Dropped hardware-write statuses across X550 link/flow-control setup: failed MMIO/MDIO writes reported as success
Summary
Five sites assign a device-write status and then unconditionally overwrite or ignore it: setup_fc_backplane_x550em_a drops the AN-cntl pause-advertisement write status before returning the restart status; setup_sfi_x550a; CS4227 LINE-mode write masked by the flush read; setup_sgmii_fw ignores rc; setup_mac_link_sfp_x550em ignores ixgbe_setup_kr_speed_x550em's return. Physical-trigger (link flap/cable insert) or init-path misconfiguration: the driver believes link/FC config was programmed when it was not - availability/wedged-link impact only; no memory unsafety; upstream-identical code. fix.diff propagates all five statuses, compile-validated.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-3725 · 5 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | — | 1.5 KB | ↓ raw | |
| VERDICT.md | — | 1.9 KB | ↓ raw | |
| fix.diff | — | 1.1 KB | view raw | |
| manifest.json | — | 700 B | view raw | |
| verdict.json | — | 1.6 KB | view raw |
DF-3725 — Dropped write/return statuses across X550 link/FC setup: failed hardware writes reported as success
File: sys/dev/netif/ix/ixgbe_x550.c (five instances) Severity: Info Confidence: certain (DF-3671 family)
| Line | Function | Dropped status |
|---|---|---|
| 4207-4212 | ixgbe_setup_fc_backplane_x550em_a |
AN-cntl write result overwritten by ixgbe_restart_an_internal_phy_x550em() → a failed flow-control advertisement write is returned as success |
| 2697-2702 | ixgbe_setup_sfi_x550a |
FLX_MASK_ST20 write result overwritten by the restart call |
| 2802-2806 | ixgbe_setup_mac_link_sfp_x550a |
CS4227 LINE mode write result masked by the "flush" read |
| 1812-1814 | ixgbe_setup_sgmii_fw |
rc = ixgbe_restart_an_internal_phy_x550em() computed and ignored; setup_link_speed result returned instead |
| 2644 | ixgbe_setup_mac_link_sfp_x550em |
ixgbe_setup_kr_speed_x550em() return fully ignored |
Effect: a write that failed (semaphore timeout, IOSF completion error, MDIO fault) is invisible to the caller — the driver proceeds believing the link/FC config was programmed. No kernel memory unsafety; misconfiguration/DoS-grade at most, physical-trigger (link event, cable insert). Upstream-identical code (Linux master, FreeBSD head).
fix.diff propagates the four droppable statuses (compile-validated on guest
/usr/src, -Werror, DF-3725_make_rc=0 — see ../DF-3724/fix_build.log).
Not runtime-verifiable: guest has no X550 (../DF-3723/env.txt).
DF-3725 — VERDICT
Status: inconclusive at runtime (no X550 hardware on guest). Source-certain error-propagation defects (DF-3671 family).
Root cause
The five call sites listed in README.md assign an MMIO/MDIO write result to a
status variable and then unconditionally overwrite it (or never read it),
so IXGBE_SUCCESS is returned for operations that failed. The strongest
instance is ixgbe_x550.c:4207-4212: after programming the pause
advertisement into KRM_AN_CNTL_1, the write status is dropped and the
function returns whatever ixgbe_restart_an_internal_phy_x550em() returns —
a failed FC-config write (e.g. IOSF completion error, reported by
ixgbe_iosf_wait at :1118-1121) is reported to the caller as success.
Bounds of impact
- No kernel memory unsafety (all writes are to device registers through checked-width register macros).
- Trigger is physical (link flap / cable insert calling setup_link paths via
ixgbe_handle_mod,ixgbe_setup_link), or driver init. A mis-programmed advertisement can wedge the link until the next reset — availability only. - Upstream-identical (Linux master / FreeBSD head carry the same drops), so this is shared-code hygiene, not a DragonFly regression.
Verification
- Guest has no Intel 10G NIC (../DF-3723/env.txt) — cannot execute the path.
fix.diffcompile-validated on guest/usr/srcmodule build with-Werror(DF-3725_make_rc=0, ../DF-3724/fix_build.log), reverted after.
Recommended fix
fix.diff (check-and-return after each dropped write; propagate rc in
ixgbe_setup_sgmii_fw).
Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.
Fix verification
inconclusivefix.diff applied to guest /usr/src; module rebuild clean under -Werror (DF-3725_make_rc=0); reverted. Runtime validation impossible (no X550 hardware).
../DF-3724/fix_build.log: DF-3725_make_rc=0 + md5 restored
Confirmed kernel references
Detail
Evidence (decisive lines)
VERDICT.md path:line trace; fix compile-validated DF-3725_make_rc=0 in ../DF-3724/fix_build.log
PoC changes
n/a (source-level)
Verified recommended fix
Check and return each dropped write status (fix.diff)
Verdict
Five X550 link/FC setup sites drop hardware-write status values and report success for failed writes (ixgbe_x550.c:4207-4212 setup_fc_backplane drops the AN-cntl pause-advertisement write; :2697-2702 setup_sfi; :2802-2806 CS4227 mode write masked by flush read; :1812-1814 setup_sgmii_fw ignores rc; :2644 setup_kr_speed ignored). DF-3671 family, error propagation only — no memory unsafety; upstream-identical. Runtime inconclusive: no X550 NIC on guest.
No comments yet.