* Re: [PATCH net-next] ipv6: move IFA_F_PERMANENT percpu allocation in process scope
From: Jakub Kicinski @ 2026-03-27 1:35 UTC (permalink / raw)
To: Paolo Abeni
Cc: netdev, David S. Miller, David Ahern, Eric Dumazet, Simon Horman
In-Reply-To: <8c8bfe2e1a324e501f0e15fef404a77443fd8caf.1774365668.git.pabeni@redhat.com>
On Tue, 24 Mar 2026 16:22:08 +0100 Paolo Abeni wrote:
> + while (!list_empty(&tmp_addr_list)) {
> + ifp = list_first_entry(&tmp_addr_list,
> + struct inet6_ifaddr, if_list_aux);
> + list_del(&ifp->if_list_aux);
> +
> + if (fixup_permanent_addr(net, idev, ifp) < 0) {
> in6_ifa_hold(ifp);
> ipv6_del_addr(ifp);
> - write_lock_bh(&idev->lock);
>
> net_info_ratelimited("%s: Failed to add prefix route for address %pI6c; dropping\n",
> idev->dev->name, &ifp->addr);
> }
Sashiko points out that there's a UAF on the ifp->addr in the print
statement. Could you reorder these in net first, to avoid the conflict?
--
pw-bot: cr
^ permalink raw reply
* Re: [PATCH net] ipv6: fix data race in fib6_metric_set() using cmpxchg
From: Hangbin Liu @ 2026-03-27 1:37 UTC (permalink / raw)
To: Eric Dumazet
Cc: Jiayuan Chen, David S. Miller, David Ahern, Jakub Kicinski,
Paolo Abeni, Simon Horman, David Ahern, netdev, linux-kernel,
Fei Liu
In-Reply-To: <CANn89i+wuKmY7NNoe+RNPN0XZNHvzTDOyKDSwA3QJZE3BMgVfQ@mail.gmail.com>
On Thu, Mar 26, 2026 at 07:01:36AM -0700, Eric Dumazet wrote:
> On Thu, Mar 26, 2026 at 6:44 AM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
> >
> >
> > On 3/26/26 9:13 PM, Hangbin Liu wrote:
> > > On Thu, Mar 26, 2026 at 05:05:57AM -0700, Eric Dumazet wrote:
> > >>> diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
> > >>> index dd26657b6a4a..64de761f40d5 100644
> > >>> --- a/net/ipv6/ip6_fib.c
> > >>> +++ b/net/ipv6/ip6_fib.c
> > >>> @@ -730,14 +730,16 @@ void fib6_metric_set(struct fib6_info *f6i, int metric, u32 val)
> > >>> if (!f6i)
> > >>> return;
> > >>>
> > >>> - if (f6i->fib6_metrics == &dst_default_metrics) {
> > >>> + if (READ_ONCE(f6i->fib6_metrics) == &dst_default_metrics) {
> > >>> + struct dst_metrics *dflt = (struct dst_metrics *)&dst_default_metrics;
> > >>> struct dst_metrics *p = kzalloc_obj(*p, GFP_ATOMIC);
> > >>>
> > >>> if (!p)
> > >>> return;
> > >>>
> > >>> refcount_set(&p->refcnt, 1);
> > >>> - f6i->fib6_metrics = p;
> > >>> + if (cmpxchg(&f6i->fib6_metrics, dflt, p) != dflt)
> > >>> + kfree(p);
> > >>> }
> > >>>
> > >> The following line should happen before the cmpxchg(),
> > >> ->metrics[X] accesses also need READ_ONCE()/WRITE_ONCE() annotations.
> > > Hi Eric,
> > >
> > > Jiayuan also suggested to using READ_ONCE()/WRITE_ONCE() for metrics[X]
> > > accesses. But I don't get why this line should happen before the cmpxchg(),
> > > Would you please help explain?
> >
> >
> > I think what Eric means is something like this:
> >
> >
> > ...
> > struct dst_metrics *p = kzalloc_obj(*p, GFP_ATOMIC);
> >
> > if (!p)
> > return;
> >
> > p->metrics[metric - 1] = val;
> > refcount_set(&p->refcnt, 1);
> > if (cmpxchg(&f6i->fib6_metrics, dflt, p) != dflt)
> > kfree(p);
> > else
> > return;
> > }
> > }
> >
> > m = READ_ONCE(f6i->fib6_metrics);
> > WRITE_ONCE(m->metrics[metric - 1], val);
> >
> >
> > Since p is private data before being published via cmpxchg(), we can
> > safely initialize its metrics beforehand. This way we don't need to
> > worry about concurrent access to f6i->fib6_metrics->metrics[] during
> > initialization. Right?
>
> Yes. Think about RCU (Read Copy Update) rules.
>
> We allocate an object, and populate it, then make sure changes are
> committed, before publishing the new pointer.
>
> Othewise an other cpu could read a 0 metric, while we wanted something else.
Ah, got it. Thanks for the explanation.
Regards
Hangbin
^ permalink raw reply
* Re: [PATCH net-next] sfc: add transmit timestamping support
From: Jakub Kicinski @ 2026-03-27 1:39 UTC (permalink / raw)
To: Breno Leitao
Cc: Izabela Bakollari, Edward Cree, Andrew Lunn, David S. Miller,
Eric Dumazet, Paolo Abeni, netdev, linux-net-drivers,
linux-kernel
In-Reply-To: <acOrt0LqV__xh_93@gmail.com>
On Wed, 25 Mar 2026 02:35:12 -0700 Breno Leitao wrote:
> On Tue, Mar 24, 2026 at 05:08:21PM +0100, Izabela Bakollari wrote:
> > Enable software TX Timestamping. The out of tree driver
> > also implements this.
>
> "The out of tree driver also implements this" is not the most technical
> justification.
+1 it's an odd thing to put in the commit msg.
Please fix and repost (keep Ed's tag)
> > diff --git a/drivers/net/ethernet/sfc/ethtool.c b/drivers/net/ethernet/sfc/ethtool.c
> > index 362388754a29..c0038b942913 100644
> > --- a/drivers/net/ethernet/sfc/ethtool.c
> > +++ b/drivers/net/ethernet/sfc/ethtool.c
> > @@ -231,6 +231,8 @@ static int efx_ethtool_get_ts_info(struct net_device *net_dev,
> > {
> > struct efx_nic *efx = efx_netdev_priv(net_dev);
> >
> > + ts_info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE;
>
> Don't you need to append SOF_TIMESTAMPING_TX_SOFTWARE instead of
> assinging it?
>
> ts_info->so_timestamping |= SOF_TIMESTAMPING_TX_SOFTWARE;
Either way is fine IMHO unless you see a specific reason Breno?
--
pw-bot: cr
^ permalink raw reply
* Re: [PATCH net-next v2] docs/mlx5: Fix typo subfuction
From: patchwork-bot+netdevbpf @ 2026-03-27 1:40 UTC (permalink / raw)
To: Ryohei Kinugawa
Cc: rrameshbabu, saeedm, leon, tariqt, mbloch, davem, edumazet, kuba,
pabeni, horms, corbet, skhan, netdev, linux-rdma, linux-doc, joe
In-Reply-To: <20260324053416.70166-1-ryohei.kinugawa@gmail.com>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 24 Mar 2026 14:34:10 +0900 you wrote:
> Fix two typos:
> - 'Subfunctons' -> 'Subfunctions'
> - 'subfuction' -> 'subfunction'
>
> Reviewed-by: Joe Damato <joe@dama.to>
> Signed-off-by: Ryohei Kinugawa <ryohei.kinugawa@gmail.com>
>
> [...]
Here is the summary with links:
- [net-next,v2] docs/mlx5: Fix typo subfuction
https://git.kernel.org/netdev/net-next/c/ed8edcd47529
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next v2 4/4] net: phy: Introduce Airoha AN8801/R Gigabit Ethernet PHY driver
From: Jakub Kicinski @ 2026-03-27 1:43 UTC (permalink / raw)
To: Louis-Alexis Eyraud
Cc: Andrew Lunn, Andrew Lunn, David S. Miller, Eric Dumazet,
Paolo Abeni, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
AngeloGioacchino Del Regno, Heiner Kallweit, Russell King,
kevin-kw.huang, macpaul.lin, matthias.bgg, kernel, netdev,
devicetree, linux-arm-kernel, linux-mediatek, linux-kernel
In-Reply-To: <3688a285-7f98-4afa-80ad-697094cd7b97@lunn.ch>
On Thu, 26 Mar 2026 13:47:43 +0100 Andrew Lunn wrote:
> > + if (phydev->link && prev_speed != phydev->speed) {
> > + val = phydev->speed == SPEED_1000 ?
> > + AN8801_BPBUS_LINK_MODE_1000 : 0;
> > +
> > + return an8801_buckpbus_reg_rmw(phydev,
> > + AN8801_BPBUS_REG_LINK_MODE,
> > + AN8801_BPBUS_LINK_MODE_1000,
> > + val);
> > + };
>
> This is unusual. What is it doing? Please add a comment.
Also - nit spurious ; after if () {}
^ permalink raw reply
* Re: [PATCH net-next v5] net: pppoe: implement GRO/GSO support
From: Qingfang Deng @ 2026-03-27 1:48 UTC (permalink / raw)
To: Xin Long
Cc: Jakub Kicinski, Felix Fietkau, linux-ppp, Andrew Lunn,
David S. Miller, Eric Dumazet, Paolo Abeni, David Ahern,
Simon Horman, netdev, linux-kernel, Richard Gobert
In-Reply-To: <CADvbK_f3LwEt+-BG-1Pcr4jMn6Jxry+0p-Fu_s0C6Px+F_NHCA@mail.gmail.com>
Hi,
On Thu, Mar 26, 2026 at 10:44 PM Xin Long <lucien.xin@gmail.com> wrote:
>
> On Thu, Mar 26, 2026 at 10:43 AM Xin Long <lucien.xin@gmail.com> wrote:
> >
> > On Wed, Mar 25, 2026 at 10:43 PM Qingfang Deng <dqfext@gmail.com> wrote:
> > >
> > > Hi all,
> > >
> > > In some cases (such as BIG TCP) a GRO skb length can overflow a u16,
> > > then what should I do with the u16 length field here?
> >
> > I think you can either add a check in pppoe_gro_complete() to ensure
> sorry, I meant add a check in pppoe_gro_receive().
> > the aggregated size does not exceed U16_MAX, avoiding BIG TCP
> > behavior; Or, set phdr->length to 0 and rely on skb->len to determine
> > the actual length, as done in BIG TCP itself.
In my v6 patch, I set phdr->length to 0xFFFF. Is that okay?
https://lore.kernel.org/netdev/20260326081127.61229-1-dqfext@gmail.com/
^ permalink raw reply
* Re: [PATCH net] mpls: add seqcount to protect the platform_label{,s} pair
From: patchwork-bot+netdevbpf @ 2026-03-27 1:50 UTC (permalink / raw)
To: Sabrina Dubroca
Cc: netdev, ebiederm, kuniyu, gnault, tanyuan98, yifanwucs,
tomapufckgml, bird
In-Reply-To: <cd8fca15e3eb7e212b094064cd83652e20fd9d31.1774284088.git.sd@queasysnail.net>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 24 Mar 2026 00:25:57 +0100 you wrote:
> The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have
> an inconsistent view of platform_labels vs platform_label in case of a
> concurrent resize (resize_platform_label_table, under
> platform_mutex). This can lead to OOB accesses.
>
> This patch adds a seqcount, so that we get a consistent snapshot.
>
> [...]
Here is the summary with links:
- [net] mpls: add seqcount to protect the platform_label{,s} pair
https://git.kernel.org/netdev/net/c/629ec78ef860
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next v5 0/2] Add support for per-route seg6 tunsrc
From: patchwork-bot+netdevbpf @ 2026-03-27 1:50 UTC (permalink / raw)
To: Justin Iurman
Cc: netdev, andrea.mayer, davem, edumazet, kuba, pabeni, horms,
justin.iurman, nicolas.dichtel, stefano.salsano
In-Reply-To: <20260324091434.359341-1-justin.iurman@6wind.com>
Hello:
This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 24 Mar 2026 10:14:32 +0100 you wrote:
> This series adds support for the new per-route seg6 "tunsrc" parameter.
> Selftests are extended to make sure it works as expected.
>
> Example with the iproute2-next companion patch:
>
> ip -6 r a 2001:db8:1::/64 encap seg6 mode encap tunsrc 2001:db8:ab::
> segs 2001:db8:42::1,2001:db8:ffff::2 dev eth0
>
> [...]
Here is the summary with links:
- [net-next,v5,1/2] seg6: add per-route tunnel source address
https://git.kernel.org/netdev/net-next/c/78723a62b969
- [net-next,v5,2/2] selftests: add check for seg6 tunsrc
https://git.kernel.org/netdev/net-next/c/2d047673d374
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next] net: mctp: avoid copy in fragmentation loop for near-MTU messages
From: patchwork-bot+netdevbpf @ 2026-03-27 1:50 UTC (permalink / raw)
To: Jeremy Kerr; +Cc: matt, davem, edumazet, kuba, pabeni, horms, netdev, yuanzm2
In-Reply-To: <20260324-dev-mtu-copy-v1-1-7af6bd7027d3@codeconstruct.com.au>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 24 Mar 2026 15:19:56 +0800 you wrote:
> Currently, we incorrectly send messages that are within 4 bytes (a
> struct mctp_hdr) smaller than the MTU through mctp_do_fragment_route().
> This has no effect on the actual fragmentation, as we will still send as
> one packet, but unnecessarily copies the original skb into a new
> single-fragment skb.
>
> Instead of having the MTU comparisons in both mctp_local_output() and
> mctp_do_fragment_route(), feed all local messages through the latter,
> and add the single-packet optimisation there.
>
> [...]
Here is the summary with links:
- [net-next] net: mctp: avoid copy in fragmentation loop for near-MTU messages
https://git.kernel.org/netdev/net-next/c/e1877cf62311
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH bpf v2 2/2] selftests/bpf: Add protocol check test for bpf_sk_assign_tcp_reqsk()
From: Jiayuan Chen @ 2026-03-27 1:52 UTC (permalink / raw)
To: Kuniyuki Iwashima, Jiayuan Chen
Cc: netdev, Jiayuan Chen, Martin KaFai Lau, Daniel Borkmann,
John Fastabend, Stanislav Fomichev, Alexei Starovoitov,
Andrii Nakryiko, Eduard Zingerman, Song Liu, Yonghong Song,
KP Singh, Hao Luo, Jiri Olsa, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Shuah Khan, bpf,
linux-kernel, linux-kselftest
In-Reply-To: <CAAVpQUAKAeU8SXpKQwcQS6P6aFJ_BxmevcrK=Hs+_rf_mnaLXA@mail.gmail.com>
On 3/27/26 1:33 AM, Kuniyuki Iwashima wrote:
[...]
>> for (i = 0; i < ARRAY_SIZE(test_cases); i++) {
>> @@ -145,6 +145,82 @@ void test_tcp_custom_syncookie(void)
>>
>> destroy_skel:
>> system("tc qdisc del dev lo clsact");
>> + test_tcp_custom_syncookie__destroy(skel);
>> +}
>>
>> +/* Test: bpf_sk_assign_tcp_reqsk() should reject non-TCP skb.
>> + *
>> + * Send a UDP packet through TC ingress where a BPF program calls
>> + * bpf_sk_assign_tcp_reqsk() on it. The kfunc should return an error
>> + * because the skb carries UDP, not TCP.
>> + */
>> +void test_tcp_custom_syncookie_protocol_check(void)
>> +{
>> + int tcp_server = -1, udp_server = -1, udp_client = -1;
>> + struct test_tcp_custom_syncookie *skel;
>> + struct sockaddr_in udp_addr;
>> + char buf[32] = "test";
>> + int udp_port, ret;
>> +
>> + if (setup_netns())
>> + return;
>> +
>> + skel = test_tcp_custom_syncookie__open_and_load();
>> + if (!ASSERT_OK_PTR(skel, "open_and_load"))
>> + return;
>> +
>> + /* Create a TCP listener so the BPF can find a LISTEN socket */
>> + tcp_server = start_server(AF_INET, SOCK_STREAM, "127.0.0.1", 0, 0);
> Can you add IPv6 test as well ?
> You can reuse test_tcp_custom_syncookie_case[].
>
>
>> + if (!ASSERT_NEQ(tcp_server, -1, "start tcp_server"))
>> + goto destroy_skel;
>> +
>> + /* Create a UDP server to receive the packet as synchronization */
>> + udp_server = start_server(AF_INET, SOCK_DGRAM, "127.0.0.1", 0, 0);
> You can specify the port to get_socket_local_port(tcp_server),
>
>
>> + if (!ASSERT_NEQ(udp_server, -1, "start udp_server"))
>> + goto close_tcp;
>> +
>> + skel->bss->tcp_listener_port = ntohs(get_socket_local_port(tcp_server));
>> + udp_port = ntohs(get_socket_local_port(udp_server));
>> + skel->bss->udp_test_port = udp_port;
> then the 3 lines above will be unnecessary,
>
>
>> +
>> + ret = bpf_program__fd(skel->progs.tcp_custom_syncookie_badproto);
>> + if (setup_tc(ret))
>> + goto close_udp_server;
>> +
>> + udp_client = socket(AF_INET, SOCK_DGRAM, 0);
>> + if (!ASSERT_NEQ(udp_client, -1, "udp socket"))
>> + goto cleanup_tc;
>> +
>> + memset(&udp_addr, 0, sizeof(udp_addr));
>> + udp_addr.sin_family = AF_INET;
>> + udp_addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
>> + udp_addr.sin_port = htons(udp_port);
> and you can reuse get_socket_local_port(tcp_server) here too.
>
>
>> +
>> [...]
>> + iph = (struct iphdr *)(eth + 1);
>> + if (iph + 1 > data_end)
>> + return TC_ACT_OK;
>> +
>> + if (iph->protocol != IPPROTO_UDP)
>> + return TC_ACT_OK;
>> +
>> + udp = (struct udphdr *)(iph + 1);
>> + if (udp + 1 > data_end)
>> + return TC_ACT_OK;
>> +
>> + if (bpf_ntohs(udp->dest) != udp_test_port)
>> + return TC_ACT_OK;
> You don't need to worry about other program sending UDP
> packets in this netns created by unshare().
>
>
>> +
>> + udp_intercepted = true;
>> +
>> + tuple.ipv4.saddr = iph->saddr;
>> + tuple.ipv4.daddr = iph->daddr;
>> + tuple.ipv4.sport = udp->source;
>> + tuple.ipv4.dport = bpf_htons(tcp_listener_port);
> and you can simply reuse dport here too.
>
Thanks for the review. I'll update the code to address all these points.
^ permalink raw reply
* [PATCH 6.1.y 3/3] net: phy: fix phy_uses_state_machine()
From: Rajani Kantha @ 2026-03-27 1:53 UTC (permalink / raw)
To: gregkh, stable, rmk+kernel
Cc: patches, linux-kernel, andrew, hkallweit1, linux, davem, edumazet,
kuba, pabeni, vladimir.oltean, netdev, xu.yang_2
From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
[ Upstream commit e0d1c55501d377163eb57feed863777ed1c973ad ]
The blamed commit changed the conditions which phylib uses to stop
and start the state machine in the suspend and resume paths, and
while improving it, has caused two issues.
The original code used this test:
phydev->attached_dev && phydev->adjust_link
and if true, the paths would handle the PHY state machine. This test
evaluates true for normal drivers that are using phylib directly
while the PHY is attached to the network device, but false in all
other cases, which include the following cases:
- when the PHY has never been attached to a network device.
- when the PHY has been detached from a network device (as phy_detach()
sets phydev->attached_dev to NULL, phy_disconnect() calls
phy_detach() and additionally sets phydev->adjust_link NULL.)
- when phylink is using the driver (as phydev->adjust_link is NULL.)
Only the third case was incorrect, and the blamed commit attempted to
fix this by changing this test to (simplified for brevity, see
phy_uses_state_machine()):
phydev->phy_link_change == phy_link_change ?
phydev->attached_dev && phydev->adjust_link : true
However, this also incorrectly evaluates true in the first two cases.
Fix the first case by ensuring that phy_uses_state_machine() returns
false when phydev->phy_link_change is NULL.
Fix the second case by ensuring that phydev->phy_link_change is set to
NULL when phy_detach() is called.
Reported-by: Xu Yang <xu.yang_2@nxp.com>
Link: https://lore.kernel.org/r/20250806082931.3289134-1-xu.yang_2@nxp.com
Fixes: fc75ea20ffb4 ("net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY")
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/E1uvMEz-00000003Aoe-3qWe@rmk-PC.armlinux.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Rajani Kantha <681739313@139.com>
---
drivers/net/phy/phy_device.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index fd49616c6608..9b0c88c19795 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -270,8 +270,7 @@ static bool phy_uses_state_machine(struct phy_device *phydev)
if (phydev->phy_link_change == phy_link_change)
return phydev->attached_dev && phydev->adjust_link;
- /* phydev->phy_link_change is implicitly phylink_phy_change() */
- return true;
+ return !!phydev->phy_link_change;
}
static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
@@ -1791,6 +1790,8 @@ void phy_detach(struct phy_device *phydev)
phydev->attached_dev->phydev = NULL;
phydev->attached_dev = NULL;
}
+
+ phydev->phy_link_change = NULL;
phydev->phylink = NULL;
if (phydev->mdio.dev.driver)
--
2.34.1
^ permalink raw reply related
* [PATCH 6.1.y 1/3] net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend()
From: Rajani Kantha @ 2026-03-27 1:51 UTC (permalink / raw)
To: gregkh, stable, vladimir.oltean
Cc: patches, linux-kernel, andrew, hkallweit1, linux, davem, edumazet,
kuba, pabeni, netdev, rmk+kernel
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit f40a673d6b4a128fe95dd9b8c3ed02da50a6a862 ]
In an upcoming change, mdio_bus_phy_may_suspend() will need to
distinguish a phylib-based PHY client from a phylink PHY client.
For that, it will need to compare the phydev->phy_link_change() function
pointer with the eponymous phy_link_change() provided by phylib.
To avoid forward function declarations, the default PHY link state
change method should be moved upwards. There is no functional change
associated with this patch, it is only to reduce the noise from a real
bug fix.
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://patch.msgid.link/20250407093900.2155112-1-vladimir.oltean@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Minor context change fixed ]
Signed-off-by: Rajani Kantha <681739313@139.com>
---
drivers/net/phy/phy_device.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 11839dca8f56..7d19857a6dc4 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -234,6 +234,19 @@ static struct phy_driver genphy_driver;
static LIST_HEAD(phy_fixup_list);
static DEFINE_MUTEX(phy_fixup_lock);
+static void phy_link_change(struct phy_device *phydev, bool up)
+{
+ struct net_device *netdev = phydev->attached_dev;
+
+ if (up)
+ netif_carrier_on(netdev);
+ else
+ netif_carrier_off(netdev);
+ phydev->adjust_link(netdev);
+ if (phydev->mii_ts && phydev->mii_ts->link_state)
+ phydev->mii_ts->link_state(phydev->mii_ts, phydev);
+}
+
static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
{
struct device_driver *drv = phydev->mdio.dev.driver;
@@ -1036,19 +1049,6 @@ struct phy_device *phy_find_first(struct mii_bus *bus)
}
EXPORT_SYMBOL(phy_find_first);
-static void phy_link_change(struct phy_device *phydev, bool up)
-{
- struct net_device *netdev = phydev->attached_dev;
-
- if (up)
- netif_carrier_on(netdev);
- else
- netif_carrier_off(netdev);
- phydev->adjust_link(netdev);
- if (phydev->mii_ts && phydev->mii_ts->link_state)
- phydev->mii_ts->link_state(phydev->mii_ts, phydev);
-}
-
/**
* phy_prepare_link - prepares the PHY layer to monitor link status
* @phydev: target phy_device struct
--
2.34.1
^ permalink raw reply related
* [PATCH 6.1.y 2/3] net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY
From: Rajani Kantha @ 2026-03-27 1:52 UTC (permalink / raw)
To: gregkh, stable, vladimir.oltean
Cc: patches, linux-kernel, andrew, hkallweit1, linux, davem, edumazet,
kuba, pabeni, matthias.bgg, f.fainelli, netdev, linux-arm-kernel,
linux-mediatek, wei.fang
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit fc75ea20ffb452652f0d4033f38fe88d7cfdae35 ]
DSA has 2 kinds of drivers:
1. Those who call dsa_switch_suspend() and dsa_switch_resume() from
their device PM ops: qca8k-8xxx, bcm_sf2, microchip ksz
2. Those who don't: all others. The above methods should be optional.
For type 1, dsa_switch_suspend() calls dsa_user_suspend() -> phylink_stop(),
and dsa_switch_resume() calls dsa_user_resume() -> phylink_start().
These seem good candidates for setting mac_managed_pm = true because
that is essentially its definition [1], but that does not seem to be the
biggest problem for now, and is not what this change focuses on.
Talking strictly about the 2nd category of DSA drivers here (which
do not have MAC managed PM, meaning that for their attached PHYs,
mdio_bus_phy_suspend() and mdio_bus_phy_resume() should run in full),
I have noticed that the following warning from mdio_bus_phy_resume() is
triggered:
WARN_ON(phydev->state != PHY_HALTED && phydev->state != PHY_READY &&
phydev->state != PHY_UP);
because the PHY state machine is running.
It's running as a result of a previous dsa_user_open() -> ... ->
phylink_start() -> phy_start() having been initiated by the user.
The previous mdio_bus_phy_suspend() was supposed to have called
phy_stop_machine(), but it didn't. So this is why the PHY is in state
PHY_NOLINK by the time mdio_bus_phy_resume() runs.
mdio_bus_phy_suspend() did not call phy_stop_machine() because for
phylink, the phydev->adjust_link function pointer is NULL. This seems a
technicality introduced by commit fddd91016d16 ("phylib: fix PAL state
machine restart on resume"). That commit was written before phylink
existed, and was intended to avoid crashing with consumer drivers which
don't use the PHY state machine - phylink always does, when using a PHY.
But phylink itself has historically not been developed with
suspend/resume in mind, and apparently not tested too much in that
scenario, allowing this bug to exist unnoticed for so long. Plus, prior
to the WARN_ON(), it would have likely been invisible.
This issue is not in fact restricted to type 2 DSA drivers (according to
the above ad-hoc classification), but can be extrapolated to any MAC
driver with phylink and MDIO-bus-managed PHY PM ops. DSA is just where
the issue was reported. Assuming mac_managed_pm is set correctly, a
quick search indicates the following other drivers might be affected:
$ grep -Zlr PHYLINK_NETDEV drivers/ | xargs -0 grep -L mac_managed_pm
drivers/net/ethernet/atheros/ag71xx.c
drivers/net/ethernet/microchip/sparx5/sparx5_main.c
drivers/net/ethernet/microchip/lan966x/lan966x_main.c
drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
drivers/net/ethernet/freescale/ucc_geth.c
drivers/net/ethernet/freescale/enetc/enetc_pf_common.c
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
drivers/net/ethernet/marvell/mvneta.c
drivers/net/ethernet/marvell/prestera/prestera_main.c
drivers/net/ethernet/mediatek/mtk_eth_soc.c
drivers/net/ethernet/altera/altera_tse_main.c
drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c
drivers/net/ethernet/meta/fbnic/fbnic_phylink.c
drivers/net/ethernet/tehuti/tn40_phy.c
drivers/net/ethernet/mscc/ocelot_net.c
Make the existing conditions dependent on the PHY device having a
phydev->phy_link_change() implementation equal to the default
phy_link_change() provided by phylib. Otherwise, we implicitly know that
the phydev has the phylink-provided phylink_phy_change() callback, and
when phylink is used, the PHY state machine always needs to be stopped/
started on the suspend/resume path. The code is structured as such that
if phydev->phy_link_change() is absent, it is a matter of time until the
kernel will crash - no need to further complicate the test.
Thus, for the situation where the PM is not managed by the MAC, we will
make the MDIO bus PM ops treat identically the phylink-controlled PHYs
with the phylib-controlled PHYs where an adjust_link() callback is
supplied. In both cases, the MDIO bus PM ops should stop and restart the
PHY state machine.
[1] https://lore.kernel.org/netdev/Z-1tiW9zjcoFkhwc@shell.armlinux.org.uk/
Fixes: 744d23c71af3 ("net: phy: Warn about incorrect mdio_bus_phy_resume() state")
Reported-by: Wei Fang <wei.fang@nxp.com>
Tested-by: Wei Fang <wei.fang@nxp.com>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20250407094042.2155633-1-vladimir.oltean@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Rajani Kantha <681739313@139.com>
---
drivers/net/phy/phy_device.c | 31 +++++++++++++++++++++++++++++--
1 file changed, 29 insertions(+), 2 deletions(-)
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 7d19857a6dc4..fd49616c6608 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -247,6 +247,33 @@ static void phy_link_change(struct phy_device *phydev, bool up)
phydev->mii_ts->link_state(phydev->mii_ts, phydev);
}
+/**
+ * phy_uses_state_machine - test whether consumer driver uses PAL state machine
+ * @phydev: the target PHY device structure
+ *
+ * Ultimately, this aims to indirectly determine whether the PHY is attached
+ * to a consumer which uses the state machine by calling phy_start() and
+ * phy_stop().
+ *
+ * When the PHY driver consumer uses phylib, it must have previously called
+ * phy_connect_direct() or one of its derivatives, so that phy_prepare_link()
+ * has set up a hook for monitoring state changes.
+ *
+ * When the PHY driver is used by the MAC driver consumer through phylink (the
+ * only other provider of a phy_link_change() method), using the PHY state
+ * machine is not optional.
+ *
+ * Return: true if consumer calls phy_start() and phy_stop(), false otherwise.
+ */
+static bool phy_uses_state_machine(struct phy_device *phydev)
+{
+ if (phydev->phy_link_change == phy_link_change)
+ return phydev->attached_dev && phydev->adjust_link;
+
+ /* phydev->phy_link_change is implicitly phylink_phy_change() */
+ return true;
+}
+
static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
{
struct device_driver *drv = phydev->mdio.dev.driver;
@@ -307,7 +334,7 @@ static __maybe_unused int mdio_bus_phy_suspend(struct device *dev)
* may call phy routines that try to grab the same lock, and that may
* lead to a deadlock.
*/
- if (phydev->attached_dev && phydev->adjust_link)
+ if (phy_uses_state_machine(phydev))
phy_stop_machine(phydev);
if (!mdio_bus_phy_may_suspend(phydev))
@@ -361,7 +388,7 @@ static __maybe_unused int mdio_bus_phy_resume(struct device *dev)
}
}
- if (phydev->attached_dev && phydev->adjust_link)
+ if (phy_uses_state_machine(phydev))
phy_start_machine(phydev);
return 0;
--
2.34.1
^ permalink raw reply related
* Re: [PATCH net-next] selftests: net: Remove unnecessary backslashes in fq_band_pktlimit.sh
From: patchwork-bot+netdevbpf @ 2026-03-27 2:00 UTC (permalink / raw)
To: Yohei Kojima
Cc: davem, edumazet, kuba, pabeni, horms, shuah, netdev,
linux-kselftest, linux-kernel
In-Reply-To: <dd0bbd48cdf468da56ec34fd61cecd4d2111d7ba.1774372510.git.yk@y-koj.net>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 25 Mar 2026 02:20:28 +0900 you wrote:
> Address "grep: warning: stray \ before white space" warning from GNU
> grep 3.12. This warns the misplaced backslashes before whitespaces
> (e.g. \\' ' or '\ ') which leads to unspecified behavior [1].
>
> We can just remove the backslashes before whitespaces as POSIX says:
>
> Enclosing characters in single-quotes ('') shall preserve the literal
> value of each character within the single-quotes.
>
> [...]
Here is the summary with links:
- [net-next] selftests: net: Remove unnecessary backslashes in fq_band_pktlimit.sh
https://git.kernel.org/netdev/net-next/c/5f70b0aa08ad
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next 0/2] net: dsa: microchip: Small cleanups for ksz9477 SGMII
From: patchwork-bot+netdevbpf @ 2026-03-27 2:00 UTC (permalink / raw)
To: Maxime Chevallier
Cc: andrew, kuba, davem, edumazet, pabeni, horms, woojung.huh,
olteanv, UNGLinuxDriver, thomas.petazzoni, netdev, linux-kernel
In-Reply-To: <20260324180826.524327-1-maxime.chevallier@bootlin.com>
Hello:
This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 24 Mar 2026 19:08:23 +0100 you wrote:
> Hi,
>
> While working with ksz9477, I've done some very minor cleanups around the
> PCS code for the SGMII port. No changes intended.
>
> Maxime
>
> [...]
Here is the summary with links:
- [net-next,1/2] net: dsa: microchip: Drop unnecessary check in ksz9477 PCS setup
https://git.kernel.org/netdev/net-next/c/e1da0e1859c6
- [net-next,2/2] net: dsa: microchip: drop an outdated comment about SGMII support
https://git.kernel.org/netdev/net-next/c/588cd4e7d22c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* RE: [PATCH v3 net-next 02/14] dt-bindings: net: dsa: add NETC switch
From: Wei Fang @ 2026-03-27 2:09 UTC (permalink / raw)
To: Frank Li
Cc: Claudiu Manoil, Vladimir Oltean, Clark Wang,
andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com, robh@kernel.org,
krzk+dt@kernel.org, conor+dt@kernel.org, f.fainelli@gmail.com,
chleroy@kernel.org, horms@kernel.org, linux@armlinux.org.uk,
andrew@lunn.ch, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, devicetree@vger.kernel.org,
linuxppc-dev@lists.ozlabs.org,
linux-arm-kernel@lists.infradead.org, imx@lists.linux.dev
In-Reply-To: <acWR0QwRSnupmCvI@lizhi-Precision-Tower-5810>
> On Thu, Mar 26, 2026 at 02:29:05PM +0800, Wei Fang wrote:
> > Add bindings for NETC switch. This switch is a PCIe function of NETC
> > IP, it supports advanced QoS with 8 traffic classes and 4 drop
> > resilience levels, and a full range of TSN standards capabilities.
> > The switch CPU
>
> Nit: double space before TSN.
Thanks for catching this, I will fix it.
>
> > port connects to an internal ENETC port, which is also a PCIe function
> > of NETC IP. So these two ports use a light-weight "pseudo MAC" instead
> > of a back-to-back MAC, because the "pseudo MAC" provides the
> > delineation between switch and ENETC, this translates to lower power
> > (less logic and
>
> what's means "this translates", do you means "this help reduce power and
> latency."
This sentence is excerpted from the NETC Block Guide. It is equivalent to
"it means".
>
> > memory) and lower delay (as there is no serialization delay across
> > this link).
> >
> > Signed-off-by: Wei Fang <wei.fang@nxp.com>
> > ---
> > .../bindings/net/dsa/nxp,netc-switch.yaml | 130 ++++++++++++++++++
> > 1 file changed, 130 insertions(+)
> > create mode 100644
> > Documentation/devicetree/bindings/net/dsa/nxp,netc-switch.yaml
> >
> > diff --git
> > a/Documentation/devicetree/bindings/net/dsa/nxp,netc-switch.yaml
> > b/Documentation/devicetree/bindings/net/dsa/nxp,netc-switch.yaml
> > new file mode 100644
> > index 000000000000..e34a4e3504c3
> > --- /dev/null
> > +++ b/Documentation/devicetree/bindings/net/dsa/nxp,netc-switch.yaml
> > @@ -0,0 +1,130 @@
> > +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) %YAML 1.2
> > +---
> > +$id: http://devicetree.org/schemas/net/dsa/nxp,netc-switch.yaml#
> > +$schema: http://devicetree.org/meta-schemas/core.yaml#
> > +
> > +title: NETC Switch family
> > +
> > +description:
>
> Nit use ">" for multi paragraph.
Okay, I suppose I also need to add '>' to the below description of
"dsa,member" property.
>
> others look good
>
> Reviewed-by: Frank Li <Frank.Li@nxp.com>
>
> > + The NETC presents itself as a multi-function PCIe Root Complex
> > + Integrated Endpoint (RCiEP) and provides full 802.1Q Ethernet
> > + switch functionality, advanced QoS with 8 traffic classes and 4
> > + drop resilience levels, and a full range of TSN standards capabilities.
> > +
> > + The CPU port of the switch connects to an internal ENETC. The
> > + switch and the internal ENETC are fully integrated into the NETC
> > + IP, a back-to-back MAC is not required. Instead, a light-weight
> > + "pseudo MAC" provides the delineation between the switch and ENETC.
> > + This translates to lower power (less logic and memory) and lower
> > + delay (as there is no serialization delay across this link).
> > +
> > +maintainers:
> > + - Wei Fang <wei.fang@nxp.com>
> > +
> > +properties:
> > + compatible:
> > + enum:
> > + - pci1131,eef2
> > +
> > + reg:
> > + maxItems: 1
> > +
> > + dsa,member:
> > + description:
> > + The property indicates DSA cluster and switch index. For NETC switch,
> > + the valid range of the switch index is 1 ~ 7, the index is reflected
> > + in the switch tag as an indication of the switch ID where the frame
> > + originated. The value 0 is reserved for ENETC VEPA switch, whose ID
> > + is hardwired to zero.
> > +
> > +$ref: dsa.yaml#
> > +
> > +patternProperties:
> > + "^(ethernet-)?ports$":
> > + type: object
> > + additionalProperties: true
> > + patternProperties:
> > + "^(ethernet-)?port@[0-9a-f]$":
> > + type: object
> > +
> > + $ref: dsa-port.yaml#
> > +
> > + properties:
> > + clocks:
> > + items:
> > + - description: MAC transmit/receive reference clock.
> > +
> > + clock-names:
> > + items:
> > + - const: ref
> > +
> > + mdio:
> > + $ref: /schemas/net/mdio.yaml#
> > + unevaluatedProperties: false
> > + description:
> > + Optional child node for switch port, otherwise use NETC
> EMDIO.
> > +
> > + unevaluatedProperties: false
> > +
> > +required:
> > + - compatible
> > + - reg
> > + - dsa,member
> > +
> > +allOf:
> > + - $ref: /schemas/pci/pci-device.yaml
> > +
> > +unevaluatedProperties: false
> > +
> > +examples:
> > + - |
> > + pcie {
> > + #address-cells = <3>;
> > + #size-cells = <2>;
> > +
> > + ethernet-switch@0,2 {
> > + compatible = "pci1131,eef2";
> > + reg = <0x200 0 0 0 0>;
> > + dsa,member = <0 1>;
> > + pinctrl-names = "default";
> > + pinctrl-0 = <&pinctrl_switch>;
> > +
> > + ports {
> > + #address-cells = <1>;
> > + #size-cells = <0>;
> > +
> > + port@0 {
> > + reg = <0>;
> > + phy-handle = <ðphy0>;
> > + phy-mode = "mii";
> > + };
> > +
> > + port@1 {
> > + reg = <1>;
> > + phy-handle = <ðphy1>;
> > + phy-mode = "mii";
> > + };
> > +
> > + port@2 {
> > + reg = <2>;
> > + clocks = <&scmi_clk 103>;
> > + clock-names = "ref";
> > + phy-handle = <ðphy2>;
> > + phy-mode = "rgmii-id";
> > + };
> > +
> > + port@3 {
> > + reg = <3>;
> > + ethernet = <&enetc3>;
> > + phy-mode = "internal";
> > +
> > + fixed-link {
> > + speed = <2500>;
> > + full-duplex;
> > + pause;
> > + };
> > + };
> > + };
> > + };
> > + };
> > --
> > 2.34.1
> >
^ permalink raw reply
* Re: [PATCH net,v2] net: mana: Fix RX skb truesize accounting
From: patchwork-bot+netdevbpf @ 2026-03-27 2:10 UTC (permalink / raw)
To: Dipayaan Roy
Cc: kys, haiyangz, wei.liu, decui, andrew+netdev, davem, edumazet,
kuba, pabeni, leon, longli, kotaranov, horms, shradhagupta,
ssengar, ernis, shirazsaleem, linux-hyperv, netdev, linux-kernel,
linux-rdma, stephen, jacob.e.keller, dipayanroy
In-Reply-To: <acLUhLpLum6qrD/N@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 24 Mar 2026 11:14:28 -0700 you wrote:
> MANA passes rxq->alloc_size to napi_build_skb() for all RX buffers.
> It is correct for fragment-backed RX buffers, where alloc_size matches
> the actual backing allocation used for each packet buffer. However, in
> the non-fragment RX path mana allocates a full page, or a higher-order
> page, per RX buffer. In that case alloc_size only reflects the usable
> packet area and not the actual backing memory.
>
> [...]
Here is the summary with links:
- [net,v2] net: mana: Fix RX skb truesize accounting
https://git.kernel.org/netdev/net/c/f73896b4197e
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net] net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
From: patchwork-bot+netdevbpf @ 2026-03-27 2:10 UTC (permalink / raw)
To: Sven Eckelmann
Cc: nbd, lorenzo, andrew+netdev, davem, edumazet, kuba, pabeni,
matthias.bgg, angelogioacchino.delregno, eladwf, netdev,
linux-kernel, linux-arm-kernel, linux-mediatek, stable
In-Reply-To: <20260324-wed-crash-gmac0-disabled-v1-1-3bc388aee565@simonwunderlich.de>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 24 Mar 2026 09:36:01 +0100 you wrote:
> If the gmac0 is disabled, the precheck for a valid ingress device will
> cause a NULL pointer deref and crash the system. This happens because
> eth->netdev[0] will be NULL but the code will directly try to access
> netdev_ops.
>
> Instead of just checking for the first net_device, it must be checked if
> any of the mtk_eth net_devices is matching the netdev_ops of the ingress
> device.
>
> [...]
Here is the summary with links:
- [net] net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
https://git.kernel.org/netdev/net/c/976ff48c2ac6
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net v5] bnxt_en: validate firmware backing store types
From: Michael Chan @ 2026-03-27 2:12 UTC (permalink / raw)
To: Pengpeng Hou
Cc: pavan.chebbi, andrew+netdev, davem, edumazet, kuba, pabeni,
netdev, linux-kernel
In-Reply-To: <20260327010235.42668-1-pengpeng@iscas.ac.cn>
[-- Attachment #1: Type: text/plain, Size: 1374 bytes --]
On Thu, Mar 26, 2026 at 6:03 PM Pengpeng Hou <pengpeng@iscas.ac.cn> wrote:
> @@ -8692,15 +8692,18 @@ static int bnxt_hwrm_func_backing_store_qcaps_v2(struct bnxt *bp)
> u8 init_val, init_off, i;
> u32 max_entries;
> u16 entry_size;
> + u16 req_type;
> __le32 *p;
> + u16 next_type;
> u32 flags;
>
> - req->type = cpu_to_le16(type);
> + req_type = type;
> + req->type = cpu_to_le16(req_type);
> rc = hwrm_req_send(bp, req);
> if (rc)
> goto ctx_done;
> flags = le32_to_cpu(resp->flags);
> - type = le16_to_cpu(resp->next_valid_type);
I think a simpler fix is to assign ctxm->type = type here if the
concern is that FW can return a bogus resp->type.
ctxm->type is fixed and is equal to the array index of ctx->ctx_arr so
it can be set up early. You can optionally validate resp->type for
sanity but it will not be used. After that, type can advance to the
next valid type.
> + next_type = le16_to_cpu(resp->next_valid_type);
> if (!(flags & BNXT_CTX_MEM_TYPE_VALID)) {
> bnxt_free_one_ctx_mem(bp, ctxm, true);
> continue;
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5469 bytes --]
^ permalink raw reply
* [PATCH net v2] ipv6: fix data race in fib6_metric_set() using cmpxchg
From: Hangbin Liu @ 2026-03-27 2:24 UTC (permalink / raw)
To: David S. Miller, David Ahern, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Jiayuan Chen
Cc: David Ahern, netdev, linux-kernel, Fei Liu, Hangbin Liu
fib6_metric_set() may be called concurrently from softirq context without
holding the FIB table lock. A typical path is:
ndisc_router_discovery()
spin_unlock_bh(&table->tb6_lock) <- lock released
fib6_metric_set(rt, RTAX_HOPLIMIT, ...) <- lockless call
When two CPUs process Router Advertisement packets for the same router
simultaneously, they can both arrive at fib6_metric_set() with the same
fib6_info pointer whose fib6_metrics still points to dst_default_metrics.
if (f6i->fib6_metrics == &dst_default_metrics) { /* both CPUs: true */
struct dst_metrics *p = kzalloc_obj(*p, GFP_ATOMIC);
refcount_set(&p->refcnt, 1);
f6i->fib6_metrics = p; /* CPU1 overwrites CPU0's p -> p0 leaked */
}
The dst_metrics allocated by the losing CPU has refcnt=1 but no pointer
to it anywhere in memory, producing a kmemleak report:
unreferenced object 0xff1100025aca1400 (size 96):
comm "softirq", pid 0, jiffies 4299271239
backtrace:
kmalloc_trace+0x28a/0x380
fib6_metric_set+0xcd/0x180
ndisc_router_discovery+0x12dc/0x24b0
icmpv6_rcv+0xc16/0x1360
Fix this by:
- Set val for p->metrics before published via cmpxchg() so the metrics
value is ready before the pointer becomes visible to other CPUs.
- Replace the plain pointer store with cmpxchg() and free the allocation
safely when competition failed.
- Add READ_ONCE()/WRITE_ONCE() for metrics[] setting in the non-default
metrics path to prevent compiler-based data races.
Fixes: d4ead6b34b67 ("net/ipv6: move metrics from dst to rt6_info")
Reported-by: Fei Liu <feliu@redhat.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
---
Changes in v2:
- Set val for p->metrics before published via cmpxchg() (Eric Dumazet)
- Add READ_ONCE()/WRITE_ONCE() for metrics[] setting (Jiayuan Chen)
- Link to v1: https://lore.kernel.org/r/20260326-b4-fib6_metric_set-kmemleak-v1-1-c89fc1b312c0@gmail.com
---
net/ipv6/ip6_fib.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index dd26657b6a4a..2a7cc33fbcef 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -730,17 +730,24 @@ void fib6_metric_set(struct fib6_info *f6i, int metric, u32 val)
if (!f6i)
return;
- if (f6i->fib6_metrics == &dst_default_metrics) {
+ if (READ_ONCE(f6i->fib6_metrics) == &dst_default_metrics) {
+ struct dst_metrics *dflt = (struct dst_metrics *)&dst_default_metrics;
struct dst_metrics *p = kzalloc_obj(*p, GFP_ATOMIC);
if (!p)
return;
+ p->metrics[metric - 1] = val;
refcount_set(&p->refcnt, 1);
- f6i->fib6_metrics = p;
+ if (cmpxchg(&f6i->fib6_metrics, dflt, p) != dflt)
+ kfree(p);
+ else
+ return;
}
- f6i->fib6_metrics->metrics[metric - 1] = val;
+ struct dst_metrics *m = READ_ONCE(f6i->fib6_metrics);
+
+ WRITE_ONCE(m->metrics[metric - 1], val);
}
/*
---
base-commit: c4ea7d8907cf72b259bf70bd8c2e791e1c4ff70f
change-id: 20260326-b4-fib6_metric_set-kmemleak-7aa51978284a
Best regards,
--
Hangbin Liu <liuhangbin@gmail.com>
^ permalink raw reply related
* Re: [Intel-wired-lan] [PATCH net-next v4 1/2] e1000e: add basic XDP support
From: Matteo Croce @ 2026-03-27 2:27 UTC (permalink / raw)
To: Loktionov, Aleksandr
Cc: Nguyen, Anthony L, Kitszel, Przemyslaw, Andrew Lunn,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Alexei Starovoitov, Daniel Borkmann, Jesper Dangaard Brouer,
John Fastabend, Mohsin Bashir, netdev@vger.kernel.org,
bpf@vger.kernel.org, intel-wired-lan@lists.osuosl.org,
linux-kernel@vger.kernel.org
In-Reply-To: <IA3PR11MB8986EC18B4FE10649049AF87E548A@IA3PR11MB8986.namprd11.prod.outlook.com>
Il giorno mar 24 mar 2026 alle ore 09:06 Loktionov, Aleksandr
<aleksandr.loktionov@intel.com> ha scritto:
>
>
>
> > -----Original Message-----
> > From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> > Of Matteo Croce
> > Sent: Monday, March 23, 2026 7:28 PM
> > To: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> > Przemyslaw <przemyslaw.kitszel@intel.com>; Andrew Lunn
> > <andrew+netdev@lunn.ch>; David S. Miller <davem@davemloft.net>; Eric
> > Dumazet <edumazet@google.com>; Jakub Kicinski <kuba@kernel.org>; Paolo
> > Abeni <pabeni@redhat.com>; Alexei Starovoitov <ast@kernel.org>; Daniel
> > Borkmann <daniel@iogearbox.net>; Jesper Dangaard Brouer
> > <hawk@kernel.org>; John Fastabend <john.fastabend@gmail.com>; Mohsin
> > Bashir <mohsin.bashr@gmail.com>
> > Cc: netdev@vger.kernel.org; bpf@vger.kernel.org; intel-wired-
> > lan@lists.osuosl.org; linux-kernel@vger.kernel.org
> > Subject: [Intel-wired-lan] [PATCH net-next v4 1/2] e1000e: add basic
> > XDP support
> >
> > Add XDP support to the e1000e driver covering the actions defined by
> > NETDEV_XDP_ACT_BASIC: XDP_DROP, XDP_PASS, XDP_TX and XDP_ABORTED.
> >
> > Infrastructure:
> > - e1000_xdp_setup() / e1000_xdp() for program attach/detach with
> > MTU validation and close/open cycle
> > - ndo_bpf support in net_device_ops
> > - xdp_rxq_info registration in setup/free_rx_resources
> >
> > Receive path:
> > - e1000_alloc_rx_buffers_xdp() for page-based Rx buffer allocation
> > with XDP_PACKET_HEADROOM
> > - e1000_clean_rx_irq_xdp() as the XDP receive handler
> > - e1000_run_xdp() to execute the XDP program on received packets
> > - SKB building via napi_build_skb() for XDP_PASS with metadata,
> > checksum offload and RSS hash support
> >
> > Transmit path:
> > - e1000_xdp_xmit_ring() to DMA-map and enqueue an XDP frame
> > - e1000_xdp_xmit_back() to convert an xdp_buff to a frame and send it
> > - e1000_finalize_xdp() to flush the TX ring after XDP processing
> > - TX completion via xdp_return_frame() with buffer type tracking
> >
> > Assisted-by: claude-opus-4-6
> > Signed-off-by: Matteo Croce <teknoraver@meta.com>
> > ---
> > drivers/net/ethernet/intel/Kconfig | 1 +
> > drivers/net/ethernet/intel/e1000e/e1000.h | 18 +-
> > drivers/net/ethernet/intel/e1000e/netdev.c | 533 ++++++++++++++++++++-
> > 3 files changed, 540 insertions(+), 12 deletions(-)
> >
> > diff --git a/drivers/net/ethernet/intel/Kconfig
> > b/drivers/net/ethernet/intel/Kconfig
> > index 288fa8ce53af..46e37cb68e70 100644
> > --- a/drivers/net/ethernet/intel/Kconfig
> > +++ b/drivers/net/ethernet/intel/Kconfig
> > @@ -63,6 +63,7 @@ config E1000E
> > depends on PCI && (!SPARC32 || BROKEN)
> > depends on PTP_1588_CLOCK_OPTIONAL
> > select CRC32
> > + select PAGE_POOL
> > help
> > This driver supports the PCI-Express Intel(R) PRO/1000
> > gigabit
> > ethernet family of adapters. For PCI or PCI-X e1000 adapters,
> > diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h
> > b/drivers/net/ethernet/intel/e1000e/e1000.h
> > index 63ebe00376f5..4c1175d4e5cb 100644
> > --- a/drivers/net/ethernet/intel/e1000e/e1000.h
> > +++ b/drivers/net/ethernet/intel/e1000e/e1000.h
> > @@ -19,10 +19,13 @@
> > #include <linux/net_tstamp.h>
> > #include <linux/ptp_clock_kernel.h>
> > #include <linux/ptp_classify.h>
>
> ...
>
> > +/**
> > + * e1000_xdp_xmit_ring - transmit an XDP frame on the TX ring
> > + * @adapter: board private structure
> > + * @tx_ring: Tx descriptor ring
> > + * @xdpf: XDP frame to transmit
> > + *
> > + * Returns E1000_XDP_TX on success, E1000_XDP_CONSUMED on failure
> > **/
> > +static int e1000_xdp_xmit_ring(struct e1000_adapter *adapter,
> > + struct e1000_ring *tx_ring,
> > + struct xdp_frame *xdpf)
> > +{
> > + struct e1000_buffer *buffer_info;
> > + struct e1000_tx_desc *tx_desc;
> > + dma_addr_t dma;
> > + u16 i;
> > +
> > + if (e1000_desc_unused(tx_ring) < 1)
> > + return E1000_XDP_CONSUMED;
> > +
> > + i = tx_ring->next_to_use;
> Unsynchronized read of next_to_use. ndo_start_xmit on another CPU can be
> reading+writing this same field RIGHT NOW under __netif_tx_lock, which we do NOT hold.
> Isn't it ?
>
> > + buffer_info = &tx_ring->buffer_info[i];
> > +
> > + dma = dma_map_single(&adapter->pdev->dev, xdpf->data, xdpf-
> > >len,
> > + DMA_TO_DEVICE);
> > + if (dma_mapping_error(&adapter->pdev->dev, dma))
> > + return E1000_XDP_CONSUMED;
> > +
> > + buffer_info->xdpf = xdpf;
> > + buffer_info->type = E1000_TX_BUF_XDP;
> > + buffer_info->dma = dma;
> > + buffer_info->length = xdpf->len;
> > + buffer_info->time_stamp = jiffies;
> > + buffer_info->next_to_watch = i;
> > + buffer_info->segs = 1;
> > + buffer_info->bytecount = xdpf->len;
> > + buffer_info->mapped_as_page = 0;
> > +
> > + tx_desc = E1000_TX_DESC(*tx_ring, i);
> > + tx_desc->buffer_addr = cpu_to_le64(dma);
> Writing DMA descriptor that ndo_start_xmit may also be writing to
> at the same index - probably causes ring corruption
>
> > + tx_desc->lower.data = cpu_to_le32(adapter->txd_cmd |
> > + E1000_TXD_CMD_IFCS |
> > + xdpf->len);
> > + tx_desc->upper.data = 0;
> > +
> > + i++;
> > + if (i == tx_ring->count)
> > + i = 0;
> > + tx_ring->next_to_use = i;
> Unsynchronized store - races with the identical write in e1000_xmit_frame.
>
> > +
> > + return E1000_XDP_TX;
> > +}
> > +
>
> ...
>
> > kfree(adapter->tx_ring);
> > kfree(adapter->rx_ring);
> >
> > --
> > 2.53.0
>
You're right. I see two solutions here: taking __netif_tx_lock around
the XDP TX, or using a separate TX ring dedicated to XDP.
The latter would be a bigger change for e1000e since it only has one
TX queue, so I'd go with the lock.
Thanks,
--
Matteo Croce
perl -e 'for($t=0;;$t++){print chr($t*($t>>8|$t>>13)&255)}' |aplay
^ permalink raw reply
* Re: [PATCH net-next v2 1/3] gve: skip error logging for retryable AdminQ commands
From: Li Xiasong @ 2026-03-27 2:28 UTC (permalink / raw)
To: Harshitha Ramamurthy
Cc: joshwash, andrew+netdev, davem, edumazet, kuba, pabeni,
richardcochran, willemb, nktgrg, jfraker, ziweixiao, maolson,
thostet, jordanrhee, jefrogers, alok.a.tiwari, yyd, linux-kernel,
netdev, yuehaibing, zhangchangzhong, weiyongjun1
In-Reply-To: <20260326224527.1044097-2-hramamurthy@google.com>
Hi,
On 3/27/2026 6:45 AM, Harshitha Ramamurthy wrote:
> From: Jordan Rhee <jordanrhee@google.com>
>
> AdminQ commands may return -EAGAIN under certain transient conditions.
> These commands are intended to be retried by the driver, so logging
> a formal error to the system log is misleading and creates
> unnecessary noise.
>
> Modify the logging logic to skip the error message when the result
> is -EAGAIN.
>
> Reviewed-by: Joshua Washington <joshwash@google.com>
> Signed-off-by: Jordan Rhee <jordanrhee@google.com>
> Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
> ---
> drivers/net/ethernet/google/gve/gve_adminq.c | 26 +++++++++++++++-----
> 1 file changed, 20 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/net/ethernet/google/gve/gve_adminq.c b/drivers/net/ethernet/google/gve/gve_adminq.c
> index 08587bf40ed4..c7834614c5f0 100644
> --- a/drivers/net/ethernet/google/gve/gve_adminq.c
> +++ b/drivers/net/ethernet/google/gve/gve_adminq.c
> @@ -416,11 +416,6 @@ static bool gve_adminq_wait_for_cmd(struct gve_priv *priv, u32 prod_cnt)
>
> static int gve_adminq_parse_err(struct gve_priv *priv, u32 status)
> {
> - if (status != GVE_ADMINQ_COMMAND_PASSED &&
> - status != GVE_ADMINQ_COMMAND_UNSET) {
> - dev_err(&priv->pdev->dev, "AQ command failed with status %d\n", status);
> - priv->adminq_cmd_fail++;
> - }
> switch (status) {
> case GVE_ADMINQ_COMMAND_PASSED:
> return 0;
> @@ -455,6 +450,16 @@ static int gve_adminq_parse_err(struct gve_priv *priv, u32 status)
> }
> }
>
> +static bool gve_adminq_is_retryable(enum gve_adminq_opcodes opcode)
> +{
> + switch (opcode) {
> + case GVE_ADMINQ_REPORT_NIC_TIMESTAMP:
> + return true;
> + default:
> + return false;
> + }
> +}
> +
> /* Flushes all AQ commands currently queued and waits for them to complete.
> * If there are failures, it will return the first error.
> */
> @@ -482,9 +487,18 @@ static int gve_adminq_kick_and_wait(struct gve_priv *priv)
> cmd = &priv->adminq[i & priv->adminq_mask];
> status = be32_to_cpu(READ_ONCE(cmd->status));
> err = gve_adminq_parse_err(priv, status);
> - if (err)
> + if (err) {
> + enum gve_adminq_opcodes opcode =
> + be32_to_cpu(READ_ONCE(cmd->opcode));
> + priv->adminq_cmd_fail++;
> + if (!gve_adminq_is_retryable(opcode) || err != -EAGAIN)
In gve_adminq_kick_and_wait(), the condition is:
if (!gve_adminq_is_retryable(opcode) || err != -EAGAIN)
dev_err_ratelimited(...);
Based on the commit log, the goal is to skip logging when the result is
-EAGAIN for transient conditions. However, when gve_adminq_is_retryable()
returns false (e.g., GVE_ADMINQ_COMMAND_ERROR_ABORTED), even if err is
-EAGAIN, the condition evaluates to true and the error would still be logged.
Would it be more appropriate to use && instead of || here?
if (!gve_adminq_is_retryable(opcode) && err != -EAGAIN)
I may be missing something, so please let me know if I've misunderstood.
> + dev_err_ratelimited(&priv->pdev->dev,
> + "AQ command %d failed with status %d\n",
> + opcode, status);
> +
> // Return the first error if we failed.
> return err;
> + }
> }
>
> return 0;
Best regards,
Li Xiasong
^ permalink raw reply
* Re: [Intel-wired-lan] [PATCH net-next v4 2/2] e1000e: add XDP_REDIRECT support
From: Matteo Croce @ 2026-03-27 2:39 UTC (permalink / raw)
To: Loktionov, Aleksandr
Cc: Nguyen, Anthony L, Kitszel, Przemyslaw, Andrew Lunn,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Alexei Starovoitov, Daniel Borkmann, Jesper Dangaard Brouer,
John Fastabend, Mohsin Bashir, netdev@vger.kernel.org,
bpf@vger.kernel.org, intel-wired-lan@lists.osuosl.org,
linux-kernel@vger.kernel.org
In-Reply-To: <IA3PR11MB8986307A14724905DE2FDFF6E548A@IA3PR11MB8986.namprd11.prod.outlook.com>
Il giorno mar 24 mar 2026 alle ore 09:48 Loktionov, Aleksandr
<aleksandr.loktionov@intel.com> ha scritto:
>
>
>
> > -----Original Message-----
> > From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> > Of Matteo Croce
> > Sent: Monday, March 23, 2026 7:28 PM
> > To: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> > Przemyslaw <przemyslaw.kitszel@intel.com>; Andrew Lunn
> > <andrew+netdev@lunn.ch>; David S. Miller <davem@davemloft.net>; Eric
> > Dumazet <edumazet@google.com>; Jakub Kicinski <kuba@kernel.org>; Paolo
> > Abeni <pabeni@redhat.com>; Alexei Starovoitov <ast@kernel.org>; Daniel
> > Borkmann <daniel@iogearbox.net>; Jesper Dangaard Brouer
> > <hawk@kernel.org>; John Fastabend <john.fastabend@gmail.com>; Mohsin
> > Bashir <mohsin.bashr@gmail.com>
> > Cc: netdev@vger.kernel.org; bpf@vger.kernel.org; intel-wired-
> > lan@lists.osuosl.org; linux-kernel@vger.kernel.org
> > Subject: [Intel-wired-lan] [PATCH net-next v4 2/2] e1000e: add
> > XDP_REDIRECT support
> >
> > Add the ability to redirect packets to other devices via XDP_REDIRECT
> > and to receive redirected frames from other devices via ndo_xdp_xmit.
> >
> > New functionality:
> > - XDP_REDIRECT case in e1000_run_xdp() using xdp_do_redirect()
> > - e1000_xdp_xmit() as the ndo_xdp_xmit callback for receiving
> > redirected frames from other devices
> > - xdp_do_flush() in e1000_finalize_xdp() for REDIR completions
> > - xdp_features_set/clear_redirect_target() in e1000_xdp_setup()
> > - NETDEV_XDP_ACT_REDIRECT and NETDEV_XDP_ACT_NDO_XMIT advertised
> >
> > Assisted-by: claude-opus-4-6
> > Signed-off-by: Matteo Croce <teknoraver@meta.com>
> > ---
> > drivers/net/ethernet/intel/e1000e/netdev.c | 85
> > +++++++++++++++++++++-
> > 1 file changed, 81 insertions(+), 4 deletions(-)
> >
> > diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c
> > b/drivers/net/ethernet/intel/e1000e/netdev.c
> > index d77f208f00cc..01661e1a74e5 100644
> > --- a/drivers/net/ethernet/intel/e1000e/netdev.c
> > +++ b/drivers/net/ethernet/intel/e1000e/netdev.c
> > @@ -41,6 +41,7 @@ char e1000e_driver_name[] = "e1000e";
> > #define E1000_XDP_PASS 0
> > #define E1000_XDP_CONSUMED BIT(0)
> > #define E1000_XDP_TX BIT(1)
>
> ...
>
> >
> > +/**
> > + * e1000_xdp_xmit - transmit XDP frames from another device
> > + * @netdev: network interface device structure
> > + * @n: number of frames to transmit
> > + * @frames: array of XDP frame pointers
> > + * @flags: XDP transmit flags
> > + *
> > + * This is the ndo_xdp_xmit callback, called when other devices
> > +redirect
> > + * frames to this device.
> > + **/
> > +static int e1000_xdp_xmit(struct net_device *netdev, int n,
> > + struct xdp_frame **frames, u32 flags) {
> > + struct e1000_adapter *adapter = netdev_priv(netdev);
> > + struct e1000_ring *tx_ring = adapter->tx_ring;
> > + struct netdev_queue *nq = netdev_get_tx_queue(netdev, 0);
> > + int cpu = smp_processor_id();
> > + int nxmit = 0;
> > + int i;
> > +
> > + if (unlikely(test_bit(__E1000_DOWN, &adapter->state)))
> > + return -ENETDOWN;
> > +
> > + if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK))
> > + return -EINVAL;
> > +
> > + if (!adapter->xdp_prog)
> > + return -ENXIO;
> > +
> > + __netif_tx_lock(nq, cpu);
> > + txq_trans_cond_update(nq);
> > +
> > + for (i = 0; i < n; i++) {
> > + int err;
> > +
> > + err = e1000_xdp_xmit_ring(adapter, tx_ring, frames[i]);
> > + if (err != E1000_XDP_TX)
> > + break;
> On first failure, we break out of the loop. frames[i] through frames[n-1] are silently abandoned.
> It should be no memleaks I hope, but silent packets drop is nasty!
>
I wanted to be consistent with other similar drivers, this i what igb
does in igb_main.c:
for (i = 0; i < n; i++) {
struct xdp_frame *xdpf = frames[i];
int err;
err = igb_xmit_xdp_ring(adapter, tx_ring, xdpf);
if (err != IGB_XDP_TX)
break;
nxmit++;
}
Regards,
--
Matteo Croce
perl -e 'for($t=0;;$t++){print chr($t*($t>>8|$t>>13)&255)}' |aplay
^ permalink raw reply
* [PATCH net-next v5] selftests: net: add tests for PPP
From: Qingfang Deng @ 2026-03-27 2:41 UTC (permalink / raw)
To: Shuah Khan, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Felix Maurer,
Sebastian Andrzej Siewior, Petr Machata, Allison Henderson,
linux-kernel, linux-kselftest, linux-ppp, netdev
Cc: Paul Mackerras
Add ping and iperf3 tests for ppp_async.c and pppoe.c.
Signed-off-by: Qingfang Deng <dqfext@gmail.com>
---
v5: suppress SC2329 warning (cleanup called indirectly via trap)
https://lore.kernel.org/netdev/20260326021642.29170-1-dqfext@gmail.com/
MAINTAINERS | 1 +
tools/testing/selftests/Makefile | 1 +
tools/testing/selftests/net/ppp/Makefile | 15 +++++++
tools/testing/selftests/net/ppp/config | 9 ++++
tools/testing/selftests/net/ppp/ppp_async.sh | 44 +++++++++++++++++++
tools/testing/selftests/net/ppp/ppp_common.sh | 44 +++++++++++++++++++
.../selftests/net/ppp/pppoe-server-options | 2 +
tools/testing/selftests/net/ppp/pppoe.sh | 41 +++++++++++++++++
8 files changed, 157 insertions(+)
create mode 100644 tools/testing/selftests/net/ppp/Makefile
create mode 100644 tools/testing/selftests/net/ppp/config
create mode 100755 tools/testing/selftests/net/ppp/ppp_async.sh
create mode 100644 tools/testing/selftests/net/ppp/ppp_common.sh
create mode 100644 tools/testing/selftests/net/ppp/pppoe-server-options
create mode 100755 tools/testing/selftests/net/ppp/pppoe.sh
diff --git a/MAINTAINERS b/MAINTAINERS
index 7a2ffd9d37d5..b922e154b9e7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -21080,6 +21080,7 @@ PPP PROTOCOL DRIVERS AND COMPRESSORS
L: linux-ppp@vger.kernel.org
S: Orphan
F: drivers/net/ppp/ppp_*
+F: tools/testing/selftests/net/ppp/
PPS SUPPORT
M: Rodolfo Giometti <giometti@enneenne.com>
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 450f13ba4cca..65f84e8a0cf0 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -78,6 +78,7 @@ TARGETS += net/netfilter
TARGETS += net/openvswitch
TARGETS += net/ovpn
TARGETS += net/packetdrill
+TARGETS += net/ppp
TARGETS += net/rds
TARGETS += net/tcp_ao
TARGETS += nolibc
diff --git a/tools/testing/selftests/net/ppp/Makefile b/tools/testing/selftests/net/ppp/Makefile
new file mode 100644
index 000000000000..b39b0abadde6
--- /dev/null
+++ b/tools/testing/selftests/net/ppp/Makefile
@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: GPL-2.0
+
+top_srcdir = ../../../../..
+
+TEST_PROGS := \
+ ppp_async.sh \
+ pppoe.sh \
+# end of TEST_PROGS
+
+TEST_FILES := \
+ ppp_common.sh \
+ pppoe-server-options \
+# end of TEST_FILES
+
+include ../../lib.mk
diff --git a/tools/testing/selftests/net/ppp/config b/tools/testing/selftests/net/ppp/config
new file mode 100644
index 000000000000..b45d25c5b970
--- /dev/null
+++ b/tools/testing/selftests/net/ppp/config
@@ -0,0 +1,9 @@
+CONFIG_IPV6=y
+CONFIG_PACKET=y
+CONFIG_PPP=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPPOE=m
+CONFIG_PPPOE_HASH_BITS_4=y
+CONFIG_VETH=y
diff --git a/tools/testing/selftests/net/ppp/ppp_async.sh b/tools/testing/selftests/net/ppp/ppp_async.sh
new file mode 100755
index 000000000000..7ef98fe9d486
--- /dev/null
+++ b/tools/testing/selftests/net/ppp/ppp_async.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+source ppp_common.sh
+
+# Temporary files for PTY symlinks
+TTY_DIR=$(mktemp -d /tmp/ppp.XXXXXX)
+TTY_SERVER="$TTY_DIR"/server
+TTY_CLIENT="$TTY_DIR"/client
+
+cleanup() {
+ # shellcheck disable=SC2329
+ cleanup_all_ns
+ [ -n "$SOCAT_PID" ] && kill_process "$SOCAT_PID"
+ rm -fr "$TTY_DIR"
+}
+
+trap cleanup EXIT
+
+require_command socat
+ppp_common_init
+modprobe -q ppp_async
+
+# Create the virtual serial device
+socat -d PTY,link="$TTY_SERVER",rawer PTY,link="$TTY_CLIENT",rawer &
+SOCAT_PID=$!
+
+# Wait for symlinks to be created
+slowwait 5 [ -L "$TTY_SERVER" ]
+
+# Start the PPP Server
+ip netns exec "$NS_SERVER" pppd "$TTY_SERVER" 115200 \
+ "$IP_SERVER":"$IP_CLIENT" \
+ local noauth nodefaultroute debug
+
+# Start the PPP Client
+ip netns exec "$NS_CLIENT" pppd "$TTY_CLIENT" 115200 \
+ local noauth updetach nodefaultroute debug
+
+ppp_test_connectivity
+
+log_test "PPP async"
+
+exit "$EXIT_STATUS"
diff --git a/tools/testing/selftests/net/ppp/ppp_common.sh b/tools/testing/selftests/net/ppp/ppp_common.sh
new file mode 100644
index 000000000000..c72218813f95
--- /dev/null
+++ b/tools/testing/selftests/net/ppp/ppp_common.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# shellcheck disable=SC2153
+
+source ../lib.sh
+
+IP_SERVER="192.168.200.1"
+IP_CLIENT="192.168.200.2"
+
+ppp_common_init() {
+ # Package requirements
+ require_command pppd
+ require_command iperf3
+
+ # Check for root privileges
+ if [ "$(id -u)" -ne 0 ];then
+ echo "SKIP: Need root privileges"
+ exit $ksft_skip
+ fi
+
+ # Namespaces
+ setup_ns NS_SERVER NS_CLIENT
+}
+
+ppp_check_addr() {
+ dev=$1
+ addr=$2
+ ns=$3
+ ip -netns "$ns" -4 addr show dev "$dev" 2>/dev/null | grep -q "$addr"
+ return $?
+}
+
+ppp_test_connectivity() {
+ slowwait 10 ppp_check_addr "ppp0" "$IP_CLIENT" "$NS_CLIENT"
+
+ ip netns exec "$NS_CLIENT" ping -c 3 "$IP_SERVER"
+ check_err $?
+
+ ip netns exec "$NS_SERVER" iperf3 -s -1 -D
+ wait_local_port_listen "$NS_SERVER" 5201 tcp
+
+ ip netns exec "$NS_CLIENT" iperf3 -c "$IP_SERVER" -Z -t 2
+ check_err $?
+}
diff --git a/tools/testing/selftests/net/ppp/pppoe-server-options b/tools/testing/selftests/net/ppp/pppoe-server-options
new file mode 100644
index 000000000000..66c8c9d319e9
--- /dev/null
+++ b/tools/testing/selftests/net/ppp/pppoe-server-options
@@ -0,0 +1,2 @@
+noauth
+noipdefault
diff --git a/tools/testing/selftests/net/ppp/pppoe.sh b/tools/testing/selftests/net/ppp/pppoe.sh
new file mode 100755
index 000000000000..a93bb7d4ee8f
--- /dev/null
+++ b/tools/testing/selftests/net/ppp/pppoe.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+source ppp_common.sh
+
+VETH_SERVER="veth-server"
+VETH_CLIENT="veth-client"
+
+cleanup() {
+ # shellcheck disable=SC2329
+ cleanup_all_ns
+}
+
+trap cleanup EXIT
+
+require_command pppoe-server
+ppp_common_init
+modprobe -q pppoe
+
+# Create the veth pair
+ip link add "$VETH_SERVER" type veth peer name "$VETH_CLIENT"
+ip link set "$VETH_SERVER" netns "$NS_SERVER"
+ip link set "$VETH_CLIENT" netns "$NS_CLIENT"
+ip -netns "$NS_SERVER" link set "$VETH_SERVER" up
+ip -netns "$NS_CLIENT" link set "$VETH_CLIENT" up
+
+# Start the PPP Server
+ip netns exec "$NS_SERVER" pppoe-server -I "$VETH_SERVER" \
+ -L "$IP_SERVER" -R "$IP_CLIENT" -N 1 -q "$(command -v pppd)" \
+ -k -O "$(pwd)/pppoe-server-options"
+
+# Start the PPP Client
+ip netns exec "$NS_CLIENT" pppd \
+ local debug updetach noipdefault noauth nodefaultroute \
+ plugin pppoe.so nic-"$VETH_CLIENT"
+
+ppp_test_connectivity
+
+log_test "PPPoE"
+
+exit "$EXIT_STATUS"
--
2.43.0
^ permalink raw reply related
* Re: [PATCH net-next v4] virtio-net: enable NETIF_F_GRO_HW only if GRO-related offloads are supported
From: Jakub Kicinski @ 2026-03-27 3:03 UTC (permalink / raw)
To: mst, jasowang
Cc: Di Zhu, xuanzhuo, eperezma, andrew+netdev, davem, edumazet,
pabeni, willemb, netdev, virtualization, lijing, yingzhiwei
In-Reply-To: <20260323041730.986351-1-zhud@hygon.cn>
On Mon, 23 Mar 2026 12:17:30 +0800 Di Zhu wrote:
> Negotiating VIRTIO_NET_F_CTRL_GUEST_OFFLOADS indicates the device
> allows control over offload support, but the offloads that can be
> controlled may have nothing to do with GRO (e.g., if neither GUEST_TSO4
> nor GUEST_TSO6 is supported).
>
> In such a setup, reporting NETIF_F_GRO_HW as available for the device
> is too optimistic and misleading to the user.
>
> Improve the situation by masking off NETIF_F_GRO_HW unless the device
> possesses actual GRO-related offload capabilities. Out of an abundance
> of caution, this does not change the current behaviour for hardware with
> just v6 or just v4 GRO: current interfaces do not allow distinguishing
> between v6/v4 GRO, so we can't expose them to userspace precisely.
Michael, Jason, does this patch look good now?
https://lore.kernel.org/all/20260323041730.986351-1-zhud@hygon.cn/
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox