)]}'
{
  "commit": "6fb0a9d9071f1ff0cc5cfc0782302d9c90d642cb",
  "tree": "85ccd19c466526d014968985eb97b9c30a851e51",
  "parents": [
    "f97d8c7bab7843631206a114986c9059da03efeb"
  ],
  "author": {
    "name": "Chunfeng Song",
    "email": "springbreeze@stu.pku.edu.cn",
    "time": "Thu Sep 10 05:51:10 2026 +0000"
  },
  "committer": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Mon Sep 14 18:56:16 2026 -0700"
  },
  "message": "rust: net: phy: fix off-by-one bit positions in device status accessors\n\nThe hand-written bitfield offsets in is_link_up(), is_autoneg_enabled()\nand is_autoneg_completed() were correct when the abstraction was\nmerged: at that time autoneg, link, and autoneg_complete were at bits\n13, 14, and 15 of struct phy_device\u0027s first bitfield unit. Commit\n2796ff1e3dca (\"net: phy: add flag is_genphy_driven to struct phy_device\")\nlater inserted is_genphy_driven just before autoneg, shifting the three\nfields up by one, so the accessors now read:\n\n  is_link_up()           reads bit 14 \u003d autoneg\n  is_autoneg_enabled()   reads bit 13 \u003d is_genphy_driven\n  is_autoneg_completed() reads bit 15 \u003d link\n\nThe official ax88796b Rust driver uses all three accessors in its\nread_status() implementation, so it inherits the bug.\nphy_attach_direct() sets is_genphy_driven only when it falls back to\nthe generic driver, and ax88796b has a real driver, so\nis_genphy_driven stays 0. The broken is_autoneg_enabled() therefore\nreads bit 13 as 0, compares it against AUTONEG_ENABLE (1), and always\nreturns false, so read_status() never reaches the\nresolve_aneg_linkmode() call.\n\nThe ordinary bindgen accessors take \u0026self. Calling them through\n(*phydev).link() would create a shared reference to the complete\nbindings::phy_device, which is not appropriate for an object wrapped in\nOpaque.\n\nUse the bindgen-generated raw accessors (link_raw(), autoneg_raw(),\nand autoneg_complete_raw()) instead. They retain the bit positions and\nendianness handling generated from the C layout without creating a Rust\nreference to the complete phy_device. Drop the hand-written numbers\ntogether with the TODO comment that marked them as a stopgap.\n\nThe raw accessors are only emitted by bindgen 0.71 and later, and were\nadded at the Rust-for-Linux project\u0027s request, so this fix can only be\nbackported to stable branches whose minimum bindgen version is at least\nthat, hence the scope on the Cc: stable line below.\n\nFound by a static equivalence audit (C2RustDrv, a C-to-Rust driver\nmigration tool) that compares hand-written bitfield offsets against\nthe bindgen layout of struct phy_device. Verified by building the\nbindings and checking the generated accessors; no runtime testing was\npossible without PHY hardware.\n\nFixes: 2796ff1e3dca (\"net: phy: add flag is_genphy_driven to struct phy_device\")\nCc: stable@vger.kernel.org # Only 7.1.y and later (requires bindgen\u0027s raw pointer accessors).\nLink: https://github.com/rust-lang/rust-bindgen/issues/2674\nSigned-off-by: Chunfeng Song \u003cspringbreeze@stu.pku.edu.cn\u003e\nReviewed-by: FUJITA Tomonori \u003cfujita.tomonori@gmail.com\u003e\nLink: https://patch.msgid.link/20260910055110.167110-1-springbreeze@stu.pku.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "956cda573ddba304d8d6a44e7953c2398bc4f4b0",
      "old_mode": 33188,
      "old_path": "rust/kernel/net/phy.rs",
      "new_id": "c4e7b1d6c6f4aab170c7b7894650781c24236e59",
      "new_mode": 33188,
      "new_path": "rust/kernel/net/phy.rs"
    }
  ]
}