Skip to content

Commit 85e15f3

Browse files
LorenzoBianconiAnsuel
authored andcommitted
airoha: backport additional fixes for ethernet driver
Backport fixes for airoha_eth driver from net tree recently merged upstream. Refresh all affected patch. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> [ refresh patch, improve commit title/description ] Link: openwrt#23934 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
1 parent e79df8a commit 85e15f3

14 files changed

Lines changed: 456 additions & 23 deletions
Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
From 1402ecccf5630a0b7fa4749d7d2e72abc3f3d73d Mon Sep 17 00:00:00 2001
2+
Message-ID: <1402ecccf5630a0b7fa4749d7d2e72abc3f3d73d.1782312403.git.lorenzo@kernel.org>
3+
From: "Wayen.Yan" <win847@gmail.com>
4+
Date: Fri, 12 Jun 2026 07:09:13 +0800
5+
Subject: [PATCH 1/2] net: airoha: Fix register index for Tx-fwd counter
6+
configuration
7+
8+
In airoha_qdma_init_qos_stats(), the Tx-fwd counter configuration
9+
register uses the same index (i << 1) as the Tx-cpu counter, which
10+
overwrites the Tx-cpu configuration. The Tx-fwd counter value register
11+
correctly uses (i << 1) + 1, so the configuration register should use
12+
the same index.
13+
14+
Fix the REG_CNTR_CFG index from (i << 1) to ((i << 1) + 1) so that
15+
the Tx-fwd counter is properly configured instead of clobbering the
16+
Tx-cpu counter config.
17+
18+
Fixes: 20bf7d07c956 ("net: airoha: Add sched ETS offload support")
19+
Signed-off-by: Wayen.Yan <win847@gmail.com>
20+
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
21+
Link: https://patch.msgid.link/6a2b40e7.4dd82583.3a5c46.e566@mx.google.com
22+
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
23+
---
24+
drivers/net/ethernet/airoha/airoha_eth.c | 2 +-
25+
1 file changed, 1 insertion(+), 1 deletion(-)
26+
27+
--- a/drivers/net/ethernet/airoha/airoha_eth.c
28+
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
29+
@@ -1331,7 +1331,7 @@ static void airoha_qdma_init_qos_stats(s
30+
FIELD_PREP(CNTR_CHAN_MASK, i));
31+
/* Tx-fwd transferred count */
32+
airoha_qdma_wr(qdma, REG_CNTR_VAL((i << 1) + 1), 0);
33+
- airoha_qdma_wr(qdma, REG_CNTR_CFG(i << 1),
34+
+ airoha_qdma_wr(qdma, REG_CNTR_CFG((i << 1) + 1),
35+
CNTR_EN_MASK | CNTR_ALL_QUEUE_EN_MASK |
36+
CNTR_ALL_DSCP_RING_EN_MASK |
37+
FIELD_PREP(CNTR_SRC_MASK, 1) |
Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
From 1c3a77471afbb3981af28f7f7c8b2487558e4b00 Mon Sep 17 00:00:00 2001
2+
Message-ID: <1c3a77471afbb3981af28f7f7c8b2487558e4b00.1782312403.git.lorenzo@kernel.org>
3+
In-Reply-To: <1402ecccf5630a0b7fa4749d7d2e72abc3f3d73d.1782312403.git.lorenzo@kernel.org>
4+
References: <1402ecccf5630a0b7fa4749d7d2e72abc3f3d73d.1782312403.git.lorenzo@kernel.org>
5+
From: "Wayen.Yan" <win847@gmail.com>
6+
Date: Fri, 12 Jun 2026 07:09:56 +0800
7+
Subject: [PATCH 2/2] net: airoha: Fix debugfs new-tuple display for IPv4 ROUTE
8+
entries
9+
MIME-Version: 1.0
10+
Content-Type: text/plain; charset=UTF-8
11+
Content-Transfer-Encoding: 8bit
12+
13+
In airoha_ppe_debugfs_foe_show(), the second switch statement falls
14+
through from PPE_PKT_TYPE_IPV4_HNAPT/DSLITE to PPE_PKT_TYPE_IPV4_ROUTE,
15+
accessing hwe->ipv4.new_tuple for all three types. However, IPv4 ROUTE
16+
(3-tuple) entries do not contain a valid new_tuple — this field is only
17+
meaningful for NATted flows (HNAPT/DSLITE). For ROUTE entries, the
18+
memory at the new_tuple offset holds routing information, not NAT data,
19+
so displaying "new=" produces garbage output.
20+
21+
Display new_tuple only for HNAPT and DSLITE, and let IPV4_ROUTE fall
22+
through to the default case.
23+
24+
Fixes: 3fe15c640f38 ("net: airoha: Introduce PPE debugfs support")
25+
Link: https://lore.kernel.org/6a2b40ea.4dd82583.3a5c46.e5a2@mx.google.com
26+
Signed-off-by: Wayen.Yan <win847@gmail.com>
27+
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
28+
Link: https://patch.msgid.link/6a2be54b.ef98c1b2.3c3224.2ed8@mx.google.com
29+
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
30+
---
31+
drivers/net/ethernet/airoha/airoha_ppe_debugfs.c | 2 --
32+
1 file changed, 2 deletions(-)
33+
34+
--- a/drivers/net/ethernet/airoha/airoha_ppe_debugfs.c
35+
+++ b/drivers/net/ethernet/airoha/airoha_ppe_debugfs.c
36+
@@ -121,8 +121,6 @@ static int airoha_ppe_debugfs_foe_show(s
37+
case PPE_PKT_TYPE_IPV4_DSLITE:
38+
src_port = &hwe->ipv4.new_tuple.src_port;
39+
dest_port = &hwe->ipv4.new_tuple.dest_port;
40+
- fallthrough;
41+
- case PPE_PKT_TYPE_IPV4_ROUTE:
42+
src_addr = &hwe->ipv4.new_tuple.src_ip;
43+
dest_addr = &hwe->ipv4.new_tuple.dest_ip;
44+
seq_puts(m, " new=");
Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
From 5c121ee635680c93d7074becf14cfbaac140f80d Mon Sep 17 00:00:00 2001
2+
Message-ID: <5c121ee635680c93d7074becf14cfbaac140f80d.1782312136.git.lorenzo@kernel.org>
3+
From: Wayen Yan <win847@gmail.com>
4+
Date: Tue, 16 Jun 2026 19:52:36 +0800
5+
Subject: [PATCH] net: airoha: fix foe_check_time allocation size
6+
7+
foe_check_time is declared as u16 pointer but was allocated with
8+
only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16).
9+
10+
When airoha_ppe_foe_verify_entry() is called with hash >= ppe_num_entries/2,
11+
it writes beyond the allocated buffer, causing heap buffer overflow and
12+
potential kernel crash.
13+
14+
Fixes: 6d5b601d52a2 ("net: airoha: ppe: Dynamically allocate foe_check_time array in airoha_ppe struct")
15+
Signed-off-by: Wayen Yan <win847@gmail.com>
16+
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
17+
Link: https://patch.msgid.link/178161119471.2163752.14373384830691569758@gmail.com
18+
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
19+
---
20+
drivers/net/ethernet/airoha/airoha_ppe.c | 3 ++-
21+
1 file changed, 2 insertions(+), 1 deletion(-)
22+
23+
--- a/drivers/net/ethernet/airoha/airoha_ppe.c
24+
+++ b/drivers/net/ethernet/airoha/airoha_ppe.c
25+
@@ -1601,7 +1601,8 @@ int airoha_ppe_init(struct airoha_eth *e
26+
return -ENOMEM;
27+
}
28+
29+
- ppe->foe_check_time = devm_kzalloc(eth->dev, ppe_num_entries,
30+
+ ppe->foe_check_time = devm_kzalloc(eth->dev,
31+
+ ppe_num_entries * sizeof(*ppe->foe_check_time),
32+
GFP_KERNEL);
33+
if (!ppe->foe_check_time)
34+
return -ENOMEM;
Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
From 05173fa30add3787e7ab2e735c4ee00431994259 Mon Sep 17 00:00:00 2001
2+
Message-ID: <05173fa30add3787e7ab2e735c4ee00431994259.1782312341.git.lorenzo@kernel.org>
3+
From: "Wayen.Yan" <win847@gmail.com>
4+
Date: Sat, 13 Jun 2026 08:22:31 +0800
5+
Subject: [PATCH] net: airoha: Fix non-standard return value in
6+
airoha_ppe_get_wdma_info()
7+
8+
airoha_ppe_get_wdma_info() returns -1 when the last path in the
9+
forwarding path stack is not of type DEV_PATH_MTK_WDMA. This is not
10+
a standard kernel error code. Replace it with -EINVAL since the
11+
input path type is invalid from the caller's perspective.
12+
13+
Signed-off-by: Wayen.Yan <win847@gmail.com>
14+
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
15+
Link: https://patch.msgid.link/6a2ca3d9.ad59c0a6.147df9.2a62@mx.google.com
16+
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
17+
---
18+
drivers/net/ethernet/airoha/airoha_ppe.c | 2 +-
19+
1 file changed, 1 insertion(+), 1 deletion(-)
20+
21+
--- a/drivers/net/ethernet/airoha/airoha_ppe.c
22+
+++ b/drivers/net/ethernet/airoha/airoha_ppe.c
23+
@@ -277,7 +277,7 @@ static int airoha_ppe_get_wdma_info(stru
24+
25+
path = &stack.path[stack.num_paths - 1];
26+
if (path->type != DEV_PATH_MTK_WDMA)
27+
- return -1;
28+
+ return -EINVAL;
29+
30+
info->idx = path->mtk_wdma.wdma_idx;
31+
info->bss = path->mtk_wdma.bss;
Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
From 86e51aa24686cc95bb35613059e8b94b9b81e3f0 Mon Sep 17 00:00:00 2001
2+
Message-ID: <86e51aa24686cc95bb35613059e8b94b9b81e3f0.1782312099.git.lorenzo@kernel.org>
3+
From: Wayen Yan <win847@gmail.com>
4+
Date: Sat, 20 Jun 2026 16:17:44 +0800
5+
Subject: [PATCH] net: airoha: Fix skb->priority underflow in
6+
airoha_dev_select_queue()
7+
MIME-Version: 1.0
8+
Content-Type: text/plain; charset=UTF-8
9+
Content-Transfer-Encoding: 8bit
10+
11+
In airoha_dev_select_queue(), the expression:
12+
13+
queue = (skb->priority - 1) % AIROHA_NUM_QOS_QUEUES;
14+
15+
implicitly converts to unsigned arithmetic: when skb->priority is 0
16+
(the default for unclassified traffic), (0u - 1u) wraps to UINT_MAX,
17+
and UINT_MAX % 8 = 7, routing default best-effort packets to the
18+
highest-priority QoS queue. This causes QoS inversion where the
19+
majority of traffic on a PON gateway starves actual high-priority
20+
flows (VoIP, gaming, etc.).
21+
22+
The "- 1" offset was a leftover from the ETS offload implementation
23+
that has since been removed. The correct mapping is a direct modulo:
24+
25+
queue = skb->priority % AIROHA_NUM_QOS_QUEUES;
26+
27+
This maps priority 0 → queue 0 (lowest), priority 7 → queue 7
28+
(highest), with higher priorities wrapping around. This is the
29+
standard Linux sk_prio → HW queue mapping used by other drivers.
30+
31+
Fixes: 2b288b81560b ("net: airoha: Introduce ndo_select_queue callback")
32+
Link: https://lore.kernel.org/netdev/178185573207.2378135.3729126358670287878@gmail.com/
33+
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
34+
Reviewed-by: Joe Damato <joe@dama.to>
35+
Signed-off-by: Wayen Yan <win847@gmail.com>
36+
Link: https://patch.msgid.link/178194366700.2485734.5368768965976693502@gmail.com
37+
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
38+
---
39+
drivers/net/ethernet/airoha/airoha_eth.c | 2 +-
40+
1 file changed, 1 insertion(+), 1 deletion(-)
41+
42+
--- a/drivers/net/ethernet/airoha/airoha_eth.c
43+
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
44+
@@ -2110,7 +2110,7 @@ static u16 airoha_dev_select_queue(struc
45+
*/
46+
channel = netdev_uses_dsa(netdev) ? skb_get_queue_mapping(skb) : port->id;
47+
channel = channel % AIROHA_NUM_QOS_CHANNELS;
48+
- queue = (skb->priority - 1) % AIROHA_NUM_QOS_QUEUES; /* QoS queue */
49+
+ queue = skb->priority % AIROHA_NUM_QOS_QUEUES;
50+
queue = channel * AIROHA_NUM_QOS_QUEUES + queue;
51+
52+
return queue < netdev->num_tx_queues ? queue : 0;
Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
From 245043dfc2101e7dc6268bf123b75305a91e4e00 Mon Sep 17 00:00:00 2001
2+
Message-ID: <245043dfc2101e7dc6268bf123b75305a91e4e00.1782312080.git.lorenzo@kernel.org>
3+
From: Wayen Yan <win847@gmail.com>
4+
Date: Fri, 19 Jun 2026 21:12:06 +0800
5+
Subject: [PATCH] net: airoha: Fix TX scheduler queue mask loop upper bound
6+
MIME-Version: 1.0
7+
Content-Type: text/plain; charset=UTF-8
8+
Content-Transfer-Encoding: 8bit
9+
10+
In airoha_qdma_set_chan_tx_sched(), the loop clearing queue mask was
11+
using AIROHA_NUM_TX_RING (32) instead of AIROHA_NUM_QOS_QUEUES (8).
12+
13+
Each channel has 8 queues, and TXQ_DISABLE_CHAN_QUEUE_MASK(channel, i)
14+
computes BIT(i + (channel * 8)). With i ranging 0..31, this causes:
15+
- channel 0: clears bit 0..31 (all 4 channels) instead of 0..7
16+
- channel 1: clears bit 8..31 (channels 1-3) instead of 8..15
17+
- channel 2: clears bit 16..31 (channels 2-3) instead of 16..23
18+
- channel 3: clears bit 24..31 (channel 3 only) - correct by accident
19+
20+
While BIT(32+) on arm64 produces 64-bit values truncated to 0 in u32
21+
mask parameter, the loop still incorrectly clears queues within the
22+
same channel beyond queue 7.
23+
24+
Even though this is functionally harmless (the register resets to 0
25+
and is only ever cleared, never set — so clearing extra bits is a
26+
no-op), the loop bound is semantically wrong and should be fixed for
27+
correctness and clarity.
28+
29+
Fix by using AIROHA_NUM_QOS_QUEUES (8) as the loop upper bound.
30+
31+
Fixes: ef1ca9271313 ("net: airoha: Add sched HTB offload support")
32+
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
33+
Signed-off-by: Wayen Yan <win847@gmail.com>
34+
Link: https://patch.msgid.link/178187479434.2400840.1312143943526335838@gmail.com
35+
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
36+
---
37+
drivers/net/ethernet/airoha/airoha_eth.c | 2 +-
38+
1 file changed, 1 insertion(+), 1 deletion(-)
39+
40+
--- a/drivers/net/ethernet/airoha/airoha_eth.c
41+
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
42+
@@ -2395,7 +2395,7 @@ static int airoha_qdma_set_chan_tx_sched
43+
struct airoha_gdm_dev *dev = netdev_priv(netdev);
44+
int i;
45+
46+
- for (i = 0; i < AIROHA_NUM_TX_RING; i++)
47+
+ for (i = 0; i < AIROHA_NUM_QOS_QUEUES; i++)
48+
airoha_qdma_clear(dev->qdma, REG_QUEUE_CLOSE_CFG(channel),
49+
TXQ_DISABLE_CHAN_QUEUE_MASK(channel, i));
50+
Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
From a061dfb063fa03ed09cf21145ffff247cf94721a Mon Sep 17 00:00:00 2001
2+
Message-ID: <a061dfb063fa03ed09cf21145ffff247cf94721a.1782312317.git.lorenzo@kernel.org>
3+
In-Reply-To: <05173fa30add3787e7ab2e735c4ee00431994259.1782312317.git.lorenzo@kernel.org>
4+
References: <05173fa30add3787e7ab2e735c4ee00431994259.1782312317.git.lorenzo@kernel.org>
5+
From: "Wayen.Yan" <win847@gmail.com>
6+
Date: Sat, 13 Jun 2026 08:41:16 +0800
7+
Subject: [PATCH 2/2] net: airoha: Fix typos in comments and Kconfig
8+
9+
Fix several typos found during code review:
10+
- Kconfig: "Aiorha" -> "Airoha" in NET_AIROHA_FLOW_STATS help text
11+
- Comment: "CMD1" -> "CDM1" (Central DMA, not Command)
12+
- Comments: "GMD1/2/3/4" -> "GDM1/2/3/4" (Gigabit DMA, not GMD)
13+
14+
These are pure comment and documentation fixes with no functional impact.
15+
16+
Signed-off-by: Wayen.Yan <win847@gmail.com>
17+
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
18+
Link: https://patch.msgid.link/6a2ca74a.c5b1db4e.21a698.01e7@mx.google.com
19+
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
20+
---
21+
drivers/net/ethernet/airoha/Kconfig | 2 +-
22+
drivers/net/ethernet/airoha/airoha_eth.c | 10 +++++-----
23+
2 files changed, 6 insertions(+), 6 deletions(-)
24+
25+
--- a/drivers/net/ethernet/airoha/Kconfig
26+
+++ b/drivers/net/ethernet/airoha/Kconfig
27+
@@ -29,6 +29,6 @@ config NET_AIROHA_FLOW_STATS
28+
bool "Airoha flow stats"
29+
depends on NET_AIROHA && NET_AIROHA_NPU
30+
help
31+
- Enable Aiorha flowtable statistic counters.
32+
+ Enable Airoha flowtable statistic counters.
33+
34+
endif #NET_VENDOR_AIROHA
35+
--- a/drivers/net/ethernet/airoha/airoha_eth.c
36+
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
37+
@@ -344,18 +344,18 @@ static void airoha_fe_pse_ports_init(str
38+
FIELD_PREP(PSE_ALLRSV_MASK, all_rsv));
39+
}
40+
41+
- /* CMD1 */
42+
+ /* CDM1 */
43+
for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_CDM1]; q++)
44+
airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_CDM1, q,
45+
PSE_QUEUE_RSV_PAGES);
46+
- /* GMD1 */
47+
+ /* GDM1 */
48+
for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_GDM1]; q++)
49+
airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_GDM1, q,
50+
PSE_QUEUE_RSV_PAGES);
51+
- /* GMD2 */
52+
+ /* GDM2 */
53+
for (q = 6; q < pse_port_num_queues[FE_PSE_PORT_GDM2]; q++)
54+
airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_GDM2, q, 0);
55+
- /* GMD3 */
56+
+ /* GDM3 */
57+
for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_GDM3]; q++)
58+
airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_GDM3, q,
59+
PSE_QUEUE_RSV_PAGES);
60+
@@ -390,7 +390,7 @@ static void airoha_fe_pse_ports_init(str
61+
q, 0);
62+
}
63+
}
64+
- /* GMD4 */
65+
+ /* GDM4 */
66+
for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_GDM4]; q++)
67+
airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_GDM4, q,
68+
PSE_QUEUE_RSV_PAGES);
Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
From bfcce49c4aaab9339ef7b9a7fa4d8ac5a19cc820 Mon Sep 17 00:00:00 2001
2+
Message-ID: <bfcce49c4aaab9339ef7b9a7fa4d8ac5a19cc820.1782366471.git.lorenzo@kernel.org>
3+
From: Lorenzo Bianconi <lorenzo@kernel.org>
4+
Date: Fri, 19 Jun 2026 13:37:13 +0200
5+
Subject: [PATCH 1/2] net: airoha: Fix off-by-one in
6+
airoha_tc_remove_htb_queue()
7+
8+
airoha_tc_htb_alloc_leaf_queue() computes the HTB QoS channel index
9+
as opt->classid % AIROHA_NUM_QOS_CHANNELS and stores it in qos_sq_bmap.
10+
However, airoha_tc_remove_htb_queue() clears the HTB configuration
11+
using queue + 1 as the channel index, causing an off-by-one error.
12+
Use queue directly as the QoS channel index to match the allocation
13+
logic.
14+
15+
Fixes: ef1ca9271313b ("net: airoha: Add sched HTB offload support")
16+
Reviewed-by: Simon Horman <horms@kernel.org>
17+
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
18+
Link: https://patch.msgid.link/20260619-airoha-qos-fixes-v2-1-5c43485038f9@kernel.org
19+
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
20+
---
21+
drivers/net/ethernet/airoha/airoha_eth.c | 2 +-
22+
1 file changed, 1 insertion(+), 1 deletion(-)
23+
24+
--- a/drivers/net/ethernet/airoha/airoha_eth.c
25+
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
26+
@@ -3006,7 +3006,7 @@ static void airoha_tc_remove_htb_queue(s
27+
struct airoha_qdma *qdma = dev->qdma;
28+
29+
netif_set_real_num_tx_queues(netdev, netdev->real_num_tx_queues - 1);
30+
- airoha_qdma_set_tx_rate_limit(netdev, queue + 1, 0, 0);
31+
+ airoha_qdma_set_tx_rate_limit(netdev, queue, 0, 0);
32+
33+
clear_bit(queue, qdma->qos_channel_map);
34+
clear_bit(queue, dev->qos_sq_bmap);

0 commit comments

Comments
 (0)