Re: [PATCH 0/2] net: add USB CDC Ethernet NCSI support and fix unregister UAF

[Potin Lai]

On Tue, Sep 8, 2026 at 2:23 AM Andrew Lunn <andrew@xxxxxxx> wrote:
>
> On Mon, Sep 07, 2026 at 08:15:54PM +0800, Potin Lai wrote:
> > This series introduces NCSI (Network Controller Sideband Interface)
> > passthrough support for USB CDC Ethernet devices and fixes a
> > use-after-free race condition in the NCSI core unregistration path.
> >
> > In DPU (Data Processing Unit) platforms such as the NVIDIA BlueField
> > series, the Baseboard Management Controller (BMC) communicates with the
> > host or DPU via a dedicated USB CDC Ethernet connection for out-of-band
> > management traffic.
>
> I'm confused with the architecture here. What normally happens is the
> BMC has a standard Ethernet interface which outputs RGMII. That goes
> into what is in effect a little 3 port switch in the host
> interface. That switch allows packets to flow to the host, to the BMC,
> or out the PHY to the medium.
>
> Because the PHY is in effect being shared by two interfaces,
> management of that PHY becomes "Interesting". You don't want either of
> the interfaces setting the PHY down because it would cut the other off
> from the medium.
>
> What is the architecture then USB is used?
>
>      Andrew

Hi Andrew,

Thanks for the review. To clarify the architecture, it looks like this:

[ BMC ] <--(USB)--> [ SMA Controller ] <--(Internal)--> [ Shared NIC (CX9) ]

1. The USB Interface: Between the BMC and the shared NIC, there is an
   SMA controller. This controller emulates a standard USB CDC Ethernet
   device facing the BMC.

2. Passthrough (Bypass): The SMA controller acts as a transparent bridge.
   It simply passes through both standard network packets and NCSI
   control packets between the BMC's USB interface and the actual
   shared NIC.

3. PHY Management: Because of this architecture, the actual 3-port switch
   logic and the physical PHY management are handled entirely by the
   NIC/SMA hardware firmware on the DPU side.

>From the BMC's perspective, it only sees a point-to-point USB CDC Ethernet
device. The BMC driver does not have direct access to manage the shared
PHY's link state.

Best regards,
Potin