From a2e12d759c3b3669b6318ab54457559d2cd1679e Mon Sep 17 00:00:00 2001
From: Fengyan Mu <mufengyan@huawei.com>
Date: Thu, 20 Nov 2025 10:20:15 +0800
Subject: [PATCH 01/11] ub: ubase: Fix priqos infomaton interface functions to
 query and check sl_bitmap

drivers inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/ID7LHB
CVE: NA

--------------------------------------------------------------

Previously, in the function 'ubase_get_priqos_info', the input
parameter 'sl_priqos->sl_bitmap' was assumed to be provided by
the caller. However, the caller doesn't know which SLs can be used.
Therefore, this patch sets 'sl_priqos->sl_bitmap' to the union of
SLs supported by UNIC and UDMA. And, in the function
'ubase_set_priqos_info', a check process for the input parameter
'sl_priqos->sl_bitmap' is added to ensure that the corresponding
SLs in sl_bitmap are those supported by UNIC or UDMA.

Fixes: 38f3f5d80a6d ("ub: ubase: Added QoS and traffic management debugging features")
Signed-off-by: Zhang Lei <zhanglei917@huawei.com>
Signed-off-by: Fengyan Mu <mufengyan@huawei.com>
---
 drivers/ub/ubase/ubase_dev.h    |  1 -
 drivers/ub/ubase/ubase_qos_hw.c | 36 ++++++++++++++++++++++++++++++++-
 2 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/drivers/ub/ubase/ubase_dev.h b/drivers/ub/ubase/ubase_dev.h
index d32d9fb98377..c8ccd5bd107a 100644
--- a/drivers/ub/ubase/ubase_dev.h
+++ b/drivers/ub/ubase/ubase_dev.h
@@ -429,7 +429,6 @@ static inline u32 ubase_ta_timer_align_size(struct ubase_dev *udev)
 static inline bool ubase_mbx_ue_id_is_valid(u16 mbx_ue_id,
 					    struct ubase_dev *udev)
 {
-
 	if (!mbx_ue_id || (mbx_ue_id > udev->caps.dev_caps.ue_num - 1))
 		return false;
 
diff --git a/drivers/ub/ubase/ubase_qos_hw.c b/drivers/ub/ubase/ubase_qos_hw.c
index 5a5881f79547..bfd5c4e0f5c1 100644
--- a/drivers/ub/ubase/ubase_qos_hw.c
+++ b/drivers/ub/ubase/ubase_qos_hw.c
@@ -409,6 +409,36 @@ int ubase_query_fst_fvt_rqmt(struct ubase_dev *udev,
 	return ret;
 }
 
+static unsigned long ubase_get_sl_bitmap(struct ubase_dev *udev)
+{
+	struct ubase_adev_qos *qos = &udev->qos;
+	unsigned long sl_bitmap = 0;
+	u8 i;
+
+	for (i = 0; i < qos->nic_sl_num; i++)
+		sl_bitmap |= 1 << qos->nic_sl[i];
+	for (i = 0; i < qos->sl_num; i++)
+		sl_bitmap |= 1 << qos->sl[i];
+
+	return sl_bitmap;
+}
+
+static int ubase_check_sl_bitmap(struct ubase_dev *udev, unsigned long sl_bitmap)
+{
+	unsigned long sl_bitmap_cap;
+	u8 i;
+
+	sl_bitmap_cap = ubase_get_sl_bitmap(udev);
+	for (i = 0; i < UBASE_MAX_SL_NUM; i++) {
+		if (!test_bit(i, &sl_bitmap))
+			continue;
+		if (!test_bit(i, &sl_bitmap_cap))
+			return -EINVAL;
+	}
+
+	return 0;
+}
+
 int ubase_check_qos_sch_param(struct auxiliary_device *adev, u16 vl_bitmap,
 			      u8 *vl_bw, u8 *vl_tsa, bool is_ets)
 {
@@ -447,6 +477,9 @@ int ubase_set_priqos_info(struct device *dev, struct ubase_sl_priqos *sl_priqos)
 
 	udev = dev_get_drvdata(dev);
 
+	if (ubase_check_sl_bitmap(udev, sl_priqos->sl_bitmap))
+		return -EINVAL;
+
 	if (sl_priqos->port_bitmap)
 		return ubase_set_ets_priqos(udev, sl_priqos);
 
@@ -458,11 +491,12 @@ int ubase_get_priqos_info(struct device *dev, struct ubase_sl_priqos *sl_priqos)
 {
 	struct ubase_dev *udev;
 
-	if (!dev || !sl_priqos || !sl_priqos->sl_bitmap)
+	if (!dev || !sl_priqos)
 		return -EINVAL;
 
 	udev = dev_get_drvdata(dev);
 
+	sl_priqos->sl_bitmap = ubase_get_sl_bitmap(udev);
 	if (sl_priqos->port_bitmap)
 		return ubase_get_ets_priqos(udev, sl_priqos);
 
-- 
Gitee


From 313470c59d7f1158d832074319e35b823e4ccd29 Mon Sep 17 00:00:00 2001
From: Fengyan Mu <mufengyan@huawei.com>
Date: Thu, 20 Nov 2025 10:34:28 +0800
Subject: [PATCH 02/11] ub: ubase: add CMDQ&CTRLQ compatibility code

drivers inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/ID7LHB
CVE: NA

------------------------------------------------------------------

The ubase driver and firmware communicate through the CMDQ interface,
which needs to be forward and backward compatible. When pairing
new drivers with old firmware or old drivers with new firmware,
it is essential to ensure that the program can still work.
Therefore, some compatibility design needs to be done in advance,
and the relevant interfaces should be implemented. In subsequent
versions, the predefined compatibility plan should be followed
to handle these scenarios.

Specifically, during the ubase dev probe, the driver first queries
the firmware for the chip version using a message with opcode 0x0001.
It then informs the firmware of its supported feature capability set
through a message with opcode 0x0007.
Subsequently, it queries the firmware for the feature capability
sets supported by both the chip and the firmware using a message
with opcode 0x0030.
These commands could ensure backward and forward compatibility.

In the CTRLQ interface, the version number check is addedd. If the
version is not supported or the command is not supported, an error
response of EOPNOTSUPP is returned.

In the CMDQ interface, we removed some obsolete capability bit
definitions and interface parameters. And optimized the code for
handling scenarios where firmware returns an unauthorized error.

In the CTRLQ interface, we add an version number check for requests
coming from the control plane.

By the way, we have also optimized the parameters of some commands.

Fixes: 8d68017f37fa ("ub: ubase: support for command process")
Signed-off-by: Chuan Wu <wuchuan4@huawei.com>
Signed-off-by: Fengyan Mu <mufengyan@huawei.com>
---
 drivers/net/ub/unic/debugfs/unic_debugfs.c |  1 -
 drivers/net/ub/unic/unic.h                 |  5 ---
 drivers/net/ub/unic/unic_cmd.h             |  2 +-
 drivers/net/ub/unic/unic_dev.c             | 21 ++++-------
 drivers/net/ub/unic/unic_dev.h             |  5 ---
 drivers/net/ub/unic/unic_ethtool.c         |  3 --
 drivers/net/ub/unic/unic_hw.c              | 14 +++----
 drivers/net/ub/unic/unic_qos_hw.c          |  3 +-
 drivers/net/ub/unic/unic_rack_ip.c         |  7 +++-
 drivers/net/ub/unic/unic_stats.c           | 29 ++++++--------
 drivers/ub/ubase/debugfs/ubase_debugfs.c   | 10 +----
 drivers/ub/ubase/ubase_cmd.c               | 16 ++++----
 drivers/ub/ubase/ubase_cmd.h               | 18 ++++++---
 drivers/ub/ubase/ubase_ctrlq.c             | 41 +++++++++++++++++---
 drivers/ub/ubase/ubase_dev.c               | 22 ++++++++---
 drivers/ub/ubase/ubase_hw.c                | 10 ++---
 drivers/ub/ubase/ubase_hw.h                | 44 +++++++++-------------
 drivers/ub/ubase/ubase_qos_hw.c            |  9 ++---
 include/ub/ubase/ubase_comm_cmd.h          |  1 +
 include/ub/ubase/ubase_comm_dev.h          |  5 ---
 20 files changed, 132 insertions(+), 134 deletions(-)

diff --git a/drivers/net/ub/unic/debugfs/unic_debugfs.c b/drivers/net/ub/unic/debugfs/unic_debugfs.c
index 63703934613d..0a6dbdaffedc 100644
--- a/drivers/net/ub/unic/debugfs/unic_debugfs.c
+++ b/drivers/net/ub/unic/debugfs/unic_debugfs.c
@@ -46,7 +46,6 @@ static const struct unic_dbg_cap_bit_info {
 	{"\tsupport_ubl: %u\n", &unic_dev_ubl_supported},
 	{"\tsupport_ets: %u\n", &unic_dev_ets_supported},
 	{"\tsupport_fec: %u\n", &unic_dev_fec_supported},
-	{"\tsupport_rss: %u\n", &unic_dev_rss_supported},
 	{"\tsupport_tc_speed_limit: %u\n", &unic_dev_tc_speed_limit_supported},
 	{"\tsupport_tx_csum_offload: %u\n", &unic_dev_tx_csum_offload_supported},
 	{"\tsupport_rx_csum_offload: %u\n", &unic_dev_rx_csum_offload_supported},
diff --git a/drivers/net/ub/unic/unic.h b/drivers/net/ub/unic/unic.h
index 7f6572c50a0c..e63ee6e900ff 100644
--- a/drivers/net/ub/unic/unic.h
+++ b/drivers/net/ub/unic/unic.h
@@ -20,16 +20,11 @@ enum {
 	UNIC_SUPPORT_ETS_B		= 1,
 	UNIC_SUPPORT_FEC_B		= 2,
 	UNIC_SUPPORT_PAUSE_B		= 3,
-	UNIC_SUPPORT_GRO_B		= 5,
 	UNIC_SUPPORT_ETH_B		= 7,
 
-	UNIC_SUPPORT_TSO_B			= 8,
-	UNIC_SUPPORT_RSS_B			= 9,
 	UNIC_SUPPORT_SERIAL_SERDES_LB_B		= 10,
 	UNIC_SUPPORT_TC_SPEED_LIMIT_B		= 12,
 	UNIC_SUPPORT_TX_CSUM_OFFLOAD_B		= 13,
-	UNIC_SUPPORT_TUNNEL_CSUM_OFFLOAD_B	= 14,
-	UNIC_SUPPORT_PTP_B			= 15,
 
 	UNIC_SUPPORT_RX_CSUM_OFFLOAD_B		= 16,
 	UNIC_SUPPORT_APP_LB_B			= 17,
diff --git a/drivers/net/ub/unic/unic_cmd.h b/drivers/net/ub/unic/unic_cmd.h
index bf3e11e343cd..125802234e6b 100644
--- a/drivers/net/ub/unic/unic_cmd.h
+++ b/drivers/net/ub/unic/unic_cmd.h
@@ -150,7 +150,7 @@ struct unic_config_vl_map_cmd {
 };
 
 struct unic_config_vl_speed_cmd {
-	__le16 bus_ue_id;
+	u8 resv0[2];
 	__le16 vl_bitmap;
 	__le32 max_speed[UBASE_MAX_VL_NUM];
 	u8 resv1[20];
diff --git a/drivers/net/ub/unic/unic_dev.c b/drivers/net/ub/unic/unic_dev.c
index ef79194c24bb..f8d5676bfc1f 100644
--- a/drivers/net/ub/unic/unic_dev.c
+++ b/drivers/net/ub/unic/unic_dev.c
@@ -248,10 +248,12 @@ static int unic_init_vl_info(struct unic_dev *unic_dev)
 		return ret;
 
 	ret = unic_init_vl_maxrate(unic_dev);
-	if (ret)
+	if (ret && ret != -EPERM)
 		return ret;
 
-	return unic_init_vl_sch(unic_dev);
+	ret = unic_init_vl_sch(unic_dev);
+
+	return ret == -EPERM ? 0 : ret;
 }
 
 static int unic_init_channels_attr(struct unic_dev *unic_dev)
@@ -559,17 +561,12 @@ static int unic_dev_init_mtu(struct unic_dev *unic_dev)
 {
 	struct net_device *netdev = unic_dev->comdev.netdev;
 	struct unic_caps *caps = &unic_dev->caps;
-	int ret;
 
 	netdev->mtu = UB_DATA_LEN;
 	netdev->max_mtu = caps->max_trans_unit;
 	netdev->min_mtu = caps->min_trans_unit;
 
-	ret = unic_config_mtu(unic_dev, netdev->mtu);
-	if (ret == -EPERM)
-		return 0;
-
-	return ret;
+	return unic_config_mtu(unic_dev, netdev->mtu);
 }
 
 static int unic_init_mac(struct unic_dev *unic_dev)
@@ -583,11 +580,11 @@ static int unic_init_mac(struct unic_dev *unic_dev)
 
 	ret = unic_set_mac_speed_duplex(unic_dev, mac->speed, mac->duplex,
 					mac->lanes);
-	if (ret && ret != -EPERM)
+	if (ret)
 		return ret;
 
 	ret = unic_set_mac_autoneg(unic_dev, mac->autoneg);
-	if (ret && ret != -EPERM)
+	if (ret)
 		return ret;
 
 	ret = unic_dev_fec_supported(unic_dev) && mac->user_fec_mode ?
@@ -621,9 +618,7 @@ int unic_set_mtu(struct unic_dev *unic_dev, int new_mtu)
 	new_mtu = max(new_mtu, UB_DATA_LEN);
 
 	ret = unic_check_validate_dump_mtu(unic_dev, new_mtu, &max_frame_size);
-	if (ret == -EPERM) {
-		return 0;
-	} else if (ret < 0) {
+	if (ret) {
 		unic_err(unic_dev, "invalid MTU(%d), please check, ret = %d.\n",
 			 new_mtu, ret);
 		return -EINVAL;
diff --git a/drivers/net/ub/unic/unic_dev.h b/drivers/net/ub/unic/unic_dev.h
index a20744b810e8..51708850e38d 100644
--- a/drivers/net/ub/unic/unic_dev.h
+++ b/drivers/net/ub/unic/unic_dev.h
@@ -293,11 +293,6 @@ static inline bool unic_dev_fec_supported(struct unic_dev *unic_dev)
 	return unic_get_cap_bit(unic_dev, UNIC_SUPPORT_FEC_B);
 }
 
-static inline bool unic_dev_rss_supported(struct unic_dev *unic_dev)
-{
-	return unic_get_cap_bit(unic_dev, UNIC_SUPPORT_RSS_B);
-}
-
 static inline bool unic_dev_tc_speed_limit_supported(struct unic_dev *unic_dev)
 {
 	return unic_get_cap_bit(unic_dev, UNIC_SUPPORT_TC_SPEED_LIMIT_B);
diff --git a/drivers/net/ub/unic/unic_ethtool.c b/drivers/net/ub/unic/unic_ethtool.c
index c9593ba74fe4..22f530c45107 100644
--- a/drivers/net/ub/unic/unic_ethtool.c
+++ b/drivers/net/ub/unic/unic_ethtool.c
@@ -67,9 +67,6 @@ static int unic_get_fecparam(struct net_device *ndev,
 	struct unic_dev *unic_dev = netdev_priv(ndev);
 	struct unic_mac *mac = &unic_dev->hw.mac;
 
-	if (!unic_dev_fec_supported(unic_dev))
-		return -EOPNOTSUPP;
-
 	fec->fec = mac->fec_ability;
 	fec->active_fec = mac->fec_mode;
 
diff --git a/drivers/net/ub/unic/unic_hw.c b/drivers/net/ub/unic/unic_hw.c
index d2b7026514c4..be606bfb6495 100644
--- a/drivers/net/ub/unic/unic_hw.c
+++ b/drivers/net/ub/unic/unic_hw.c
@@ -76,7 +76,7 @@ int unic_set_mac_autoneg(struct unic_dev *unic_dev, u8 autoneg)
 			     sizeof(req), &req);
 
 	ret = ubase_cmd_send_in(unic_dev->comdev.adev, &in);
-	if (ret && ret != -EPERM)
+	if (ret)
 		dev_err(unic_dev->comdev.adev->dev.parent,
 			"failed to send cmd in config autoneg(%u), ret = %d.\n",
 			autoneg, ret);
@@ -105,7 +105,7 @@ int unic_set_mac_speed_duplex(struct unic_dev *unic_dev, u32 speed, u8 duplex,
 			     sizeof(req), &req);
 
 	ret = ubase_cmd_send_in(unic_dev->comdev.adev, &in);
-	if (ret && ret != -EPERM)
+	if (ret)
 		dev_err(unic_dev->comdev.adev->dev.parent,
 			"failed to send cmd in config speed(%u), ret = %d.\n",
 			speed, ret);
@@ -334,9 +334,7 @@ int unic_set_promisc_mode(struct unic_dev *unic_dev,
 
 	time_out = unic_cmd_timeout(unic_dev);
 	ret = ubase_cmd_send_in_ex(adev, &in, time_out);
-	if (ret == -EPERM)
-		return 0;
-	else if (ret)
+	if (ret)
 		unic_err(unic_dev,
 			 "failed to set promisc mode, ret = %d.\n", ret);
 
@@ -561,15 +559,15 @@ static int unic_query_flush_status(struct unic_dev *unic_dev, u8 *status)
 	struct ubase_cmd_buf in;
 	int ret;
 
+	if (unic_dev_ubl_supported(unic_dev))
+		return -EOPNOTSUPP;
+
 	ubase_fill_inout_buf(&in, UBASE_OPC_QUERY_FLUSH_STATUS, true, 0, NULL);
 	ubase_fill_inout_buf(&out, UBASE_OPC_QUERY_FLUSH_STATUS, false,
 			     sizeof(resp), &resp);
 
 	ret = ubase_cmd_send_inout(unic_dev->comdev.adev, &in, &out);
 	if (ret) {
-		if (ret == -EPERM)
-			return -EOPNOTSUPP;
-
 		unic_err(unic_dev,
 			 "failed to send cmd when query flush status, ret = %d.\n",
 			 ret);
diff --git a/drivers/net/ub/unic/unic_qos_hw.c b/drivers/net/ub/unic/unic_qos_hw.c
index 79fb7271c08e..bba05964156b 100644
--- a/drivers/net/ub/unic/unic_qos_hw.c
+++ b/drivers/net/ub/unic/unic_qos_hw.c
@@ -59,7 +59,6 @@ int unic_config_vl_rate_limit(struct unic_dev *unic_dev, u64 *vl_maxrate,
 	u32 vl_rate;
 	int i, ret;
 
-	req.bus_ue_id = cpu_to_le16(USHRT_MAX);
 	req.vl_bitmap = cpu_to_le16(vl_bitmap);
 	for (i = 0; i < caps->vl_num; i++) {
 		vl_rate = vl_maxrate[i] / UNIC_MBYTE_PER_SEND;
@@ -72,7 +71,7 @@ int unic_config_vl_rate_limit(struct unic_dev *unic_dev, u64 *vl_maxrate,
 			     sizeof(req), &req);
 
 	ret = ubase_cmd_send_in(adev, &in);
-	if (ret)
+	if (ret && ret != -EPERM)
 		dev_err(adev->dev.parent,
 			"failed to config vl rate limit, ret = %d.\n", ret);
 
diff --git a/drivers/net/ub/unic/unic_rack_ip.c b/drivers/net/ub/unic/unic_rack_ip.c
index f2ff97304e78..529856dcff73 100644
--- a/drivers/net/ub/unic/unic_rack_ip.c
+++ b/drivers/net/ub/unic/unic_rack_ip.c
@@ -41,7 +41,7 @@ static void unic_update_rack_addr_state(struct unic_vport *vport,
 			addr_node->state = UNIC_COMM_ADDR_TO_ADD;
 			unic_format_masked_ip_addr(format_masked_ip_addr, addr);
 			unic_info(unic_dev,
-				  "deleted an existing ip %s by accident and need to add it.\n",
+				  "stack deleted an planned ip %s, need to re-add it.\n",
 				  format_masked_ip_addr);
 		}
 		break;
@@ -90,7 +90,7 @@ static int unic_update_stack_ip_addr(struct unic_vport *vport,
 	list_add_tail(&addr_node->node, list);
 	unic_format_masked_ip_addr(format_masked_ip_addr, addr);
 	unic_info(unic_dev,
-		  "added a new ip %s by accident and need to delete it.\n",
+		  "stack added a non-planned ip %s, need to delete it.\n",
 		  format_masked_ip_addr);
 	set_bit(UNIC_VPORT_STATE_IP_TBL_CHANGE, &vport->state);
 	goto unlock_and_exit;
@@ -469,6 +469,9 @@ int unic_handle_notify_ip_event(struct auxiliary_device *adev, u8 service_ver,
 	struct unic_stack_ip_info st_ip;
 	int ret;
 
+	if (service_ver != UBASE_CTRLQ_SER_VER_01)
+		return -EOPNOTSUPP;
+
 	if (len < sizeof(*req)) {
 		unic_err(priv, "failed to verify ip info size, len = %u.\n", len);
 		return -EINVAL;
diff --git a/drivers/net/ub/unic/unic_stats.c b/drivers/net/ub/unic/unic_stats.c
index dcefeab1bb2d..d8ccd1876500 100644
--- a/drivers/net/ub/unic/unic_stats.c
+++ b/drivers/net/ub/unic/unic_stats.c
@@ -88,7 +88,7 @@ static int unic_get_dfx_reg_num(struct unic_dev *unic_dev, u32 *reg_num,
 	ubase_fill_inout_buf(&out, UBASE_OPC_DFX_REG_NUM, true,
 			     reg_arr_size * sizeof(u32), reg_num);
 	ret = ubase_cmd_send_inout(unic_dev->comdev.adev, &in, &out);
-	if (ret && ret != -EPERM)
+	if (ret)
 		unic_err(unic_dev,
 			 "failed to query dfx reg num, ret = %d.\n", ret);
 
@@ -149,17 +149,13 @@ int unic_get_regs_len(struct net_device *netdev)
 		return -ENOMEM;
 
 	ret = unic_get_dfx_reg_num(unic_dev, reg_num, reg_arr_size);
-	if (!ret) {
-		count += unic_get_dfx_regs_len(unic_dev, unic_dfx_reg_arr,
-					       reg_arr_size, reg_num);
-	} else if (ret != -EPERM) {
-		unic_err(unic_dev,
-			 "failed to get dfx regs length, ret = %d.\n", ret);
+	if (ret) {
 		kfree(reg_num);
-
 		return -EBUSY;
 	}
 
+	count += unic_get_dfx_regs_len(unic_dev, unic_dfx_reg_arr,
+				       reg_arr_size, reg_num);
 	kfree(reg_num);
 
 	return count;
@@ -286,17 +282,16 @@ void unic_get_regs(struct net_device *netdev, struct ethtool_regs *cmd,
 
 	pdata += unic_get_res_regs(unic_dev, pdata);
 	ret = unic_get_dfx_reg_num(unic_dev, reg_num, reg_arr_size);
-	if (!ret) {
-		ret = unic_get_dfx_regs(unic_dev, pdata, unic_dfx_reg_arr,
-					reg_arr_size, reg_num);
-		if (ret)
-			unic_err(unic_dev,
-				 "failed to get dfx regs, ret = %d.\n", ret);
-	} else if (ret != -EPERM) {
-		unic_err(unic_dev,
-			 "failed to get dfx reg num, ret = %d.\n", ret);
+	if (ret) {
+		kfree(reg_num);
+		return;
 	}
 
+	ret = unic_get_dfx_regs(unic_dev, pdata, unic_dfx_reg_arr,
+				reg_arr_size, reg_num);
+	if (ret)
+		unic_err(unic_dev, "failed to get dfx regs, ret = %d.\n", ret);
+
 	kfree(reg_num);
 }
 
diff --git a/drivers/ub/ubase/debugfs/ubase_debugfs.c b/drivers/ub/ubase/debugfs/ubase_debugfs.c
index ad97d7a58188..bf49fc3fdc93 100644
--- a/drivers/ub/ubase/debugfs/ubase_debugfs.c
+++ b/drivers/ub/ubase/debugfs/ubase_debugfs.c
@@ -94,6 +94,7 @@ static void ubase_dbg_dump_caps_info(struct seq_file *s, struct ubase_dev *udev)
 		{"\tdie_id: %u\n", dev_caps->die_id},
 		{"\tue_id: %u\n", dev_caps->ue_id},
 		{"\tnl_id: %u\n", dev_caps->nl_id},
+		{"\tfw_version: %u\n", dev_caps->fw_version},
 	};
 	int i;
 
@@ -123,29 +124,20 @@ static void ubase_dbg_dump_adev_caps(struct seq_file *s,
 		u32 caps_info;
 	} ubase_adev_caps_info[] = {
 		{"\tjfs_max_cnt: %u\n", caps->jfs.max_cnt},
-		{"\tjfs_reserved_cnt: %u\n", caps->jfs.reserved_cnt},
 		{"\tjfs_depth: %u\n", caps->jfs.depth},
 		{"\tjfr_max_cnt: %u\n", caps->jfr.max_cnt},
-		{"\tjfr_reserved_cnt: %u\n", caps->jfr.reserved_cnt},
 		{"\tjfr_depth: %u\n", caps->jfr.depth},
 		{"\tjfc_max_cnt: %u\n", caps->jfc.max_cnt},
-		{"\tjfc_reserved_cnt: %u\n", caps->jfc.reserved_cnt},
 		{"\tjfc_depth: %u\n", caps->jfc.depth},
 		{"\ttp_max_cnt: %u\n", caps->tp.max_cnt},
-		{"\ttp_reserved_cnt: %u\n", caps->tp.reserved_cnt},
 		{"\ttp_depth: %u\n", caps->tp.depth},
 		{"\ttpg_max_cnt: %u\n", caps->tpg.max_cnt},
-		{"\ttpg_reserved_cnt: %u\n", caps->tpg.reserved_cnt},
 		{"\ttpg_depth: %u\n", caps->tpg.depth},
 		{"\tcqe_size: %hu\n", caps->cqe_size},
 		{"\tutp_port_bitmap: 0x%x\n", caps->utp_port_bitmap},
 		{"\tjtg_max_cnt: %u\n", caps->jtg_max_cnt},
 		{"\trc_max_cnt: %u\n", caps->rc_max_cnt},
 		{"\trc_depth: %u\n", caps->rc_que_depth},
-		{"\tccc_max_cnt: %u\n", caps->ccc_max_cnt},
-		{"\tdest_addr_max_cnt: %u\n", caps->dest_addr_max_cnt},
-		{"\tseid_upi_max_cnt: %u\n", caps->seid_upi_max_cnt},
-		{"\ttpm_max_cnt: %u\n", caps->tpm_max_cnt},
 		{"\tprealloc_mem_dma_len: %llu\n", caps->pmem.dma_len},
 	};
 	int i;
diff --git a/drivers/ub/ubase/ubase_cmd.c b/drivers/ub/ubase/ubase_cmd.c
index 4526f92ac117..4eedb6eff530 100644
--- a/drivers/ub/ubase/ubase_cmd.c
+++ b/drivers/ub/ubase/ubase_cmd.c
@@ -306,10 +306,11 @@ int ubase_send_cmd(struct ubase_dev *udev,
 	return ret;
 }
 
-static int ubase_cmd_query_version(struct ubase_dev *udev, u32 *fw_version)
+static int ubase_cmd_query_version(struct ubase_dev *udev)
 {
 	struct ubase_query_version_cmd *resp;
 	struct ubase_cmdq_desc desc;
+	u32 fw_ver;
 	int ret;
 
 	ubase_cmd_setup_basic_desc(&desc, UBASE_OPC_QUERY_FW_VER, true, 1);
@@ -321,13 +322,14 @@ static int ubase_cmd_query_version(struct ubase_dev *udev, u32 *fw_version)
 	}
 
 	resp = (struct ubase_query_version_cmd *)desc.data;
-	*fw_version = le32_to_cpu(resp->firmware);
+	udev->caps.dev_caps.fw_version = le32_to_cpu(resp->fw_version);
+	fw_ver = udev->caps.dev_caps.fw_version;
 
 	ubase_info(udev, "The firmware version is %u.%u.%u.%u\n",
-		   u32_get_bits(*fw_version, UBASE_FW_VERSION_BYTE3_MASK),
-		   u32_get_bits(*fw_version, UBASE_FW_VERSION_BYTE2_MASK),
-		   u32_get_bits(*fw_version, UBASE_FW_VERSION_BYTE1_MASK),
-		   u32_get_bits(*fw_version, UBASE_FW_VERSION_BYTE0_MASK));
+		   u32_get_bits(fw_ver, UBASE_FW_VERSION_BYTE3_MASK),
+		   u32_get_bits(fw_ver, UBASE_FW_VERSION_BYTE2_MASK),
+		   u32_get_bits(fw_ver, UBASE_FW_VERSION_BYTE1_MASK),
+		   u32_get_bits(fw_ver, UBASE_FW_VERSION_BYTE0_MASK));
 
 	return 0;
 }
@@ -366,7 +368,7 @@ int ubase_cmd_init(struct ubase_dev *udev)
 
 	clear_bit(UBASE_STATE_CMD_DISABLE, &udev->hw.state);
 
-	ret = ubase_cmd_query_version(udev, &udev->caps.dev_caps.fw_version);
+	ret = ubase_cmd_query_version(udev);
 	if (ret)
 		goto err_query_version;
 
diff --git a/drivers/ub/ubase/ubase_cmd.h b/drivers/ub/ubase/ubase_cmd.h
index 63b67179f2fb..263e88c9fa49 100644
--- a/drivers/ub/ubase/ubase_cmd.h
+++ b/drivers/ub/ubase/ubase_cmd.h
@@ -43,10 +43,16 @@ enum ubase_cmd_state {
 };
 
 struct ubase_query_version_cmd {
-	__le32 firmware;
-	__le32 hardware;
-	__le32 rsv;
-	__le32 caps[UBASE_CAP_LEN];
+	__le32	fw_version;
+	u8	rsv[20];
+};
+
+enum ubase_drv_cap_bit {
+	UBASE_CAP_SUP_ACTIVATE_B = 0,
+};
+
+struct ubase_notify_drv_cap_cmd {
+	u8	cap_bits[24]; /* see ubase_drv_cap_bit */
 };
 
 #define UBASE_UBCL_CFG_DATA_ALIGN	4
@@ -106,10 +112,10 @@ struct ubase_cfg_ets_vl_sch_cmd {
 };
 
 struct ubase_cfg_tm_vl_sch_cmd {
-	__le16 bus_ue_id;
+	u8 rsvd0[2];
 	__le16 vl_bitmap;
 	__le16 vl_tsa;
-	u8 rsvd[2];
+	u8 rsvd1[2];
 	u8 vl_bw[UBASE_MAX_VL_NUM];
 };
 
diff --git a/drivers/ub/ubase/ubase_ctrlq.c b/drivers/ub/ubase/ubase_ctrlq.c
index d590463b0efc..b8d7681dd518 100644
--- a/drivers/ub/ubase/ubase_ctrlq.c
+++ b/drivers/ub/ubase/ubase_ctrlq.c
@@ -742,6 +742,32 @@ static void ubase_ctrlq_read_msg_data(struct ubase_dev *udev, u8 num, u8 *msg)
 	}
 }
 
+static void ubase_ctrlq_send_unsupported_resp(struct ubase_dev *udev,
+					      struct ubase_ctrlq_base_block *head,
+					      void *msg_data, u16 msg_data_len,
+					      u16 seq)
+{
+	struct ubase_ctrlq_msg msg = {0};
+	int ret;
+
+	msg.service_ver = head->service_ver;
+	msg.service_type = head->service_type;
+	msg.opcode = head->opcode;
+	msg.in_size = msg_data_len;
+	msg.in = msg_data;
+	msg.is_resp = 1;
+	msg.resp_seq = seq;
+	msg.resp_ret = EOPNOTSUPP;
+
+	ubase_info(udev, "ctrlq received unsupported req. seq=%u, ser_type=%d, ser_ver=%d, opc=%u.",
+		   seq, head->service_type, head->service_ver, head->opcode);
+
+	ret = __ubase_ctrlq_send(udev, &msg, NULL);
+	if (ret)
+		ubase_warn(udev, "failed to send ctrlq unsupported resp. seq=%u, ser_type=%d, ser_ver=%d, opc=%u.",
+			   seq, head->service_type, head->service_ver, head->opcode);
+}
+
 static void ubase_ctrlq_crq_event_callback(struct ubase_dev *udev,
 					   struct ubase_ctrlq_base_block *head,
 					   void *msg_data, u16 msg_data_len,
@@ -749,20 +775,25 @@ static void ubase_ctrlq_crq_event_callback(struct ubase_dev *udev,
 {
 	struct ubase_ctrlq_crq_table *crq_tab = &udev->ctrlq.crq_table;
 	struct ubase_ctrlq_crq_event_nbs *nbs;
+	int ret = -EOPNOTSUPP;
 
 	mutex_lock(&crq_tab->lock);
 	list_for_each_entry(nbs, &crq_tab->crq_nbs.list, list) {
 		if (nbs->crq_nb.service_type == head->service_type &&
 		    nbs->crq_nb.opcode == head->opcode) {
-			nbs->crq_nb.crq_handler(nbs->crq_nb.back,
-						head->service_ver,
-						msg_data,
-						msg_data_len,
-						seq);
+			ret = nbs->crq_nb.crq_handler(nbs->crq_nb.back,
+						      head->service_ver,
+						      msg_data,
+						      msg_data_len,
+						      seq);
 			break;
 		}
 	}
 	mutex_unlock(&crq_tab->lock);
+
+	if (ret == -EOPNOTSUPP)
+		ubase_ctrlq_send_unsupported_resp(udev, head, msg_data,
+						  msg_data_len, seq);
 }
 
 static void ubase_ctrlq_notify_completed(struct ubase_dev *udev,
diff --git a/drivers/ub/ubase/ubase_dev.c b/drivers/ub/ubase/ubase_dev.c
index 3921cd0ff824..fa61159d4295 100644
--- a/drivers/ub/ubase/ubase_dev.c
+++ b/drivers/ub/ubase/ubase_dev.c
@@ -454,11 +454,6 @@ static int ubase_handle_ue2ue_ctrlq_req(struct ubase_dev *udev,
 		return -EINVAL;
 	}
 
-	if (cmd->in_size > (len - (sizeof(*cmd) + UBASE_CTRLQ_HDR_LEN))) {
-		ubase_err(udev, "ubase e2e cmd len = %u error.\n", cmd->in_size);
-		return -EINVAL;
-	}
-
 	msg.service_ver = head->service_ver;
 	msg.service_type = head->service_type;
 	msg.opcode = head->opcode;
@@ -621,6 +616,19 @@ static int ubase_register_cmdq_crq_event(struct ubase_dev *udev)
 	return ret;
 }
 
+static int ubase_notify_drv_capbilities(struct ubase_dev *udev)
+{
+	struct ubase_notify_drv_cap_cmd req = {0};
+	struct ubase_cmd_buf in;
+
+	set_bit(UBASE_CAP_SUP_ACTIVATE_B, (unsigned long *)req.cap_bits);
+
+	__ubase_fill_inout_buf(&in, UBASE_OPC_NOTIFY_DRV_CAPS, false,
+			       sizeof(req), &req);
+
+	return __ubase_cmd_send_in(udev, &in);
+}
+
 static const struct ubase_init_function ubase_init_func_map[] = {
 	{
 		"init work queue", UBASE_SUP_ALL, 0,
@@ -630,6 +638,10 @@ static const struct ubase_init_function ubase_init_func_map[] = {
 		"init cmd queue", UBASE_SUP_ALL, 1,
 		ubase_cmd_init, ubase_cmd_uninit
 	},
+	{
+		"notify drv capbilities", UBASE_SUP_ALL, 0,
+		ubase_notify_drv_capbilities, NULL
+	},
 	{
 		"query dev res", UBASE_SUP_ALL, 0,
 		ubase_query_dev_res, NULL
diff --git a/drivers/ub/ubase/ubase_hw.c b/drivers/ub/ubase/ubase_hw.c
index d728dd47f116..290a03a74b0e 100644
--- a/drivers/ub/ubase/ubase_hw.c
+++ b/drivers/ub/ubase/ubase_hw.c
@@ -156,13 +156,10 @@ static void ubase_parse_dev_caps_unic(struct ubase_dev *udev,
 	struct ubase_adev_caps *unic_caps = &udev->caps.unic_caps;
 
 	unic_caps->jfs.max_cnt = le32_to_cpu(resp->nic_jfs_max_cnt);
-	unic_caps->jfs.reserved_cnt = le32_to_cpu(resp->nic_jfs_reserved_cnt);
 	unic_caps->jfs.depth = le32_to_cpu(resp->nic_jfs_depth);
 	unic_caps->jfr.max_cnt = le32_to_cpu(resp->nic_jfr_max_cnt);
-	unic_caps->jfr.reserved_cnt = le32_to_cpu(resp->nic_jfr_reserved_cnt);
 	unic_caps->jfr.depth = le32_to_cpu(resp->nic_jfr_depth);
 	unic_caps->jfc.max_cnt = le32_to_cpu(resp->nic_jfc_max_cnt);
-	unic_caps->jfc.reserved_cnt = le32_to_cpu(resp->nic_jfc_reserved_cnt);
 	unic_caps->jfc.depth = le32_to_cpu(resp->nic_jfc_depth);
 	unic_caps->cqe_size = le16_to_cpu(resp->nic_cqe_size);
 	unic_caps->utp_port_bitmap = le32_to_cpu(resp->port_bitmap);
@@ -174,13 +171,10 @@ static void ubase_parse_dev_caps_udma(struct ubase_dev *udev,
 	struct ubase_adev_caps *udma_caps = &udev->caps.udma_caps;
 
 	udma_caps->jfs.max_cnt = le32_to_cpu(resp->udma_jfs_max_cnt);
-	udma_caps->jfs.reserved_cnt = le32_to_cpu(resp->udma_jfs_reserved_cnt);
 	udma_caps->jfs.depth = le32_to_cpu(resp->udma_jfs_depth);
 	udma_caps->jfr.max_cnt = le32_to_cpu(resp->udma_jfr_max_cnt);
-	udma_caps->jfr.reserved_cnt = le32_to_cpu(resp->udma_jfr_reserved_cnt);
 	udma_caps->jfr.depth = le32_to_cpu(resp->udma_jfr_depth);
 	udma_caps->jfc.max_cnt = le32_to_cpu(resp->udma_jfc_max_cnt);
-	udma_caps->jfc.reserved_cnt = le32_to_cpu(resp->udma_jfc_reserved_cnt);
 	udma_caps->jfc.depth = le32_to_cpu(resp->udma_jfc_depth);
 	udma_caps->cqe_size = le16_to_cpu(resp->udma_cqe_size);
 	udma_caps->jtg_max_cnt = le32_to_cpu(resp->jtg_max_cnt);
@@ -951,7 +945,7 @@ int __ubase_perf_stats(struct ubase_dev *udev, u64 port_bitmap, u32 period,
 		       struct ubase_perf_stats_result *data, u32 data_size)
 {
 #define UBASE_MS_TO_US(ms) (1000 * (ms))
-	struct ubase_stop_perf_stats_cmd resp = {0};
+	struct ubase_stop_perf_stats_cmd resp;
 	unsigned long logic_port_bitmap;
 	int ret, j, k, port_num;
 	u8 i;
@@ -988,6 +982,8 @@ int __ubase_perf_stats(struct ubase_dev *udev, u64 port_bitmap, u32 period,
 	for (i = 0, k = 0; i < UBASE_MAX_PORT_NUM && k < port_num; i++) {
 		if (!test_bit(i, (unsigned long *)&port_bitmap))
 			continue;
+
+		memset(&resp, 0, sizeof(resp));
 		ret = ubase_stop_perf_stats(udev, &resp, period, i);
 		if (ret)
 			goto unlock;
diff --git a/drivers/ub/ubase/ubase_hw.h b/drivers/ub/ubase/ubase_hw.h
index ee455ba317d1..12bc101cd04f 100644
--- a/drivers/ub/ubase/ubase_hw.h
+++ b/drivers/ub/ubase/ubase_hw.h
@@ -30,7 +30,7 @@ struct ubase_caps_item {
 
 struct ubase_res_cmd_resp {
 	__le32	cap_bits[UBASE_CAP_LEN];
-	__le32	rsvd[3];
+	__le32	rsvd0[3];
 
 	u8	rsvd1[2];
 	__le16	ceq_vector_num;
@@ -43,37 +43,32 @@ struct ubase_res_cmd_resp {
 	__le32	aeqe_depth;
 	__le32	ceqe_depth;
 	__le32	udma_jfs_max_cnt;
-	__le32	udma_jfs_reserved_cnt;
+	u8	rsvd2[4];
 
 	__le32	udma_jfs_depth;
 	__le32	udma_jfr_max_cnt;
-	__le32	udma_jfr_reserved_cnt;
+	u8	rsvd3[4];
 	__le32	udma_jfr_depth;
 	u8	nic_vl_num;
-	u8	rsvd2[3];
+	u8	rsvd4[3];
 	u8	nic_vl[UBASE_MAX_REQ_VL_NUM];
 	__le32	udma_jfc_max_cnt;
 
-	__le32	udma_jfc_reserved_cnt;
+	u8	rsvd5[4];
 	__le32	udma_jfc_depth;
-	__le32	udma_tp_max_cnt;
-	__le32	udma_tp_reserved_cnt;
-	__le32	udma_tp_depth;
-	__le32	udma_tpg_max_cnt;
-	__le32	udma_tpg_reserved_cnt;
-	__le32	udma_tpg_depth;
+	u8	rsvd6[24];
 
 	__le32	nic_jfs_max_cnt;
-	__le32	nic_jfs_reserved_cnt;
+	u8	rsvd7[4];
 	__le32	nic_jfs_depth;
 	__le32	nic_jfr_max_cnt;
-	__le32	nic_jfr_reserved_cnt;
+	u8	rsvd8[4];
 	__le32	nic_jfr_depth;
-	__le32	rsvd3[2];
+	__le32	rsvd9[2];
 
-	__le32	rsvd4;
+	__le32	rsvd10;
 	__le32	nic_jfc_max_cnt;
-	__le32	nic_jfc_reserved_cnt;
+	u8	rsvd11[4];
 	__le32	nic_jfc_depth;
 	__le32	nic_tp_max_cnt;
 	__le32	nic_tp_reserved_cnt;
@@ -83,10 +78,7 @@ struct ubase_res_cmd_resp {
 	__le32	nic_tpg_reserved_cnt;
 	__le32	nic_tpg_depth;
 	__le32	total_ue_num;
-	__le32	jfs_ctx_size;
-	__le32	jfr_ctx_size;
-	__le32	jfc_ctx_size;
-	__le32	tp_ctx_size;
+	u8	rsvd12[16];
 	__le16	rsvd_jetty_cnt;
 	__le16	mac_stats_num;
 
@@ -95,24 +87,22 @@ struct ubase_res_cmd_resp {
 	__le32	public_jetty_cnt;
 	__le32	tp_extdb_buf_size;
 	__le32	tp_timer_buf_size;
-	u8	port_work_mode;
+	u8	resv13;
 	u8	udma_vl_num;
 	u8	udma_tp_resp_vl_offset;
 	u8	ue_num;
 	__le32	port_bitmap;
-	u8	rsvd5[4];
+	u8	rsvd14[4];
 
 	/* include udma tp and ctp req vl */
 	u8	udma_req_vl[UBASE_MAX_REQ_VL_NUM];
 	__le32	udma_rc_depth;
-	u8	rsvd6[4];
+	u8	rsvd15[4];
 	__le32	jtg_max_cnt;
 	__le32	rc_max_cnt_per_vl;
-	__le32	dest_addr_max_cnt;
-	__le32	seid_upi_max_cnt;
+	u8	rsvd16[8];
 
-	__le32	tpm_max_cnt;
-	__le32	ccc_max_cnt;
+	u8	rsvd17[32];
 };
 
 struct ubase_query_oor_resp {
diff --git a/drivers/ub/ubase/ubase_qos_hw.c b/drivers/ub/ubase/ubase_qos_hw.c
index bfd5c4e0f5c1..8145edc4401c 100644
--- a/drivers/ub/ubase/ubase_qos_hw.c
+++ b/drivers/ub/ubase/ubase_qos_hw.c
@@ -195,13 +195,10 @@ static int __ubase_config_tm_vl_sch(struct ubase_dev *udev, u16 vl_bitmap,
 	int ret;
 	u8 i;
 
-	/* the configuration takes effect for all entities. */
-	req.bus_ue_id = cpu_to_le16(USHRT_MAX);
-	req.vl_bitmap = cpu_to_le16(vl_bitmap);
-
 	for (i = 0; i < UBASE_MAX_VL_NUM; i++)
 		tsa_bitmap |= vl_tsa[i] ? 1 << i : 0;
 
+	req.vl_bitmap = cpu_to_le16(vl_bitmap);
 	req.vl_tsa = cpu_to_le16(tsa_bitmap);
 	memcpy(req.vl_bw, vl_bw, UBASE_MAX_VL_NUM);
 
@@ -209,7 +206,7 @@ static int __ubase_config_tm_vl_sch(struct ubase_dev *udev, u16 vl_bitmap,
 			     sizeof(req), &req);
 
 	ret = __ubase_cmd_send_in(udev, &in);
-	if (ret)
+	if (ret && ret != -EPERM)
 		ubase_err(udev, "failed to config tm vl sch, ret = %d", ret);
 
 	return ret;
@@ -230,7 +227,7 @@ static int __ubase_config_ets_vl_sch(struct ubase_dev *udev, u16 vl_bitmap,
 			     &req);
 
 	ret = __ubase_cmd_send_in(udev, &in);
-	if (ret)
+	if (ret && ret != -EPERM)
 		ubase_err(udev, "failed to cfg ets vl sch, ret = %d.", ret);
 
 	return ret;
diff --git a/include/ub/ubase/ubase_comm_cmd.h b/include/ub/ubase/ubase_comm_cmd.h
index 4eb3c435a8f9..492b5e8513ea 100644
--- a/include/ub/ubase/ubase_comm_cmd.h
+++ b/include/ub/ubase/ubase_comm_cmd.h
@@ -30,6 +30,7 @@ enum ubase_opcode_type {
 	/* Generic commands */
 	UBASE_OPC_QUERY_FW_VER		= 0x0001,
 	UBASE_OPC_QUERY_CTL_INFO	= 0x0003,
+	UBASE_OPC_NOTIFY_DRV_CAPS	= 0x0007,
 	UBASE_OPC_QUERY_COMM_RSRC_PARAM	= 0x0030,
 	UBASE_OPC_QUERY_NIC_RSRC_PARAM	= 0x0031,
 	UBASE_OPC_QUERY_LINK_STATUS	= 0x0032,
diff --git a/include/ub/ubase/ubase_comm_dev.h b/include/ub/ubase/ubase_comm_dev.h
index ac85c20311dd..35e0496ac01d 100644
--- a/include/ub/ubase/ubase_comm_dev.h
+++ b/include/ub/ubase/ubase_comm_dev.h
@@ -103,7 +103,6 @@ struct ubase_caps {
 struct ubase_res_caps {
 	u32	max_cnt;
 	u32	start_idx;
-	u32	reserved_cnt;
 	u32	depth;
 };
 
@@ -123,10 +122,6 @@ struct ubase_adev_caps {
 	u32			jtg_max_cnt;
 	u32			rc_max_cnt;
 	u32			rc_que_depth;
-	u32			ccc_max_cnt;
-	u32			dest_addr_max_cnt;
-	u32			seid_upi_max_cnt;
-	u32			tpm_max_cnt;
 	u16			cqe_size;
 };
 
-- 
Gitee


From 15bde327170a99bf1cc5e4869d70872c53b69ba6 Mon Sep 17 00:00:00 2001
From: Xiongchuan Zhou <zhouxiongchuan@h-partners.com>
Date: Mon, 10 Nov 2025 20:33:36 +0800
Subject: [PATCH 03/11] net: unic: Fix the ethtool stats and basic capability
 information query interface

drivers inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/ID7LHB
CVE: NA

-----------------------------------------------------------------

The ethtool tool supports querying stats information for the
ub network port. Resolving issues with stats information collection
and failure to query FEC and speed-related configurations.

Fixes: 4420dfeed31d ("net: unic: Support to query and clear historical NIC link status information")
Signed-off-by: Xiongchuan Zhou <zhouxiongchuan@h-partners.com>
Signed-off-by: Fengyan Mu <mufengyan@huawei.com>
---
 drivers/net/ub/unic/unic_ethtool.c |  50 ++++++++++
 drivers/net/ub/unic/unic_stats.c   | 142 +++++++++++++++++++++++++++++
 drivers/net/ub/unic/unic_stats.h   |  21 +++++
 3 files changed, 213 insertions(+)

diff --git a/drivers/net/ub/unic/unic_ethtool.c b/drivers/net/ub/unic/unic_ethtool.c
index 22f530c45107..960477451df5 100644
--- a/drivers/net/ub/unic/unic_ethtool.c
+++ b/drivers/net/ub/unic/unic_ethtool.c
@@ -24,6 +24,46 @@ static u32 unic_get_link_status(struct net_device *netdev)
 	return unic_dev->sw_link_status;
 }
 
+static void unic_get_port_type(struct unic_dev *unic_dev,
+			       struct ethtool_link_ksettings *cmd)
+{
+	u8 module_type = unic_dev->hw.mac.module_type;
+	u8 media_type = unic_dev->hw.mac.media_type;
+
+	switch (media_type) {
+	case UNIC_MEDIA_TYPE_NONE:
+	case UNIC_MEDIA_TYPE_BACKPLANE:
+		cmd->base.port = PORT_NONE;
+		break;
+	case UNIC_MEDIA_TYPE_FIBER:
+		if (module_type == UNIC_MODULE_TYPE_CR)
+			cmd->base.port = PORT_DA;
+		else
+			cmd->base.port = PORT_FIBRE;
+		break;
+	default:
+		cmd->base.port = PORT_NONE;
+		break;
+	}
+}
+
+static void unic_get_ksettings(struct unic_dev *unic_dev,
+			       struct ethtool_link_ksettings *cmd)
+{
+	struct unic_mac *mac = &unic_dev->hw.mac;
+
+	unic_get_port_type(unic_dev, cmd);
+
+	cmd->base.speed = mac->speed;
+	cmd->base.duplex = mac->duplex;
+	cmd->base.autoneg = mac->autoneg;
+
+	linkmode_copy(cmd->link_modes.supported, mac->supported);
+	linkmode_copy(cmd->link_modes.advertising, mac->advertising);
+
+	cmd->lanes = mac->lanes;
+}
+
 static int unic_get_link_ksettings(struct net_device *netdev,
 				   struct ethtool_link_ksettings *cmd)
 {
@@ -32,6 +72,13 @@ static int unic_get_link_ksettings(struct net_device *netdev,
 	/* Ensure that the latest information is obtained. */
 	unic_update_port_info(unic_dev);
 
+	unic_get_ksettings(unic_dev, cmd);
+
+	if (!unic_get_link_status(netdev)) {
+		cmd->base.speed = SPEED_UNKNOWN;
+		cmd->base.duplex = DUPLEX_UNKNOWN;
+	}
+
 	return 0;
 }
 
@@ -326,6 +373,9 @@ static const struct ethtool_ops unic_ethtool_ops = {
 	.get_drvinfo = unic_get_driver_info,
 	.get_regs_len = unic_get_regs_len,
 	.get_regs = unic_get_regs,
+	.get_ethtool_stats = unic_get_stats,
+	.get_strings = unic_get_stats_strings,
+	.get_sset_count = unic_get_sset_count,
 	.get_channels = unic_get_channels,
 	.set_channels = unic_set_channels,
 	.get_ringparam = unic_get_channels_param,
diff --git a/drivers/net/ub/unic/unic_stats.c b/drivers/net/ub/unic/unic_stats.c
index d8ccd1876500..4647ba5e3e5e 100644
--- a/drivers/net/ub/unic/unic_stats.c
+++ b/drivers/net/ub/unic/unic_stats.c
@@ -78,6 +78,36 @@ static struct unic_dfx_regs_group unic_dfx_reg_arr[] = {
 	},
 };
 
+static const struct unic_stats_desc unic_sq_stats_str[] = {
+	{"pad_err", UNIC_SQ_STATS_FIELD_OFF(pad_err)},
+	{"packets", UNIC_SQ_STATS_FIELD_OFF(packets)},
+	{"bytes", UNIC_SQ_STATS_FIELD_OFF(bytes)},
+	{"busy", UNIC_SQ_STATS_FIELD_OFF(busy)},
+	{"more", UNIC_SQ_STATS_FIELD_OFF(more)},
+	{"restart_queue", UNIC_SQ_STATS_FIELD_OFF(restart_queue)},
+	{"over_max_sge_num", UNIC_SQ_STATS_FIELD_OFF(over_max_sge_num)},
+	{"csum_err", UNIC_SQ_STATS_FIELD_OFF(csum_err)},
+	{"ci_mismatch", UNIC_SQ_STATS_FIELD_OFF(ci_mismatch)},
+	{"vlan_err", UNIC_SQ_STATS_FIELD_OFF(vlan_err)},
+	{"fd_cnt", UNIC_SQ_STATS_FIELD_OFF(fd_cnt)},
+	{"drop_cnt", UNIC_SQ_STATS_FIELD_OFF(drop_cnt)},
+	{"cfg5_drop_cnt", UNIC_SQ_STATS_FIELD_OFF(cfg5_drop_cnt)}
+};
+
+static const struct unic_stats_desc unic_rq_stats_str[] = {
+	{"alloc_skb_err", UNIC_RQ_STATS_FIELD_OFF(alloc_skb_err)},
+	{"packets", UNIC_RQ_STATS_FIELD_OFF(packets)},
+	{"bytes", UNIC_RQ_STATS_FIELD_OFF(bytes)},
+	{"err_pkt_len_cnt", UNIC_RQ_STATS_FIELD_OFF(err_pkt_len_cnt)},
+	{"doi_cnt", UNIC_RQ_STATS_FIELD_OFF(doi_cnt)},
+	{"trunc_cnt", UNIC_RQ_STATS_FIELD_OFF(trunc_cnt)},
+	{"multicast", UNIC_RQ_STATS_FIELD_OFF(multicast)},
+	{"l2_err", UNIC_RQ_STATS_FIELD_OFF(l2_err)},
+	{"l3_l4_csum_err", UNIC_RQ_STATS_FIELD_OFF(l3_l4_csum_err)},
+	{"alloc_frag_err", UNIC_RQ_STATS_FIELD_OFF(alloc_frag_err)},
+	{"csum_complete", UNIC_RQ_STATS_FIELD_OFF(csum_complete)},
+};
+
 static int unic_get_dfx_reg_num(struct unic_dev *unic_dev, u32 *reg_num,
 				u32 reg_arr_size)
 {
@@ -295,6 +325,118 @@ void unic_get_regs(struct net_device *netdev, struct ethtool_regs *cmd,
 	kfree(reg_num);
 }
 
+static u64 *unic_get_queues_stats(struct unic_dev *unic_dev,
+				  const struct unic_stats_desc *stats,
+				  u32 stats_size, enum unic_queue_type type,
+				  u64 *data)
+{
+	struct unic_channel *c;
+	u32 i, j;
+	u8 *q;
+
+	for (i = 0; i < unic_dev->channels.num; i++) {
+		c = &unic_dev->channels.c[i];
+		q = (type == UNIC_QUEUE_TYPE_SQ) ? (u8 *)c->sq : (u8 *)c->rq;
+		for (j = 0; j < stats_size; j++) {
+			*data = UNIC_STATS_READ(q, stats[j].offset);
+			data++;
+		}
+	}
+
+	return data;
+}
+
+void unic_get_stats(struct net_device *netdev,
+		    struct ethtool_stats *stats, u64 *data)
+{
+	struct unic_dev *unic_dev = netdev_priv(netdev);
+	u64 *p = data;
+
+	if (unic_resetting(netdev) || !unic_dev->channels.c) {
+		unic_err(unic_dev,
+			 "dev resetting or channel is null, could not get stats.\n");
+		return;
+	}
+
+	p = unic_get_queues_stats(unic_dev, unic_sq_stats_str,
+				  ARRAY_SIZE(unic_sq_stats_str),
+				  UNIC_QUEUE_TYPE_SQ, p);
+
+	p = unic_get_queues_stats(unic_dev, unic_rq_stats_str,
+				  ARRAY_SIZE(unic_rq_stats_str),
+				  UNIC_QUEUE_TYPE_RQ, p);
+}
+
+static u8 *unic_get_strings(u8 *data, const char *prefix, u32 num,
+			    const struct unic_stats_desc *strs, u32 stats_size)
+{
+	u32 i, j;
+
+	for (i = 0; i < num; i++) {
+		for (j = 0; j < stats_size; j++) {
+			data[ETH_GSTRING_LEN - 1] = '\0';
+
+			if (prefix)
+				scnprintf(data, ETH_GSTRING_LEN - 1, "%s%u_%s",
+					  prefix, i, strs[j].desc);
+			else
+				scnprintf(data, ETH_GSTRING_LEN - 1, "%s",
+					  strs[j].desc);
+
+			data += ETH_GSTRING_LEN;
+		}
+	}
+
+	return data;
+}
+
+static u8 *unic_get_queues_strings(struct unic_dev *unic_dev, u8 *data)
+{
+	u32 channel_num = unic_dev->channels.num;
+
+	/* get desc for Tx */
+	data = unic_get_strings(data, "txq", channel_num, unic_sq_stats_str,
+				ARRAY_SIZE(unic_sq_stats_str));
+
+	/* get desc for Rx */
+	data = unic_get_strings(data, "rxq", channel_num, unic_rq_stats_str,
+				ARRAY_SIZE(unic_rq_stats_str));
+
+	return data;
+}
+
+void unic_get_stats_strings(struct net_device *netdev, u32 stringset, u8 *data)
+{
+	struct unic_dev *unic_dev = netdev_priv(netdev);
+	u8 *p = data;
+
+	switch (stringset) {
+	case ETH_SS_STATS:
+		p = unic_get_queues_strings(unic_dev, p);
+		break;
+	default:
+		break;
+	}
+}
+
+int unic_get_sset_count(struct net_device *netdev, int stringset)
+{
+	struct unic_dev *unic_dev = netdev_priv(netdev);
+	u32 channel_num = unic_dev->channels.num;
+	int count;
+
+	switch (stringset) {
+	case ETH_SS_STATS:
+		count = ARRAY_SIZE(unic_sq_stats_str) * channel_num;
+		count += ARRAY_SIZE(unic_rq_stats_str) * channel_num;
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	return count;
+}
+
 static void unic_get_fec_stats_total(struct unic_dev *unic_dev, u8 stats_flags,
 				     struct ethtool_fec_stats *fec_stats)
 {
diff --git a/drivers/net/ub/unic/unic_stats.h b/drivers/net/ub/unic/unic_stats.h
index 2a2a8746d838..623b732f3d8e 100644
--- a/drivers/net/ub/unic/unic_stats.h
+++ b/drivers/net/ub/unic/unic_stats.h
@@ -12,6 +12,13 @@
 #include <ub/ubase/ubase_comm_cmd.h>
 #include <ub/ubase/ubase_comm_ctrlq.h>
 
+#define UNIC_SQ_STATS_FIELD_OFF(fld) (offsetof(struct unic_sq, stats) + \
+				      offsetof(struct unic_sq_stats, fld))
+#define UNIC_RQ_STATS_FIELD_OFF(fld) (offsetof(struct unic_rq, stats) + \
+				      offsetof(struct unic_rq_stats, fld))
+
+#define UNIC_STATS_READ(p, offset) (*(u64 *)((u8 *)(p) + (offset)))
+
 #define UNIC_FEC_CORR_BLOCKS	BIT(0)
 #define UNIC_FEC_UNCORR_BLOCKS	BIT(1)
 #define UNIC_FEC_CORR_BITS	BIT(2)
@@ -58,6 +65,11 @@ enum unic_reg_tag {
 	UNIC_TAG_MAX,
 };
 
+enum unic_queue_type {
+	UNIC_QUEUE_TYPE_SQ = 0,
+	UNIC_QUEUE_TYPE_RQ,
+};
+
 struct unic_res_regs_group {
 	u16 tag;
 	u32 *regs_addr;
@@ -83,9 +95,18 @@ struct unic_dfx_regs_group {
 	bool (*is_supported)(struct unic_dev *unic_dev, u32 property);
 };
 
+struct unic_stats_desc {
+	char desc[ETH_GSTRING_LEN];
+	u16 offset;
+};
+
 int unic_get_regs_len(struct net_device *netdev);
 void unic_get_regs(struct net_device *netdev, struct ethtool_regs *cmd,
 		   void *data);
+void unic_get_stats_strings(struct net_device *netdev, u32 stringset, u8 *data);
+int unic_get_sset_count(struct net_device *netdev, int stringset);
+void unic_get_stats(struct net_device *netdev,
+		    struct ethtool_stats *stats, u64 *data);
 void unic_get_fec_stats(struct net_device *ndev,
 			struct ethtool_fec_stats *fec_stats);
 
-- 
Gitee


From e87c0f1d745bd8cea6ec52d5b79c163ba12d4a1d Mon Sep 17 00:00:00 2001
From: Fengyan Mu <mufengyan@huawei.com>
Date: Wed, 12 Nov 2025 18:21:17 +0800
Subject: [PATCH 04/11] ub: ubase: Fix verification to ctrlq message seq

drivers inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/ID7LHB
CVE: NA

------------------------------------------------------------------

The data sent by the UE to the UE will be accessed through seq,
but the value of seq may not be trustworthy. Accessing untrusted
seq data can cause anomalies. a new check for seq values has
been added.

Fixes: d7ce08663cc5 ("ub: ubase: Supports for ctrl queue management.")
Signed-off-by: Yixi Shen <shenyixi@huawei.com>
Signed-off-by: Fengyan Mu <mufengyan@huawei.com>
---
 drivers/ub/ubase/ubase_ctrlq.c | 13 +++++++++----
 drivers/ub/ubase/ubase_ctrlq.h |  1 +
 drivers/ub/ubase/ubase_dev.c   |  5 +++++
 3 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/drivers/ub/ubase/ubase_ctrlq.c b/drivers/ub/ubase/ubase_ctrlq.c
index b8d7681dd518..c49f713226c5 100644
--- a/drivers/ub/ubase/ubase_ctrlq.c
+++ b/drivers/ub/ubase/ubase_ctrlq.c
@@ -569,6 +569,11 @@ static int ubase_ctrlq_msg_check(struct ubase_dev *udev,
 		return -EINVAL;
 	}
 
+	if (msg->is_resp && msg->need_resp) {
+		ubase_err(udev, "ctrlq input resp type is invalid.\n");
+		return -EINVAL;
+	}
+
 	if (msg->is_resp && !(msg->resp_seq & UBASE_CTRLQ_SEQ_MASK)) {
 		ubase_err(udev, "ctrlq input resp_seq(%u) is invalid.\n",
 			  msg->resp_seq);
@@ -759,13 +764,13 @@ static void ubase_ctrlq_send_unsupported_resp(struct ubase_dev *udev,
 	msg.resp_seq = seq;
 	msg.resp_ret = EOPNOTSUPP;
 
-	ubase_info(udev, "ctrlq received unsupported req. seq=%u, ser_type=%d, ser_ver=%d, opc=%u.",
+	ubase_info(udev, "ctrlq received unsupported req. seq=%u, ser_type=%d, ser_ver=%d, opc=0x%x.",
 		   seq, head->service_type, head->service_ver, head->opcode);
 
 	ret = __ubase_ctrlq_send(udev, &msg, NULL);
 	if (ret)
-		ubase_warn(udev, "failed to send ctrlq unsupported resp. seq=%u, ser_type=%d, ser_ver=%d, opc=%u.",
-			   seq, head->service_type, head->service_ver, head->opcode);
+		ubase_warn(udev, "failed to send ctrlq unsupported resp. seq=%u, ser_type=%d, ser_ver=%d, opc=0x%x, ret=%d.",
+			   seq, head->service_type, head->service_ver, head->opcode, ret);
 }
 
 static void ubase_ctrlq_crq_event_callback(struct ubase_dev *udev,
@@ -809,7 +814,7 @@ static void ubase_ctrlq_notify_completed(struct ubase_dev *udev,
 	complete(&ctx->done);
 }
 
-static bool ubase_ctrlq_check_seq(struct ubase_dev *udev, u16 seq)
+bool ubase_ctrlq_check_seq(struct ubase_dev *udev, u16 seq)
 {
 	bool is_pushed = !!(seq & UBASE_CTRLQ_SEQ_MASK);
 	u16 max_seq = ubase_ctrlq_max_seq(udev);
diff --git a/drivers/ub/ubase/ubase_ctrlq.h b/drivers/ub/ubase/ubase_ctrlq.h
index 431253df5054..b868ace06ab1 100644
--- a/drivers/ub/ubase/ubase_ctrlq.h
+++ b/drivers/ub/ubase/ubase_ctrlq.h
@@ -94,6 +94,7 @@ void ubase_ctrlq_disable(struct ubase_dev *udev);
 int __ubase_ctrlq_send(struct ubase_dev *udev, struct ubase_ctrlq_msg *msg,
 		       struct ubase_ctrlq_ue_info *ue_info);
 
+bool ubase_ctrlq_check_seq(struct ubase_dev *udev, u16 seq);
 void ubase_ctrlq_service_task(struct ubase_delay_work *ubase_work);
 void ubase_ctrlq_handle_crq_msg(struct ubase_dev *udev,
 				struct ubase_ctrlq_base_block *head,
diff --git a/drivers/ub/ubase/ubase_dev.c b/drivers/ub/ubase/ubase_dev.c
index fa61159d4295..76d179093abe 100644
--- a/drivers/ub/ubase/ubase_dev.c
+++ b/drivers/ub/ubase/ubase_dev.c
@@ -492,6 +492,11 @@ static int ubase_handle_ue2ue_ctrlq_event(struct ubase_dev *udev, void *data,
 	if (ubase_dev_ctrlq_supported(udev))
 		return ubase_handle_ue2ue_ctrlq_req(udev, cmd, len);
 
+	if (!ubase_ctrlq_check_seq(udev, cmd->seq)) {
+		ubase_err(udev, "invalid ue2ue ctrlq seq(%u).\n", cmd->seq);
+		return -EINVAL;
+	}
+
 	head = (struct ubase_ctrlq_base_block *)(cmd + 1);
 	data_len = len - sizeof(*cmd) - UBASE_CTRLQ_HDR_LEN;
 	ubase_ctrlq_handle_crq_msg(udev, head, cmd->seq,
-- 
Gitee


From 0ee149f4767688691a85b306b128d9d84f4232ec Mon Sep 17 00:00:00 2001
From: Fengyan Mu <mufengyan@huawei.com>
Date: Wed, 12 Nov 2025 18:37:23 +0800
Subject: [PATCH 05/11] ub: ubase: Optimization of ubase_ctrlq_send_msg
 interface parameters

drivers inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/ID7LHB
CVE: NA

-----------------------------------------------------------------

This patch optimizes the parameters of the ubase_ctrlq_send_msg
interface by adding the is_async parameter to specify whether
to call it synchronously.

Fixes: d7ce08663cc5 ("ub: ubase: Supports for ctrl queue management.")
Signed-off-by: Guangwei Zhang <zhangguangwei6@huawei.com>
Signed-off-by: Fengyan Mu <mufengyan@huawei.com>
---
 drivers/ub/ubase/ubase_cmd.h        |  3 +-
 drivers/ub/ubase/ubase_ctrlq.c      | 96 +++++++++++++++++++----------
 drivers/ub/ubase/ubase_ctrlq.h      | 20 ++++++
 drivers/ub/ubase/ubase_dev.c        |  3 +
 include/ub/ubase/ubase_comm_ctrlq.h |  3 +-
 5 files changed, 91 insertions(+), 34 deletions(-)

diff --git a/drivers/ub/ubase/ubase_cmd.h b/drivers/ub/ubase/ubase_cmd.h
index 263e88c9fa49..a99422b59dc4 100644
--- a/drivers/ub/ubase/ubase_cmd.h
+++ b/drivers/ub/ubase/ubase_cmd.h
@@ -83,7 +83,8 @@ struct ubase_ue2ue_ctrlq_head {
 	u16 out_size;
 	u8 need_resp : 1;
 	u8 is_resp : 1;
-	u8 rsv : 6;
+	u8 is_async : 1;
+	u8 rsv : 5;
 };
 
 struct ubase_start_perf_stats_cmd {
diff --git a/drivers/ub/ubase/ubase_ctrlq.c b/drivers/ub/ubase/ubase_ctrlq.c
index c49f713226c5..352342ee01dc 100644
--- a/drivers/ub/ubase/ubase_ctrlq.c
+++ b/drivers/ub/ubase/ubase_ctrlq.c
@@ -369,11 +369,13 @@ static void ubase_ctrlq_fill_first_bb(struct ubase_dev *udev,
 	head->service_type = msg->service_type;
 	head->opcode = msg->opcode;
 	head->mbx_ue_id = ue_info ? ue_info->mbx_ue_id : 0;
-	head->ret = msg->is_resp ? msg->resp_ret : 0;
+	head->ret = ubase_ctrlq_msg_is_resp(msg) ? msg->resp_ret : 0;
 	head->bus_ue_id = cpu_to_le16(ue_info ?
 				      ue_info->bus_ue_id :
 				      ue->entity_idx);
-	memcpy(head->data, msg->in, min(msg->in_size, UBASE_CTRLQ_DATA_LEN));
+	if (msg->in)
+		memcpy(head->data, msg->in,
+		       min(msg->in_size, UBASE_CTRLQ_DATA_LEN));
 }
 
 static inline void ubase_ctrlq_csq_report_irq(struct ubase_dev *udev)
@@ -408,10 +410,12 @@ static int ubase_ctrlq_send_to_cmdq(struct ubase_dev *udev,
 	ue2ue_head.out_size = msg->out_size;
 	ue2ue_head.need_resp = msg->need_resp;
 	ue2ue_head.is_resp = msg->is_resp;
+	ue2ue_head.is_async = msg->is_async;
 	memcpy(req, &ue2ue_head, sizeof(ue2ue_head));
 	memcpy((u8 *)req + sizeof(ue2ue_head), head, UBASE_CTRLQ_HDR_LEN);
-	memcpy((u8 *)req + sizeof(ue2ue_head) + UBASE_CTRLQ_HDR_LEN, msg->in,
-	       msg->in_size);
+	if (msg->in)
+		memcpy((u8 *)req + sizeof(ue2ue_head) + UBASE_CTRLQ_HDR_LEN,
+		       msg->in, msg->in_size);
 
 	__ubase_fill_inout_buf(&in, UBASE_OPC_UE2UE_UBASE, false, req_len, req);
 	ret = __ubase_cmd_send_in(udev, &in);
@@ -541,18 +545,17 @@ static void ubase_ctrlq_addto_msg_queue(struct ubase_dev *udev, u16 seq,
 {
 	struct ubase_ctrlq_msg_ctx *ctx;
 
-	if (!msg->need_resp)
+	if (!(ubase_ctrlq_msg_is_sync_req(msg) ||
+	      ubase_ctrlq_msg_is_async_req(msg)))
 		return;
 
 	ctx = &udev->ctrlq.msg_queue[seq];
 	ctx->valid = 1;
-	ctx->is_sync = msg->need_resp && msg->out && msg->out_size ? 1 : 0;
+	ctx->is_sync = ubase_ctrlq_msg_is_sync_req(msg) ? 1 : 0;
 	ctx->result = ETIME;
 	ctx->dead_jiffies = jiffies + msecs_to_jiffies(UBASE_CTRLQ_DEAD_TIME);
-	if (ctx->is_sync) {
-		ctx->out = msg->out;
-		ctx->out_size = msg->out_size;
-	}
+	ctx->out = msg->out;
+	ctx->out_size = msg->out_size;
 
 	if (ue_info) {
 		ctx->ue_seq = ue_info->seq;
@@ -564,30 +567,58 @@ static void ubase_ctrlq_addto_msg_queue(struct ubase_dev *udev, u16 seq,
 static int ubase_ctrlq_msg_check(struct ubase_dev *udev,
 				 struct ubase_ctrlq_msg *msg)
 {
-	if (!msg || !msg->in || !msg->in_size) {
-		ubase_err(udev, "ctrlq input buf is invalid.\n");
-		return -EINVAL;
-	}
-
-	if (msg->is_resp && msg->need_resp) {
-		ubase_err(udev, "ctrlq input resp type is invalid.\n");
+	if ((!msg->in && msg->in_size) || (msg->in && !msg->in_size)) {
+		ubase_err(udev, "ctrlq msg in param error.\n");
 		return -EINVAL;
 	}
 
-	if (msg->is_resp && !(msg->resp_seq & UBASE_CTRLQ_SEQ_MASK)) {
-		ubase_err(udev, "ctrlq input resp_seq(%u) is invalid.\n",
-			  msg->resp_seq);
+	if ((!msg->out && msg->out_size) || (msg->out && !msg->out_size)) {
+		ubase_err(udev, "ctrlq msg out param error.\n");
 		return -EINVAL;
 	}
 
 	if (msg->in_size > UBASE_CTRLQ_MAX_DATA_SIZE) {
 		ubase_err(udev,
-			  "requested ctrlq space(%u) exceeds the maximum(%u).\n",
+			   "ctrlq msg in_size(%u) exceeds the maximum(%u).\n",
 			  msg->in_size, UBASE_CTRLQ_MAX_DATA_SIZE);
 		return -EINVAL;
 	}
 
-	return 0;
+	if (ubase_ctrlq_msg_is_sync_req(msg))
+		return 0;
+
+	if (ubase_ctrlq_msg_is_async_req(msg)) {
+		if (msg->out) {
+			ubase_err(udev, "ctrlq msg out is not NULL in async req.\n");
+			return -EINVAL;
+		}
+		return 0;
+	}
+
+	if (ubase_ctrlq_msg_is_notify_req(msg)) {
+		if (msg->out) {
+			ubase_err(udev, "ctrlq msg out is not NULL in notify req.\n");
+			return -EINVAL;
+		}
+		return 0;
+	}
+
+	if (ubase_ctrlq_msg_is_resp(msg)) {
+		if (msg->out) {
+			ubase_err(udev, "ctrlq msg out is not NULL in resp.\n");
+			return -EINVAL;
+		}
+		if (!(msg->resp_seq & UBASE_CTRLQ_SEQ_MASK)) {
+			ubase_err(udev, "ctrlq msg resp_seq error, resp_seq=%u.\n",
+				  msg->resp_seq);
+			return -EINVAL;
+		}
+		return 0;
+	}
+
+	ubase_err(udev, "ctrlq msg param error, is_resp=%u, is_async=%u, need_resp=%u.\n",
+		  msg->is_resp, msg->is_async, msg->need_resp);
+	return -EINVAL;
 }
 
 static int ubase_ctrlq_check_csq_enough(struct ubase_dev *udev, u16 num)
@@ -612,8 +643,6 @@ static int ubase_ctrlq_send_real(struct ubase_dev *udev,
 				 struct ubase_ctrlq_msg *msg,
 				 struct ubase_ctrlq_ue_info *ue_info)
 {
-	bool sync_req = msg->out && msg->out_size && msg->need_resp;
-	bool no_resp = !msg->is_resp && !msg->need_resp;
 	struct ubase_ctrlq_ring *csq = &udev->ctrlq.csq;
 	struct ubase_ctrlq_base_block head = {0};
 	u16 seq, num;
@@ -627,7 +656,7 @@ static int ubase_ctrlq_send_real(struct ubase_dev *udev,
 	if (ret)
 		goto unlock;
 
-	if (!msg->is_resp) {
+	if (!ubase_ctrlq_msg_is_resp(msg)) {
 		ret = ubase_ctrlq_alloc_seq(udev, msg, &seq);
 		if (ret) {
 			ubase_warn(udev, "no enough seq in ctrlq.\n");
@@ -645,20 +674,22 @@ static int ubase_ctrlq_send_real(struct ubase_dev *udev,
 	ret = ubase_ctrlq_send_msg_to_sq(udev, &head, msg, num);
 	if (ret) {
 		spin_unlock_bh(&csq->lock);
-		goto free_seq;
+		if (!ubase_ctrlq_msg_is_resp(msg))
+			ubase_ctrlq_free_seq(udev, seq);
+		return ret;
 	}
 
 	spin_unlock_bh(&csq->lock);
 
-	if (sync_req)
+	if (ubase_ctrlq_msg_is_sync_req(msg))
 		ret = ubase_ctrlq_wait_completed(udev, seq, msg);
 
-free_seq:
-	/* Only the seqs in synchronous requests and no response requests need to be released. */
-	/* The seqs are released in periodic tasks of asynchronous requests. */
-	if (sync_req || no_resp)
+	if (ubase_ctrlq_msg_is_sync_req(msg) ||
+	    ubase_ctrlq_msg_is_notify_req(msg))
 		ubase_ctrlq_free_seq(udev, seq);
+
 	return ret;
+
 unlock:
 	spin_unlock_bh(&csq->lock);
 	return ret;
@@ -809,7 +840,8 @@ static void ubase_ctrlq_notify_completed(struct ubase_dev *udev,
 
 	ctx = &udev->ctrlq.msg_queue[seq];
 	ctx->result = head->ret;
-	memcpy(ctx->out, msg, min(msg_len, ctx->out_size));
+	if (ctx->out)
+		memcpy(ctx->out, msg, min(msg_len, ctx->out_size));
 
 	complete(&ctx->done);
 }
diff --git a/drivers/ub/ubase/ubase_ctrlq.h b/drivers/ub/ubase/ubase_ctrlq.h
index b868ace06ab1..c3d5f55db87d 100644
--- a/drivers/ub/ubase/ubase_ctrlq.h
+++ b/drivers/ub/ubase/ubase_ctrlq.h
@@ -87,6 +87,26 @@ struct ubase_ctrlq_reset_ctrl_req {
 	u8 rsv[3];
 };
 
+static inline bool ubase_ctrlq_msg_is_sync_req(struct ubase_ctrlq_msg *msg)
+{
+	return !msg->is_resp && !msg->is_async && msg->need_resp;
+}
+
+static inline bool ubase_ctrlq_msg_is_async_req(struct ubase_ctrlq_msg *msg)
+{
+	return !msg->is_resp && msg->is_async && msg->need_resp;
+}
+
+static inline bool ubase_ctrlq_msg_is_notify_req(struct ubase_ctrlq_msg *msg)
+{
+	return !msg->is_resp && !msg->is_async && !msg->need_resp;
+}
+
+static inline bool ubase_ctrlq_msg_is_resp(struct ubase_ctrlq_msg *msg)
+{
+	return msg->is_resp && !msg->is_async && !msg->need_resp;
+}
+
 int ubase_ctrlq_init(struct ubase_dev *udev);
 void ubase_ctrlq_uninit(struct ubase_dev *udev);
 void ubase_ctrlq_disable(struct ubase_dev *udev);
diff --git a/drivers/ub/ubase/ubase_dev.c b/drivers/ub/ubase/ubase_dev.c
index 76d179093abe..7331afa03c80 100644
--- a/drivers/ub/ubase/ubase_dev.c
+++ b/drivers/ub/ubase/ubase_dev.c
@@ -459,11 +459,14 @@ static int ubase_handle_ue2ue_ctrlq_req(struct ubase_dev *udev,
 	msg.opcode = head->opcode;
 	msg.need_resp = cmd->need_resp;
 	msg.is_resp = cmd->is_resp;
+	msg.is_async = cmd->is_async;
 	msg.resp_seq = cmd->seq;
 	msg.in = (u8 *)head + UBASE_CTRLQ_HDR_LEN;
 	msg.in_size = cmd->in_size;
 	msg.out = NULL;
 	msg.out_size = 0;
+	if (ubase_ctrlq_msg_is_sync_req(&msg))
+		msg.is_async = 1;
 
 	ue_info.bus_ue_id = le16_to_cpu(cmd->head.bus_ue_id);
 	ue_info.seq = cmd->seq;
diff --git a/include/ub/ubase/ubase_comm_ctrlq.h b/include/ub/ubase/ubase_comm_ctrlq.h
index 7e772dcb0746..da3337573b61 100644
--- a/include/ub/ubase/ubase_comm_ctrlq.h
+++ b/include/ub/ubase/ubase_comm_ctrlq.h
@@ -61,7 +61,8 @@ struct ubase_ctrlq_msg {
 	u8	opcode;
 	u8	need_resp : 1;
 	u8	is_resp : 1;
-	u8	resv : 6;
+	u8	is_async : 1;
+	u8	resv : 5;
 	u8	resp_ret; /* must set when the is_resp field is true. */
 	u16	resp_seq; /* must set when the is_resp field is true. */
 	u16	in_size;
-- 
Gitee


From aca32b8e11f4d793529e2d06a7453d9dcbcf2f43 Mon Sep 17 00:00:00 2001
From: Fengyan Mu <mufengyan@huawei.com>
Date: Thu, 20 Nov 2025 11:03:26 +0800
Subject: [PATCH 06/11] ub: ubase: Fix CTRLQ white list

drivers inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/ID7LHB
CVE: NA

-------------------------------------------------------

According to the design requirements for CtrlQ interface
compatibility, when the Ubase receives a message that it
does not support, it needs to return a notsupport response
to the peer.

Currently, Ubase determines whether a message is supported
by checking whether the corresponding callback function has
been registered. This leads to an edge case: when the auxiliary
drivers has not registered, the corresponding callback function
is null, and in this case, Ubase also returns notsupport.
This causes the peer to mistakenly believe that we does not support
the message, and subsequently, the peer will no longer send this
message, which is not in line with the design expectations.

Therefore, it is necessary for Ubase to distinguish between the two
scenarios: when a message is supported but the callback is not
registered, and when a message is not supported at all.
So we add a message whitelist in Ubase. Messages not included in the
whitelist will return notsupport while those included will return
a specific error code 255 indicating "DRV NOT EXIST."

Fixes: d7ce08663cc5 ("ub: ubase: Supports for ctrl queue management.")
Signed-off-by: Chuan Wu <wuchuan4@huawei.com>
Signed-off-by: Fengyan Mu <mufengyan@huawei.com>
---
 drivers/ub/ubase/ubase_ctrlq.c      | 202 ++++++++++++++++++++--------
 drivers/ub/ubase/ubase_dev.h        |   8 +-
 include/ub/ubase/ubase_comm_ctrlq.h |  23 ++--
 3 files changed, 160 insertions(+), 73 deletions(-)

diff --git a/drivers/ub/ubase/ubase_ctrlq.c b/drivers/ub/ubase/ubase_ctrlq.c
index 352342ee01dc..9351ed2c70fd 100644
--- a/drivers/ub/ubase/ubase_ctrlq.c
+++ b/drivers/ub/ubase/ubase_ctrlq.c
@@ -11,19 +11,102 @@
 #include "ubase_cmd.h"
 #include "ubase_ctrlq.h"
 
-static inline void ubase_ctrlq_crq_table_init(struct ubase_dev *udev)
+/* UNIC ctrlq msg white list */
+static const struct ubase_ctrlq_event_nb ubase_ctrlq_wlist_unic[] = {
+	{UBASE_CTRLQ_SER_TYPE_IP_ACL, UBASE_CTRLQ_OPC_NOTIFY_IP, NULL, NULL},
+};
+
+/* UDMA ctrlq msg white list */
+static const struct ubase_ctrlq_event_nb ubase_ctrlq_wlist_udma[] = {
+	{UBASE_CTRLQ_SER_TYPE_TP_ACL, UBASE_CTRLQ_OPC_CHECK_TP_ACTIVE, NULL, NULL},
+	{UBASE_CTRLQ_SER_TYPE_DEV_REGISTER, UBASE_CTRLQ_OPC_UPDATE_SEID, NULL, NULL},
+	{UBASE_CTRLQ_SER_TYPE_DEV_REGISTER, UBASE_CTRLQ_OPC_NOTIFY_RES_RATIO, NULL, NULL},
+};
+
+/* CDMA ctrlq msg white list */
+static const struct ubase_ctrlq_event_nb ubase_ctrlq_wlist_cdma[] = {
+	{UBASE_CTRLQ_SER_TYPE_DEV_REGISTER, UBASE_CTRLQ_OPC_UPDATE_SEID, NULL, NULL},
+};
+
+static int ubase_ctrlq_alloc_crq_tbl_mem(struct ubase_dev *udev)
 {
 	struct ubase_ctrlq_crq_table *crq_tab = &udev->ctrlq.crq_table;
+	u16 cnt = 0;
+
+	if (ubase_dev_cdma_supported(udev)) {
+		cnt = ARRAY_SIZE(ubase_ctrlq_wlist_cdma);
+	} else if (ubase_dev_urma_supported(udev)) {
+		if (ubase_dev_unic_supported(udev))
+			cnt += ARRAY_SIZE(ubase_ctrlq_wlist_unic);
+		if (ubase_dev_udma_supported(udev))
+			cnt += ARRAY_SIZE(ubase_ctrlq_wlist_udma);
+	}
+
+	if (!cnt)
+		return -EINVAL;
+
+	crq_tab->crq_nbs = kcalloc(cnt, sizeof(struct ubase_ctrlq_event_nb), GFP_KERNEL);
+	if (!crq_tab->crq_nbs)
+		return -ENOMEM;
+
+	crq_tab->crq_nb_cnt = cnt;
+
+	return 0;
+}
+
+static void ubase_ctrlq_free_crq_tbl_mem(struct ubase_dev *udev)
+{
+	struct ubase_ctrlq_crq_table *crq_tab = &udev->ctrlq.crq_table;
+
+	kfree(crq_tab->crq_nbs);
+	crq_tab->crq_nbs = NULL;
+	crq_tab->crq_nb_cnt = 0;
+}
+
+static void ubase_ctrlq_init_crq_wlist(struct ubase_dev *udev)
+{
+	struct ubase_ctrlq_crq_table *crq_tab = &udev->ctrlq.crq_table;
+	u32 offset = 0;
+
+	if (ubase_dev_cdma_supported(udev)) {
+		memcpy(crq_tab->crq_nbs, ubase_ctrlq_wlist_cdma,
+		       sizeof(ubase_ctrlq_wlist_cdma));
+	} else if (ubase_dev_urma_supported(udev)) {
+		if (ubase_dev_unic_supported(udev)) {
+			memcpy(crq_tab->crq_nbs, ubase_ctrlq_wlist_unic,
+			       sizeof(ubase_ctrlq_wlist_unic));
+			offset = ARRAY_SIZE(ubase_ctrlq_wlist_unic);
+		}
+		if (ubase_dev_udma_supported(udev)) {
+			memcpy(&crq_tab->crq_nbs[offset], ubase_ctrlq_wlist_udma,
+			       sizeof(ubase_ctrlq_wlist_udma));
+		}
+	}
+}
+
+static int ubase_ctrlq_crq_table_init(struct ubase_dev *udev)
+{
+	struct ubase_ctrlq_crq_table *crq_tab = &udev->ctrlq.crq_table;
+	int ret;
+
+	ret = ubase_ctrlq_alloc_crq_tbl_mem(udev);
+	if (ret)
+		return ret;
+
+	ubase_ctrlq_init_crq_wlist(udev);
 
 	mutex_init(&crq_tab->lock);
-	INIT_LIST_HEAD(&crq_tab->crq_nbs.list);
+
+	return 0;
 }
 
-static inline void ubase_ctrlq_crq_table_uninit(struct ubase_dev *udev)
+static void ubase_ctrlq_crq_table_uninit(struct ubase_dev *udev)
 {
 	struct ubase_ctrlq_crq_table *crq_tab = &udev->ctrlq.crq_table;
 
 	mutex_destroy(&crq_tab->lock);
+
+	ubase_ctrlq_free_crq_tbl_mem(udev);
 }
 
 static inline u16 ubase_ctrlq_msg_queue_depth(struct ubase_dev *udev)
@@ -233,10 +316,15 @@ int ubase_ctrlq_init(struct ubase_dev *udev)
 	if (ret)
 		goto err_msg_queue_init;
 
+	ret = ubase_ctrlq_crq_table_init(udev);
+	if (ret)
+		goto err_crq_table_init;
+
 	udev->ctrlq.csq_next_seq = 1;
 	atomic_set(&udev->ctrlq.req_cnt, 0);
-	ubase_ctrlq_crq_table_init(udev);
 
+err_crq_table_init:
+	ubase_ctrlq_msg_queue_uninit(udev);
 success:
 	set_bit(UBASE_CTRLQ_STATE_ENABLE, &udev->ctrlq.state);
 	return 0;
@@ -780,8 +868,7 @@ static void ubase_ctrlq_read_msg_data(struct ubase_dev *udev, u8 num, u8 *msg)
 
 static void ubase_ctrlq_send_unsupported_resp(struct ubase_dev *udev,
 					      struct ubase_ctrlq_base_block *head,
-					      void *msg_data, u16 msg_data_len,
-					      u16 seq)
+					      u16 resp_seq, u8 resp_ret)
 {
 	struct ubase_ctrlq_msg msg = {0};
 	int ret;
@@ -789,19 +876,14 @@ static void ubase_ctrlq_send_unsupported_resp(struct ubase_dev *udev,
 	msg.service_ver = head->service_ver;
 	msg.service_type = head->service_type;
 	msg.opcode = head->opcode;
-	msg.in_size = msg_data_len;
-	msg.in = msg_data;
 	msg.is_resp = 1;
-	msg.resp_seq = seq;
-	msg.resp_ret = EOPNOTSUPP;
-
-	ubase_info(udev, "ctrlq received unsupported req. seq=%u, ser_type=%d, ser_ver=%d, opc=0x%x.",
-		   seq, head->service_type, head->service_ver, head->opcode);
+	msg.resp_seq = resp_seq;
+	msg.resp_ret = resp_ret;
 
 	ret = __ubase_ctrlq_send(udev, &msg, NULL);
 	if (ret)
-		ubase_warn(udev, "failed to send ctrlq unsupported resp. seq=%u, ser_type=%d, ser_ver=%d, opc=0x%x, ret=%d.",
-			   seq, head->service_type, head->service_ver, head->opcode, ret);
+		ubase_warn(udev, "failed to send ctrlq unsupport resp, ret=%d.",
+			   ret);
 }
 
 static void ubase_ctrlq_crq_event_callback(struct ubase_dev *udev,
@@ -809,27 +891,43 @@ static void ubase_ctrlq_crq_event_callback(struct ubase_dev *udev,
 					   void *msg_data, u16 msg_data_len,
 					   u16 seq)
 {
+#define EDRVNOEXIST 255
 	struct ubase_ctrlq_crq_table *crq_tab = &udev->ctrlq.crq_table;
-	struct ubase_ctrlq_crq_event_nbs *nbs;
-	int ret = -EOPNOTSUPP;
+	int ret = -ENOENT;
+	u32 i;
+
+	ubase_info(udev,
+		   "ctrlq recv notice req: seq=%u, ser_type=%u, ser_ver=%u, opc=0x%x.",
+		   seq, head->service_type, head->service_ver, head->opcode);
 
 	mutex_lock(&crq_tab->lock);
-	list_for_each_entry(nbs, &crq_tab->crq_nbs.list, list) {
-		if (nbs->crq_nb.service_type == head->service_type &&
-		    nbs->crq_nb.opcode == head->opcode) {
-			ret = nbs->crq_nb.crq_handler(nbs->crq_nb.back,
-						      head->service_ver,
-						      msg_data,
-						      msg_data_len,
-						      seq);
+	for (i = 0; i < crq_tab->crq_nb_cnt; i++) {
+		if (crq_tab->crq_nbs[i].service_type == head->service_type &&
+		    crq_tab->crq_nbs[i].opcode == head->opcode) {
+			if (!crq_tab->crq_nbs[i].crq_handler) {
+				ret = -EDRVNOEXIST;
+				break;
+			}
+			ret = crq_tab->crq_nbs[i].crq_handler(crq_tab->crq_nbs[i].back,
+							      head->service_ver,
+							      msg_data,
+							      msg_data_len,
+							      seq);
 			break;
 		}
 	}
 	mutex_unlock(&crq_tab->lock);
 
-	if (ret == -EOPNOTSUPP)
-		ubase_ctrlq_send_unsupported_resp(udev, head, msg_data,
-						  msg_data_len, seq);
+	if (ret == -ENOENT) {
+		ubase_info(udev, "this notice is not supported.");
+		ubase_ctrlq_send_unsupported_resp(udev, head, seq, EOPNOTSUPP);
+	} else if (ret == -EOPNOTSUPP) {
+		ubase_info(udev, "the notice processor return not support.");
+		ubase_ctrlq_send_unsupported_resp(udev, head, seq, EOPNOTSUPP);
+	} else if (ret == -EDRVNOEXIST) {
+		ubase_info(udev, "the notice processor is unregistered.");
+		ubase_ctrlq_send_unsupported_resp(udev, head, seq, EDRVNOEXIST);
+	}
 }
 
 static void ubase_ctrlq_notify_completed(struct ubase_dev *udev,
@@ -1064,10 +1162,10 @@ void ubase_ctrlq_clean_service_task(struct ubase_delay_work *ubase_work)
 int ubase_ctrlq_register_crq_event(struct auxiliary_device *aux_dev,
 				   struct ubase_ctrlq_event_nb *nb)
 {
-	struct ubase_ctrlq_crq_event_nbs *nbs, *tmp, *new_nbs;
 	struct ubase_ctrlq_crq_table *crq_tab;
 	struct ubase_dev *udev;
-	int ret;
+	int ret = -ENOENT;
+	u32 i;
 
 	if (!aux_dev || !nb || !nb->crq_handler)
 		return -EINVAL;
@@ -1075,31 +1173,21 @@ int ubase_ctrlq_register_crq_event(struct auxiliary_device *aux_dev,
 	udev = __ubase_get_udev_by_adev(aux_dev);
 	crq_tab = &udev->ctrlq.crq_table;
 	mutex_lock(&crq_tab->lock);
-	list_for_each_entry_safe(nbs, tmp, &crq_tab->crq_nbs.list, list) {
-		if (nbs->crq_nb.service_type == nb->service_type &&
-		    nbs->crq_nb.opcode == nb->opcode) {
-			ret = -EEXIST;
-			goto err_crq_register;
+	for (i = 0; i < crq_tab->crq_nb_cnt; i++) {
+		if (crq_tab->crq_nbs[i].service_type == nb->service_type &&
+		    crq_tab->crq_nbs[i].opcode == nb->opcode) {
+			if (crq_tab->crq_nbs[i].crq_handler) {
+				ret = -EEXIST;
+				break;
+			}
+			crq_tab->crq_nbs[i].back = nb->back;
+			crq_tab->crq_nbs[i].crq_handler = nb->crq_handler;
+			ret = 0;
+			break;
 		}
 	}
 
-	new_nbs = kzalloc(sizeof(*new_nbs), GFP_KERNEL);
-	if (!new_nbs) {
-		ret = -ENOMEM;
-		goto err_crq_register;
-	}
-
-	new_nbs->crq_nb = *nb;
-	list_add_tail(&new_nbs->list, &crq_tab->crq_nbs.list);
-	mutex_unlock(&crq_tab->lock);
-
-	return 0;
-
-err_crq_register:
 	mutex_unlock(&crq_tab->lock);
-	ubase_err(udev,
-		  "failed to register ctrlq crq event, opcode = 0x%x, service_type = 0x%x, ret = %d.\n",
-		  nb->opcode, nb->service_type, ret);
 
 	return ret;
 }
@@ -1108,9 +1196,9 @@ EXPORT_SYMBOL(ubase_ctrlq_register_crq_event);
 void ubase_ctrlq_unregister_crq_event(struct auxiliary_device *aux_dev,
 				      u8 service_type, u8 opcode)
 {
-	struct ubase_ctrlq_crq_event_nbs *nbs, *tmp;
 	struct ubase_ctrlq_crq_table *crq_tab;
 	struct ubase_dev *udev;
+	u32 i;
 
 	if (!aux_dev)
 		return;
@@ -1118,11 +1206,11 @@ void ubase_ctrlq_unregister_crq_event(struct auxiliary_device *aux_dev,
 	udev = __ubase_get_udev_by_adev(aux_dev);
 	crq_tab = &udev->ctrlq.crq_table;
 	mutex_lock(&crq_tab->lock);
-	list_for_each_entry_safe(nbs, tmp, &crq_tab->crq_nbs.list, list) {
-		if (nbs->crq_nb.service_type == service_type &&
-		    nbs->crq_nb.opcode == opcode) {
-			list_del(&nbs->list);
-			kfree(nbs);
+	for (i = 0; i < crq_tab->crq_nb_cnt; i++) {
+		if (crq_tab->crq_nbs[i].service_type == service_type &&
+		    crq_tab->crq_nbs[i].opcode == opcode) {
+			crq_tab->crq_nbs[i].back = NULL;
+			crq_tab->crq_nbs[i].crq_handler = NULL;
 			break;
 		}
 	}
diff --git a/drivers/ub/ubase/ubase_dev.h b/drivers/ub/ubase/ubase_dev.h
index c8ccd5bd107a..8d21ff16ef19 100644
--- a/drivers/ub/ubase/ubase_dev.h
+++ b/drivers/ub/ubase/ubase_dev.h
@@ -178,15 +178,11 @@ struct ubase_ctrlq_msg_ctx {
 	struct completion	done;
 };
 
-struct ubase_ctrlq_crq_event_nbs {
-	struct list_head		list;
-	struct ubase_ctrlq_event_nb	crq_nb;
-};
-
 struct ubase_ctrlq_crq_table {
 	struct mutex	lock;
 	unsigned long	last_crq_scheduled;
-	struct ubase_ctrlq_crq_event_nbs	crq_nbs;
+	u16				crq_nb_cnt;
+	struct ubase_ctrlq_event_nb	*crq_nbs;
 };
 
 struct ubase_ctrlq {
diff --git a/include/ub/ubase/ubase_comm_ctrlq.h b/include/ub/ubase/ubase_comm_ctrlq.h
index da3337573b61..b1ee65524052 100644
--- a/include/ub/ubase/ubase_comm_ctrlq.h
+++ b/include/ub/ubase/ubase_comm_ctrlq.h
@@ -28,16 +28,17 @@ enum ubase_ctrlq_ser_ver {
 };
 
 enum ubase_ctrlq_ser_type {
-	UBASE_CTRLQ_SER_TYPE_TP_ACL = 0x01,
-	UBASE_CTRLQ_SER_TYPE_DEV_REGISTER = 0x02,
-	UBASE_CTRLQ_SER_TYPE_IP_ACL = 0x03,
-	UBASE_CTRLQ_SER_TYPE_QOS = 0x04,
+	UBASE_CTRLQ_SER_TYPE_TP_ACL		= 0x01,
+	UBASE_CTRLQ_SER_TYPE_DEV_REGISTER	= 0x02,
+	UBASE_CTRLQ_SER_TYPE_IP_ACL		= 0x03,
+	UBASE_CTRLQ_SER_TYPE_QOS		= 0x04,
 };
 
-enum ubase_ctrlq_opc_type {
+enum ubase_ctrlq_opc_type_tp {
 	UBASE_CTRLQ_OPC_CREATE_TP	= 0x11,
 	UBASE_CTRLQ_OPC_DESTROY_TP	= 0x12,
 	UBASE_CTRLQ_OPC_TP_FLUSH_DONE	= 0x14,
+	UBASE_CTRLQ_OPC_CHECK_TP_ACTIVE	= 0x15,
 };
 
 enum ubase_ctrlq_opc_type_qos {
@@ -45,14 +46,16 @@ enum ubase_ctrlq_opc_type_qos {
 	UBASE_CTRLQ_OPC_QUERY_SL	= 0x02,
 };
 
-enum ubase_ctrlq_opc_ip {
-	UBASE_CTRLQ_OPC_NOTIFY_IP = 0x01,
-	UBASE_CTRLQ_OPC_QUERY_IP = 0x02,
+enum ubase_ctrlq_opc_type_ip {
+	UBASE_CTRLQ_OPC_NOTIFY_IP	= 0x01,
+	UBASE_CTRLQ_OPC_QUERY_IP	= 0x02,
 };
 
 enum ubase_ctrlq_opc_type_dev_register {
-	UBASE_CTRLQ_OPC_CTRLQ_CTRL	= 0x14,
-	UBASE_CTRLQ_OPC_UE_RESET_CTRL	= 0x15,
+	UBASE_CTRLQ_OPC_UPDATE_SEID		= 0x02,
+	UBASE_CTRLQ_OPC_NOTIFY_RES_RATIO	= 0x13,
+	UBASE_CTRLQ_OPC_CTRLQ_CTRL		= 0x14,
+	UBASE_CTRLQ_OPC_UE_RESET_CTRL		= 0x15,
 };
 
 struct ubase_ctrlq_msg {
-- 
Gitee


From 300514e725420aa5309724a6f8e5f43845602ac3 Mon Sep 17 00:00:00 2001
From: Fengyan Mu <mufengyan@huawei.com>
Date: Thu, 13 Nov 2025 11:20:06 +0800
Subject: [PATCH 07/11] net: unic: Fix configure coal parameters without
 deactivate

drivers inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/ID7LHB
CVE: NA

-----------------------------------------------------------

When activating/deactivating, it is necessary to open/close
the protocol stack with link. When configuring parameters,
it is necessary to disable the network interface before making
changes.
Previously, flag was used to intercept and ensure that the two
did not run concurrently. After analysis, the UNIC_ACTIVATE_FLAG
check in the current code is redundant and can be removed.

Fixes: e0ccc63cc72e ("net: unic: support querying and configuring coalesce parameters.")
Signed-off-by: Zhenyu Wan <wanzhenyu3@huawei.com>
Signed-off-by: Fengyan Mu <mufengyan@huawei.com>
---
 drivers/net/ub/unic/unic_ethtool.c | 15 +--------------
 1 file changed, 1 insertion(+), 14 deletions(-)

diff --git a/drivers/net/ub/unic/unic_ethtool.c b/drivers/net/ub/unic/unic_ethtool.c
index 960477451df5..f2cfa3df1126 100644
--- a/drivers/net/ub/unic/unic_ethtool.c
+++ b/drivers/net/ub/unic/unic_ethtool.c
@@ -276,12 +276,6 @@ static int unic_set_coalesce(struct net_device *netdev,
 	struct unic_coalesce old_tx_coal, old_rx_coal;
 	int ret, ret1;
 
-	if (test_bit(UNIC_STATE_DEACTIVATE, &unic_dev->state)) {
-		unic_err(unic_dev,
-			 "failed to set coalesce, due to dev deacitve.\n");
-		return -EBUSY;
-	}
-
 	if (unic_resetting(netdev))
 		return -EBUSY;
 
@@ -298,7 +292,6 @@ static int unic_set_coalesce(struct net_device *netdev,
 	tx_coal->int_ql = cmd->tx_max_coalesced_frames;
 	rx_coal->int_ql = cmd->rx_max_coalesced_frames;
 
-	unic_net_stop_no_link_change(netdev);
 	unic_uninit_channels(unic_dev);
 
 	ret = unic_init_channels(unic_dev, unic_dev->channels.num);
@@ -307,18 +300,12 @@ static int unic_set_coalesce(struct net_device *netdev,
 		memcpy(tx_coal, &old_tx_coal, sizeof(struct unic_coalesce));
 		memcpy(rx_coal, &old_rx_coal, sizeof(struct unic_coalesce));
 		ret1 = unic_init_channels(unic_dev, unic_dev->channels.num);
-		if (ret1) {
+		if (ret1)
 			unic_err(unic_dev,
 				 "failed to recover old channels, ret = %d.\n",
 				 ret1);
-			return ret;
-		}
 	}
 
-	ret1 = unic_net_open_no_link_change(netdev);
-	if (ret1)
-		unic_err(unic_dev, "failed to set net open, ret = %d.\n", ret1);
-
 	return ret;
 }
 
-- 
Gitee


From f348a2d07557f2bd87d672f1c006d68436a4d179 Mon Sep 17 00:00:00 2001
From: Fengyan Mu <mufengyan@huawei.com>
Date: Thu, 13 Nov 2025 17:52:07 +0800
Subject: [PATCH 08/11] ub: ubase: Fix link status timestamp information

idrivers inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/ID7LHB
CVE: NA

----------------------------------------------------------------------

In the current version, the timestamp recorded in the link status record
changes with the system time because the TIME is obtained through the
ktime_get_real_seconds function when printing the link status record.
This patch fixes the issue by changing the value of TIME to the historical
moment recorded in the stats array.

Fixes: 58daddb6f308 ("net: unic: support subscribes to the RX stream stop and recovery interface.")
Signed-off-by: Xuanyu Pu <puxuanyu@huawei.com>
Signed-off-by: Fengyan Mu <mufengyan@huawei.com>
---
 drivers/net/ub/unic/debugfs/unic_debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ub/unic/debugfs/unic_debugfs.c b/drivers/net/ub/unic/debugfs/unic_debugfs.c
index 0a6dbdaffedc..f58ed6f7567a 100644
--- a/drivers/net/ub/unic/debugfs/unic_debugfs.c
+++ b/drivers/net/ub/unic/debugfs/unic_debugfs.c
@@ -222,7 +222,7 @@ static int unic_dbg_query_link_record(struct seq_file *s, void *data)
 		total--;
 		idx = total % LINK_STAT_MAX_IDX;
 		seq_printf(s, "\t%-2d\t", cnt);
-		ubase_dbg_format_time(ktime_get_real_seconds(), s);
+		ubase_dbg_format_time(record->stats[idx].link_tv_sec, s);
 		seq_printf(s, "\t%s\n",
 			   record->stats[idx].link_status ? "LINK UP" : "LINK DOWN");
 		cnt++;
-- 
Gitee


From 0bc3e46d0f2d581c68f2825235a8ab10f92c71a9 Mon Sep 17 00:00:00 2001
From: Xiongchuan Zhou <zhouxiongchuan@h-partners.com>
Date: Thu, 13 Nov 2025 15:08:53 +0800
Subject: [PATCH 09/11] net: unic: Fix lose vport_ctx and vport_buf information
 query in debugfs

drivers inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/ID7LHB
CVE: NA

-------------------------------------------------------------

Added vport_ctx and vport_buf queries in debugfs to facilitate
viewing the related configuration information of pf.

Fixes: 4420dfeed31d ("net: unic: Support to query and clear historical NIC link status information")
Signed-off-by: Xiongchuan Zhou <zhouxiongchuan@h-partners.com>
Signed-off-by: Fengyan Mu <mufengyan@huawei.com>
---
 drivers/net/ub/unic/debugfs/unic_debugfs.c | 73 ++++++++++++++++++++++
 drivers/net/ub/unic/debugfs/unic_debugfs.h |  1 +
 drivers/net/ub/unic/unic_cmd.h             |  8 +++
 drivers/net/ub/unic/unic_hw.c              | 23 +++++++
 drivers/net/ub/unic/unic_hw.h              |  2 +
 include/ub/ubase/ubase_comm_cmd.h          |  1 +
 6 files changed, 108 insertions(+)

diff --git a/drivers/net/ub/unic/debugfs/unic_debugfs.c b/drivers/net/ub/unic/debugfs/unic_debugfs.c
index f58ed6f7567a..4c7bf3bb83fc 100644
--- a/drivers/net/ub/unic/debugfs/unic_debugfs.c
+++ b/drivers/net/ub/unic/debugfs/unic_debugfs.c
@@ -39,6 +39,61 @@ static int unic_dbg_dump_dev_info(struct seq_file *s, void *data)
 	return 0;
 }
 
+static int unic_dbg_dump_vport_buf(struct seq_file *s, void *data)
+{
+	struct unic_dev *unic_dev = dev_get_drvdata(s->private);
+
+	seq_printf(s, "vport buffer num: %u\n", unic_dev->caps.vport_buf_num);
+	seq_printf(s, "vport buffer size: %u\n", unic_dev->caps.vport_buf_size);
+	return 0;
+}
+
+static void unic_dbg_fill_vport_ctx_content(struct unic_vport_ctx_cmd *resp,
+					    struct seq_file *s)
+{
+	u32 i, j;
+
+	for (i = 0; i < UNIC_VORT_CTX_DATA_NUM; i += UNIC_VORT_CTX_DATA_ALIGN) {
+		seq_printf(s, "%08X: ", i * UNIC_VORT_CTX_DATA_ALIGN);
+		for (j = 0; j < UNIC_VORT_CTX_DATA_ALIGN; j++) {
+			if ((i + j) == UNIC_VORT_CTX_DATA_NUM)
+				break;
+			seq_printf(s, "%08X ", resp->data[i + j]);
+		}
+		seq_puts(s, "\n");
+	}
+}
+
+static int unic_dbg_query_vport_ctx(struct seq_file *s)
+{
+	struct unic_dev *unic_dev = dev_get_drvdata(s->private);
+	struct unic_vport_ctx_cmd resp;
+	u16 offset = 0;
+	int ret;
+
+	do {
+		memset(&resp, 0, sizeof(resp));
+		ret = unic_query_vport_ctx(unic_dev, offset, &resp);
+		if (ret)
+			return ret;
+		offset = resp.offset;
+
+		unic_dbg_fill_vport_ctx_content(&resp, s);
+	} while (resp.offset);
+
+	return 0;
+}
+
+static int unic_dbg_dump_vport_ctx(struct seq_file *s, void *data)
+{
+	struct unic_dev *unic_dev = dev_get_drvdata(s->private);
+
+	if (__unic_resetting(unic_dev))
+		return -EBUSY;
+
+	return unic_dbg_query_vport_ctx(s);
+}
+
 static const struct unic_dbg_cap_bit_info {
 	const char *format;
 	bool (*get_bit)(struct unic_dev *dev);
@@ -265,6 +320,10 @@ static struct ubase_dbg_dentry_info unic_dbg_dentry[] = {
 		.name = "context",
 		.property = UBASE_SUP_UNIC | UBASE_SUP_UBL,
 		.support = unic_dbg_dentry_support,
+	}, {
+		.name = "vport",
+		.property = UBASE_SUP_UNIC | UBASE_SUP_UBL,
+		.support = unic_dbg_dentry_support,
 	}, {
 		.name = "qos",
 		.property = UBASE_SUP_UNIC | UBASE_SUP_UBL,
@@ -328,6 +387,20 @@ static struct ubase_dbg_cmd_info unic_dbg_cmd[] = {
 		.support = unic_dbg_dentry_support,
 		.init = ubase_dbg_seq_file_init,
 		.read_func = unic_dbg_dump_dev_info,
+	}, {
+		.name = "vport_buf",
+		.dentry_index = UNIC_DBG_DENTRY_VPORT,
+		.property = UBASE_SUP_UNIC | UBASE_SUP_UBL_ETH,
+		.support = unic_dbg_dentry_support,
+		.init = ubase_dbg_seq_file_init,
+		.read_func = unic_dbg_dump_vport_buf,
+	}, {
+		.name = "vport_ctx",
+		.dentry_index = UNIC_DBG_DENTRY_VPORT,
+		.property = UBASE_SUP_UNIC | UBASE_SUP_UBL_ETH,
+		.support = unic_dbg_dentry_support,
+		.init = ubase_dbg_seq_file_init,
+		.read_func = unic_dbg_dump_vport_ctx,
 	}, {
 		.name = "caps_info",
 		.dentry_index = UNIC_DBG_DENTRY_ROOT,
diff --git a/drivers/net/ub/unic/debugfs/unic_debugfs.h b/drivers/net/ub/unic/debugfs/unic_debugfs.h
index 73a75b091b4b..853597b90f45 100644
--- a/drivers/net/ub/unic/debugfs/unic_debugfs.h
+++ b/drivers/net/ub/unic/debugfs/unic_debugfs.h
@@ -15,6 +15,7 @@
 enum unic_dbg_dentry_type {
 	UNIC_DBG_DENTRY_IP = 0,
 	UNIC_DBG_DENTRY_CONTEXT,
+	UNIC_DBG_DENTRY_VPORT,
 	UNIC_DBG_DENTRY_QOS,
 	/* must be the last entry. */
 	UNIC_DBG_DENTRY_ROOT
diff --git a/drivers/net/ub/unic/unic_cmd.h b/drivers/net/ub/unic/unic_cmd.h
index 125802234e6b..ac571815be6a 100644
--- a/drivers/net/ub/unic/unic_cmd.h
+++ b/drivers/net/ub/unic/unic_cmd.h
@@ -109,6 +109,14 @@ struct unic_cfg_vport_buf_cmd {
 	__le32	buf_addr[UNIC_MAX_VPORT_BUF_NUM * U32S_PER_U64];
 };
 
+#define UNIC_VORT_CTX_DATA_NUM		13
+#define UNIC_VORT_CTX_DATA_ALIGN	4
+struct unic_vport_ctx_cmd {
+	u8	resv[2];
+	__le16	offset;
+	__le32	data[UNIC_VORT_CTX_DATA_NUM];
+};
+
 struct unic_cfg_fec_cmd {
 	__le32	fec_mode;
 	u8	rsv[20];
diff --git a/drivers/net/ub/unic/unic_hw.c b/drivers/net/ub/unic/unic_hw.c
index be606bfb6495..565ac56fb638 100644
--- a/drivers/net/ub/unic/unic_hw.c
+++ b/drivers/net/ub/unic/unic_hw.c
@@ -674,6 +674,29 @@ int unic_cfg_vport_buf(struct unic_dev *unic_dev, bool init)
 	return ret;
 }
 
+int unic_query_vport_ctx(struct unic_dev *unic_dev, u16 offset,
+			 struct unic_vport_ctx_cmd *resp)
+{
+	struct unic_vport_ctx_cmd req;
+	struct ubase_cmd_buf in, out;
+	int ret;
+
+	memset(&req, 0, sizeof(req));
+	req.offset = cpu_to_le16(offset);
+
+	ubase_fill_inout_buf(&in, UBASE_OPC_VPORT_CTX, true,
+			     sizeof(req), &req);
+	ubase_fill_inout_buf(&out, UBASE_OPC_VPORT_CTX, true,
+			     sizeof(*resp), resp);
+
+	ret = ubase_cmd_send_inout(unic_dev->comdev.adev, &in, &out);
+	if (ret)
+		unic_err(unic_dev,
+			 "failed to query vport ctx, offset = %u, ret = %d.\n",
+			 offset, ret);
+	return ret;
+}
+
 int unic_set_fec_mode(struct unic_dev *unic_dev, u32 fec_mode)
 {
 	struct unic_cfg_fec_cmd req = {0};
diff --git a/drivers/net/ub/unic/unic_hw.h b/drivers/net/ub/unic/unic_hw.h
index cfd46b6eadf4..ba64d398e44b 100644
--- a/drivers/net/ub/unic/unic_hw.h
+++ b/drivers/net/ub/unic/unic_hw.h
@@ -95,6 +95,8 @@ int unic_set_promisc_mode(struct unic_dev *unic_dev,
 			  struct unic_promisc_en *promisc_en);
 
 int unic_cfg_vport_buf(struct unic_dev *unic_dev, bool init);
+int unic_query_vport_ctx(struct unic_dev *unic_dev, u16 offset,
+			 struct unic_vport_ctx_cmd *resp);
 int unic_set_fec_mode(struct unic_dev *unic_dev, u32 fec_mode);
 int unic_update_fec_stats(struct unic_dev *unic_dev);
 int unic_set_rss_tc_mode(struct unic_dev *unic_dev, u8 tc_vaild);
diff --git a/include/ub/ubase/ubase_comm_cmd.h b/include/ub/ubase/ubase_comm_cmd.h
index 492b5e8513ea..b0f97fb6cba7 100644
--- a/include/ub/ubase/ubase_comm_cmd.h
+++ b/include/ub/ubase/ubase_comm_cmd.h
@@ -102,6 +102,7 @@ enum ubase_opcode_type {
 	UBASE_OPC_NOTIFY_UE_RESET	= 0xF006,
 	UBASE_OPC_QUERY_UE_RST_RDY	= 0xF007,
 	UBASE_OPC_RESET_DONE		= 0xF008,
+	UBASE_OPC_VPORT_CTX		= 0xF009,
 	UBASE_OPC_DESTROY_CTX_RESOURCE	= 0xF00D,
 	UBASE_OPC_UE2UE_UBASE		= 0xF00E,
 	UBASE_OPC_ACTIVATE_REQ		= 0xF00F,
-- 
Gitee


From b056b8147b7551de6c6a1652032f55d0b5f51a20 Mon Sep 17 00:00:00 2001
From: Fengyan Mu <mufengyan@huawei.com>
Date: Thu, 20 Nov 2025 11:29:44 +0800
Subject: [PATCH 10/11] ub: ubase: flush the work queue.

drivers inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/ID7LHB
CVE: NA

------------------------------------------------------------------

Fixed an Error issue when the ctrlq crq work queue accesses the
ctrlq memory during the ELR reset. Wait until the work queue is
complete in the suspend phase to ensure that no work queue is
executed during the reset.

Fixes: 727362c0978c ("ub: ubase: Support for ELR and entity reset.")
Signed-off-by: ShiLong <shilong10@h-partners.com>
Signed-off-by: Jianqiang Li <lijianqiang16@huawei.com>
Signed-off-by: Fengyan Mu <mufengyan@huawei.com>
---
 drivers/ub/ubase/ubase_dev.c   | 8 ++++++++
 drivers/ub/ubase/ubase_dev.h   | 2 ++
 drivers/ub/ubase/ubase_reset.c | 1 +
 3 files changed, 11 insertions(+)

diff --git a/drivers/ub/ubase/ubase_dev.c b/drivers/ub/ubase/ubase_dev.c
index 7331afa03c80..9ea0d14a4d39 100644
--- a/drivers/ub/ubase/ubase_dev.c
+++ b/drivers/ub/ubase/ubase_dev.c
@@ -1317,6 +1317,14 @@ int ubase_deactivate_handler(struct ubase_dev *udev, u32 bus_ue_id)
 	return ubase_send_activate_dev_req(udev, false, (u16)bus_ue_id);
 }
 
+void ubase_flush_workqueue(struct ubase_dev *udev)
+{
+	flush_workqueue(udev->ubase_wq);
+	flush_workqueue(udev->ubase_async_wq);
+	flush_workqueue(udev->ubase_period_wq);
+	flush_workqueue(udev->ubase_arq_wq);
+}
+
 int ubase_activate_dev(struct auxiliary_device *adev)
 {
 	struct ubase_dev *udev;
diff --git a/drivers/ub/ubase/ubase_dev.h b/drivers/ub/ubase/ubase_dev.h
index 8d21ff16ef19..45605409de6b 100644
--- a/drivers/ub/ubase/ubase_dev.h
+++ b/drivers/ub/ubase/ubase_dev.h
@@ -451,4 +451,6 @@ void ubase_virt_handler(struct ubase_dev *udev, u16 bus_ue_id, bool is_en);
 int ubase_activate_handler(struct ubase_dev *udev, u32 bus_ue_id);
 int ubase_deactivate_handler(struct ubase_dev *udev, u32 bus_ue_id);
 
+void ubase_flush_workqueue(struct ubase_dev *udev);
+
 #endif
diff --git a/drivers/ub/ubase/ubase_reset.c b/drivers/ub/ubase/ubase_reset.c
index bb1c281c02d3..7da51b021026 100644
--- a/drivers/ub/ubase/ubase_reset.c
+++ b/drivers/ub/ubase/ubase_reset.c
@@ -229,6 +229,7 @@ void ubase_suspend(struct ubase_dev *udev)
 	ubase_ctrlq_disable_remote(udev);
 	ubase_ctrlq_disable(udev);
 	ubase_irq_table_free(udev);
+	ubase_flush_workqueue(udev);
 }
 
 void ubase_resume(struct ubase_dev *udev)
-- 
Gitee


From 6006cbfe442fd607d4042a4d6d82f8239d93aae4 Mon Sep 17 00:00:00 2001
From: Xiongchuan Zhou <zhouxiongchuan@h-partners.com>
Date: Fri, 14 Nov 2025 15:55:34 +0800
Subject: [PATCH 11/11] ub: ubase: Fix the lose of HIMAC reset.

drivers inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/ID7LHB
CVE: NA

---------------------------------------------------------------

Added support for HIMAC reset, including state detection, reset
command sending, and debug information output. The modifications include:

Added HIMAC reset handling logic to trigger reset operations when HIMAC
anomalies are detected.
Included HIMAC reset count in debug information for tracking and analysis.
Defined a new command code UBASE_OPC_HIMAC_RESET for sending HIMAC reset
commands.
These changes enable comprehensive support for HIMAC reset, covering
state management, command execution, and debug output.

Fixes: 727362c0978c ("ub: ubase: Support for ELR and entity reset.")
Signed-off-by: Xu Wang <wangxu341@h-partners.com>
Signed-off-by: Xiongchuan Zhou <zhouxiongchuan@h-partners.com>
Signed-off-by: Fengyan Mu <mufengyan@huawei.com>
---
 drivers/ub/ubase/debugfs/ubase_debugfs.c |  1 +
 drivers/ub/ubase/ubase_err_handle.c      | 20 ++++++++++++++++++++
 include/ub/ubase/ubase_comm_cmd.h        |  1 +
 3 files changed, 22 insertions(+)

diff --git a/drivers/ub/ubase/debugfs/ubase_debugfs.c b/drivers/ub/ubase/debugfs/ubase_debugfs.c
index bf49fc3fdc93..21fe4d1fa9b6 100644
--- a/drivers/ub/ubase/debugfs/ubase_debugfs.c
+++ b/drivers/ub/ubase/debugfs/ubase_debugfs.c
@@ -24,6 +24,7 @@ static int ubase_dbg_dump_rst_info(struct seq_file *s, void *data)
 
 	seq_printf(s, "ELR reset count: %u\n", udev->reset_stat.elr_reset_cnt);
 	seq_printf(s, "port reset count: %u\n", udev->reset_stat.port_reset_cnt);
+	seq_printf(s, "himac reset count: %u\n", udev->reset_stat.himac_reset_cnt);
 	seq_printf(s, "reset done count: %u\n", udev->reset_stat.reset_done_cnt);
 	seq_printf(s, "HW reset done count: %u\n", udev->reset_stat.hw_reset_done_cnt);
 	seq_printf(s, "reset fail count: %u\n", udev->reset_stat.reset_fail_cnt);
diff --git a/drivers/ub/ubase/ubase_err_handle.c b/drivers/ub/ubase/ubase_err_handle.c
index d91ab0f80b6b..179e59acec0a 100644
--- a/drivers/ub/ubase/ubase_err_handle.c
+++ b/drivers/ub/ubase/ubase_err_handle.c
@@ -9,6 +9,19 @@
 #include "ubase_reset.h"
 #include "ubase_err_handle.h"
 
+static void ubase_notify_himac_reset(struct ubase_dev *udev)
+{
+	struct ubase_cmd_buf in;
+	int ret;
+
+	__ubase_fill_inout_buf(&in, UBASE_OPC_HIMAC_RESET, false, 0, NULL);
+
+	ret = __ubase_cmd_send_in(udev, &in);
+	if (ret)
+		ubase_err(udev,
+			  "failed to send himac reset cmd, ret = %d.\n", ret);
+}
+
 void ubase_errhandle_service_task(struct ubase_delay_work *ubase_work)
 {
 	struct ubase_dev *udev;
@@ -23,6 +36,13 @@ void ubase_errhandle_service_task(struct ubase_delay_work *ubase_work)
 		return;
 	}
 
+	if (test_and_clear_bit(UBASE_STATE_HIMAC_RESETTING_B, &udev->state_bits)) {
+		ubase_err(udev, "ras occurred, ubase need to reset himac.\n");
+		ubase_notify_himac_reset(udev);
+		udev->reset_stat.himac_reset_cnt++;
+		return;
+	}
+
 	if (test_and_clear_bit(UBASE_STATE_PORT_RESETTING_B, &udev->state_bits)) {
 		ubase_err(udev, "ras occurred, ubase need to reset port.\n");
 		ubase_port_reset(udev);
diff --git a/include/ub/ubase/ubase_comm_cmd.h b/include/ub/ubase/ubase_comm_cmd.h
index b0f97fb6cba7..7ae969c897b9 100644
--- a/include/ub/ubase/ubase_comm_cmd.h
+++ b/include/ub/ubase/ubase_comm_cmd.h
@@ -87,6 +87,7 @@ enum ubase_opcode_type {
 	UBASE_OPC_QUERY_PORT_INFO	= 0x6200,
 	UBASE_OPC_QUERY_CHIP_INFO	= 0x6201,
 	UBASE_OPC_QUERY_FEC_STATS	= 0x6202,
+	UBASE_OPC_HIMAC_RESET		= 0x6302,
 
 	/* Mailbox commands */
 	UBASE_OPC_POST_MB		= 0x7000,
-- 
Gitee