qualcommax: qca_ppe: fix BPDU trapping and CPU transmission

The STP APP_CTRL rule uses 0x93fc for its third word. CMD occupies
bits 16:15 of that word, so this selects DROP (1), not the intended
REDIRECT_TO_CPU (3). Incoming BPDUs never reach the bridge protocol
implementation even though ordinary traffic continues to work.

Correcting only CMD exposes another issue: the 0x7f ingress port mask
includes CPU port 0. CPU-originated BPDUs are then trapped back to the
CPU rather than transmitted to the selected external port. Exclude
the CPU and SoC-specific loopback ports, deriving the remaining mask
from the port count. Use named fields for the third word so the action
and port selection are explicit.

On an AX3600/IPQ8074 running 6.18.44, register readback confirmed the
original rule. A guarded runtime test of 0x193fc restored BPDU reception
but captured locally generated BPDUs on the CPU RX path. With 0x193f4,
those RX reflections disappeared and the adjacent switch received
bridge protocol traffic again. Reapplying that value automatically
after a reboot established RSTP with the upstream root. The patched
driver also builds against the matching aarch64 kernel SDK.

IPQ6018's generated mask was checked, but not tested on hardware.

Fixes: 142104bb90 ("qualcommax: add PPE driver")
Assisted-by: OpenAI Codex
Signed-off-by: Jan Leon <Jan.gaschler@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25063
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit is contained in:
Jan Leon
2026-09-07 15:59:08 +02:00
committed by Robert Marko
parent 74eb10ed5c
commit a34ff932fa
2 changed files with 17 additions and 1 deletions
@@ -276,6 +276,12 @@
#define PPE_RFDB_TBL(idx) (PPE_L2_BASE + 0x1000 + (idx) * 0x8)
#define PPE_APP_CTRL(idx) (PPE_L2_BASE + 0x1400 + (idx) * 0x10)
/* Fields in the third 32-bit word of APP_CTRL. */
#define PPE_APP_CTRL_PORT_BITMAP_EN BIT(2)
#define PPE_APP_CTRL_PORT_BITMAP GENMASK(10, 3)
#define PPE_APP_CTRL_STP_BYPASS BIT(12)
#define PPE_APP_CTRL_CMD GENMASK(16, 15)
#define PPE_APP_CTRL_REDIRECT_CPU 3
#define PPE_VSI_TBL(vsi) (PPE_L2_BASE + 0x1800 + (vsi) * 0x10)
#define PPE_VSI_TBL_MEMBER GENMASK(7, 0)
@@ -1683,6 +1683,12 @@ static void ppe_mac_hw_init(struct qca_ppe_priv *priv)
static void ppe_ctrlpkt_init(struct qca_ppe_priv *priv)
{
u32 ports;
/* Trap external BPDUs, but let CPU-originated BPDUs reach the wire. */
ports = GENMASK(priv->data->num_ports - 1, 0) &
~(BIT(QCA_PPE_CPU_PORT) | BIT(priv->data->loopback_port));
/* RFDB_TBL[31]: STP multicast MAC 01:80:c2:00:00:00 */
regmap_write(priv->regmap, PPE_RFDB_TBL(31), 0xc2000000);
regmap_write(priv->regmap, PPE_RFDB_TBL(31) + 4, 0x00010180);
@@ -1690,7 +1696,11 @@ static void ppe_ctrlpkt_init(struct qca_ppe_priv *priv)
/* APP_CTRL[0]: match RFDB profile 31, bypass STP, redirect to CPU */
regmap_write(priv->regmap, PPE_APP_CTRL(0), 0x00000003);
regmap_write(priv->regmap, PPE_APP_CTRL(0) + 4, 0x00000002);
regmap_write(priv->regmap, PPE_APP_CTRL(0) + 8, 0x000093fc);
regmap_write(priv->regmap, PPE_APP_CTRL(0) + 8,
PPE_APP_CTRL_PORT_BITMAP_EN |
FIELD_PREP(PPE_APP_CTRL_PORT_BITMAP, ports) |
PPE_APP_CTRL_STP_BYPASS |
FIELD_PREP(PPE_APP_CTRL_CMD, PPE_APP_CTRL_REDIRECT_CPU));
}
static int ppe_ipq6018_mux_setup(struct qca_ppe_priv *priv)