qca8k_mii_write32() ignores errors from both 16-bit half-word writes. Its callers (register writes and read-modify-write helpers) then return the earlier successful page selection or read result, incorrectly reporting success even when writing the switch register failed. Propagate write errors from both the low and high half-words through the regmap paths and internal MDIO master transactions. Attempt to clear MASTER_EN even if a transaction fails, preserving the initial error, and report a cleanup failure if the transaction itself succeeded. Preserve the existing Ethernet-to-MDIO fallback order. Propagate read errors through the internal and legacy MDIO bus callbacks instead of masking them as 0xffff. Returning 0xffff causes PHY read-modify-write callers to treat the failed read as valid register data, which can corrupt unrelated bits on writeback. Stop polling when reading the MDIO busy status fails, and return the error immediately. Because the read helper clears its output on failure, checking only the BUSY bit mistakes an unsuccessful read for transaction completion. Code inspection found these problems. Fault injection into a userspace model of the driver's functions reproduces them; the corresponding cases pass after this change. qca8k_mii_write32() has not returned write errors since its introduction in commit 6b93fb46480a ("net-next: dsa: add new driver for qca8xxx family"). Signed-off-by: Yongzhao Chen Assisted-by: LLM --- v3: - Target net-next and drop the Fixes: tag: no actual MDIO error has been reported. The commit that introduced the problem is named in the text. - Order local variable declarations in reverse Christmas tree order. v2: - Removed the blank line between the Fixes: tag and the other trailers. - Cc John Crispin, author of the commit named in the Fixes: tag. v1: https://lore.kernel.org/netdev/20260923215748.1336-1-yongzhao.derek@gmail.com/ drivers/net/dsa/qca/qca8k-8xxx.c | 53 +++++++++++++++++--------------- 1 file changed, 29 insertions(+), 24 deletions(-) diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c index 60f2a615a5c..b73c7c52e0f 100644 --- a/drivers/net/dsa/qca/qca8k-8xxx.c +++ b/drivers/net/dsa/qca/qca8k-8xxx.c @@ -129,13 +129,16 @@ qca8k_mii_read32(struct mii_bus *bus, int phy_id, u32 regnum, u32 *val) return ret; } -static void +static int qca8k_mii_write32(struct mii_bus *bus, int phy_id, u32 regnum, u32 val) { - if (qca8k_mii_write_lo(bus, phy_id, regnum, val) < 0) - return; + int ret; + + ret = qca8k_mii_write_lo(bus, phy_id, regnum, val); + if (ret < 0) + return ret; - qca8k_mii_write_hi(bus, phy_id, regnum + 1, val); + return qca8k_mii_write_hi(bus, phy_id, regnum + 1, val); } static int @@ -462,7 +465,7 @@ qca8k_write_mii(struct qca8k_priv *priv, uint32_t reg, uint32_t val) if (ret < 0) goto exit; - qca8k_mii_write32(bus, 0x10 | r2, r1, val); + ret = qca8k_mii_write32(bus, 0x10 | r2, r1, val); exit: mutex_unlock(&bus->mdio_lock); @@ -492,7 +495,7 @@ qca8k_regmap_update_bits_mii(struct qca8k_priv *priv, uint32_t reg, val &= ~mask; val |= write_val; - qca8k_mii_write32(bus, 0x10 | r2, r1, val); + ret = qca8k_mii_write32(bus, 0x10 | r2, r1, val); exit: mutex_unlock(&bus->mdio_lock); @@ -794,19 +797,18 @@ static int qca8k_mdio_busy_wait(struct mii_bus *bus, u32 reg, u32 mask) { u16 r1, r2, page; - u32 val; int ret, ret1; + u32 val; qca8k_split_addr(reg, &r1, &r2, &page); - ret = read_poll_timeout(qca8k_mii_read_hi, ret1, !(val & mask), 0, + ret = read_poll_timeout(qca8k_mii_read_hi, ret1, + ret1 < 0 || !(val & mask), 0, QCA8K_BUSY_WAIT_TIMEOUT * USEC_PER_MSEC, false, bus, 0x10 | r2, r1 + 1, &val); - /* Check if qca8k_read has failed for a different reason - * before returnting -ETIMEDOUT - */ - if (ret < 0 && ret1 < 0) + /* Preserve an MDIO read error instead of treating it as ready. */ + if (ret1 < 0) return ret1; return ret; @@ -817,8 +819,8 @@ qca8k_mdio_write(struct qca8k_priv *priv, int phy, int regnum, u16 data) { struct mii_bus *bus = priv->bus; u16 r1, r2, page; + int ret, ret1; u32 val; - int ret; if (regnum >= QCA8K_MDIO_MASTER_MAX_REG) return -EINVAL; @@ -836,14 +838,18 @@ qca8k_mdio_write(struct qca8k_priv *priv, int phy, int regnum, u16 data) if (ret) goto exit; - qca8k_mii_write32(bus, 0x10 | r2, r1, val); + ret = qca8k_mii_write32(bus, 0x10 | r2, r1, val); + if (ret < 0) + goto exit; ret = qca8k_mdio_busy_wait(bus, QCA8K_MDIO_MASTER_CTRL, QCA8K_MDIO_MASTER_BUSY); exit: /* even if the busy_wait timeouts try to clear the MASTER_EN */ - qca8k_mii_write_hi(bus, 0x10 | r2, r1 + 1, 0); + ret1 = qca8k_mii_write_hi(bus, 0x10 | r2, r1 + 1, 0); + if (!ret) + ret = ret1; mutex_unlock(&bus->mdio_lock); @@ -855,8 +861,8 @@ qca8k_mdio_read(struct qca8k_priv *priv, int phy, int regnum) { struct mii_bus *bus = priv->bus; u16 r1, r2, page; + int ret, ret1; u32 val; - int ret; if (regnum >= QCA8K_MDIO_MASTER_MAX_REG) return -EINVAL; @@ -873,7 +879,9 @@ qca8k_mdio_read(struct qca8k_priv *priv, int phy, int regnum) if (ret) goto exit; - qca8k_mii_write_hi(bus, 0x10 | r2, r1 + 1, val); + ret = qca8k_mii_write_hi(bus, 0x10 | r2, r1 + 1, val); + if (ret < 0) + goto exit; ret = qca8k_mdio_busy_wait(bus, QCA8K_MDIO_MASTER_CTRL, QCA8K_MDIO_MASTER_BUSY); @@ -884,7 +892,9 @@ qca8k_mdio_read(struct qca8k_priv *priv, int phy, int regnum) exit: /* even if the busy_wait timeouts try to clear the MASTER_EN */ - qca8k_mii_write_hi(bus, 0x10 | r2, r1 + 1, 0); + ret1 = qca8k_mii_write_hi(bus, 0x10 | r2, r1 + 1, 0); + if (!ret) + ret = ret1; mutex_unlock(&bus->mdio_lock); @@ -919,12 +929,7 @@ qca8k_internal_mdio_read(struct mii_bus *slave_bus, int phy, int regnum) if (ret >= 0) return ret; - ret = qca8k_mdio_read(priv, phy, regnum); - - if (ret < 0) - return 0xffff; - - return ret; + return qca8k_mdio_read(priv, phy, regnum); } static int -- 2.43.0