_lock);
+ if (!err)
+ nf_flow_table_offload_del_cb(ft,
+ sw_fl_setup_ft_block_ingress_cb,
+ nic);
+ return -ENOMEM;
+ }
+
+ entry->ft = ft;
+ entry->nic = nic;
+ refcount_set(&entry->ref, 1);
+ list_add_tail(&entry->list, &sw_fl_ct_cb_list);
+ mutex_unlock(&sw_fl_ct_cb_lock);
+
+ return 0;
+}
+
+static void sw_fl_ct_cb_put(struct nf_flowtable *ft, struct otx2_nic *nic)
+{
+ struct sw_fl_ct_cb *entry;
+ struct sw_fl_ct_drain drain;
+
+ mutex_lock(&sw_fl_ct_cb_lock);
+ entry = sw_fl_ct_cb_find(ft, nic);
+ if (!entry || !refcount_dec_and_test(&entry->ref)) {
+ mutex_unlock(&sw_fl_ct_cb_lock);
+ return;
+ }
+
+ drain.ft = ft;
+ drain.nic = nic;
+ INIT_LIST_HEAD(&drain.list);
+ list_add_tail(&drain.list, &sw_fl_ct_drain_list);
+
+ list_del(&entry->list);
+ mutex_unlock(&sw_fl_ct_cb_lock);
+
+ nf_flow_table_offload_del_cb(ft, sw_fl_setup_ft_block_ingress_cb, nic);
+
+ mutex_lock(&sw_fl_ct_cb_lock);
+ list_del(&drain.list);
+ mutex_unlock(&sw_fl_ct_cb_lock);
+
+ kfree(entry);
+}
+
+static struct sw_fl_ct_cookie *sw_fl_ct_cookie_find(unsigned long cookie)
+{
+ struct sw_fl_ct_cookie *entry;
+
+ list_for_each_entry(entry, &sw_fl_ct_cookie_list, list) {
+ if (entry->cookie == cookie)
+ return entry;
+ }
+
+ return NULL;
+}
+
+static int sw_fl_ct_cookie_add(unsigned long cookie, struct nf_flowtable *ft,
+ struct otx2_nic *nic)
+{
+ struct sw_fl_ct_cookie *entry, *existing;
+
+ entry = kzalloc_obj(*entry, GFP_KERNEL);
+ if (!entry)
+ return -ENOMEM;
+
+ entry->cookie = cookie;
+ entry->ft = ft;
+ entry->nic = nic;
+
+ mutex_lock(&sw_fl_ct_cookie_lock);
+ existing = sw_fl_ct_cookie_find(cookie);
+ if (existing) {
+ if (existing->ft == ft && existing->nic == nic) {
+ mutex_unlock(&sw_fl_ct_cookie_lock);
+ kfree(entry);
+ sw_fl_ct_cb_put(ft, nic);
+ return 0;
+ }
+
+ list_del(&existing->list);
+ mutex_unlock(&sw_fl_ct_cookie_lock);
+ sw_fl_ct_cb_put(existing->ft, existing->nic);
+ kfree(existing);
+
+ mutex_lock(&sw_fl_ct_cookie_lock);
+ }
+
+ list_add_tail(&entry->list, &sw_fl_ct_cookie_list);
+ mutex_unlock(&sw_fl_ct_cookie_lock);
+
+ return 0;
+}
+
+static void sw_fl_ct_cookie_put(unsigned long cookie)
+{
+ struct sw_fl_ct_cookie *entry, *tmp;
+
+ mutex_lock(&sw_fl_ct_cookie_lock);
+ list_for_each_entry_safe(entry, tmp, &sw_fl_ct_cookie_list, list) {
+ if (entry->cookie != cookie)
+ continue;
+
+ list_del(&entry->list);
+ mutex_unlock(&sw_fl_ct_cookie_lock);
+ sw_fl_ct_cb_put(entry->ft, entry->nic);
+ kfree(entry);
+ return;
+ }
+ mutex_unlock(&sw_fl_ct_cookie_lock);
+}
+
+static void sw_fl_ct_cb_flush(void)
+{
+ struct sw_fl_ct_cookie *cookie, *ctmp;
+ struct sw_fl_ct_cb *entry;
+ struct sw_fl_ct_drain drain;
+ struct nf_flowtable *ft;
+ struct otx2_nic *nic;
+
+ mutex_lock(&sw_fl_ct_cookie_lock);
+ list_for_each_entry_safe(cookie, ctmp, &sw_fl_ct_cookie_list, list) {
+ list_del(&cookie->list);
+ kfree(cookie);
+ }
+ mutex_unlock(&sw_fl_ct_cookie_lock);
+
+ mutex_lock(&sw_fl_ct_cb_lock);
+ while ((entry = list_first_entry_or_null(&sw_fl_ct_cb_list,
+ struct sw_fl_ct_cb, list))) {
+ ft = entry->ft;
+ nic = entry->nic;
+ drain.ft = ft;
+ drain.nic = nic;
+ INIT_LIST_HEAD(&drain.list);
+ list_add_tail(&drain.list, &sw_fl_ct_drain_list);
+
+ list_del(&entry->list);
+ mutex_unlock(&sw_fl_ct_cb_lock);
+
+ nf_flow_table_offload_del_cb(ft,
+ sw_fl_setup_ft_block_ingress_cb,
+ nic);
+
+ mutex_lock(&sw_fl_ct_cb_lock);
+ list_del(&drain.list);
+ kfree(entry);
+ }
+ mutex_unlock(&sw_fl_ct_cb_lock);
+}
+
+static int sw_fl_msg_send(struct otx2_nic *pf,
+ struct fl_tuple *tuple,
+ u64 flags,
+ unsigned long cookie)
+{
+ struct fl_notify_req *req;
+ int rc;
+
+ mutex_lock(&pf->mbox.lock);
+ req = otx2_mbox_alloc_msg_fl_notify(&pf->mbox);
+ if (!req) {
+ rc = -ENOMEM;
+ goto out;
+ }
+
+ req->tuple = *tuple;
+ req->flags = flags;
+ req->cookie = cookie;
+
+ rc = otx2_sync_mbox_msg(&pf->mbox);
+out:
+ mutex_unlock(&pf->mbox.lock);
+ return rc;
+}
+
+static void sw_fl_wq_handler(struct work_struct *work)
+{
+ struct sw_fl_list_entry *entry;
+ LIST_HEAD(tlist);
+
+ spin_lock_bh(&sw_fl_lock);
+ list_splice_init(&sw_fl_lh, &tlist);
+ spin_unlock_bh(&sw_fl_lock);
+
+ while ((entry =
+ list_first_entry_or_null(&tlist,
+ struct sw_fl_list_entry,
+ list)) != NULL) {
+ list_del_init(&entry->list);
+ if (sw_fl_msg_send(entry->pf, &entry->tuple,
+ entry->flags, entry->cookie)) {
+ netdev_err(entry->pf->netdev,
+ "Failed to notify flow update to AF, will retry\n");
+ spin_lock_bh(&sw_fl_lock);
+ if (sw_fl_wq) {
+ list_add(&entry->list, &sw_fl_lh);
+ queue_delayed_work(sw_fl_wq, &sw_fl_work,
+ msecs_to_jiffies(100));
+ spin_unlock_bh(&sw_fl_lock);
+ continue;
+ }
+ spin_unlock_bh(&sw_fl_lock);
+ netdev_put(entry->pf->netdev, &entry->dev_tracker);
+ kfree(entry);
+ continue;
+ }
+ netdev_put(entry->pf->netdev, &entry->dev_tracker);
+ kfree(entry);
+ }
+
+ spin_lock_bh(&sw_fl_lock);
+ if (!list_empty(&sw_fl_lh) && sw_fl_wq)
+ queue_delayed_work(sw_fl_wq, &sw_fl_work, msecs_to_jiffies(10));
+ spin_unlock_bh(&sw_fl_lock);
+}
+
+static int
+sw_fl_add_to_list(struct otx2_nic *pf, struct fl_tuple *tuple,
+ unsigned long cookie, bool add_fl)
+{
+ struct sw_fl_list_entry *entry;
+
+ entry = kcalloc(1, sizeof(*entry), GFP_ATOMIC);
+ if (!entry)
+ return -ENOMEM;
+
+ entry->pf = pf;
+ entry->flags = add_fl ? FL_ADD : FL_DEL;
+ if (add_fl)
+ entry->tuple = *tuple;
+ entry->cookie = cookie;
+ entry->tuple.uni_di = netif_is_ovs_port(pf->netdev);
+
+ spin_lock_bh(&sw_fl_lock);
+ if (!sw_fl_wq) {
+ spin_unlock_bh(&sw_fl_lock);
+ kfree(entry);
+ return -EINVAL;
+ }
+
+ netdev_hold(pf->netdev, &entry->dev_tracker, GFP_ATOMIC);
+ list_add_tail(&entry->list, &sw_fl_lh);
+ queue_delayed_work(sw_fl_wq, &sw_fl_work, msecs_to_jiffies(10));
+ spin_unlock_bh(&sw_fl_lock);
+
+ return 0;
+}
+
+static int sw_fl_mangle_layer(enum flow_action_mangle_base htype)
+{
+ switch (htype) {
+ case FLOW_ACT_MANGLE_HDR_TYPE_ETH:
+ return 0;
+ case FLOW_ACT_MANGLE_HDR_TYPE_IP4:
+ case FLOW_ACT_MANGLE_HDR_TYPE_IP6:
+ return 2;
+ case FLOW_ACT_MANGLE_HDR_TYPE_TCP:
+ case FLOW_ACT_MANGLE_HDR_TYPE_UDP:
+ return 3;
+ default:
+ return -EOPNOTSUPP;
+ }
+}
+
+static int sw_fl_parse_actions(struct otx2_nic *nic,
+ struct flow_action *flow_action,
+ struct flow_cls_offload *f,
+ struct fl_tuple *tuple, u64 *op,
+ struct nf_flowtable **ct_ft)
+{
+ struct flow_action_entry *act;
+ struct nf_flowtable *parsed_ct_ft = NULL;
+ struct otx2_nic *out_nic;
+ int parsed_ct_refs = 0;
+ int used = 0;
+ int err;
+ int i;
+
+ if (!flow_action_has_entries(flow_action))
+ return -EINVAL;
+
+ flow_action_for_each(i, act, flow_action) {
+ switch (act->id) {
+ case FLOW_ACTION_REDIRECT:
+ if (!act->dev || !sw_nb_is_valid_dev(act->dev)) {
+ err = -EOPNOTSUPP;
+ goto unwind_ct;
+ }
+ trace_sw_act_dump(__func__, "redirect to egress port", act->id);
+ tuple->in_pf = nic->pcifunc;
+ out_nic = netdev_priv(act->dev);
+ tuple->xmit_pf = out_nic->pcifunc;
+ *op |= BIT_ULL(FLOW_ACTION_REDIRECT);
+ break;
+
+ case FLOW_ACTION_CT:
+ trace_sw_act_dump(__func__, "register conntrack offload callback", act->id);
+ err = sw_fl_ct_cb_get(act->ct.flow_table, nic);
+ if (err) {
+ netdev_err(nic->netdev,
+ "%s: Error to offload flow, err=%d\n",
+ __func__, err);
+ goto unwind_ct;
+ }
+
+ parsed_ct_ft = act->ct.flow_table;
+ parsed_ct_refs++;
+ if (ct_ft)
+ *ct_ft = act->ct.flow_table;
+ *op |= BIT_ULL(FLOW_ACTION_CT);
+ break;
+
+ case FLOW_ACTION_MANGLE: {
+ int layer;
+
+ if (used >= MANGLE_ARR_SZ) {
+ netdev_err(nic->netdev,
+ "%s: More mangle entries than supported %u\n",
+ __func__, MANGLE_ARR_SZ);
+ err = -ENOMEM;
+ goto unwind_ct;
+ }
+
+ layer = sw_fl_mangle_layer(act->mangle.htype);
+ if (layer < 0) {
+ err = layer;
+ goto unwind_ct;
+ }
+
+ trace_sw_act_dump(__func__, "header mangle action", act->id);
+ tuple->mangle[used].type = act->mangle.htype;
+ tuple->mangle[used].val = act->mangle.val;
+ tuple->mangle[used].mask = act->mangle.mask;
+ tuple->mangle[used].offset = act->mangle.offset;
+ tuple->mangle_map[layer] |= BIT(used);
+ used++;
+ break;
+ }
+
+ default:
+ trace_sw_act_dump(__func__, "unsupported flow action", act->id);
+ break;
+ }
+ }
+
+ tuple->mangle_cnt = used;
+
+ if (!*op && !used) {
+ netdev_dbg(nic->netdev, "%s: Op is not valid\n", __func__);
+ return -EOPNOTSUPP;
+ }
+
+ return 0;
+
+unwind_ct:
+ while (parsed_ct_refs--)
+ sw_fl_ct_cb_put(parsed_ct_ft, nic);
+ return err;
+}
+
+static int sw_fl_get_route(struct net *net, struct fib_result *res, __be32 addr)
+{
+ struct flowi4 fl4;
+
+ memset(&fl4, 0, sizeof(fl4));
+ fl4.daddr = addr;
+ return fib_lookup(net, &fl4, res, 0);
+}
+
+static int sw_fl_get_pcifunc(struct otx2_nic *pf, __be32 dst, u16 *pcifunc,
+ struct fl_tuple *ftuple, bool is_in_dev)
+{
+ struct fib_nh_common *fib_nhc;
+ struct net_device *dev, *br;
+ struct fib_result res;
+ struct list_head *lh;
+ struct otx2_nic *nic;
+ int err;
+
+ rcu_read_lock();
+
+ err = sw_fl_get_route(dev_net(pf->netdev), &res, dst);
+ if (err) {
+ netdev_err(pf->netdev,
+ "%s: Failed to find route to dst %pI4\n",
+ __func__, &dst);
+ goto done;
+ }
+
+ if (res.fi->fib_type != RTN_UNICAST) {
+ netdev_err(pf->netdev,
+ "%s: Not unicast route to dst %pi4\n",
+ __func__, &dst);
+ err = -EFAULT;
+ goto done;
+ }
+
+ fib_nhc = fib_info_nhc(res.fi, 0);
+ if (!fib_nhc) {
+ err = -EINVAL;
+ netdev_err(pf->netdev,
+ "%s: Could not get fib_nhc for %pI4\n",
+ __func__, &dst);
+ goto done;
+ }
+
+ if (unlikely(netif_is_bridge_master(fib_nhc->nhc_dev))) {
+ br = fib_nhc->nhc_dev;
+
+ if (is_in_dev)
+ ftuple->is_indev_br = 1;
+ else
+ ftuple->is_xdev_br = 1;
+
+ lh = &br->adj_list.lower;
+ if (list_empty(lh)) {
+ netdev_err(pf->netdev,
+ "%s: Unable to find any slave device\n",
+ __func__);
+ err = -EINVAL;
+ goto done;
+ }
+ dev = netdev_next_lower_dev_rcu(br, &lh);
+
+ } else {
+ dev = fib_nhc->nhc_dev;
+ }
+
+ if (!dev || !sw_nb_is_valid_dev(dev)) {
+ netdev_err(pf->netdev,
+ "%s: flow acceleration support is only for cavium devices\n",
+ __func__);
+ err = -EOPNOTSUPP;
+ goto done;
+ }
+
+ nic = netdev_priv(dev);
+ *pcifunc = nic->pcifunc;
+
+done:
+ rcu_read_unlock();
+ return err;
+}
+
+static int sw_fl_parse_flow(struct otx2_nic *nic, struct flow_cls_offload *f,
+ struct fl_tuple *tuple, u64 *features)
+{
+ struct flow_rule *rule;
+ u8 ip_proto = 0;
+
+ *features = 0;
+
+ rule = flow_cls_offload_flow_rule(f);
+
+ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) {
+ struct flow_match_basic match;
+
+ flow_rule_match_basic(rule, &match);
+
+ /* All EtherTypes can be matched, no hw limitation */
+
+ if (match.mask->n_proto) {
+ tuple->eth_type = match.key->n_proto;
+ tuple->m_eth_type = match.mask->n_proto;
+ *features |= BIT_ULL(NPC_ETYPE);
+ }
+
+ if (match.mask->ip_proto) {
+ if (match.key->ip_proto != IPPROTO_TCP &&
+ match.key->ip_proto != IPPROTO_UDP)
+ return -EOPNOTSUPP;
+
+ ip_proto = match.key->ip_proto;
+ if (ip_proto == IPPROTO_UDP)
+ *features |= BIT_ULL(NPC_IPPROTO_UDP);
+ else
+ *features |= BIT_ULL(NPC_IPPROTO_TCP);
+ }
+
+ tuple->proto = ip_proto;
+ }
+
+ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
+ struct flow_match_eth_addrs match;
+
+ flow_rule_match_eth_addrs(rule, &match);
+
+ /* Switch flow offload matches unicast L2 addresses only.
+ * Multicast and broadcast MAC keys are not programmed in
+ * hardware; rules that rely solely on those keys are not
+ * supported here.
+ */
+ if (!is_zero_ether_addr(match.key->dst) &&
+ is_unicast_ether_addr(match.key->dst)) {
+ ether_addr_copy(tuple->dmac,
+ match.key->dst);
+
+ ether_addr_copy(tuple->m_dmac,
+ match.mask->dst);
+
+ *features |= BIT_ULL(NPC_DMAC);
+ }
+
+ if (!is_zero_ether_addr(match.key->src) &&
+ is_unicast_ether_addr(match.key->src)) {
+ ether_addr_copy(tuple->smac,
+ match.key->src);
+ ether_addr_copy(tuple->m_smac,
+ match.mask->src);
+ *features |= BIT_ULL(NPC_SMAC);
+ }
+ }
+
+ /* Switch flow offload parses IPv4 address keys only; IPv6 flow
+ * matching and FIB-based pcifunc resolution are not supported yet.
+ */
+ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_IPV4_ADDRS)) {
+ struct flow_match_ipv4_addrs match;
+
+ flow_rule_match_ipv4_addrs(rule, &match);
+
+ if (match.mask->dst) {
+ tuple->ip4dst = match.key->dst;
+ tuple->m_ip4dst = match.mask->dst;
+ *features |= BIT_ULL(NPC_DIP_IPV4);
+ }
+
+ if (match.mask->src) {
+ tuple->ip4src = match.key->src;
+ tuple->m_ip4src = match.mask->src;
+ *features |= BIT_ULL(NPC_SIP_IPV4);
+ }
+ }
+
+ if (!(*features & BIT_ULL(NPC_DMAC))) {
+ if (!tuple->m_ip4src || !tuple->m_ip4dst) {
+ netdev_err(nic->netdev,
+ "%s: Invalid src=%pI4 and dst=%pI4 addresses\n",
+ __func__, &tuple->ip4src, &tuple->ip4dst);
+ return -EINVAL;
+ }
+
+ if ((tuple->ip4src & tuple->m_ip4src) == (tuple->ip4dst & tuple->m_ip4dst)) {
+ netdev_err(nic->netdev,
+ "%s: Masked values are same; Invalid src=%pI4 and dst=%pI4 addresses\n",
+ __func__, &tuple->ip4src, &tuple->ip4dst);
+ return -EINVAL;
+ }
+ }
+
+ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS)) {
+ struct flow_match_ports match;
+
+ flow_rule_match_ports(rule, &match);
+
+ if (ip_proto == IPPROTO_UDP) {
+ if (match.mask->dst)
+ *features |= BIT_ULL(NPC_DPORT_UDP);
+
+ if (match.mask->src)
+ *features |= BIT_ULL(NPC_SPORT_UDP);
+ } else if (ip_proto == IPPROTO_TCP) {
+ if (match.mask->dst)
+ *features |= BIT_ULL(NPC_DPORT_TCP);
+
+ if (match.mask->src)
+ *features |= BIT_ULL(NPC_SPORT_TCP);
+ }
+
+ if (match.mask->src) {
+ tuple->sport = match.key->src;
+ tuple->m_sport = match.mask->src;
+ }
+
+ if (match.mask->dst) {
+ tuple->dport = match.key->dst;
+ tuple->m_dport = match.mask->dst;
+ }
+ }
+
+ if (!(*features & (BIT_ULL(NPC_DMAC) |
+ BIT_ULL(NPC_SMAC) |
+ BIT_ULL(NPC_DIP_IPV4) |
+ BIT_ULL(NPC_SIP_IPV4) |
+ BIT_ULL(NPC_DIP_IPV6) |
+ BIT_ULL(NPC_SIP_IPV6) |
+ BIT_ULL(NPC_DPORT_UDP) |
+ BIT_ULL(NPC_SPORT_UDP) |
+ BIT_ULL(NPC_DPORT_TCP) |
+ BIT_ULL(NPC_SPORT_TCP)))) {
+ return -EINVAL;
+ }
+
+ tuple->features = *features;
+
+ return 0;
+}
+
+static int sw_fl_add(struct otx2_nic *nic, struct flow_cls_offload *f)
+{
+ struct nf_flowtable *ct_ft = NULL;
+ struct fl_tuple tuple = { 0 };
+ struct flow_rule *rule;
+ u64 features = 0;
+ u64 op = 0;
+ int rc;
+
+ rule = flow_cls_offload_flow_rule(f);
+
+ rc = sw_fl_parse_actions(nic, &rule->action, f, &tuple, &op, &ct_ft);
+ if (rc)
+ return rc;
+
+ if (ct_ft) {
+ rc = sw_fl_ct_cookie_add(f->cookie, ct_ft, nic);
+ if (rc) {
+ sw_fl_ct_cb_put(ct_ft, nic);
+ return rc;
+ }
+ }
+
+ if (op == BIT_ULL(FLOW_ACTION_CT) && !tuple.mangle_cnt)
+ return 0;
+
+ rc = sw_fl_parse_flow(nic, f, &tuple, &features);
+ if (rc) {
+ trace_sw_fl_dump(__func__, "flow key parse failed", &tuple);
+ if (ct_ft)
+ sw_fl_ct_cookie_put(f->cookie);
+ return -EFAULT;
+ }
+
+ /* Non-OVS ports resolve ingress and egress pcifunc via IPv4 FIB
+ * lookups below. IPv6 and L2-only flows are not supported yet.
+ */
+ if (!netif_is_ovs_port(nic->netdev)) {
+ rc = sw_fl_get_pcifunc(nic, tuple.ip4src, &tuple.in_pf,
+ &tuple, true);
+ if (rc) {
+ trace_sw_fl_dump(__func__, "ingress pcifunc lookup failed", &tuple);
+ if (ct_ft)
+ sw_fl_ct_cookie_put(f->cookie);
+ return rc;
+ }
+
+ rc = sw_fl_get_pcifunc(nic, tuple.ip4dst,
+ &tuple.xmit_pf, &tuple, false);
+ if (rc) {
+ trace_sw_fl_dump(__func__, "egress pcifunc lookup failed", &tuple);
+ if (ct_ft)
+ sw_fl_ct_cookie_put(f->cookie);
+ return rc;
+ }
+ }
+
+ trace_sw_fl_dump(__func__, "offload flow add queued", &tuple);
+ return sw_fl_add_to_list(nic, &tuple, f->cookie, true);
+}
+
+static int sw_fl_del(struct otx2_nic *nic, struct flow_cls_offload *f)
+{
+ sw_fl_ct_cookie_put(f->cookie);
+ return sw_fl_add_to_list(nic, NULL, f->cookie, false);
+}
+
+static int sw_fl_stats(struct otx2_nic *nic, struct flow_cls_offload *f)
+{
+ struct fl_get_stats_req *req;
+ struct fl_get_stats_rsp *rsp;
+ u64 pkts_diff;
+ int rc = 0;
+
+ mutex_lock(&nic->mbox.lock);
+
+ req = otx2_mbox_alloc_msg_fl_get_stats(&nic->mbox);
+ if (!req) {
+ netdev_err(nic->netdev,
+ "%s: Error happened while mcam alloc req\n",
+ __func__);
+ rc = -ENOMEM;
+ goto fail;
+ }
+ req->cookie = f->cookie;
+
+ rc = otx2_sync_mbox_msg(&nic->mbox);
+ if (rc)
+ goto fail;
+
+ rsp = (struct fl_get_stats_rsp *)otx2_mbox_get_rsp
+ (&nic->mbox.mbox, 0, &req->hdr);
+ if (IS_ERR(rsp)) {
+ rc = PTR_ERR(rsp);
+ goto fail;
+ }
+ pkts_diff = rsp->pkts_diff;
+ mutex_unlock(&nic->mbox.lock);
+
+ if (pkts_diff) {
+ flow_stats_update(&f->stats, 0x0, pkts_diff,
+ 0x0, jiffies,
+ FLOW_ACTION_HW_STATS_IMMEDIATE);
+ }
+ return 0;
+fail:
+ mutex_unlock(&nic->mbox.lock);
+ return rc;
+}
+
+static bool init_done;
+
+int sw_fl_setup_ft_block_ingress_cb(enum tc_setup_type type,
+ void *type_data, void *cb_priv)
+{
+ struct flow_cls_offload *cls = type_data;
+ struct otx2_nic *nic = cb_priv;
+
+ if (!smp_load_acquire(&init_done)) /* published in sw_fl_init() */
+ return 0;
+
+ switch (cls->command) {
+ case FLOW_CLS_REPLACE:
+ return sw_fl_add(nic, cls);
+ case FLOW_CLS_DESTROY:
+ return sw_fl_del(nic, cls);
+ case FLOW_CLS_STATS:
+ return sw_fl_stats(nic, cls);
+ default:
+ break;
+ }
+
+ return -EOPNOTSUPP;
+}
+
int sw_fl_init(void)
{
+ sw_fl_wq = alloc_workqueue("sw_fl_wq", 0, 0);
+ if (!sw_fl_wq)
+ return -ENOMEM;
+
+ smp_store_release(&init_done, true); /* visible to sw_fl_setup_ft_block_ingress_cb() */
return 0;
}
void sw_fl_deinit(void)
{
+ struct sw_fl_list_entry *entry;
+ struct workqueue_struct *wq;
+ LIST_HEAD(tlist);
+
+ smp_store_release(&init_done, false); /* visible to sw_fl_setup_ft_block_ingress_cb() */
+
+ spin_lock_bh(&sw_fl_lock);
+ wq = sw_fl_wq;
+ sw_fl_wq = NULL;
+ spin_unlock_bh(&sw_fl_lock);
+
+ if (!wq)
+ return;
+
+ cancel_delayed_work_sync(&sw_fl_work);
+ destroy_workqueue(wq);
+
+ spin_lock_bh(&sw_fl_lock);
+ list_splice_init(&sw_fl_lh, &tlist);
+ spin_unlock_bh(&sw_fl_lock);
+
+ while ((entry =
+ list_first_entry_or_null(&tlist,
+ struct sw_fl_list_entry,
+ list)) != NULL) {
+ list_del_init(&entry->list);
+ netdev_put(entry->pf->netdev, &entry->dev_tracker);
+ kfree(entry);
+ }
+
+ sw_fl_ct_cb_flush();
}
+#endif
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fl.h b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fl.h
index cd018d770a8a..8dd816eb17d2 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fl.h
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_fl.h
@@ -9,5 +9,7 @@
void sw_fl_deinit(void);
int sw_fl_init(void);
+int sw_fl_setup_ft_block_ingress_cb(enum tc_setup_type type,
+ void *type_data, void *cb_priv);
#endif // SW_FL_H
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_trace.c b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_trace.c
new file mode 100644
index 000000000000..672f3405de85
--- /dev/null
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_trace.c
@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Marvell RVU Admin Function driver
+ *
+ * Copyright (C) 2026 Marvell.
+ *
+ */
+
+#define CREATE_TRACE_POINTS
+#if IS_ENABLED(CONFIG_OCTEONTX_SWITCH)
+#include "sw_trace.h"
+#endif
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_trace.h b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_trace.h
new file mode 100644
index 000000000000..f4e2832939e4
--- /dev/null
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/switch/sw_trace.h
@@ -0,0 +1,84 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Marvell RVU Admin Function driver
+ *
+ * Copyright (C) 2026 Marvell.
+ *
+ */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM rvu_sw
+
+#if !defined(SW_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
+#define SW_TRACE_H
+
+#include <linux/types.h>
+#include <linux/tracepoint.h>
+#include <linux/byteorder/generic.h>
+
+#include "mbox.h"
+
+TRACE_EVENT(sw_fl_dump,
+ TP_PROTO(const char *fname, const char *info, struct fl_tuple *ftuple),
+ TP_ARGS(fname, info, ftuple),
+ TP_STRUCT__entry(__string(f, fname)
+ __string(info, info)
+ __array(u8, smac, ETH_ALEN)
+ __array(u8, dmac, ETH_ALEN)
+ __field_struct(__be16, eth_type)
+ __field_struct(__be32, sip)
+ __field_struct(__be32, dip)
+ __field(u8, ip_proto)
+ __field_struct(__be16, sport)
+ __field_struct(__be16, dport)
+ __field(u8, uni_di)
+ __field(u16, in_pf)
+ __field(u16, out_pf)
+ ),
+ TP_fast_assign(__assign_str(f);
+ __assign_str(info);
+ memcpy(__entry->smac, ftuple->smac, ETH_ALEN);
+ memcpy(__entry->dmac, ftuple->dmac, ETH_ALEN);
+ __entry->sip = ftuple->ip4src;
+ __entry->dip = ftuple->ip4dst;
+ __entry->eth_type = ftuple->eth_type;
+ __entry->ip_proto = ftuple->proto;
+ __entry->sport = ftuple->sport;
+ __entry->dport = ftuple->dport;
+ __entry->uni_di = ftuple->uni_di;
+ __entry->in_pf = ftuple->in_pf;
+ __entry->out_pf = ftuple->xmit_pf;
+ ),
+ TP_printk("[%s] %s: %pM %pI4:%u to %pM %pI4:%u eth_type=%#x proto=%u uni=%u in=%#x out=%#x",
+ __get_str(f), __get_str(info),
+ __entry->smac, &__entry->sip, __entry->sport,
+ __entry->dmac, &__entry->dip, __entry->dport,
+ __entry->eth_type, __entry->ip_proto, __entry->uni_di,
+ __entry->in_pf, __entry->out_pf)
+);
+
+TRACE_EVENT(sw_act_dump,
+ TP_PROTO(const char *fname, const char *info, u32 act),
+ TP_ARGS(fname, info, act),
+ TP_STRUCT__entry(__string(fname, fname)
+ __string(info, info)
+ __field(u32, act)
+ ),
+
+ TP_fast_assign(__assign_str(fname);
+ __assign_str(info);
+ __entry->act = act;
+ ),
+
+ TP_printk("[%s] %s: act=%u",
+ __get_str(fname), __get_str(info), __entry->act)
+);
+
+#endif
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE sw_trace
+
+#include <trace/define_trace.h>
--
2.43.0
^ permalink raw reply related
* Re: [PATCH v3 net-next 0/6] net: Move system_long_wq to system_dfl_long_wq
From: Marco Crivellari @ 2026-07-21 8:20 UTC (permalink / raw)
To: Jacob Keller
Cc: linux-kernel, netdev, Tejun Heo, Lai Jiangshan,
Frederic Weisbecker, Sebastian Andrzej Siewior, Michal Hocko,
Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Christophe Leroy (CS GROUP), Ethan Nelson-Moore,
Haren Myneni, Madhavan Srinivasan, MD Danish Anwar,
Michael Ellerman, Mika Westerberg, Nicholas Piggin, Nick Child,
Petko Manolov, Richard Cheng, Rick Lindsley, Roger Quadros,
Yehezkel Bernat
In-Reply-To: <e1e391ca-7085-4151-832f-bf187491089e@intel.com>
Hi,
On Tue, Jul 21, 2026 at 12:35 AM Jacob Keller <jacob.e.keller@intel.com> wrote:
> [...]
> > system_long_wq is a per-cpu workqueue and it is used as a parameter of
> > queue_delayed_work(). This function schedule an item that it will later
> > be enqueued (once the timer will fire). __queue_delayed_work() does the job
> > receiving as "cpu" WORK_CPU_UNBOUND:
> >
> > if (housekeeping_enabled(HK_TYPE_TIMER)) {
> > // [....]
> > } else {
> > if (likely(cpu == WORK_CPU_UNBOUND))
> > add_timer_global(timer);
> > else
> > add_timer_on(timer, cpu);
> > }
> >
> > The timer is global, so can fire everywhere, and the work item will be
> > enqueued where the timer fired.
> >
> > Since the workqueue work doesn't rely on per-cpu variables, there is no
> > obvious reason that justify the use of a per-cpu workqueue. So change the
> > workqueue with the new system_dfl_long_wq, so that the used workqueue is
> > now unbound and can benefit from scheduler task placement.
> >
>
>
> Ok. So if I am understanding this correctly, the current code uses
> system_long_wq which is per-CPU, but is fired using an unbound timer. As
> a result, whichever CPU the timer triggers on will be the one which
> selects the work queue. From there, the work item will be enqueued to
> that work queue and remain on that work queue until resolving with no
> way for scheduler to adjust it?
>
> With the new change, we schedule on the system_dfl_long_wq which *isn't*
> per CPU, so the scheduler is free to move the task around and
> reschedule. As a result we get better overall behavior with more input
> from the scheduler, instead of effective randomness from the timer which
> is then forced so that such long running task cannot migrate?
>
> That sounds like a pretty good improvement for the cases where the
> queued work doesn't depend on any per-cpu behavior. Nice!
Yes, that's pretty much it!
> I am not sure I can speak to any of the individual drivers here since I
> wouldn't know whether moving that particular work item would be
> affected.. so feel free to take this review with a grain of salt :)
>
> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Sure, thank you!
--
Marco Crivellari
SUSE Labs
^ permalink raw reply
* Re: [PATCH net] bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
From: Nikolay Aleksandrov @ 2026-07-21 8:22 UTC (permalink / raw)
To: Xiang Mei (Microsoft), Jay Vosburgh, Andrew Lunn,
David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni
Cc: netdev, linux-kernel, AutonomousCodeSecurity, tgopinath, kys
In-Reply-To: <20260720223400.1939998-1-xmei5@asu.edu>
On 21/07/2026 01:34, Xiang Mei (Microsoft) wrote:
> bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and
> takes RTNL via rtnl_trylock() before undoing the promiscuity it set on the
> active slave. In that window the active slave can change under RTNL
> (RTM_DELLINK -> __bond_release_one() -> bond_alb_handle_active_change()),
> which already drops the promiscuity and clears primary_is_promisc. The
> monitor still acts on the stale decision: if the slave was removed with no
> failover, curr_active_slave is now NULL and the deref faults; if it failed
> over, the stale dev_set_promiscuity(-1) underflows the new slave's
> promiscuity counter and pins it in IFF_PROMISC.
>
> Oops: general protection fault, probably for non-canonical address ...
> KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
> Workqueue: b42 bond_alb_monitor
> RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600)
> process_one_work (kernel/workqueue.c:3322)
> worker_thread (kernel/workqueue.c:3486)
> kthread (kernel/kthread.c:436)
> ret_from_fork (arch/x86/kernel/process.c:158)
> Kernel panic - not syncing: Fatal exception
>
> Re-check primary_is_promisc (and curr_active_slave) after taking RTNL so
> the monitor only undoes an increment it still owns. The other bonding
> monitors already re-read state under RTNL in their commit phase
> (bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only
> one acting on the pre-trylock decision.
>
> Fixes: d0e81b7e2246 ("bonding: Acquire correct locks in alb for promisc change")
> Reported-by: AutonomousCodeSecurity@microsoft.com
> Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
> ---
> drivers/net/bonding/bond_alb.c | 10 ++++++----
> 1 file changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
> index 2d37b07c8215..70458c5b23cc 100644
> --- a/drivers/net/bonding/bond_alb.c
> +++ b/drivers/net/bonding/bond_alb.c
> @@ -1535,7 +1535,7 @@ void bond_alb_monitor(struct work_struct *work)
> alb_work.work);
> struct alb_bond_info *bond_info = &(BOND_ALB_INFO(bond));
> struct list_head *iter;
> - struct slave *slave;
> + struct slave *slave, *curr;
please move this up to keep the reverse xmas tree ordering
>
> if (!bond_has_slaves(bond)) {
> atomic_set(&bond_info->tx_rebalance_counter, 0);
> @@ -1597,9 +1597,11 @@ void bond_alb_monitor(struct work_struct *work)
> * because a slave was disabled then
> * it can now leave promiscuous mode.
> */
> - dev_set_promiscuity(rtnl_dereference(bond->curr_active_slave)->dev,
> - -1);
> - bond_info->primary_is_promisc = 0;
> + curr = rtnl_dereference(bond->curr_active_slave);
> + if (bond_info->primary_is_promisc && curr) {
> + dev_set_promiscuity(curr->dev, -1);
> + bond_info->primary_is_promisc = 0;
> + }
>
> rtnl_unlock();
> rcu_read_lock();
^ permalink raw reply
* Re: [PATCH net] openvswitch: fix GSO userspace truncation underflow
From: patchwork-bot+netdevbpf @ 2026-07-21 8:30 UTC (permalink / raw)
To: Kyle Zeng; +Cc: netdev, aconole, echaudro, i.maximets, stable
In-Reply-To: <20260707221635.27489-1-kylebot@openai.com>
Hello:
This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Tue, 7 Jul 2026 15:16:35 -0700 you wrote:
> OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb
> length in OVS_CB(skb)->cutlen. When a later userspace action segments a
> GSO skb, queue_gso_packets() reuses that delta for each smaller segment.
> A segment can then reach queue_userspace_packet() with cutlen greater
> than skb->len, underflowing the length passed to skb_zerocopy().
>
> Store the maximum preserved length instead and bound each consumer
> against the current skb length. Use U32_MAX as the no-truncation
> sentinel so the value remains valid if skb geometry changes before a
> consumer handles it.
>
> [...]
Here is the summary with links:
- [net] openvswitch: fix GSO userspace truncation underflow
https://git.kernel.org/netdev/net/c/4032f8ed10fc
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v5 2/3] drm/xe/xe_ras: Report correctable error events to userspace
From: Raag Jadav @ 2026-07-21 8:37 UTC (permalink / raw)
To: Riana Tauro
Cc: intel-xe, dri-devel, netdev, aravind.iddamsetty, anshuman.gupta,
rodrigo.vivi, joonas.lahtinen, kuba, simona.vetter, airlied,
pratik.bari, joshua.santosh.ranjan, ashwin.kumar.kulkarni,
shubham.kumar, ravi.kishore.koppuravuri, maarten.lankhorst,
mallesh.koujalagi, soham.purkait, Michal Wajdeczko
In-Reply-To: <20260720082208.2648279-7-riana.tauro@intel.com>
On Mon, Jul 20, 2026 at 01:52:11PM +0530, Riana Tauro wrote:
> When an interrupt is received indicating that error counter has crossed
> its threshold, read the current counter value and deliver a drm_ras error
> event to userspace for each affected component.
>
> To avoid sending duplicate events when the same component appears multiple
> times in the response. Send the error-event once per component.
...
> +void xe_drm_ras_event(struct xe_device *xe, u8 component, u8 severity, u32 value)
> +{
> + struct xe_drm_ras *ras = &xe->ras;
> + struct xe_drm_ras_counter *info;
> + struct drm_ras_node *node;
> + int ret;
> +
> + /* Event is supported only if drm_ras is enabled */
> + if (!xe->info.has_drm_ras)
> + return;
> +
> + if (component >= DRM_XE_RAS_ERR_COMP_MAX) {
IIUC this is error_id and should be validated against first/last counter
range in drm_ras layer (similar to registration code).
> + drm_warn(&xe->drm, "unsupported component %u\n", component);
> + return;
> + }
> +
> + if (severity >= DRM_XE_RAS_ERR_SEV_MAX) {
> + drm_warn(&xe->drm, "unsupported severity %u\n", severity);
> + return;
> + }
> +
> + node = &ras->node[severity];
> + info = ras->info[severity];
> +
> + if (!info || !info[component].name)
> + return;
> +
> + ret = drm_ras_nl_error_event(node, component, info[component].name, value);
> + if (ret)
> + drm_err_ratelimited(&xe->drm, "drm_ras error-event failed: %d for %s %s\n", ret,
> + info[component].name, error_severity[severity]);
> +}
...
> +static void ras_send_error_event(struct xe_device *xe, u8 severity, u8 component)
> +{
> + struct xe_ras_error_class counter = {0};
> + u8 drm_severity, drm_component;
> + u32 value;
> + int ret;
> +
> + counter.common.severity = severity;
> + counter.common.component = component;
> +
> + ret = get_counter(xe, &counter, &value);
> + if (ret)
> + return;
> +
> + drm_severity = xe_to_drm_ras_severity(severity);
> + drm_component = xe_to_drm_ras_component(component);
> +
> + xe_drm_ras_event(xe, drm_component, drm_severity, value);
> +}
This entire function can be dropped. See below.
> static u8 handle_core_compute_errors(struct xe_ras_error_array *arr)
> {
> struct xe_ras_compute_error *error_info = (void *)arr->details;
> @@ -312,8 +364,10 @@ void xe_ras_counter_threshold_crossed(struct xe_device *xe,
> struct xe_ras_threshold_crossed *pending = (void *)&response->data;
> struct xe_ras_error_class *errors = pending->counters;
> u32 id, ncounters = pending->ncounters;
> + u8 sent = 0;
>
> BUILD_BUG_ON(sizeof(response->data) < sizeof(*pending));
> + BUILD_BUG_ON(BITS_PER_TYPE(sent) < XE_RAS_COMP_MAX);
> xe_device_assert_mem_access(xe);
>
> if (!ncounters || ncounters > XE_RAS_NUM_COUNTERS)
> @@ -327,8 +381,21 @@ void xe_ras_counter_threshold_crossed(struct xe_device *xe,
> severity = errors[id].common.severity;
> component = errors[id].common.component;
>
> + if (severity != XE_RAS_SEV_CORRECTABLE) {
> + xe_warn(xe, "sysctrl: unexpected severity %s (%u)\n", sev_to_str(severity),
> + severity);
Sanity checks are good, but I think this needs to be extended a bit.
I have something[1] more robust, feel free to reuse.
[1] https://lore.kernel.org/intel-xe/20260721082953.640497-1-raag.jadav@intel.com
> + continue;
> + }
> +
> xe_warn(xe, "[RAS]: %s %s detected\n",
> comp_to_str(component), sev_to_str(severity));
> +
> + /* Send event once per component */
> + if (sent & BIT(component))
> + continue;
> + sent |= BIT(component);
With [1] in place you can just get_counter(&counter) and drm_ras_event()
directly.
Raag
> + ras_send_error_event(xe, severity, component);
> }
> }
>
> --
> 2.47.1
>
^ permalink raw reply
* Re: [PATCH v5 3/3] drm/xe/xe_ras: Report uncorrectable error events to userspace
From: Raag Jadav @ 2026-07-21 8:40 UTC (permalink / raw)
To: Riana Tauro
Cc: intel-xe, dri-devel, netdev, aravind.iddamsetty, anshuman.gupta,
rodrigo.vivi, joonas.lahtinen, kuba, simona.vetter, airlied,
pratik.bari, joshua.santosh.ranjan, ashwin.kumar.kulkarni,
shubham.kumar, ravi.kishore.koppuravuri, maarten.lankhorst,
mallesh.koujalagi, soham.purkait
In-Reply-To: <20260720082208.2648279-8-riana.tauro@intel.com>
On Mon, Jul 20, 2026 at 01:52:12PM +0530, Riana Tauro wrote:
> When the firmware reports uncorrectable errors in response to an AER
> interrupt, deliver a drm-ras error event to userspace for each affected
> component. Multiple errors for the same component within a single firmware
> response are collapsed into one event to avoid duplicate notifications.
This one too can reuse the patch 2 kindness but I'll leave it to your
mercy.
Raag
^ permalink raw reply
* Re: [PATCH net-next v5 10/13] net: phy: add generic helpers for direct C45 MMD access
From: Paolo Abeni @ 2026-07-21 8:46 UTC (permalink / raw)
To: Selvamani Rajagopal, ciprian.regus@analog.com,
Parthiban Veerasooran, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Simon Horman, Jonathan Corbet, Shuah Khan,
Andrew Lunn, Heiner Kallweit, Russell King, Rob Herring,
Krzysztof Kozlowski, Conor Dooley
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-doc@vger.kernel.org, devicetree@vger.kernel.org
In-Reply-To: <CYYPR02MB9828A0F83559EF025D01A14C83FE2@CYYPR02MB9828.namprd02.prod.outlook.com>
On 7/9/26 4:29 AM, Selvamani Rajagopal wrote:
>
>> +int genphy_read_mmd_c45(struct phy_device *phydev, int devnum, u16 regnum)
>> +{
>> + struct mii_bus *bus = phydev->mdio.bus;
>> + int addr = phydev->mdio.addr;
>
> You may want to insert the lockdep_assert here. That'll ensure that read/write APIs are called
> after the mdio-lock is taken. Andrew's suggestion.
>
> lockdep_assert_held(&bus->mdio_lock)
Since this looks like the only pending item and has no functional
implication, I think it's better handled as a (separate) follow-up.
/P
^ permalink raw reply
* [PATCH net] packet: use a consistent hard_header_len in send paths
From: Qihang @ 2026-07-21 8:49 UTC (permalink / raw)
To: netdev
Cc: willemdebruijn.kernel, davem, edumazet, kuba, pabeni, horms,
Qihang, stable
packet_snd() and tpacket_snd() read dev->hard_header_len multiple times
while building an skb. Device reconfiguration can change this value
concurrently, for example through bonding device type changes.
For SOCK_RAW, packet_snd() stores the first value in reserve, later
allocates headroom using LL_RESERVED_SPACE(dev), and then subtracts
reserve from the skb headroom. If hard_header_len decreases between the
reads, the skb can be allocated with less headroom than reserve, moving
skb->data before skb->head. The subsequent skb_copy_datagram_from_iter()
can then attempt an out-of-bounds copy. Hardened usercopy catches this as
a kernel memory overwrite attempt.
tpacket_snd() has the same issue because its allocation and
tpacket_fill_skb() use separate hard_header_len reads.
Read hard_header_len once in each send path and use that snapshot
consistently for skb allocation and construction.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Qihang <q.h.hack.winter@gmail.com>
---
net/packet/af_packet.c | 35 +++++++++++++++++++++--------------
1 file changed, 21 insertions(+), 14 deletions(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 8e6f3a734ba0..d29e59273054 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2569,6 +2569,7 @@ static int packet_snd_vnet_parse(struct msghdr *msg, size_t *len,
static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
void *frame, struct net_device *dev, void *data, int tp_len,
__be16 proto, unsigned char *addr, int hlen, int copylen,
+ int hard_header_len,
const struct sockcm_cookie *sockc)
{
union tpacket_uhdr ph;
@@ -2600,8 +2601,8 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
} else if (copylen) {
int hdrlen = min_t(int, copylen, tp_len);
- skb_push(skb, dev->hard_header_len);
- skb_put(skb, copylen - dev->hard_header_len);
+ skb_push(skb, hard_header_len);
+ skb_put(skb, copylen - hard_header_len);
err = skb_store_bits(skb, 0, data, hdrlen);
if (unlikely(err))
return err;
@@ -2732,7 +2733,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
void *data;
int len_sum = 0;
int status = TP_STATUS_AVAILABLE;
- int hlen, tlen, copylen = 0;
+ int hard_header_len, hlen, tlen, copylen = 0;
long timeo;
mutex_lock(&po->pg_vec_lock);
@@ -2779,8 +2780,9 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
goto out_put;
}
+ hard_header_len = READ_ONCE(dev->hard_header_len);
if (po->sk.sk_socket->type == SOCK_RAW)
- reserve = dev->hard_header_len;
+ reserve = hard_header_len;
size_max = po->tx_ring.frame_size
- (po->tp_hdrlen - sizeof(struct sockaddr_ll));
@@ -2817,7 +2819,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
goto tpacket_error;
status = TP_STATUS_SEND_REQUEST;
- hlen = LL_RESERVED_SPACE(dev);
+ hlen = ((hard_header_len + READ_ONCE(dev->needed_headroom)) &
+ ~(HH_DATA_MOD - 1)) + HH_DATA_MOD;
tlen = dev->needed_tailroom;
if (vnet_hdr_sz) {
data += vnet_hdr_sz;
@@ -2835,10 +2838,10 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
vnet_hdr.hdr_len);
has_vnet_hdr = true;
}
- copylen = max_t(int, copylen, dev->hard_header_len);
+ copylen = max_t(int, copylen, hard_header_len);
skb = sock_alloc_send_skb(&po->sk,
hlen + tlen + sizeof(struct sockaddr_ll) +
- (copylen - dev->hard_header_len),
+ (copylen - hard_header_len),
!need_wait, &err);
if (unlikely(skb == NULL)) {
@@ -2848,7 +2851,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
goto out_status;
}
tp_len = tpacket_fill_skb(po, skb, ph, dev, data, tp_len, proto,
- addr, hlen, copylen, &sockc);
+ addr, hlen, copylen, hard_header_len,
+ &sockc);
if (likely(tp_len >= 0) &&
tp_len > dev->mtu + reserve &&
!vnet_hdr_sz &&
@@ -2956,7 +2960,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
int offset = 0;
struct packet_sock *po = pkt_sk(sk);
int vnet_hdr_sz = READ_ONCE(po->vnet_hdr_sz);
- int hlen, tlen, linear;
+ int hard_header_len, hlen, tlen, linear;
int extra_len = 0;
/*
@@ -2996,14 +3000,16 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
goto out_unlock;
}
- if (sock->type == SOCK_RAW)
- reserve = dev->hard_header_len;
if (vnet_hdr_sz) {
err = packet_snd_vnet_parse(msg, &len, &vnet_hdr, vnet_hdr_sz);
if (err)
goto out_unlock;
}
+ hard_header_len = READ_ONCE(dev->hard_header_len);
+ if (sock->type == SOCK_RAW)
+ reserve = hard_header_len;
+
if (unlikely(sock_flag(sk, SOCK_NOFCS))) {
if (!netif_supports_nofcs(dev)) {
err = -EPROTONOSUPPORT;
@@ -3018,10 +3024,11 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
goto out_unlock;
err = -ENOBUFS;
- hlen = LL_RESERVED_SPACE(dev);
+ hlen = ((hard_header_len + READ_ONCE(dev->needed_headroom)) &
+ ~(HH_DATA_MOD - 1)) + HH_DATA_MOD;
tlen = dev->needed_tailroom;
linear = __virtio16_to_cpu(vio_le(), vnet_hdr.hdr_len);
- linear = max(linear, min_t(int, len, dev->hard_header_len));
+ linear = max(linear, min_t(int, len, hard_header_len));
skb = packet_alloc_skb(sk, hlen + tlen, hlen, len, linear,
msg->msg_flags & MSG_DONTWAIT, &err);
if (skb == NULL)
@@ -3037,7 +3044,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
} else if (reserve) {
skb_reserve(skb, -reserve);
if (len < reserve + sizeof(struct ipv6hdr) &&
- dev->min_header_len != dev->hard_header_len)
+ dev->min_header_len != hard_header_len)
skb_reset_network_header(skb);
}
--
2.50.1 (Apple Git-155)
^ permalink raw reply related
* [PATCH v2] tty: ldisc: fix deadlock between ldisc_sem and rtnl_mutex
From: Yun Zhou @ 2026-07-21 8:50 UTC (permalink / raw)
To: gregkh, jirislaby, socketcan
Cc: linux-serial, mkl, linux-can, davem, edumazet, kuba, pabeni,
horms, netdev, linux-kernel, yun.zhou
syzbot reported a circular lock dependency involving tty ldisc_sem and
the networking rtnl_mutex. The full chain is:
rtnl_mutex --> nft_commit_mutex --> ... --> ep->mtx --> ldisc_sem --> rtnl_mutex
The last edge (ldisc_sem -> rtnl_mutex) is created because tty line
discipline .open() callbacks (slcan, slip) call register_netdev() which
acquires rtnl_mutex, and .open() runs under ldisc_sem write lock in
tty_set_ldisc().
Fix by moving the .open() call outside the ldisc_sem write lock. The
ldisc .open() is initialization of the NEW discipline after the old one
has been closed - there is no need for ldisc_sem protection at this
point since:
- tty_lock is held throughout, preventing concurrent tty_set_ldisc,
hangup, or close
- tty->ldisc is set to NULL during the window. tty_ldisc_ref_wait()
waits for the transition to complete. tty_ldisc_ref() returns NULL
which callers already handle.
- tty buffer data stays queued until the ldisc is installed
The sequence becomes:
1. Hold ldisc_sem(write): close old ldisc, set tty->ldisc = NULL
2. Release ldisc_sem(write)
3. Call new_ldisc->ops->open() without ldisc_sem
4. Re-acquire ldisc_sem(write): install new ldisc (or restore old)
5. Release ldisc_sem(write)
Reported-by: syzbot+de610eeef174bd59a8a3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=de610eeef174bd59a8a3
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
---
v2:
- Keep user-visible behavior unchanged: tty_ldisc_ref_wait() now waits
for the ldisc transition to complete instead of returning NULL (which
would cause spurious EOF/-EIO to concurrent readers).
- Fix a race between tty_ldisc_ref_wait() and __tty_hangup() where a
reader could block forever if it observed ldisc==NULL before
TTY_HUPPED was set. Add wake_up() after set_bit(TTY_HUPPED).
drivers/tty/tty_io.c | 7 +++++++
drivers/tty/tty_ldisc.c | 34 +++++++++++++++++++++++++++++++---
2 files changed, 38 insertions(+), 3 deletions(-)
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 6b283fd03ff8..e2f82e80f397 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -649,6 +649,13 @@ static void __tty_hangup(struct tty_struct *tty, int exit_session)
*/
set_bit(TTY_HUPPED, &tty->flags);
clear_bit(TTY_HUPPING, &tty->flags);
+
+ /*
+ * Wake up readers blocked in tty_ldisc_ref_wait() that may have
+ * seen ldisc == NULL but not yet TTY_HUPPED.
+ */
+ wake_up(&tty->read_wait);
+
tty_unlock(tty);
if (f)
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 27fe8236f662..bd94a1f13c44 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -242,8 +242,20 @@ struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
ldsem_down_read(&tty->ldisc_sem, MAX_SCHEDULE_TIMEOUT);
ld = tty->ldisc;
- if (!ld)
+ if (!ld) {
ldsem_up_read(&tty->ldisc_sem);
+
+ /* ldisc may be NULL during a discipline switch; wait and retry */
+ if (!test_bit(TTY_HUPPED, &tty->flags)) {
+ wait_event(tty->read_wait,
+ READ_ONCE(tty->ldisc) != NULL ||
+ test_bit(TTY_HUPPED, &tty->flags));
+ ldsem_down_read(&tty->ldisc_sem, MAX_SCHEDULE_TIMEOUT);
+ ld = tty->ldisc;
+ if (!ld)
+ ldsem_up_read(&tty->ldisc_sem);
+ }
+ }
return ld;
}
EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
@@ -556,15 +568,28 @@ int tty_set_ldisc(struct tty_struct *tty, int disc)
/* Shutdown the old discipline. */
tty_ldisc_close(tty, old_ldisc);
- /* Now set up the new line discipline. */
- tty->ldisc = new_ldisc;
+ /* Clear tty->ldisc so concurrent readers back off during transition */
+ tty->ldisc = NULL;
tty_set_termios_ldisc(tty, disc);
+ tty_ldisc_unlock(tty);
+ /*
+ * Open the new discipline outside ldisc_sem. The ldisc .open()
+ * may acquire locks (e.g., rtnl_mutex) that would create circular
+ * dependencies if taken under ldisc_sem. tty_lock is still held,
+ * preventing concurrent ldisc changes and hangup.
+ */
retval = tty_ldisc_open(tty, new_ldisc);
+
+ tty_ldisc_lock(tty, MAX_SCHEDULE_TIMEOUT);
+
if (retval < 0) {
/* Back to the old one or N_TTY if we can't */
tty_ldisc_put(new_ldisc);
tty_ldisc_restore(tty, old_ldisc);
+ } else {
+ /* Success - install new ldisc */
+ tty->ldisc = new_ldisc;
}
if (tty->ldisc->ops->num != old_ldisc->ops->num && tty->ops->set_ldisc) {
@@ -584,6 +609,9 @@ int tty_set_ldisc(struct tty_struct *tty, int disc)
out:
tty_ldisc_unlock(tty);
+ /* Wake up readers waiting for the ldisc transition to complete */
+ wake_up(&tty->read_wait);
+
/*
* Restart the work queue in case no characters kick it off. Safe if
* already running
--
2.43.0
^ permalink raw reply related
* Re: [PATCH net-next v5 13/13] net: ethernet: adi: Add a driver for the ADIN1140 MACPHY
From: Paolo Abeni @ 2026-07-21 8:52 UTC (permalink / raw)
To: ciprian.regus, Parthiban Veerasooran, Andrew Lunn,
David S. Miller, Eric Dumazet, Jakub Kicinski, Simon Horman,
Jonathan Corbet, Shuah Khan, Andrew Lunn, Heiner Kallweit,
Russell King, Rob Herring, Krzysztof Kozlowski, Conor Dooley
Cc: netdev, linux-kernel, linux-doc, devicetree
In-Reply-To: <20260708-adin1140-driver-v5-13-4aca7b51a58b@analog.com>
On 7/8/26 12:33 AM, Ciprian Regus via B4 Relay wrote:
> +static void adin1140_get_eth_mac_stats(struct net_device *netdev,
> + struct ethtool_eth_mac_stats *mac_stats)
> +{
> + struct adin1140_priv *priv = netdev_priv(netdev);
> +
> + scoped_guard(spinlock, &priv->stat_lock)
> + __adin1140_eth_mac_stats(priv, mac_stats);
I understand that past reviews suggested scoped_guard usage explicitly,
but FYI this is not the netdev preference, especially in trivial case
like the above, where it has very little - if any - advantages over
plain spin_lock.
Not a blocker anyway, just a note for future submissions.
/P
^ permalink raw reply
* Re: [PATCH net] net: hsr: fix memory leak on slave unregistration by removing synced VLANs
From: Paolo Abeni @ 2026-07-21 8:59 UTC (permalink / raw)
To: Jakub Kicinski, Fernando Fernandez Mancera, Eric Dumazet
Cc: David S . Miller, Simon Horman, Andrew Lunn, netdev, eric.dumazet,
syzbot+456957213f32970c0762
In-Reply-To: <20260720181259.4e5f976f@kernel.org>
On 7/21/26 3:12 AM, Jakub Kicinski wrote:
> On Tue, 14 Jul 2026 22:45:24 +0200 Fernando Fernandez Mancera wrote:
>>> When an HSR master device is brought UP, it auto-adds VLAN 0 via
>>> vlan_vid0_add(), which propagates VID 0 to its slave devices.
>>>
>>> If a slave device is later unregistered while HSR is active (e.g., during
>>> netns cleanup or interface destruction), hsr_del_port() is called to
>>> detach the slave port from the HSR master. However, hsr_del_port() currently
>>> does not delete the VLAN IDs that were synced to the slave device by HSR.
>>>
>>> As a result, the slave device retains a refcount on VID 0 (and any other
>>> synced VLANs). When the slave device is destroyed, its vlan_info /
>>> vlan_vid_info structure remains allocated, leading to a memory leak.
>>>
>>> Fix this by calling vlan_vids_del_by_dev(port->dev, master->dev) in
>>> hsr_del_port() before unlinking the slave device, matching the cleanup
>>> behavior in bonding and team drivers.
>>>
>>> Fixes: 1a8a63a5305e ("net: hsr: Add VLAN CTAG filter support")
>>> Reported-by: syzbot+456957213f32970c0762@syzkaller.appspotmail.com
>>> Closes: https://lore.kernel.org/netdev/6a4cb6ca.57639fcc.86d58.000b.GAE@google.com/T/#u
>>> Signed-off-by: Eric Dumazet <edumazet@google.com>
>>
>> Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
>
> Just to confirm - is the sashiko review a false positive?
> https://sashiko.dev/#/patchset/20260707082327.3238690-1-edumazet%40google.com
I'm sorry, meanwhile PW archived the patch; a repost is needed.
Thanks,
Paolo
^ permalink raw reply
* [PATCH net v2 1/2] net: fman: move IRQ registration after init to prevent NULL deref and UAF
From: ZhaoJinming @ 2026-07-21 8:58 UTC (permalink / raw)
To: horms, madalin.bucur, sean.anderson
Cc: netdev, andrew+netdev, davem, edumazet, kuba, pabeni,
linux-kernel, ZhaoJinming
In-Reply-To: <20260721085841.488088-1-zhaojinming@uniontech.com>
read_dts_node() registers shared interrupt handlers via
devm_request_irq() with fman as dev_id. Two bugs exist in the
current code:
1) Pre-init NULL dereference: at registration time fman is only
partially initialized -- kzalloc_obj() zero-initializes all fields,
so fman->cfg and fman->fpm_regs are NULL. The handlers check
is_init_done(fman->cfg) to guard against incomplete init, but
is_init_done(NULL) returns true (intended to mean cfg was freed
after successful init), so the guard is bypassed and fpm_regs is
dereferenced. If another device on the same shared IRQ line fires
during the window between devm_request_irq() and fman_init(), the
handler accesses NULL fpm_regs via ioread32be(), causing a crash.
2) Use-after-free on probe failure: fman is allocated with
kzalloc_obj() (not devm), so on error paths in read_dts_node()
(ioremap failure, of_platform_populate failure) and fman_config(),
kfree(fman) is called while the devm IRQ handlers remain
registered. The driver core's subsequent devres_release_all() frees
the IRQ handlers, but during the window between kfree(fman) and
devm_free_irq(), a shared-IRQ spurious firing will dereference
the already-freed fman.
A previous attempt to fix issue #1 with an irq_ready flag protected
by READ_ONCE()/WRITE_ONCE() is insufficient on weakly-ordered
architectures. READ_ONCE()/WRITE_ONCE() only prevent compiler
optimization; they do not provide the memory ordering guarantees
(e.g., smp_store_release/smp_load_acquire) needed to ensure that
writes to register pointers are visible to the IRQ handler before
it observes the flag as true.
Fix both issues by moving devm_request_irq() out of read_dts_node()
and into fman_probe(), after both fman_config() and fman_init()
have completed. This eliminates both race windows: by the time the
handlers are registered, all register pointers are initialized
(preventing the NULL dereference), and since fman is never freed
after this point, the use-after-free cannot occur either.
Additionally, defer the hardware enable() call to after IRQ
registration to prevent a potential interrupt storm on the shared
IRQ line. Previously, fman_init() called enable() to activate the
hardware before the IRQ handler was registered. If the hardware
asserted an interrupt in this window, no handler would be present
to clear it, potentially causing the shared IRQ line to be
permanently disabled. Now, enable() is called after all handlers
are registered and the is_init_done guard is valid, so the handler
is always ready to service interrupts when the hardware is active.
Change enable() to read qmi_def_tnums_thresh from fman->state
instead of fman->cfg, since cfg is freed before enable() is called.
Add an 'irq' field to struct fman_dts_params so that the primary IRQ
number parsed in read_dts_node() is available to fman_probe().
v2:
- move devm_request_irq() to fman_probe() after init (replaces
irq_ready + READ_ONCE approach from v1)
- defer enable() to after IRQ registration to prevent interrupt
storm on shared IRQ line
- supersede the separate UAF fix patch (v3), as this patch
resolves both issues in a single change
Fixes: 414fd46e7762 ("fsl/fman: Add FMan support")
Link: https://lore.kernel.org/netdev/20260626162323.GE1310988@horms.kernel.org/
Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
---
drivers/net/ethernet/freescale/fman/fman.c | 78 +++++++++++++---------
drivers/net/ethernet/freescale/fman/fman.h | 1 +
2 files changed, 49 insertions(+), 30 deletions(-)
diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c
index 299bab043175..13913f152147 100644
--- a/drivers/net/ethernet/freescale/fman/fman.c
+++ b/drivers/net/ethernet/freescale/fman/fman.c
@@ -924,7 +924,7 @@ static void hwp_init(struct fman_hwp_regs __iomem *hwp_rg)
iowrite32be(HWP_RPIMAC_PEN, &hwp_rg->fmprrpimac);
}
-static int enable(struct fman *fman, struct fman_cfg *cfg)
+static int enable(struct fman *fman)
{
u32 cfg_reg = 0;
@@ -936,7 +936,8 @@ static int enable(struct fman *fman, struct fman_cfg *cfg)
cfg_reg = QMI_CFG_EN_COUNTERS;
/* Set enqueue and dequeue thresholds */
- cfg_reg |= (cfg->qmi_def_tnums_thresh << 8) | cfg->qmi_def_tnums_thresh;
+ cfg_reg |= (fman->state->qmi_def_tnums_thresh << 8) |
+ fman->state->qmi_def_tnums_thresh;
iowrite32be(BMI_INIT_START, &fman->bmi_regs->fmbm_init);
iowrite32be(cfg_reg | QMI_CFG_ENQ_EN | QMI_CFG_DEQ_EN,
@@ -2000,15 +2001,8 @@ static int fman_init(struct fman *fman)
return -EINVAL;
}
- err = enable(fman, cfg);
- if (err != 0)
- return err;
-
enable_time_stamp(fman);
- kfree(fman->cfg);
- fman->cfg = NULL;
-
return 0;
}
@@ -2695,7 +2689,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
void __iomem *base_addr;
struct resource *res;
u32 val, range[2];
- int err, irq;
+ int err;
struct clk *clk;
u32 clk_rate;
@@ -2717,7 +2711,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
err = platform_get_irq(of_dev, 0);
if (err < 0)
goto fman_node_put;
- irq = err;
+ fman->dts_params.irq = err;
/* Get the FM error interrupt */
err = platform_get_irq(of_dev, 1);
@@ -2773,25 +2767,6 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
of_node_put(muram_node);
- err = devm_request_irq(&of_dev->dev, irq, fman_irq, IRQF_SHARED,
- "fman", fman);
- if (err < 0) {
- dev_err(&of_dev->dev, "%s: irq %d allocation failed (error = %d)\n",
- __func__, irq, err);
- goto fman_free;
- }
-
- if (fman->dts_params.err_irq != 0) {
- err = devm_request_irq(&of_dev->dev, fman->dts_params.err_irq,
- fman_err_irq, IRQF_SHARED,
- "fman-err", fman);
- if (err < 0) {
- dev_err(&of_dev->dev, "%s: irq %d allocation failed (error = %d)\n",
- __func__, fman->dts_params.err_irq, err);
- goto fman_free;
- }
- }
-
base_addr = devm_platform_get_and_ioremap_resource(of_dev, 0, &res);
if (IS_ERR(base_addr)) {
err = PTR_ERR(base_addr);
@@ -2848,6 +2823,49 @@ static int fman_probe(struct platform_device *of_dev)
return -EINVAL;
}
+ /* Register IRQ handlers only after initialization is complete.
+ * This prevents two issues:
+ * 1) Pre-init NULL dereference: is_init_done(NULL) returns true,
+ * so a shared-IRQ spurious firing before fpm_regs is set would
+ * dereference NULL.
+ * 2) Use-after-free on probe failure: fman was kzalloc'd (not devm),
+ * so on error paths kfree(fman) ran before devm_free_irq, leaving
+ * a window where the handler could fire with a freed dev_id.
+ * By registering here, both problems are eliminated.
+ */
+ err = devm_request_irq(dev, fman->dts_params.irq, fman_irq,
+ IRQF_SHARED, "fman", fman);
+ if (err < 0) {
+ dev_err(dev, "%s: irq %d allocation failed (error = %d)\n",
+ __func__, fman->dts_params.irq, err);
+ return err;
+ }
+
+ if (fman->dts_params.err_irq != 0) {
+ err = devm_request_irq(dev, fman->dts_params.err_irq,
+ fman_err_irq, IRQF_SHARED,
+ "fman-err", fman);
+ if (err < 0) {
+ dev_err(dev, "%s: irq %d allocation failed (error = %d)\n",
+ __func__, fman->dts_params.err_irq, err);
+ return err;
+ }
+ }
+
+ /* Free the config structure before enabling the hardware.
+ * is_init_done() uses cfg == NULL to indicate init is complete,
+ * so the IRQ handlers will properly process interrupts once
+ * the hardware is enabled below.
+ */
+ kfree(fman->cfg);
+ fman->cfg = NULL;
+
+ err = enable(fman);
+ if (err != 0) {
+ dev_err(dev, "%s: FMan enable failed\n", __func__);
+ return err;
+ }
+
if (fman->dts_params.err_irq == 0) {
fman_set_exception(fman, FMAN_EX_DMA_BUS_ERROR, false);
fman_set_exception(fman, FMAN_EX_DMA_READ_ECC, false);
diff --git a/drivers/net/ethernet/freescale/fman/fman.h b/drivers/net/ethernet/freescale/fman/fman.h
index 74eb62eba0d7..630d57c3144c 100644
--- a/drivers/net/ethernet/freescale/fman/fman.h
+++ b/drivers/net/ethernet/freescale/fman/fman.h
@@ -286,6 +286,7 @@ struct fman_dts_params {
struct resource *res; /* FMan memory resource */
u8 id; /* FMan ID */
+ int irq; /* FMan IRQ */
int err_irq; /* FMan Error IRQ */
u16 clk_freq; /* FMan clock freq (In Mhz) */
--
2.20.1
^ permalink raw reply related
* [PATCH net v2 0/2] net: fman: fix IRQ-related bugs and add probe cleanup
From: ZhaoJinming @ 2026-07-21 8:58 UTC (permalink / raw)
To: horms, madalin.bucur, sean.anderson
Cc: netdev, andrew+netdev, davem, edumazet, kuba, pabeni,
linux-kernel, ZhaoJinming
In-Reply-To: <20260709145221.1564906-3-horms@kernel.org>
Hi all,
This v2 series addresses the feedback from the previous irq_ready flag
approach (v1) and the separate UAF fix patch (v3). It replaces both
with a single root-cause fix: moving IRQ registration after driver
initialization is complete.
Issues fixed in this series:
1. Pre-init NULL dereference (crash on shared IRQ): is_init_done(NULL)
returns true, so the guard in fman_irq()/fman_err_irq() is bypassed
when fman->cfg is NULL before fman_config() allocates it. Moving
devm_request_irq() to after fman_init() eliminates this window.
2. Use-after-free on probe failure (UAF): kfree(fman) was called in
read_dts_node() error paths while devm IRQ handlers were still
registered. Moving IRQ registration later eliminates this window.
3. Interrupt storm risk on shared IRQ line: deferred enable() to after
IRQ registration, so the hardware is never active without a handler.
4. Memory leaks on probe failure: added fman_free_resources() and
fman_muram_finish() to properly release all sub-resources on
error paths after fman_config() succeeds.
5. Double-free in free_init_resources(): cleared fifo_offset and
cam_offset after each call in fman_init() error paths, and added
IS_ERR_VALUE() guards to prevent -ENOMEM from being treated as a
valid offset.
Pre-existing issues NOT addressed in this series
(suggested as follow-up patches):
- Missing .remove callback: the driver has no remove/unbind path,
causing all kzalloc'd resources to leak on device removal. This
is a larger issue affecting the entire driver lifecycle.
- Child device probe ordering: of_platform_populate() is called
before dev_set_drvdata(), so MAC drivers probing synchronously
will find no parent driver data. This is a pre-existing design
issue in the probe sequence.
- Hardware not disabled on cleanup: if enable() or devm_request_irq()
fails after fman_init() completes, the hardware remains active
while all software structures are freed. The driver lacks a
disable/stop function.
- fman_muram_alloc() failure stores -ENOMEM in fifo_offset: this is
a pre-existing issue that is now mitigated by the IS_ERR_VALUE()
guard in free_init_resources(), but the root cause (error code
stored in an unsigned long field) remains.
v2 changes:
- Move devm_request_irq() to fman_probe() after init (replaces
irq_ready + READ_ONCE approach from v1)
- Defer enable() to after IRQ registration to prevent interrupt storm
- Add proper error cleanup with fman_free_resources()
- Add fman_muram_finish() for complete MURAM teardown
- Clear fifo_offset/cam_offset after free_init_resources() to
prevent double-free
- Add IS_ERR_VALUE() guards in free_init_resources()
- Supersede the separate UAF fix patch (v3)
v1: https://lore.kernel.org/netdev/20260629084529.3709393-1-zhaojinming@uniontech.com/
Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
^ permalink raw reply
* Re: [PATCH net-next v5 00/13] net: Add ADIN1140 support
From: patchwork-bot+netdevbpf @ 2026-07-21 9:00 UTC (permalink / raw)
To: Ciprian Regus
Cc: parthiban.veerasooran, andrew+netdev, davem, edumazet, kuba,
pabeni, horms, corbet, skhan, andrew, hkallweit1, linux, robh,
krzk+dt, conor+dt, netdev, linux-kernel, linux-doc, devicetree,
conor.dooley
In-Reply-To: <20260708-adin1140-driver-v5-0-4aca7b51a58b@analog.com>
Hello:
This series was applied to netdev/net-next.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Wed, 08 Jul 2026 01:33:28 +0300 you wrote:
> This series introduces support for the ADIN1140 (also called AD3306)
> 10BASE-T1S single port MACPHY. The device integrates the MAC and PHY in
> the same package. The communication with the host CPU is done through an
> SPI interface, using the Open Alliance TC6 protocol for control and data
> transactions. As a result, the oa_tc6 framework is used to implement
> the communication with the device (register accesses and Ethernet frame
> RX/TX).
>
> [...]
Here is the summary with links:
- [net-next,v5,01/13] dt-bindings: net: Add ADIN1140
https://git.kernel.org/netdev/net-next/c/2aa955bc52e9
- [net-next,v5,02/13] net: ethernet: oa_tc6: Handle the OA TC6 SPI protected mode
https://git.kernel.org/netdev/net-next/c/7d0e4c4b8c85
- [net-next,v5,03/13] net: ethernet: oa_tc6: add OA_TC6_BROKEN_PHY quirk flag
https://git.kernel.org/netdev/net-next/c/1d030cdd52ee
- [net-next,v5,04/13] net: ethernet: oa_tc6: Export the C45 access functions
https://git.kernel.org/netdev/net-next/c/87ac7ea2153c
- [net-next,v5,05/13] net: ethernet: oa_tc6: Export standard defined registers
https://git.kernel.org/netdev/net-next/c/9210d402bdf5
- [net-next,v5,06/13] net: ethernet: oa_tc6: Add the OA_TC6_ prefix to standard registers
https://git.kernel.org/netdev/net-next/c/31bc75f17c1f
- [net-next,v5,07/13] net: ethernet: oa_tc6: Add read_mms/write_mms register access functions
https://git.kernel.org/netdev/net-next/c/6ad250179486
- [net-next,v5,08/13] net: ethernet: oa_tc6: Use the read_mms/write_mms functions for C45
https://git.kernel.org/netdev/net-next/c/92ec8d69ddb0
- [net-next,v5,09/13] net: ethernet: oa_tc6: Add new register address defines
https://git.kernel.org/netdev/net-next/c/638b41f770ad
- [net-next,v5,10/13] net: phy: add generic helpers for direct C45 MMD access
https://git.kernel.org/netdev/net-next/c/aa63217916e1
- [net-next,v5,11/13] net: phy: microchip-t1s: use generic C45 MMD access helpers
https://git.kernel.org/netdev/net-next/c/85032df227f9
- [net-next,v5,12/13] net: phy: Add support for the ADIN1140 PHY
https://git.kernel.org/netdev/net-next/c/0feaf415b782
- [net-next,v5,13/13] net: ethernet: adi: Add a driver for the ADIN1140 MACPHY
https://git.kernel.org/netdev/net-next/c/20e69e671070
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next 1/2] ipv4: devinet: list global scope addresses before link scope addresses
From: Ido Schimmel @ 2026-07-21 9:01 UTC (permalink / raw)
To: Tim Wong
Cc: netdev, dsahern, davem, edumazet, kuba, pabeni, horms,
linux-kernel
In-Reply-To: <CAPT8rhu_NGbLd54RFWRxO+=7BHhJ0pS5yeOgo5kNmq4qtQ=t8w@mail.gmail.com>
On Mon, Jul 20, 2026 at 12:16:23PM -0600, Tim Wong wrote:
> __inet_insert_ifa() inserts a new primary address by advancing an
> insertion pointer past every existing primary address whose scope
> is >= the new address's scope. Because IPv4 scope values are
> numerically smaller for wider scopes (RT_SCOPE_UNIVERSE < ... <
> RT_SCOPE_LINK < RT_SCOPE_HOST), the comparison
>
> ifa->ifa_scope <= ifa1->ifa_scope
>
> is true for a global-scope new address against essentially every
> existing entry, so the new address is pushed all the way to the
> tail of the primary address list, ending up *after* any link-scope
> addresses that were configured earlier.
>
> On an interface carrying a mix of global- and link-scope IPv4
> addresses (e.g. a routable address alongside an RFC 3927
> 169.254.0.0/16 address, or any address explicitly assigned link
> scope), this makes the resulting order in in_dev->ifa_list -- and
> therefore the order addresses are reported via netlink
> (RTM_GETADDR), ioctl (SIOCGIFCONF), and /proc/net -- depend on
> configuration order rather than scope. Userspace consumers that
> pick the first address returned for an interface (e.g. via
> getifaddrs()) can end up preferring a link-scope address over a
> global one.
It's a user space problem. The kernel provides all the needed
information for user space to make an educated choice.
There was already an attempt to change IPv6's intra-scope order to match
IPv4's and it broke user space:
https://lore.kernel.org/all/20260529112357.5079-1-fmancera@suse.de/
Now you propose changing IPv4's inter-scope order to match IPv6's. It
will most likely break user space and kernel selftests. Please solve
this in user space.
>
> IPv6 already avoids this: ipv6_add_addr() keeps idev->addr_list
> ordered so global-scope addresses precede link-local ones
> regardless of configuration order.
I don't understand the point about configuration order. Only the
intra-scope order is determined by configuration order, no?
>
> Fix the comparison so the insertion pointer only advances past
> addresses that are at least as global as the new one:
>
> ifa->ifa_scope >= ifa1->ifa_scope
>
> This groups global-scope primary addresses ahead of link-scope
> primary addresses in in_dev->ifa_list, preserving insertion order
> within each scope group, and brings IPv4 address enumeration order
> in line with existing IPv6 behavior.
>
> Signed-off-by: kanman.wong <kanman.wong@dish.com>
> ---
> net/ipv4/devinet.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
> index a35b72662e43..056f2169c6a3 100644
> --- a/net/ipv4/devinet.c
> +++ b/net/ipv4/devinet.c
> @@ -510,7 +510,7 @@ static int __inet_insert_ifa(struct in_ifaddr
> *ifa, struct nlmsghdr *nlh,
>
> while (ifa1) {
> if (!(ifa1->ifa_flags & IFA_F_SECONDARY) &&
> - ifa->ifa_scope <= ifa1->ifa_scope)
> + ifa->ifa_scope >= ifa1->ifa_scope)
> last_primary = &ifa1->ifa_next;
> if (ifa1->ifa_mask == ifa->ifa_mask &&
> inet_ifa_match(ifa1->ifa_address, ifa)) {
The patch is whitespace-damaged.
>
> base-commit: ce6b4d3216b63f902bb8e9695ee6c10c83415f65
> --
> 2.51.0
^ permalink raw reply
* [PATCH net v2 2/2] net: fman: add error cleanup path in fman_probe
From: ZhaoJinming @ 2026-07-21 8:58 UTC (permalink / raw)
To: horms, madalin.bucur, sean.anderson
Cc: netdev, andrew+netdev, davem, edumazet, kuba, pabeni,
linux-kernel, ZhaoJinming
In-Reply-To: <20260721085841.488088-1-zhaojinming@uniontech.com>
fman_init() and devm_request_irq() failure paths in fman_probe()
do not free fman and its sub-resources (keygen, muram allocations,
state, cfg), causing memory leaks on probe failure.
Add fman_muram_finish() to properly tear down a MURAM partition
(gen_pool_destroy + iounmap + kfree), complementing the existing
fman_muram_init().
Add fman_free_resources() that releases all fman sub-resources
in the correct order:
- devm_free_irq() for any already-registered IRQ handlers
- kfree(fman->keygen)
- free_init_resources() for MURAM CAM/FIFO allocations
- kfree(fman->cfg)
- fman_muram_finish(fman->muram) for the MURAM management object
- kfree(fman->state)
- kfree(fman)
Use two goto labels in fman_probe():
- err_irq: main IRQ registered but err_irq or enable() failed
-- free main IRQ then fall through to release resources
- err_no_irq: no IRQ registered -- just release resources
The IRQ handlers must be explicitly freed before kfree(fman) to
avoid a window where a shared-IRQ spurious firing could dereference
the freed dev_id.
Clear fman->fifo_offset and fman->cam_offset after each
free_init_resources() call in fman_init() to prevent a double-free
when fman_free_resources() calls free_init_resources() again on the
same error paths.
Note: fman_config() is not changed -- it already frees fman
internally on all its error paths, so fman_probe() must not touch
fman after fman_config() fails.
v2:
- add explicit devm_free_irq() before kfree(fman) to eliminate
a potential UAF window on the cleanup path
- add fman_muram_finish() for complete MURAM teardown
- add kfree(fman->cfg) to release config structure
- clear fifo_offset/cam_offset after free_init_resources() in
fman_init() to prevent double-free
Fixes: 414fd46e7762 ("fsl/fman: Add FMan support")
Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
---
drivers/net/ethernet/freescale/fman/fman.c | 42 ++++++++++++++++---
.../net/ethernet/freescale/fman/fman_muram.c | 15 +++++++
.../net/ethernet/freescale/fman/fman_muram.h | 2 +
3 files changed, 53 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c
index 13913f152147..374f5b7305f8 100644
--- a/drivers/net/ethernet/freescale/fman/fman.c
+++ b/drivers/net/ethernet/freescale/fman/fman.c
@@ -1190,10 +1190,10 @@ static bool is_init_done(struct fman_cfg *cfg)
static void free_init_resources(struct fman *fman)
{
- if (fman->cam_offset)
+ if (fman->cam_offset && !IS_ERR_VALUE(fman->cam_offset))
fman_muram_free_mem(fman->muram, fman->cam_offset,
fman->cam_size);
- if (fman->fifo_offset)
+ if (fman->fifo_offset && !IS_ERR_VALUE(fman->fifo_offset))
fman_muram_free_mem(fman->muram, fman->fifo_offset,
fman->fifo_size);
}
@@ -1963,6 +1963,8 @@ static int fman_init(struct fman *fman)
err = dma_init(fman);
if (err != 0) {
free_init_resources(fman);
+ fman->fifo_offset = 0;
+ fman->cam_offset = 0;
return err;
}
@@ -1975,6 +1977,8 @@ static int fman_init(struct fman *fman)
fman->state->total_fifo_size);
if (IS_ERR_VALUE(fman->fifo_offset)) {
free_init_resources(fman);
+ fman->fifo_offset = 0;
+ fman->cam_offset = 0;
dev_err(fman->dev, "%s: MURAM alloc for BMI FIFO failed\n",
__func__);
return -ENOMEM;
@@ -1998,6 +2002,8 @@ static int fman_init(struct fman *fman)
fman->keygen = keygen_init(fman->kg_regs);
if (!fman->keygen) {
free_init_resources(fman);
+ fman->fifo_offset = 0;
+ fman->cam_offset = 0;
return -EINVAL;
}
@@ -2800,6 +2806,24 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
return ERR_PTR(err);
}
+static void fman_free_resources(struct fman *fman, struct device *dev,
+ bool irq_registered)
+{
+ /* Free IRQs first while fman is still valid */
+ if (irq_registered) {
+ if (fman->dts_params.err_irq != 0)
+ devm_free_irq(dev, fman->dts_params.err_irq, fman);
+ devm_free_irq(dev, fman->dts_params.irq, fman);
+ }
+
+ kfree(fman->keygen);
+ free_init_resources(fman);
+ kfree(fman->cfg);
+ fman_muram_finish(fman->muram);
+ kfree(fman->state);
+ kfree(fman);
+}
+
static int fman_probe(struct platform_device *of_dev)
{
struct fman *fman;
@@ -2820,7 +2844,7 @@ static int fman_probe(struct platform_device *of_dev)
if (fman_init(fman) != 0) {
dev_err(dev, "%s: FMan init failed\n", __func__);
- return -EINVAL;
+ goto err_no_irq;
}
/* Register IRQ handlers only after initialization is complete.
@@ -2838,7 +2862,7 @@ static int fman_probe(struct platform_device *of_dev)
if (err < 0) {
dev_err(dev, "%s: irq %d allocation failed (error = %d)\n",
__func__, fman->dts_params.irq, err);
- return err;
+ goto err_no_irq;
}
if (fman->dts_params.err_irq != 0) {
@@ -2848,7 +2872,7 @@ static int fman_probe(struct platform_device *of_dev)
if (err < 0) {
dev_err(dev, "%s: irq %d allocation failed (error = %d)\n",
__func__, fman->dts_params.err_irq, err);
- return err;
+ goto err_irq;
}
}
@@ -2863,7 +2887,7 @@ static int fman_probe(struct platform_device *of_dev)
err = enable(fman);
if (err != 0) {
dev_err(dev, "%s: FMan enable failed\n", __func__);
- return err;
+ goto err_irq;
}
if (fman->dts_params.err_irq == 0) {
@@ -2891,6 +2915,12 @@ static int fman_probe(struct platform_device *of_dev)
dev_dbg(dev, "FMan%d probed\n", fman->dts_params.id);
return 0;
+
+err_irq:
+ devm_free_irq(dev, fman->dts_params.irq, fman);
+err_no_irq:
+ fman_free_resources(fman, dev, false);
+ return err ?: -EINVAL;
}
static const struct of_device_id fman_match[] = {
diff --git a/drivers/net/ethernet/freescale/fman/fman_muram.c b/drivers/net/ethernet/freescale/fman/fman_muram.c
index 6ac7c2b0cb19..6c2b4f7a02b8 100644
--- a/drivers/net/ethernet/freescale/fman/fman_muram.c
+++ b/drivers/net/ethernet/freescale/fman/fman_muram.c
@@ -129,3 +129,18 @@ void fman_muram_free_mem(struct muram_info *muram, unsigned long offset,
gen_pool_free(muram->pool, addr, size);
}
+
+/**
+ * fman_muram_finish
+ * @muram: FM-MURAM module pointer.
+ *
+ * Frees all resources associated with a MURAM partition.
+ */
+void fman_muram_finish(struct muram_info *muram)
+{
+ if (!muram)
+ return;
+ iounmap(muram->vbase);
+ gen_pool_destroy(muram->pool);
+ kfree(muram);
+}
diff --git a/drivers/net/ethernet/freescale/fman/fman_muram.h b/drivers/net/ethernet/freescale/fman/fman_muram.h
index 3643af61bae2..a5cb544c0f08 100644
--- a/drivers/net/ethernet/freescale/fman/fman_muram.h
+++ b/drivers/net/ethernet/freescale/fman/fman_muram.h
@@ -23,4 +23,6 @@ unsigned long fman_muram_alloc(struct muram_info *muram, size_t size);
void fman_muram_free_mem(struct muram_info *muram, unsigned long offset,
size_t size);
+void fman_muram_finish(struct muram_info *muram);
+
#endif /* __FM_MURAM_EXT */
--
2.20.1
^ permalink raw reply related
* Re: [PATCH net v2] net/mlx5e: Use sender devcom for MPV master-up
From: patchwork-bot+netdevbpf @ 2026-07-21 9:10 UTC (permalink / raw)
To: Manjunath Patil
Cc: saeedm, tariqt, mbloch, leon, netdev, andrew+netdev, davem,
edumazet, kuba, pabeni, phaddad, linux-rdma, linux-kernel, stable
In-Reply-To: <20260707233911.3651139-1-manjunath.b.patil@oracle.com>
Hello:
This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Tue, 7 Jul 2026 16:39:11 -0700 you wrote:
> After PCIe DPC recovery, mlx5 reloads the affected functions and
> replays multiport affiliation events. In the reported failure, the
> first relevant device error was:
>
> pcieport 0000:10:01.1: DPC: containment event
> pcieport 0000:10:01.1: PCIe Bus Error: severity=Uncorrected (Fatal)
> pcieport 0000:10:01.1: [ 5] SDES (First)
>
> [...]
Here is the summary with links:
- [net,v2] net/mlx5e: Use sender devcom for MPV master-up
https://git.kernel.org/netdev/net/c/e32649b4bad9
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [PATCH net] phonet: pep: fix use-after-free in pep_get_sb()
From: Breno Leitao @ 2026-07-21 8:58 UTC (permalink / raw)
To: Remi Denis-Courmont, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman,
Rémi Denis-Courmont
Cc: netdev, linux-kernel, kernel-team, stable, Breno Leitao
pep_get_sb() doesn't consider that pskb_may_pull() might have relocated
the skb data, and continue to access the older pointer, causing UAF.
Reproduced under KASAN:
BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0
Read of size 1 at addr ff11000105510f50 by task repro/157
pep_get_sb+0x234/0x3b0
pipe_handler_do_rcv+0x5f7/0xa10
pep_do_rcv+0x203/0x410
__sk_receive_skb+0x471/0x4a0
phonet_rcv+0x5b3/0x6c0
__netif_receive_skb+0xcc/0x1d0
Refetch the header with skb_header_pointer() after pskb_may_pull(), so
the possibly stale pointer is no longer dereferenced. There are better
ways to solve this, but, this is the less instrusive one.
Fixes: 9641458d3ec4 ("Phonet: Pipe End Point for Phonet Pipes protocol")
Cc: stable@vger.kernel.org
Signed-off-by: Breno Leitao <leitao@debian.org>
---
This showed up in sashiko report, when I've sent my other patchset
https://lore.kernel.org/all/20260720-getsockopt_phase4-v2-0-8a08fcfa0d72@debian.org/
---
net/phonet/pep.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 7069271393933..31b29e3ca7bc6 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -55,6 +55,8 @@ static unsigned char *pep_get_sb(struct sk_buff *skb, u8 *ptype, u8 *plen,
ph = skb_header_pointer(skb, 0, 2, &h);
if (ph == NULL || ph->sb_len < 2 || !pskb_may_pull(skb, ph->sb_len))
return NULL;
+ /* pskb_may_pull() may have reallocated the head; refetch ph. */
+ ph = skb_header_pointer(skb, 0, 2, &h);
ph->sb_len -= 2;
*ptype = ph->sb_type;
*plen = ph->sb_len;
---
base-commit: 1c975de3343cdef506f2eecc833cc1f14b0401c4
change-id: 20260720-phonet_get_sb_uaf-8745e9d9d62c
Best regards,
--
Breno Leitao <leitao@debian.org>
^ permalink raw reply related
* Re: [PATCH 1/2] dt-bindings: net: qcom,bam-dmux: Add qcom,shikra-bam-dmux compatible
From: Krzysztof Kozlowski @ 2026-07-21 9:17 UTC (permalink / raw)
To: Vishnu Santhosh
Cc: Stephan Gerhold, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Loic Poulain, Sergey Ryazanov, Johannes Berg,
linux-arm-msm, netdev, devicetree, linux-kernel, chris.lew,
Deepak Kumar Singh
In-Reply-To: <20260714-qcom-bam-dmux-vmid-ext-v1-1-3f29da7cca76@oss.qualcomm.com>
On Tue, Jul 14, 2026 at 11:02:31AM +0530, Vishnu Santhosh wrote:
> On platforms where the modem DMAs into the BAM-DMUX RX data buffers and
> the XPU enforces per-region access control, each individually
> DMA-mapped RX buffer consumes an XPU resource group. With only ~16
> groups available, the per-buffer mappings exhaust the table and inbound
> transfers fault.
>
> Add qcom,shikra-bam-dmux as an additional compatible for the Shikra SoC,
> paired with the generic qcom,bam-dmux fallback, so the driver can match
> on it via its of_device_id table.
Drop, redundant. What is not redundant, why you claim it is compatible
but driver code suggests it is not incompatible.
>
> Co-developed-by: Deepak Kumar Singh <deepak.singh@oss.qualcomm.com>
> Signed-off-by: Deepak Kumar Singh <deepak.singh@oss.qualcomm.com>
> Signed-off-by: Vishnu Santhosh <vishnu.santhosh@oss.qualcomm.com>
> ---
> Documentation/devicetree/bindings/net/qcom,bam-dmux.yaml | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/Documentation/devicetree/bindings/net/qcom,bam-dmux.yaml b/Documentation/devicetree/bindings/net/qcom,bam-dmux.yaml
> index 33746c238513d72366bc52359fb10f275475b331..27f0fdf285c17d6bfdecd5e59cad09912a5e821b 100644
> --- a/Documentation/devicetree/bindings/net/qcom,bam-dmux.yaml
> +++ b/Documentation/devicetree/bindings/net/qcom,bam-dmux.yaml
> @@ -22,7 +22,13 @@ description: |
>
> properties:
> compatible:
> - const: qcom,bam-dmux
> + oneOf:
> + - const: qcom,bam-dmux
> + - items:
> + - enum:
> + # Shikra
Please do not write redundant code or commit msgs. Look:
> + - qcom,shikra-bam-dmux
It has word "shikra". Can qcom,shikra-bam-dmux be anything else than
"Shikra"? Then why adding such comment?
> + - const: qcom,bam-dmux
Anyway, the generic compatible was added to cover all possible use
cases, right? So why it is not generic enough here? One more example of
generic compatibles failure.
Best regards,
Krzysztof
^ permalink raw reply
* Re: [PATCH net] rds: drop incoming messages that cross network namespace boundaries
From: patchwork-bot+netdevbpf @ 2026-07-21 9:20 UTC (permalink / raw)
To: Allison Henderson; +Cc: netdev, pabeni, edumazet, kuba, horms, qwe.aldo
In-Reply-To: <20260708024314.601139-1-achender@kernel.org>
Hello:
This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Tue, 7 Jul 2026 19:43:14 -0700 you wrote:
> From: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
>
> rds_find_bound() looks up the destination socket using a global
> rhashtable keyed solely on (addr, port, scope_id). Network namespaces
> are not part of the key, so a sender in netns A can deliver an incoming
> message (inc) to a socket that lives in a different netns B.
>
> [...]
Here is the summary with links:
- [net] rds: drop incoming messages that cross network namespace boundaries
https://git.kernel.org/netdev/net/c/5521ae71e32a
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next v6 0/2] udp: fix FOU/GUE over multicast
From: patchwork-bot+netdevbpf @ 2026-07-21 9:20 UTC (permalink / raw)
To: Anton Danilov
Cc: netdev, willemb, davem, dsahern, edumazet, kuniyu, kuba, pabeni,
horms, shuah, linux-kselftest
In-Reply-To: <cover.1783372173.git.littlesmilingcloud@gmail.com>
Hello:
This series was applied to netdev/net-next.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Wed, 8 Jul 2026 03:35:02 +0300 you wrote:
> UDP encapsulation (FOU, GUE) has never worked correctly with multicast
> destination addresses. When a FOU-encapsulated packet arrives at a
> multicast address, it enters __udp4_lib_mcast_deliver() /
> __udp6_lib_mcast_deliver() which call consume_skb() on packets that
> need resubmission to the inner protocol handler, silently dropping
> them instead.
>
> [...]
Here is the summary with links:
- [net-next,v6,1/2] udp: fix encapsulation packet resubmit in multicast deliver
https://git.kernel.org/netdev/net-next/c/3cb8d4b9bfeb
- [net-next,v6,2/2] selftests: net: add FOU multicast encapsulation resubmit test
https://git.kernel.org/netdev/net-next/c/e5382133c51c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net v3] gtp: parse extension headers before reading inner protocol
From: Paolo Abeni @ 2026-07-21 9:22 UTC (permalink / raw)
To: Zhixing Chen, Pablo Neira Ayuso, Harald Welte
Cc: Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
osmocom-net-gprs, netdev
In-Reply-To: <CAMyuFdVWgvx4yafBQfbTt4Do535p3PF0LCpZ6Gma0WZ-De2kyA@mail.gmail.com>
On 7/20/26 9:28 AM, Zhixing Chen wrote:
> Gentle ping on this v3, in case it fell through the cracks.
Please, don't.
Maintainers are overflown by LLM generated contents, and conferences &&
season interruption reduce the available time. While the patch is alive
in PW and no comments from reviewer and/or sashiko are pending, no
additional action is needed.
The patch LGTM, I'm applying it now.
/P
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox