* [PATCH 3/6] dt-bindings: net: qcom,ipa: add Milos compatible
From: Luca Weiss @ 2026-04-03 16:43 UTC (permalink / raw)
To: Alex Elder, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Bjorn Andersson, Konrad Dybcio, Alexander Koskovich
Cc: ~postmarketos/upstreaming, phone-devel, netdev, linux-kernel,
linux-arm-msm, devicetree, Luca Weiss
In-Reply-To: <20260403-milos-ipa-v1-0-01e9e4e03d3e@fairphone.com>
Add support for the Milos SoC, which uses IPA v5.2.
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
---
Documentation/devicetree/bindings/net/qcom,ipa.yaml | 1 +
1 file changed, 1 insertion(+)
diff --git a/Documentation/devicetree/bindings/net/qcom,ipa.yaml b/Documentation/devicetree/bindings/net/qcom,ipa.yaml
index e4bb627e1757..fdeaa81b9645 100644
--- a/Documentation/devicetree/bindings/net/qcom,ipa.yaml
+++ b/Documentation/devicetree/bindings/net/qcom,ipa.yaml
@@ -44,6 +44,7 @@ properties:
compatible:
oneOf:
- enum:
+ - qcom,milos-ipa
- qcom,msm8998-ipa
- qcom,sc7180-ipa
- qcom,sc7280-ipa
--
2.53.0
^ permalink raw reply related
* [PATCH 4/6] net: ipa: add IPA v5.2 configuration data
From: Luca Weiss @ 2026-04-03 16:43 UTC (permalink / raw)
To: Alex Elder, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Bjorn Andersson, Konrad Dybcio, Alexander Koskovich
Cc: ~postmarketos/upstreaming, phone-devel, netdev, linux-kernel,
linux-arm-msm, devicetree, Luca Weiss
In-Reply-To: <20260403-milos-ipa-v1-0-01e9e4e03d3e@fairphone.com>
Add the configuration data required for IPA v5.2, which is used in
the Qualcomm Milos SoC.
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
---
drivers/net/ipa/Makefile | 2 +-
drivers/net/ipa/data/ipa_data-v5.2.c | 452 +++++++++++++++++++++++++++++++++++
drivers/net/ipa/gsi_reg.c | 1 +
drivers/net/ipa/ipa_data.h | 1 +
drivers/net/ipa/ipa_main.c | 4 +
drivers/net/ipa/ipa_reg.c | 1 +
drivers/net/ipa/ipa_sysfs.c | 2 +
drivers/net/ipa/ipa_version.h | 2 +
8 files changed, 464 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ipa/Makefile b/drivers/net/ipa/Makefile
index d3abb38633e0..e148ec3c1a10 100644
--- a/drivers/net/ipa/Makefile
+++ b/drivers/net/ipa/Makefile
@@ -7,7 +7,7 @@ IPA_REG_VERSIONS := 3.1 3.5.1 4.2 4.5 4.7 4.9 4.11 5.0 5.5
# Some IPA versions can reuse another set of GSI register definitions.
GSI_REG_VERSIONS := 3.1 3.5.1 4.0 4.5 4.9 4.11 5.0
-IPA_DATA_VERSIONS := 3.1 3.5.1 4.2 4.5 4.7 4.9 4.11 5.0 5.5
+IPA_DATA_VERSIONS := 3.1 3.5.1 4.2 4.5 4.7 4.9 4.11 5.0 5.2 5.5
obj-$(CONFIG_QCOM_IPA) += ipa.o
diff --git a/drivers/net/ipa/data/ipa_data-v5.2.c b/drivers/net/ipa/data/ipa_data-v5.2.c
new file mode 100644
index 000000000000..c56c4f1836ae
--- /dev/null
+++ b/drivers/net/ipa/data/ipa_data-v5.2.c
@@ -0,0 +1,452 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2023-2024 Linaro Ltd.
+ * Copyright (c) 2026, Luca Weiss <luca.weiss@fairphone.com>
+ */
+
+#include <linux/array_size.h>
+#include <linux/log2.h>
+
+#include "../ipa_data.h"
+#include "../ipa_endpoint.h"
+#include "../ipa_mem.h"
+#include "../ipa_version.h"
+
+/** enum ipa_resource_type - IPA resource types for an SoC having IPA v5.2 */
+enum ipa_resource_type {
+ /* Source resource types; first must have value 0 */
+ IPA_RESOURCE_TYPE_SRC_PKT_CONTEXTS = 0,
+ IPA_RESOURCE_TYPE_SRC_DESCRIPTOR_LISTS,
+ IPA_RESOURCE_TYPE_SRC_DESCRIPTOR_BUFF,
+ IPA_RESOURCE_TYPE_SRC_HPS_DMARS,
+ IPA_RESOURCE_TYPE_SRC_ACK_ENTRIES,
+
+ /* Destination resource types; first must have value 0 */
+ IPA_RESOURCE_TYPE_DST_DATA_SECTORS = 0,
+ IPA_RESOURCE_TYPE_DST_DPS_DMARS,
+ IPA_RESOURCE_TYPE_DST_ULSO_SEGMENTS,
+};
+
+/* Resource groups used for an SoC having IPA v5.2 */
+enum ipa_rsrc_group_id {
+ /* Source resource group identifiers */
+ IPA_RSRC_GROUP_SRC_UL = 0,
+ IPA_RSRC_GROUP_SRC_DL,
+ IPA_RSRC_GROUP_SRC_URLLC,
+ IPA_RSRC_GROUP_SRC_COUNT, /* Last in set; not a source group */
+
+ /* Destination resource group identifiers */
+ IPA_RSRC_GROUP_DST_UL = 0,
+ IPA_RSRC_GROUP_DST_DL,
+ IPA_RSRC_GROUP_DST_UNUSED_1,
+ IPA_RSRC_GROUP_DST_DRB_IP,
+ IPA_RSRC_GROUP_DST_COUNT, /* Last; not a destination group */
+};
+
+/* QSB configuration data for an SoC having IPA v5.2 */
+static const struct ipa_qsb_data ipa_qsb_data[] = {
+ [IPA_QSB_MASTER_DDR] = {
+ .max_writes = 13,
+ .max_reads = 13,
+ .max_reads_beats = 0,
+ },
+};
+
+/* Endpoint configuration data for an SoC having IPA v5.2 */
+static const struct ipa_gsi_endpoint_data ipa_gsi_endpoint_data[] = {
+ [IPA_ENDPOINT_AP_COMMAND_TX] = {
+ .ee_id = GSI_EE_AP,
+ .channel_id = 6,
+ .endpoint_id = 9,
+ .toward_ipa = true,
+ .channel = {
+ .tre_count = 256,
+ .event_count = 256,
+ .tlv_count = 20,
+ },
+ .endpoint = {
+ .config = {
+ .resource_group = IPA_RSRC_GROUP_SRC_UL,
+ .dma_mode = true,
+ .dma_endpoint = IPA_ENDPOINT_AP_LAN_RX,
+ .tx = {
+ .seq_type = IPA_SEQ_DMA,
+ },
+ },
+ },
+ },
+ [IPA_ENDPOINT_AP_LAN_RX] = {
+ .ee_id = GSI_EE_AP,
+ .channel_id = 7,
+ .endpoint_id = 11,
+ .toward_ipa = false,
+ .channel = {
+ .tre_count = 256,
+ .event_count = 256,
+ .tlv_count = 9,
+ },
+ .endpoint = {
+ .config = {
+ .resource_group = IPA_RSRC_GROUP_DST_UL,
+ .aggregation = true,
+ .status_enable = true,
+ .rx = {
+ .buffer_size = 8192,
+ .pad_align = ilog2(sizeof(u32)),
+ .aggr_time_limit = 500,
+ },
+ },
+ },
+ },
+ [IPA_ENDPOINT_AP_MODEM_TX] = {
+ .ee_id = GSI_EE_AP,
+ .channel_id = 5,
+ .endpoint_id = 2,
+ .toward_ipa = true,
+ .channel = {
+ .tre_count = 512,
+ .event_count = 512,
+ .tlv_count = 25,
+ },
+ .endpoint = {
+ .filter_support = true,
+ .config = {
+ .resource_group = IPA_RSRC_GROUP_SRC_UL,
+ .checksum = true,
+ .qmap = true,
+ .status_enable = true,
+ .tx = {
+ .seq_type = IPA_SEQ_2_PASS_SKIP_LAST_UC,
+ .status_endpoint =
+ IPA_ENDPOINT_MODEM_AP_RX,
+ },
+ },
+ },
+ },
+ [IPA_ENDPOINT_AP_MODEM_RX] = {
+ .ee_id = GSI_EE_AP,
+ .channel_id = 9,
+ .endpoint_id = 18,
+ .toward_ipa = false,
+ .channel = {
+ .tre_count = 256,
+ .event_count = 256,
+ .tlv_count = 9,
+ },
+ .endpoint = {
+ .config = {
+ .resource_group = IPA_RSRC_GROUP_DST_DL,
+ .checksum = true,
+ .qmap = true,
+ .aggregation = true,
+ .rx = {
+ .buffer_size = 8192,
+ .aggr_time_limit = 500,
+ .aggr_close_eof = true,
+ },
+ },
+ },
+ },
+ [IPA_ENDPOINT_MODEM_AP_TX] = {
+ .ee_id = GSI_EE_MODEM,
+ .channel_id = 0,
+ .endpoint_id = 7,
+ .toward_ipa = true,
+ .endpoint = {
+ .filter_support = true,
+ },
+ },
+ [IPA_ENDPOINT_MODEM_AP_RX] = {
+ .ee_id = GSI_EE_MODEM,
+ .channel_id = 7,
+ .endpoint_id = 16,
+ .toward_ipa = false,
+ },
+ [IPA_ENDPOINT_MODEM_DL_NLO_TX] = {
+ .ee_id = GSI_EE_MODEM,
+ .channel_id = 2,
+ .endpoint_id = 10,
+ .toward_ipa = true,
+ .endpoint = {
+ .filter_support = true,
+ },
+ },
+};
+
+/* Source resource configuration data for an SoC having IPA v5.2 */
+static const struct ipa_resource ipa_resource_src[] = {
+ [IPA_RESOURCE_TYPE_SRC_PKT_CONTEXTS] = {
+ .limits[IPA_RSRC_GROUP_SRC_UL] = {
+ .min = 1, .max = 7,
+ },
+ .limits[IPA_RSRC_GROUP_SRC_DL] = {
+ .min = 1, .max = 7,
+ },
+ .limits[IPA_RSRC_GROUP_SRC_URLLC] = {
+ .min = 0, .max = 5,
+ },
+ },
+ [IPA_RESOURCE_TYPE_SRC_DESCRIPTOR_LISTS] = {
+ .limits[IPA_RSRC_GROUP_SRC_UL] = {
+ .min = 8, .max = 8,
+ },
+ .limits[IPA_RSRC_GROUP_SRC_DL] = {
+ .min = 8, .max = 8,
+ },
+ .limits[IPA_RSRC_GROUP_SRC_URLLC] = {
+ .min = 8, .max = 8,
+ },
+ },
+ [IPA_RESOURCE_TYPE_SRC_DESCRIPTOR_BUFF] = {
+ .limits[IPA_RSRC_GROUP_SRC_UL] = {
+ .min = 10, .max = 10,
+ },
+ .limits[IPA_RSRC_GROUP_SRC_DL] = {
+ .min = 12, .max = 12,
+ },
+ .limits[IPA_RSRC_GROUP_SRC_URLLC] = {
+ .min = 12, .max = 12,
+ },
+ },
+ [IPA_RESOURCE_TYPE_SRC_HPS_DMARS] = {
+ .limits[IPA_RSRC_GROUP_SRC_UL] = {
+ .min = 0, .max = 63,
+ },
+ .limits[IPA_RSRC_GROUP_SRC_DL] = {
+ .min = 0, .max = 63,
+ },
+ .limits[IPA_RSRC_GROUP_SRC_URLLC] = {
+ .min = 0, .max = 63,
+ },
+ },
+ [IPA_RESOURCE_TYPE_SRC_ACK_ENTRIES] = {
+ .limits[IPA_RSRC_GROUP_SRC_UL] = {
+ .min = 15, .max = 15,
+ },
+ .limits[IPA_RSRC_GROUP_SRC_DL] = {
+ .min = 15, .max = 15,
+ },
+ .limits[IPA_RSRC_GROUP_SRC_URLLC] = {
+ .min = 12, .max = 12,
+ },
+ },
+};
+
+/* Destination resource configuration data for an SoC having IPA v5.2 */
+static const struct ipa_resource ipa_resource_dst[] = {
+ [IPA_RESOURCE_TYPE_DST_DATA_SECTORS] = {
+ .limits[IPA_RSRC_GROUP_DST_UL] = {
+ .min = 3, .max = 3,
+ },
+ .limits[IPA_RSRC_GROUP_DST_DL] = {
+ .min = 3, .max = 3,
+ },
+ .limits[IPA_RSRC_GROUP_DST_DRB_IP] = {
+ .min = 23, .max = 23,
+ },
+ },
+ [IPA_RESOURCE_TYPE_DST_DPS_DMARS] = {
+ .limits[IPA_RSRC_GROUP_DST_UL] = {
+ .min = 1, .max = 2,
+ },
+ .limits[IPA_RSRC_GROUP_DST_DL] = {
+ .min = 1, .max = 2,
+ },
+ },
+ [IPA_RESOURCE_TYPE_DST_ULSO_SEGMENTS] = {
+ .limits[IPA_RSRC_GROUP_DST_UL] = {
+ .min = 1, .max = 63,
+ },
+ .limits[IPA_RSRC_GROUP_DST_DL] = {
+ .min = 1, .max = 63,
+ },
+ },
+};
+
+/* Resource configuration data for an SoC having IPA v5.2 */
+static const struct ipa_resource_data ipa_resource_data = {
+ .rsrc_group_dst_count = IPA_RSRC_GROUP_DST_COUNT,
+ .rsrc_group_src_count = IPA_RSRC_GROUP_SRC_COUNT,
+ .resource_src_count = ARRAY_SIZE(ipa_resource_src),
+ .resource_src = ipa_resource_src,
+ .resource_dst_count = ARRAY_SIZE(ipa_resource_dst),
+ .resource_dst = ipa_resource_dst,
+};
+
+/* IPA-resident memory region data for an SoC having IPA v5.2 */
+static const struct ipa_mem ipa_mem_local_data[] = {
+ {
+ .id = IPA_MEM_UC_SHARED,
+ .offset = 0x0000,
+ .size = 0x0080,
+ .canary_count = 0,
+ },
+ {
+ .id = IPA_MEM_UC_INFO,
+ .offset = 0x0080,
+ .size = 0x0200,
+ .canary_count = 0,
+ },
+ {
+ .id = IPA_MEM_V4_FILTER_HASHED,
+ .offset = 0x0288,
+ .size = 0x0078,
+ .canary_count = 2,
+ },
+ {
+ .id = IPA_MEM_V4_FILTER,
+ .offset = 0x0308,
+ .size = 0x0078,
+ .canary_count = 2,
+ },
+ {
+ .id = IPA_MEM_V6_FILTER_HASHED,
+ .offset = 0x0388,
+ .size = 0x0078,
+ .canary_count = 2,
+ },
+ {
+ .id = IPA_MEM_V6_FILTER,
+ .offset = 0x0408,
+ .size = 0x0078,
+ .canary_count = 2,
+ },
+ {
+ .id = IPA_MEM_V4_ROUTE_HASHED,
+ .offset = 0x0488,
+ .size = 0x0098,
+ .canary_count = 2,
+ },
+ {
+ .id = IPA_MEM_V4_ROUTE,
+ .offset = 0x0528,
+ .size = 0x0098,
+ .canary_count = 2,
+ },
+ {
+ .id = IPA_MEM_V6_ROUTE_HASHED,
+ .offset = 0x05c8,
+ .size = 0x0098,
+ .canary_count = 2,
+ },
+ {
+ .id = IPA_MEM_V6_ROUTE,
+ .offset = 0x0668,
+ .size = 0x0098,
+ .canary_count = 2,
+ },
+ {
+ .id = IPA_MEM_MODEM_HEADER,
+ .offset = 0x0708,
+ .size = 0x0240,
+ .canary_count = 2,
+ },
+ {
+ .id = IPA_MEM_AP_HEADER,
+ .offset = 0x0948,
+ .size = 0x01e0,
+ .canary_count = 0,
+ },
+ {
+ .id = IPA_MEM_MODEM_PROC_CTX,
+ .offset = 0x0b40,
+ .size = 0x0b20,
+ .canary_count = 2,
+ },
+ {
+ .id = IPA_MEM_AP_PROC_CTX,
+ .offset = 0x1660,
+ .size = 0x0200,
+ .canary_count = 0,
+ },
+ {
+ .id = IPA_MEM_STATS_QUOTA_MODEM,
+ .offset = 0x1868,
+ .size = 0x0060,
+ .canary_count = 2,
+ },
+ {
+ .id = IPA_MEM_STATS_QUOTA_AP,
+ .offset = 0x18c8,
+ .size = 0x0048,
+ .canary_count = 0,
+ },
+ {
+ .id = IPA_MEM_STATS_TETHERING,
+ .offset = 0x1910,
+ .size = 0x03c0,
+ .canary_count = 0,
+ },
+ {
+ .id = IPA_MEM_STATS_FILTER_ROUTE,
+ .offset = 0x1cd0,
+ .size = 0x0ba0,
+ .canary_count = 0,
+ },
+ {
+ .id = IPA_MEM_STATS_DROP,
+ .offset = 0x2870,
+ .size = 0x0020,
+ .canary_count = 0,
+ },
+ {
+ .id = IPA_MEM_MODEM,
+ .offset = 0x2898,
+ .size = 0x0d48,
+ .canary_count = 2,
+ },
+ {
+ .id = IPA_MEM_NAT_TABLE,
+ .offset = 0x35e0,
+ .size = 0x0900,
+ .canary_count = 0,
+ },
+ {
+ .id = IPA_MEM_PDN_CONFIG,
+ .offset = 0x3ee8,
+ .size = 0x0100,
+ .canary_count = 2,
+ },
+};
+
+/* Memory configuration data for an SoC having IPA v5.2 */
+static const struct ipa_mem_data ipa_mem_data = {
+ .local_count = ARRAY_SIZE(ipa_mem_local_data),
+ .local = ipa_mem_local_data,
+ .smem_size = 0x0000b000,
+};
+
+/* Interconnect rates are in 1000 byte/second units */
+static const struct ipa_interconnect_data ipa_interconnect_data[] = {
+ {
+ .name = "memory",
+ .peak_bandwidth = 1300000, /* 1.3 GBps */
+ .average_bandwidth = 600000, /* 600 MBps */
+ },
+ /* Average rate is unused for the next interconnect */
+ {
+ .name = "config",
+ .peak_bandwidth = 76800, /* 76.8 MBps */
+ .average_bandwidth = 0, /* unused */
+ },
+};
+
+/* Clock and interconnect configuration data for an SoC having IPA v5.2 */
+static const struct ipa_power_data ipa_power_data = {
+ .core_clock_rate = 120 * 1000 * 1000, /* Hz */
+ .interconnect_count = ARRAY_SIZE(ipa_interconnect_data),
+ .interconnect_data = ipa_interconnect_data,
+};
+
+/* Configuration data for an SoC having IPA v5.2. */
+const struct ipa_data ipa_data_v5_2 = {
+ .version = IPA_VERSION_5_2,
+ .qsb_count = ARRAY_SIZE(ipa_qsb_data),
+ .qsb_data = ipa_qsb_data,
+ .modem_route_count = 11,
+ .endpoint_count = ARRAY_SIZE(ipa_gsi_endpoint_data),
+ .endpoint_data = ipa_gsi_endpoint_data,
+ .resource_data = &ipa_resource_data,
+ .mem_data = &ipa_mem_data,
+ .power_data = &ipa_power_data,
+};
diff --git a/drivers/net/ipa/gsi_reg.c b/drivers/net/ipa/gsi_reg.c
index 825598661188..e13cf835a013 100644
--- a/drivers/net/ipa/gsi_reg.c
+++ b/drivers/net/ipa/gsi_reg.c
@@ -110,6 +110,7 @@ static const struct regs *gsi_regs(struct gsi *gsi)
return &gsi_regs_v4_11;
case IPA_VERSION_5_0:
+ case IPA_VERSION_5_2:
case IPA_VERSION_5_5:
return &gsi_regs_v5_0;
diff --git a/drivers/net/ipa/ipa_data.h b/drivers/net/ipa/ipa_data.h
index f3bdc64cef05..3eb9dc2ce339 100644
--- a/drivers/net/ipa/ipa_data.h
+++ b/drivers/net/ipa/ipa_data.h
@@ -253,6 +253,7 @@ extern const struct ipa_data ipa_data_v4_7;
extern const struct ipa_data ipa_data_v4_9;
extern const struct ipa_data ipa_data_v4_11;
extern const struct ipa_data ipa_data_v5_0;
+extern const struct ipa_data ipa_data_v5_2;
extern const struct ipa_data ipa_data_v5_5;
#endif /* _IPA_DATA_H_ */
diff --git a/drivers/net/ipa/ipa_main.c b/drivers/net/ipa/ipa_main.c
index edead9c48d1f..8e2b4bf7b14e 100644
--- a/drivers/net/ipa/ipa_main.c
+++ b/drivers/net/ipa/ipa_main.c
@@ -669,6 +669,10 @@ static const struct of_device_id ipa_match[] = {
.compatible = "qcom,sdx65-ipa",
.data = &ipa_data_v5_0,
},
+ {
+ .compatible = "qcom,milos-ipa",
+ .data = &ipa_data_v5_2,
+ },
{
.compatible = "qcom,sm8550-ipa",
.data = &ipa_data_v5_5,
diff --git a/drivers/net/ipa/ipa_reg.c b/drivers/net/ipa/ipa_reg.c
index c574f798fdc9..30bd69f4c147 100644
--- a/drivers/net/ipa/ipa_reg.c
+++ b/drivers/net/ipa/ipa_reg.c
@@ -125,6 +125,7 @@ static const struct regs *ipa_regs(enum ipa_version version)
case IPA_VERSION_4_11:
return &ipa_regs_v4_11;
case IPA_VERSION_5_0:
+ case IPA_VERSION_5_2:
return &ipa_regs_v5_0;
case IPA_VERSION_5_5:
return &ipa_regs_v5_5;
diff --git a/drivers/net/ipa/ipa_sysfs.c b/drivers/net/ipa/ipa_sysfs.c
index a53e9e6f6cdf..8b805a9d49e6 100644
--- a/drivers/net/ipa/ipa_sysfs.c
+++ b/drivers/net/ipa/ipa_sysfs.c
@@ -39,6 +39,8 @@ static const char *ipa_version_string(struct ipa *ipa)
return "5.0";
case IPA_VERSION_5_1:
return "5.1";
+ case IPA_VERSION_5_2:
+ return "5.2";
case IPA_VERSION_5_5:
return "5.5";
default:
diff --git a/drivers/net/ipa/ipa_version.h b/drivers/net/ipa/ipa_version.h
index 38c47f51a50c..c157c72a5bad 100644
--- a/drivers/net/ipa/ipa_version.h
+++ b/drivers/net/ipa/ipa_version.h
@@ -23,6 +23,7 @@
* @IPA_VERSION_4_11: IPA version 4.11/GSI version 2.11 (2.1.1)
* @IPA_VERSION_5_0: IPA version 5.0/GSI version 3.0
* @IPA_VERSION_5_1: IPA version 5.1/GSI version 3.0
+ * @IPA_VERSION_5_2: IPA version 5.2/GSI version 5.2
* @IPA_VERSION_5_5: IPA version 5.5/GSI version 5.5
* @IPA_VERSION_COUNT: Number of defined IPA versions
*
@@ -43,6 +44,7 @@ enum ipa_version {
IPA_VERSION_4_11,
IPA_VERSION_5_0,
IPA_VERSION_5_1,
+ IPA_VERSION_5_2,
IPA_VERSION_5_5,
IPA_VERSION_COUNT, /* Last; not a version */
};
--
2.53.0
^ permalink raw reply related
* [PATCH 5/6] arm64: dts: qcom: milos: Add IPA node
From: Luca Weiss @ 2026-04-03 16:43 UTC (permalink / raw)
To: Alex Elder, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Bjorn Andersson, Konrad Dybcio, Alexander Koskovich
Cc: ~postmarketos/upstreaming, phone-devel, netdev, linux-kernel,
linux-arm-msm, devicetree, Luca Weiss
In-Reply-To: <20260403-milos-ipa-v1-0-01e9e4e03d3e@fairphone.com>
Add the description of the IPA block in the Milos SoC.
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
---
arch/arm64/boot/dts/qcom/milos.dtsi | 44 +++++++++++++++++++++++++++++++++++++
1 file changed, 44 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/milos.dtsi b/arch/arm64/boot/dts/qcom/milos.dtsi
index 1c045743ef77..c388dacf47d5 100644
--- a/arch/arm64/boot/dts/qcom/milos.dtsi
+++ b/arch/arm64/boot/dts/qcom/milos.dtsi
@@ -1599,6 +1599,50 @@ adreno_smmu: iommu@3da0000 {
dma-coherent;
};
+ ipa: ipa@3f40000 {
+ compatible = "qcom,milos-ipa";
+
+ reg = <0x0 0x03f40000 0x0 0x10000>,
+ <0x0 0x03f50000 0x0 0x5000>,
+ <0x0 0x03e04000 0x0 0xfc000>;
+ reg-names = "ipa-reg",
+ "ipa-shared",
+ "gsi";
+
+ interrupts-extended = <&intc GIC_SPI 654 IRQ_TYPE_EDGE_RISING 0>,
+ <&intc GIC_SPI 432 IRQ_TYPE_LEVEL_HIGH 0>,
+ <&smp2p_ipa_in 0 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_ipa_in 1 IRQ_TYPE_EDGE_RISING>;
+ interrupt-names = "ipa",
+ "gsi",
+ "ipa-clock-query",
+ "ipa-setup-ready";
+
+ clocks = <&rpmhcc RPMH_IPA_CLK>;
+ clock-names = "core";
+
+ interconnects = <&aggre2_noc MASTER_IPA QCOM_ICC_TAG_ALWAYS
+ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
+ <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+ &cnoc_main SLAVE_IPA_CFG QCOM_ICC_TAG_ACTIVE_ONLY>;
+ interconnect-names = "memory",
+ "config";
+
+ iommus = <&apps_smmu 0x4a0 0x0>,
+ <&apps_smmu 0x4a2 0x0>;
+
+ qcom,qmp = <&aoss_qmp>;
+
+ qcom,smem-states = <&smp2p_ipa_out 0>,
+ <&smp2p_ipa_out 1>;
+ qcom,smem-state-names = "ipa-clock-enabled-valid",
+ "ipa-clock-enabled";
+
+ sram = <&ipa_modem_tables>;
+
+ status = "disabled";
+ };
+
remoteproc_mpss: remoteproc@4080000 {
compatible = "qcom,milos-mpss-pas";
reg = <0x0 0x04080000 0x0 0x10000>;
--
2.53.0
^ permalink raw reply related
* [PATCH 6/6] arm64: dts: qcom: milos-fairphone-fp6: Enable IPA
From: Luca Weiss @ 2026-04-03 16:43 UTC (permalink / raw)
To: Alex Elder, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Bjorn Andersson, Konrad Dybcio, Alexander Koskovich
Cc: ~postmarketos/upstreaming, phone-devel, netdev, linux-kernel,
linux-arm-msm, devicetree, Luca Weiss
In-Reply-To: <20260403-milos-ipa-v1-0-01e9e4e03d3e@fairphone.com>
Configure and enable the node for IPA which enables mobile data on this
device.
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
---
arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts b/arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts
index c1899db46e71..31c6d6627619 100644
--- a/arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts
+++ b/arch/arm64/boot/dts/qcom/milos-fairphone-fp6.dts
@@ -690,6 +690,15 @@ vreg_l7p: ldo7 {
/* AW86938FCR vibrator @ 0x5a */
};
+&ipa {
+ firmware-name = "qcom/milos/fairphone/fp6/ipa_fws.mbn";
+ memory-region = <&ipa_fw_mem>;
+
+ qcom,gsi-loader = "self";
+
+ status = "okay";
+};
+
&pm8550vs_c {
status = "okay";
};
--
2.53.0
^ permalink raw reply related
* Re: [PATCH v9 07/10] x86/vmscape: Use static_call() for predictor flush
From: Pawan Gupta @ 2026-04-03 16:44 UTC (permalink / raw)
To: Sean Christopherson
Cc: x86, Jon Kohler, Nikolay Borisov, H. Peter Anvin, Josh Poimboeuf,
David Kaplan, Borislav Petkov, Dave Hansen, Peter Zijlstra,
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, KP Singh,
Jiri Olsa, David S. Miller, David Laight, Andy Lutomirski,
Thomas Gleixner, Ingo Molnar, David Ahern, Martin KaFai Lau,
Eduard Zingerman, Song Liu, Yonghong Song, John Fastabend,
Stanislav Fomichev, Hao Luo, Paolo Bonzini, Jonathan Corbet,
linux-kernel, kvm, Asit Mallick, Tao Zhang, bpf, netdev,
linux-doc
In-Reply-To: <ac_UJx99kDJY8j3t@google.com>
On Fri, Apr 03, 2026 at 07:52:23AM -0700, Sean Christopherson wrote:
> On Thu, Apr 02, 2026, Pawan Gupta wrote:
> > --- a/arch/x86/kvm/x86.c
> > +++ b/arch/x86/kvm/x86.c
> > @@ -11463,7 +11463,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
> > * set for the CPU that actually ran the guest, and not the CPU that it
> > * may migrate to.
> > */
> > - if (cpu_feature_enabled(X86_FEATURE_IBPB_EXIT_TO_USER))
> > + if (vmscape_mitigation_enabled())
>
> This is pretty lame. It turns a statically patched MOV
Yes it is, this was done ...
> 11548 if (cpu_feature_enabled(X86_FEATURE_IBPB_EXIT_TO_USER))
> 11549 this_cpu_write(x86_ibpb_exit_to_user, true);
> 0x000000000003c57a <+858>: movb $0x1,%gs:0x0(%rip) # 0x3c582 <vcpu_enter_guest+866>
>
> into a function call and two sets of conditional branches. And with mitigations
> enabled, that function call may trigger the wonderful unret insanity
>
> 11548 if (vmscape_mitigation_enabled())
> 0x000000000003c575 <+853>: call 0x3c57a <vcpu_enter_guest+858>
> 0x000000000003c57a <+858>: test %al,%al
> 0x000000000003c57c <+860>: je 0x3c586 <vcpu_enter_guest+870>
>
> 11549 this_cpu_write(x86_predictor_flush_exit_to_user, true);
> 0x000000000003c57e <+862>: movb $0x1,%gs:0x0(%rip) # 0x3c586 <vcpu_enter_guest+870>
>
>
> 3166 {
> 0xffffffff81285320 <+0>: endbr64
> 0xffffffff81285324 <+4>: call 0xffffffff812aa5a0 <__fentry__>
>
> 3167 return !!static_call_query(vmscape_predictor_flush);
> 0xffffffff81285329 <+9>: mov 0x13a4f30(%rip),%rax # 0xffffffff8262a260 <__SCK__vmscape_predictor_flush>
> 0xffffffff81285330 <+16>: test %rax,%rax
> 0xffffffff81285333 <+19>: setne %al
>
> 3168 }
> 0xffffffff81285336 <+22>: jmp 0xffffffff81db1e30 <__x86_return_thunk>
>
> While this isn't KVM's super hot inner run loop, it's still very much a hot path.
> Even more annoying, KVM will eat the function call on kernels with CPU_MITIGATIONS=n.
>
> I'd like to at least do something like the below to make the common case of
> multiple guest entry/exits more or less free, and to avoid the CALL+(UN)RET
> overhead, but trying to include linux/static_call.h in processor.h (or any other
> core x86 header) creates a cyclical dependency :-/
>
> diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
> index 20ab4dd588c6..0dc0680a80f8 100644
> --- a/arch/x86/include/asm/processor.h
> +++ b/arch/x86/include/asm/processor.h
> @@ -36,6 +36,7 @@ struct vm86;
> #include <linux/err.h>
> #include <linux/irqflags.h>
> #include <linux/mem_encrypt.h>
> +#include <linux/static_call.h>
>
> /*
> * We handle most unaligned accesses in hardware. On the other hand
> @@ -753,7 +754,11 @@ enum mds_mitigations {
> };
>
> extern bool gds_ucode_mitigated(void);
> -extern bool vmscape_mitigation_enabled(void);
> +
> +static inline bool vmscape_mitigation_enabled(void)
> +{
> + return !!static_call_query(vmscape_predictor_flush);
> +}
>
> /*
> * Make previous memory operations globally visible before
> diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
> index 366ebe1e1fb9..02bf626f0773 100644
> --- a/arch/x86/kernel/cpu/bugs.c
> +++ b/arch/x86/kernel/cpu/bugs.c
> @@ -148,6 +148,7 @@ DEFINE_STATIC_KEY_FALSE(switch_mm_cond_l1d_flush);
> * sequence. This defaults to no mitigation.
> */
> DEFINE_STATIC_CALL_NULL(vmscape_predictor_flush, write_ibpb);
> +EXPORT_STATIC_CALL_GPL(vmscape_predictor_flush);
... to avoid exporting the static key, so that modules (other than KVM)
cannot do static_call_update(vmscape_predictor_flush).
Peter suggested changes that allowed adding EXPORT_STATIC_CALL_FOR_KVM():
https://lore.kernel.org/all/20260319214409.GL3738786@noisy.programming.kicks-ass.net/
EXPORT_STATIC_CALL_FOR_KVM() seems to be a cleaner approach to me.
Boris, I know you didn't like exporting the static_key. But, as Sean said
this is a hot path, and avoiding the unnecessary call would benefit all
CPUs (affected or unaffected). Moreover, EXPORT_STATIC_CALL_FOR_KVM()
somewhat addresses your concern of exporting the static_key to the world.
Would you be okay with it?
^ permalink raw reply
* Re: [PATCH v9 01/10] x86/bhi: x86/vmscape: Move LFENCE out of clear_bhb_loop()
From: Pawan Gupta @ 2026-04-03 16:45 UTC (permalink / raw)
To: Borislav Petkov
Cc: x86, Jon Kohler, Nikolay Borisov, H. Peter Anvin, Josh Poimboeuf,
David Kaplan, Sean Christopherson, Dave Hansen, Peter Zijlstra,
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, KP Singh,
Jiri Olsa, David S. Miller, David Laight, Andy Lutomirski,
Thomas Gleixner, Ingo Molnar, David Ahern, Martin KaFai Lau,
Eduard Zingerman, Song Liu, Yonghong Song, John Fastabend,
Stanislav Fomichev, Hao Luo, Paolo Bonzini, Jonathan Corbet,
linux-kernel, kvm, Asit Mallick, Tao Zhang, bpf, netdev,
linux-doc
In-Reply-To: <20260403151630.GWac_ZzhQZj5LUDlRf@fat_crate.local>
On Fri, Apr 03, 2026 at 05:16:30PM +0200, Borislav Petkov wrote:
> On Thu, Apr 02, 2026 at 05:30:47PM -0700, Pawan Gupta wrote:
> > Currently, the BHB clearing sequence is followed by an LFENCE to prevent
> > transient execution of subsequent indirect branches prematurely. However,
> > the LFENCE barrier could be unnecessary in certain cases. For example, when
> > the kernel is using the BHI_DIS_S mitigation, and BHB clearing is only
> > needed for userspace. In such cases, the LFENCE is redundant because ring
> > transitions would provide the necessary serialization.
> >
> > Below is a quick recap of BHI mitigation options:
> >
> > On Alder Lake and newer
> >
> > BHI_DIS_S: Hardware control to mitigate BHI in ring0. This has low
> > performance overhead.
> >
> > Long loop: Alternatively, a longer version of the BHB clearing sequence
> > can be used to mitigate BHI. It can also be used to mitigate the BHI
> > variant of VMSCAPE. This is not yet implemented in Linux.
> >
> > On older CPUs
> >
> > Short loop: Clears BHB at kernel entry and VMexit. The "Long loop" is
> > effective on older CPUs as well, but should be avoided because of
> > unnecessary overhead.
> >
> > On Alder Lake and newer CPUs, eIBRS isolates the indirect targets between
> > guest and host. But when affected by the BHI variant of VMSCAPE, a guest's
> > branch history may still influence indirect branches in userspace. This
> > also means the big hammer IBPB could be replaced with a cheaper option that
> > clears the BHB at exit-to-userspace after a VMexit.
> >
> > In preparation for adding the support for the BHB sequence (without LFENCE)
> > on newer CPUs, move the LFENCE to the caller side after clear_bhb_loop() is
> > executed. Allow callers to decide whether they need the LFENCE or not. This
> > adds a few extra bytes to the call sites, but it obviates the need for
> > multiple variants of clear_bhb_loop().
> >
> > Suggested-by: Dave Hansen <dave.hansen@linux.intel.com>
> > Tested-by: Jon Kohler <jon@nutanix.com>
> > Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>
> > Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
> > ---
> > arch/x86/entry/entry_64.S | 5 ++++-
> > arch/x86/include/asm/nospec-branch.h | 4 ++--
> > arch/x86/net/bpf_jit_comp.c | 2 ++
> > 3 files changed, 8 insertions(+), 3 deletions(-)
>
> Acked-by: Borislav Petkov (AMD) <bp@alien8.de>
Thanks.
^ permalink raw reply
* Re: [PATCH net-next] iavf: fix kernel-doc comment style in ethtool ops
From: Joe Damato @ 2026-04-03 16:57 UTC (permalink / raw)
To: Aleksandr Loktionov
Cc: intel-wired-lan, anthony.l.nguyen, netdev, Leszek Pepiak
In-Reply-To: <20260403054321.3791392-1-aleksandr.loktionov@intel.com>
On Fri, Apr 03, 2026 at 07:43:21AM +0200, Aleksandr Loktionov wrote:
> From: Leszek Pepiak <leszek.pepiak@intel.com>
>
> iavf_get_channels() and iavf_set_channels() use the legacy `**/`
> comment terminator and embed the return description in the body text.
> Convert to proper kernel-doc style: single `*/` terminator and an
> explicit `Return:` section.
>
> Signed-off-by: Leszek Pepiak <leszek.pepiak@intel.com>
> Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
>
> ---
> drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 13 +++++++------
> 1 file changed, 7 insertions(+), 6 deletions(-)
FWIW looks like there are a few other functions in this file that use the
"**/" terminator. Not sure it's worth respinning to get them all, though, so:
Reviewed-by: Joe Damato <joe@dama.to>
^ permalink raw reply
* Re: [net-next 2/3] selftests/net: Test PACKET_STATISTICS drops
From: Joe Damato @ 2026-04-03 17:02 UTC (permalink / raw)
To: Willem de Bruijn
Cc: netdev, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Shuah Khan, andrew+netdev,
linux-kernel, willemb, linux-kselftest
In-Reply-To: <willemdebruijn.kernel.886450145305@gmail.com>
On Fri, Apr 03, 2026 at 11:26:01AM -0400, Willem de Bruijn wrote:
[...]
> > +
> > + if (cfg_drop) {
> > + check_packet_stats(fds);
> > + goto out;
> > + }
>
> can this not use the check_packet_stats added in the previous patch
> right below?
IIRC: no it can't because when I tested this the do_rx hits the error path in
the drop case which makes sense because of the tiny receive buffer.
^ permalink raw reply
* Re: [PATCH v9 01/10] x86/bhi: x86/vmscape: Move LFENCE out of clear_bhb_loop()
From: Borislav Petkov @ 2026-04-03 17:11 UTC (permalink / raw)
To: Pawan Gupta
Cc: x86, Jon Kohler, Nikolay Borisov, H. Peter Anvin, Josh Poimboeuf,
David Kaplan, Sean Christopherson, Dave Hansen, Peter Zijlstra,
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, KP Singh,
Jiri Olsa, David S. Miller, David Laight, Andy Lutomirski,
Thomas Gleixner, Ingo Molnar, David Ahern, Martin KaFai Lau,
Eduard Zingerman, Song Liu, Yonghong Song, John Fastabend,
Stanislav Fomichev, Hao Luo, Paolo Bonzini, Jonathan Corbet,
linux-kernel, kvm, Asit Mallick, Tao Zhang, bpf, netdev,
linux-doc
In-Reply-To: <20260403164552.chdvvmdfaufcgxzo@desk>
On Fri, Apr 03, 2026 at 09:45:52AM -0700, Pawan Gupta wrote:
> Thanks.
You don't have to say "thanks" to every review - we're one big family.
:-)
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
^ permalink raw reply
* Re: [PATCH v9 07/10] x86/vmscape: Use static_call() for predictor flush
From: Pawan Gupta @ 2026-04-03 17:26 UTC (permalink / raw)
To: Sean Christopherson, Borislav Petkov
Cc: x86, Jon Kohler, Nikolay Borisov, H. Peter Anvin, Josh Poimboeuf,
David Kaplan, Dave Hansen, Peter Zijlstra, Alexei Starovoitov,
Daniel Borkmann, Andrii Nakryiko, KP Singh, Jiri Olsa,
David S. Miller, David Laight, Andy Lutomirski, Thomas Gleixner,
Ingo Molnar, David Ahern, Martin KaFai Lau, Eduard Zingerman,
Song Liu, Yonghong Song, John Fastabend, Stanislav Fomichev,
Hao Luo, Paolo Bonzini, Jonathan Corbet, linux-kernel, kvm,
Asit Mallick, Tao Zhang, bpf, netdev, linux-doc
In-Reply-To: <20260403164432.ltnr5oupddscwaqu@desk>
On Fri, Apr 03, 2026 at 09:44:32AM -0700, Pawan Gupta wrote:
> On Fri, Apr 03, 2026 at 07:52:23AM -0700, Sean Christopherson wrote:
> > On Thu, Apr 02, 2026, Pawan Gupta wrote:
> > > --- a/arch/x86/kvm/x86.c
> > > +++ b/arch/x86/kvm/x86.c
> > > @@ -11463,7 +11463,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
> > > * set for the CPU that actually ran the guest, and not the CPU that it
> > > * may migrate to.
> > > */
> > > - if (cpu_feature_enabled(X86_FEATURE_IBPB_EXIT_TO_USER))
> > > + if (vmscape_mitigation_enabled())
> >
> > This is pretty lame. It turns a statically patched MOV
>
> Yes it is, this was done ...
>
> > 11548 if (cpu_feature_enabled(X86_FEATURE_IBPB_EXIT_TO_USER))
> > 11549 this_cpu_write(x86_ibpb_exit_to_user, true);
> > 0x000000000003c57a <+858>: movb $0x1,%gs:0x0(%rip) # 0x3c582 <vcpu_enter_guest+866>
> >
> > into a function call and two sets of conditional branches. And with mitigations
> > enabled, that function call may trigger the wonderful unret insanity
> >
> > 11548 if (vmscape_mitigation_enabled())
> > 0x000000000003c575 <+853>: call 0x3c57a <vcpu_enter_guest+858>
> > 0x000000000003c57a <+858>: test %al,%al
> > 0x000000000003c57c <+860>: je 0x3c586 <vcpu_enter_guest+870>
> >
> > 11549 this_cpu_write(x86_predictor_flush_exit_to_user, true);
> > 0x000000000003c57e <+862>: movb $0x1,%gs:0x0(%rip) # 0x3c586 <vcpu_enter_guest+870>
> >
> >
> > 3166 {
> > 0xffffffff81285320 <+0>: endbr64
> > 0xffffffff81285324 <+4>: call 0xffffffff812aa5a0 <__fentry__>
> >
> > 3167 return !!static_call_query(vmscape_predictor_flush);
> > 0xffffffff81285329 <+9>: mov 0x13a4f30(%rip),%rax # 0xffffffff8262a260 <__SCK__vmscape_predictor_flush>
> > 0xffffffff81285330 <+16>: test %rax,%rax
> > 0xffffffff81285333 <+19>: setne %al
> >
> > 3168 }
> > 0xffffffff81285336 <+22>: jmp 0xffffffff81db1e30 <__x86_return_thunk>
> >
> > While this isn't KVM's super hot inner run loop, it's still very much a hot path.
> > Even more annoying, KVM will eat the function call on kernels with CPU_MITIGATIONS=n.
> >
> > I'd like to at least do something like the below to make the common case of
> > multiple guest entry/exits more or less free, and to avoid the CALL+(UN)RET
> > overhead, but trying to include linux/static_call.h in processor.h (or any other
> > core x86 header) creates a cyclical dependency :-/
> >
> > diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
> > index 20ab4dd588c6..0dc0680a80f8 100644
> > --- a/arch/x86/include/asm/processor.h
> > +++ b/arch/x86/include/asm/processor.h
> > @@ -36,6 +36,7 @@ struct vm86;
> > #include <linux/err.h>
> > #include <linux/irqflags.h>
> > #include <linux/mem_encrypt.h>
> > +#include <linux/static_call.h>
> >
> > /*
> > * We handle most unaligned accesses in hardware. On the other hand
> > @@ -753,7 +754,11 @@ enum mds_mitigations {
> > };
> >
> > extern bool gds_ucode_mitigated(void);
> > -extern bool vmscape_mitigation_enabled(void);
> > +
> > +static inline bool vmscape_mitigation_enabled(void)
> > +{
> > + return !!static_call_query(vmscape_predictor_flush);
> > +}
> >
> > /*
> > * Make previous memory operations globally visible before
> > diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
> > index 366ebe1e1fb9..02bf626f0773 100644
> > --- a/arch/x86/kernel/cpu/bugs.c
> > +++ b/arch/x86/kernel/cpu/bugs.c
> > @@ -148,6 +148,7 @@ DEFINE_STATIC_KEY_FALSE(switch_mm_cond_l1d_flush);
> > * sequence. This defaults to no mitigation.
> > */
> > DEFINE_STATIC_CALL_NULL(vmscape_predictor_flush, write_ibpb);
> > +EXPORT_STATIC_CALL_GPL(vmscape_predictor_flush);
>
> ... to avoid exporting the static key, so that modules (other than KVM)
> cannot do static_call_update(vmscape_predictor_flush).
>
> Peter suggested changes that allowed adding EXPORT_STATIC_CALL_FOR_KVM():
>
> https://lore.kernel.org/all/20260319214409.GL3738786@noisy.programming.kicks-ass.net/
Sorry, this is the correct link for EXPORT_STATIC_CALL_FOR_KVM():
https://lore.kernel.org/all/20260320062206.bdrnmnvho6lhmejw@desk/
> EXPORT_STATIC_CALL_FOR_KVM() seems to be a cleaner approach to me.
>
> Boris, I know you didn't like exporting the static_key. But, as Sean said
> this is a hot path, and avoiding the unnecessary call would benefit all
> CPUs (affected or unaffected). Moreover, EXPORT_STATIC_CALL_FOR_KVM()
> somewhat addresses your concern of exporting the static_key to the world.
> Would you be okay with it?
^ permalink raw reply
* [PATCH] ethtool: Add 2 new link_ext_state names
From: Michael Chan @ 2026-04-03 17:42 UTC (permalink / raw)
To: mkubecek, kuba, netdev
Add the corresponding names for 2 recently added ethtool_link_ext_state
enums from kernel commit bc87b14594e3:
ETHTOOL_LINK_EXT_STATE_OTP_SPEED_VIOLATION
ETHTOOL_LINK_EXT_STATE_BMC_REQUEST_DOWN
for OTP (one-time-programmable) speed restrictions and
BMC (Baseboard management controller) forcing the link down.
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
---
netlink/settings.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/netlink/settings.c b/netlink/settings.c
index 05d215e..b5e44f2 100644
--- a/netlink/settings.c
+++ b/netlink/settings.c
@@ -671,6 +671,8 @@ static const char *const names_link_ext_state[] = {
[ETHTOOL_LINK_EXT_STATE_POWER_BUDGET_EXCEEDED] = "Power budget exceeded",
[ETHTOOL_LINK_EXT_STATE_OVERHEAT] = "Overheat",
[ETHTOOL_LINK_EXT_STATE_MODULE] = "Module",
+ [ETHTOOL_LINK_EXT_STATE_OTP_SPEED_VIOLATION] = "OTP speed violation",
+ [ETHTOOL_LINK_EXT_STATE_BMC_REQUEST_DOWN] = "BMC request down",
};
static const char *const names_autoneg_link_ext_substate[] = {
--
2.51.0
^ permalink raw reply related
* [PATCH net-next] l2tp: Drop large packets with UDP encap
From: Alice Mikityanska @ 2026-04-03 17:49 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, James Chapman, netdev, Alice Mikityanska,
syzbot+ci3edea60a44225dec
From: Alice Mikityanska <alice@isovalent.com>
syzbot reported a WARN on my patch series [1]. The actual issue is an
overflow of 16-bit UDP length field, and it exists in the upstream code.
My series added a debug WARN with an overflow check that exposed the
issue, that's why syzbot tripped on my patches, rather than on upstream
code.
syzbot's repro:
# {"procs":1,"slowdown":1,"sandbox":"","sandbox_arg":0,"close_fds":false,"callcomments":true}
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0xfffffffc}, 0x1c)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0xffff, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x32)
writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)="ee", 0x34000}], 0x1)
It basically sends an oversized (0x34000 bytes) PPPoL2TP packet with UDP
encapsulation, and l2tp_xmit_core doesn't check for overflows when it
assigns the UDP length field. The value gets trimmed to 16 bites.
Add an overflow check that drops oversized packets and avoids sending
packets with trimmed UDP length to the wire.
syzbot's stack trace (with my patch applied):
len >= 65536u
WARNING: ./include/linux/udp.h:38 at udp_set_len_short include/linux/udp.h:38 [inline], CPU#1: syz.0.17/5957
WARNING: ./include/linux/udp.h:38 at l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline], CPU#1: syz.0.17/5957
WARNING: ./include/linux/udp.h:38 at l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327, CPU#1: syz.0.17/5957
Modules linked in:
CPU: 1 UID: 0 PID: 5957 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:udp_set_len_short include/linux/udp.h:38 [inline]
RIP: 0010:l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline]
RIP: 0010:l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327
Code: 0f 0b 90 e9 21 f9 ff ff e8 e9 05 ec f6 90 0f 0b 90 e9 8d f9 ff ff e8 db 05 ec f6 90 0f 0b 90 e9 cc f9 ff ff e8 cd 05 ec f6 90 <0f> 0b 90 e9 de fa ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 4f
RSP: 0018:ffffc90003d67878 EFLAGS: 00010293
RAX: ffffffff8ad985e3 RBX: ffff8881a6400090 RCX: ffff8881697f0000
RDX: 0000000000000000 RSI: 0000000000034010 RDI: 000000000000ffff
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff520007acf00 R12: ffff8881baf20900
R13: 0000000000034010 R14: ffff8881a640008e R15: ffff8881760f7000
FS: 000055557e81f500(0000) GS:ffff8882a9467000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000033000 CR3: 00000001612f4000 CR4: 00000000000006f0
Call Trace:
<TASK>
pppol2tp_sendmsg+0x40a/0x5f0 net/l2tp/l2tp_ppp.c:302
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
sock_write_iter+0x503/0x550 net/socket.c:1195
do_iter_readv_writev+0x619/0x8c0 fs/read_write.c:-1
vfs_writev+0x33c/0x990 fs/read_write.c:1059
do_writev+0x154/0x2e0 fs/read_write.c:1105
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f636479c629
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffffd4241c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00007f6364a15fa0 RCX: 00007f636479c629
RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000003
RBP: 00007f6364832b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6364a15fac R14: 00007f6364a15fa0 R15: 00007f6364a15fa0
</TASK>
[1]: https://lore.kernel.org/all/20260226201600.222044-1-alice.kernel@fastmail.im/
Reported-by: syzbot+ci3edea60a44225dec@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/69a1dfba.050a0220.3a55be.0026.GAE@google.com/
Signed-off-by: Alice Mikityanska <alice@isovalent.com>
---
net/l2tp/l2tp_core.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index c89ae52764b8..157fc23ce4e1 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1290,6 +1290,11 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, uns
uh->source = inet->inet_sport;
uh->dest = inet->inet_dport;
udp_len = uhlen + session->hdr_len + data_len;
+ if (udp_len > U16_MAX) {
+ kfree_skb(skb);
+ ret = NET_XMIT_DROP;
+ goto out_unlock;
+ }
uh->len = htons(udp_len);
/* Calculate UDP checksum if configured to do so */
--
2.53.0
^ permalink raw reply related
* [PATCH net-next] selftests/net: convert so_txtime to drv-net
From: Willem de Bruijn @ 2026-04-03 17:50 UTC (permalink / raw)
To: netdev; +Cc: davem, kuba, edumazet, pabeni, horms, Willem de Bruijn
From: Willem de Bruijn <willemb@google.com>
In preparation for extending to pacing hardware offload, convert the
so_txtime.sh test to a drv-net test that can be run against netdevsim
and real hardware.
Also move so_txtime.c to lib so that it is easily accessible for the
new drv-net test, similar to gro.c in commit 8888bf4fb980 ("selftests:
net: move gro to lib for HW vs SW reuse").
Also update so_txtime.c to not exit on first failure, but run to
completion and report exit code there. This helps with debugging
unexpected results, especially when processing multiple packets,
as in the "reverse_order" testcase.
Signed-off-by: Willem de Bruijn <willemb@google.com>
---
tools/testing/selftests/drivers/net/Makefile | 1 +
tools/testing/selftests/drivers/net/config | 2 +
.../selftests/drivers/net/so_txtime.py | 87 ++++++++++++++
tools/testing/selftests/net/.gitignore | 1 -
tools/testing/selftests/net/Makefile | 2 -
tools/testing/selftests/net/lib/.gitignore | 1 +
tools/testing/selftests/net/lib/Makefile | 1 +
.../selftests/net/{ => lib}/so_txtime.c | 25 +++-
tools/testing/selftests/net/so_txtime.sh | 110 ------------------
9 files changed, 111 insertions(+), 119 deletions(-)
create mode 100755 tools/testing/selftests/drivers/net/so_txtime.py
rename tools/testing/selftests/net/{ => lib}/so_txtime.c (97%)
delete mode 100755 tools/testing/selftests/net/so_txtime.sh
diff --git a/tools/testing/selftests/drivers/net/Makefile b/tools/testing/selftests/drivers/net/Makefile
index 7c7fa75b80c2..bfa72e07ca89 100644
--- a/tools/testing/selftests/drivers/net/Makefile
+++ b/tools/testing/selftests/drivers/net/Makefile
@@ -20,6 +20,7 @@ TEST_PROGS := \
queues.py \
ring_reconfig.py \
shaper.py \
+ so_txtime.py \
stats.py \
xdp.py \
# end of TEST_PROGS
diff --git a/tools/testing/selftests/drivers/net/config b/tools/testing/selftests/drivers/net/config
index 77ccf83d87e0..a3301d4da540 100644
--- a/tools/testing/selftests/drivers/net/config
+++ b/tools/testing/selftests/drivers/net/config
@@ -3,6 +3,8 @@ CONFIG_DEBUG_INFO_BTF=y
CONFIG_DEBUG_INFO_BTF_MODULES=n
CONFIG_INET_PSP=y
CONFIG_IPV6=y
+CONFIG_NET_SCH_ETF=m
+CONFIG_NET_SCH_FQ=m
CONFIG_NETCONSOLE=m
CONFIG_NETCONSOLE_DYNAMIC=y
CONFIG_NETCONSOLE_EXTENDED_LOG=y
diff --git a/tools/testing/selftests/drivers/net/so_txtime.py b/tools/testing/selftests/drivers/net/so_txtime.py
new file mode 100755
index 000000000000..565cecf307dd
--- /dev/null
+++ b/tools/testing/selftests/drivers/net/so_txtime.py
@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0
+
+"""Regression tests for the SO_TXTIME interface.
+
+Test delivery time in FQ and ETF qdiscs.
+"""
+
+import time
+
+from lib.py import ksft_exit, ksft_run
+from lib.py import KsftNamedVariant, KsftSkipEx, ksft_variants
+from lib.py import NetDrvEpEnv, bkg, cmd
+
+
+def test_so_txtime(cfg, clockid, ipver, args_tx, args_rx, expect_fail):
+ bin_path = cfg.net_lib_dir / "so_txtime"
+
+ tstart = time.time_ns() + 100_000_000
+
+ cmd_addr = f"-S {cfg.addr_v[ipver]} -D {cfg.remote_addr_v[ipver]}"
+ cmd_base = f"{bin_path} -{ipver} -c {clockid} -t {tstart} {cmd_addr}"
+ cmd_rx = f"{cmd_base} {args_rx} -r"
+ cmd_tx = f"{cmd_base} {args_tx}"
+
+ try:
+ with bkg(cmd_rx, host=cfg.remote, exit_wait=True):
+ cmd(cmd_tx)
+ except:
+ if not expect_fail:
+ raise
+
+
+def _test_variants_mono():
+ for ipver in ["4", "6"]:
+ for testcase in [
+ ["no_delay", "a,-1", "a,-1"],
+ ["zero_delay", "a,0", "a,0"],
+ ["one_pkt", "a,10", "a,10"],
+ ["in_order", "a,10,b,20", "a,10,b,20"],
+ ["reverse_order", "a,20,b,10", "b,20,a,20"],
+ ]:
+ name = f"_v{ipver}_{testcase[0]}"
+ yield KsftNamedVariant(name, ipver, testcase[1], testcase[2])
+
+
+@ksft_variants(_test_variants_mono())
+def test_so_txtime_mono(cfg, ipver, args_tx, args_rx):
+ cmd(f"tc qdisc replace dev {cfg.ifname} root fq")
+ test_so_txtime(cfg, "mono", ipver, args_tx, args_rx, False)
+
+
+def _test_variants_etf():
+ for ipver in ["4", "6"]:
+ for testcase in [
+ ["no_delay", "a,-1", "a,-1", True],
+ ["zero_delay", "a,0", "a,0", True],
+ ["one_pkt", "a,10", "a,10", False],
+ ["in_order", "a,10,b,20", "a,10,b,20", False],
+ ["reverse_order", "a,20,b,10", "b,10,a,20", False],
+ ]:
+ name = f"_v{ipver}_{testcase[0]}"
+ yield KsftNamedVariant(name, ipver, testcase[1], testcase[2], testcase[3])
+
+
+@ksft_variants(_test_variants_etf())
+def test_so_txtime_etf(cfg, ipver, args_tx, args_rx, expect_fail):
+ try:
+ # ETF does not support change, so remove and re-add it instead.
+ cmd(f"tc qdisc replace dev {cfg.ifname} root pfifo_fast")
+ etf_args = "clockid CLOCK_TAI delta 400000"
+ cmd(f"tc qdisc replace dev {cfg.ifname} root etf {etf_args}")
+ except Exception as e:
+ raise KsftSkipEx("tc does not support qdisc etf. skipping") from e
+
+ test_so_txtime(cfg, "tai", ipver, args_tx, args_rx, expect_fail)
+
+
+def main() -> None:
+ with NetDrvEpEnv(__file__) as cfg:
+ ksft_run([test_so_txtime_mono], args=(cfg,))
+ ksft_run([test_so_txtime_etf], args=(cfg,))
+ ksft_exit()
+
+
+if __name__ == "__main__":
+ main()
diff --git a/tools/testing/selftests/net/.gitignore b/tools/testing/selftests/net/.gitignore
index 97ad4d551d44..02ad4c99a2b4 100644
--- a/tools/testing/selftests/net/.gitignore
+++ b/tools/testing/selftests/net/.gitignore
@@ -40,7 +40,6 @@ skf_net_off
socket
so_incoming_cpu
so_netns_cookie
-so_txtime
so_rcv_listener
stress_reuseport_listen
tap
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index 6bced3ed798b..b7f51e8f190f 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -81,7 +81,6 @@ TEST_PROGS := \
rxtimestamp.sh \
sctp_vrf.sh \
skf_net_off.sh \
- so_txtime.sh \
srv6_end_dt46_l3vpn_test.sh \
srv6_end_dt4_l3vpn_test.sh \
srv6_end_dt6_l3vpn_test.sh \
@@ -154,7 +153,6 @@ TEST_GEN_FILES := \
skf_net_off \
so_netns_cookie \
so_rcv_listener \
- so_txtime \
socket \
stress_reuseport_listen \
tcp_fastopen_backup_key \
diff --git a/tools/testing/selftests/net/lib/.gitignore b/tools/testing/selftests/net/lib/.gitignore
index 6cd2b762af5d..c57d22e72c75 100644
--- a/tools/testing/selftests/net/lib/.gitignore
+++ b/tools/testing/selftests/net/lib/.gitignore
@@ -1,4 +1,5 @@
# SPDX-License-Identifier: GPL-2.0-only
csum
gro
+so_txtime
xdp_helper
diff --git a/tools/testing/selftests/net/lib/Makefile b/tools/testing/selftests/net/lib/Makefile
index ff83603397d0..8c50b6631524 100644
--- a/tools/testing/selftests/net/lib/Makefile
+++ b/tools/testing/selftests/net/lib/Makefile
@@ -15,6 +15,7 @@ TEST_GEN_FILES := \
$(patsubst %.c,%.o,$(wildcard *.bpf.c)) \
csum \
gro \
+ so_txtime \
xdp_helper \
# end of TEST_GEN_FILES
diff --git a/tools/testing/selftests/net/so_txtime.c b/tools/testing/selftests/net/lib/so_txtime.c
similarity index 97%
rename from tools/testing/selftests/net/so_txtime.c
rename to tools/testing/selftests/net/lib/so_txtime.c
index b76df1efc2ef..6583e1a83758 100644
--- a/tools/testing/selftests/net/so_txtime.c
+++ b/tools/testing/selftests/net/lib/so_txtime.c
@@ -33,6 +33,8 @@
#include <unistd.h>
#include <poll.h>
+#include "kselftest.h"
+
static int cfg_clockid = CLOCK_TAI;
static uint16_t cfg_port = 8000;
static int cfg_variance_us = 4000;
@@ -43,6 +45,8 @@ static bool cfg_rx;
static uint64_t glob_tstart;
static uint64_t tdeliver_max;
+static int errors;
+
/* encode one timed transmission (of a 1B payload) */
struct timed_send {
char data;
@@ -131,13 +135,15 @@ static void do_recv_one(int fdr, struct timed_send *ts)
fprintf(stderr, "payload:%c delay:%lld expected:%lld (us)\n",
rbuf[0], (long long)tstop, (long long)texpect);
- if (rbuf[0] != ts->data)
- error(1, 0, "payload mismatch. expected %c", ts->data);
+ if (rbuf[0] != ts->data) {
+ fprintf(stderr, "payload mismatch. expected %c", ts->data);
+ errors++;
+ }
if (llabs(tstop - texpect) > cfg_variance_us) {
fprintf(stderr, "exceeds variance (%d us)\n", cfg_variance_us);
if (!getenv("KSFT_MACHINE_SLOW"))
- exit(1);
+ errors++;
}
}
@@ -255,8 +261,10 @@ static void start_time_wait(void)
return;
now = gettime_ns(CLOCK_REALTIME);
- if (cfg_start_time_ns < now)
- return;
+ if (cfg_start_time_ns < now) {
+ fprintf(stderr, "FAIL: start time already passed\n");
+ errors++;
+ }
err = usleep((cfg_start_time_ns - now) / 1000);
if (err)
@@ -513,5 +521,10 @@ int main(int argc, char **argv)
else
do_test_tx((void *)&cfg_src_addr, cfg_alen);
- return 0;
+ if (errors) {
+ fprintf(stderr, "FAIL: %d errors\n", errors);
+ return KSFT_FAIL;
+ }
+
+ return KSFT_PASS;
}
diff --git a/tools/testing/selftests/net/so_txtime.sh b/tools/testing/selftests/net/so_txtime.sh
deleted file mode 100755
index 5e861ad32a42..000000000000
--- a/tools/testing/selftests/net/so_txtime.sh
+++ /dev/null
@@ -1,110 +0,0 @@
-#!/bin/bash
-# SPDX-License-Identifier: GPL-2.0
-#
-# Regression tests for the SO_TXTIME interface
-
-set -e
-
-readonly ksft_skip=4
-readonly DEV="veth0"
-readonly BIN="./so_txtime"
-
-readonly RAND="$(mktemp -u XXXXXX)"
-readonly NSPREFIX="ns-${RAND}"
-readonly NS1="${NSPREFIX}1"
-readonly NS2="${NSPREFIX}2"
-
-readonly SADDR4='192.168.1.1'
-readonly DADDR4='192.168.1.2'
-readonly SADDR6='fd::1'
-readonly DADDR6='fd::2'
-
-cleanup() {
- ip netns del "${NS2}"
- ip netns del "${NS1}"
-}
-
-trap cleanup EXIT
-
-# Create virtual ethernet pair between network namespaces
-ip netns add "${NS1}"
-ip netns add "${NS2}"
-
-ip link add "${DEV}" netns "${NS1}" type veth \
- peer name "${DEV}" netns "${NS2}"
-
-# Bring the devices up
-ip -netns "${NS1}" link set "${DEV}" up
-ip -netns "${NS2}" link set "${DEV}" up
-
-# Set fixed MAC addresses on the devices
-ip -netns "${NS1}" link set dev "${DEV}" address 02:02:02:02:02:02
-ip -netns "${NS2}" link set dev "${DEV}" address 06:06:06:06:06:06
-
-# Add fixed IP addresses to the devices
-ip -netns "${NS1}" addr add 192.168.1.1/24 dev "${DEV}"
-ip -netns "${NS2}" addr add 192.168.1.2/24 dev "${DEV}"
-ip -netns "${NS1}" addr add fd::1/64 dev "${DEV}" nodad
-ip -netns "${NS2}" addr add fd::2/64 dev "${DEV}" nodad
-
-run_test() {
- local readonly IP="$1"
- local readonly CLOCK="$2"
- local readonly TXARGS="$3"
- local readonly RXARGS="$4"
-
- if [[ "${IP}" == "4" ]]; then
- local readonly SADDR="${SADDR4}"
- local readonly DADDR="${DADDR4}"
- elif [[ "${IP}" == "6" ]]; then
- local readonly SADDR="${SADDR6}"
- local readonly DADDR="${DADDR6}"
- else
- echo "Invalid IP version ${IP}"
- exit 1
- fi
-
- local readonly START="$(date +%s%N --date="+ 0.1 seconds")"
-
- ip netns exec "${NS2}" "${BIN}" -"${IP}" -c "${CLOCK}" -t "${START}" -S "${SADDR}" -D "${DADDR}" "${RXARGS}" -r &
- ip netns exec "${NS1}" "${BIN}" -"${IP}" -c "${CLOCK}" -t "${START}" -S "${SADDR}" -D "${DADDR}" "${TXARGS}"
- wait "$!"
-}
-
-do_test() {
- run_test $@
- [ $? -ne 0 ] && ret=1
-}
-
-do_fail_test() {
- run_test $@
- [ $? -eq 0 ] && ret=1
-}
-
-ip netns exec "${NS1}" tc qdisc add dev "${DEV}" root fq
-set +e
-ret=0
-do_test 4 mono a,-1 a,-1
-do_test 6 mono a,0 a,0
-do_test 6 mono a,10 a,10
-do_test 4 mono a,10,b,20 a,10,b,20
-do_test 6 mono a,20,b,10 b,20,a,20
-
-if ip netns exec "${NS1}" tc qdisc replace dev "${DEV}" root etf clockid CLOCK_TAI delta 400000; then
- do_fail_test 4 tai a,-1 a,-1
- do_fail_test 6 tai a,0 a,0
- do_test 6 tai a,10 a,10
- do_test 4 tai a,10,b,20 a,10,b,20
- do_test 6 tai a,20,b,10 b,10,a,20
-else
- echo "tc ($(tc -V)) does not support qdisc etf. skipping"
- [ $ret -eq 0 ] && ret=$ksft_skip
-fi
-
-if [ $ret -eq 0 ]; then
- echo OK. All tests passed
-elif [[ $ret -ne $ksft_skip && -n "$KSFT_MACHINE_SLOW" ]]; then
- echo "Ignoring errors due to slow environment" 1>&2
- ret=0
-fi
-exit $ret
--
2.53.0.1213.gd9a14994de-goog
^ permalink raw reply related
* Re: [PATCH v2 1/1] Bluetooth: serialize accept_q access
From: Luiz Augusto von Dentz @ 2026-04-03 17:51 UTC (permalink / raw)
To: Ren Wei
Cc: linux-bluetooth, netdev, marcel, davem, edumazet, kuba, pabeni,
horms, yifanwucs, tomapufckgml, yuantan098, bird, enjou1224z,
wangjiexun2025
In-Reply-To: <06a6b4549acba207847ce532dedbf1c95ab22d13.1774925231.git.wangjiexun2025@gmail.com>
Hi Ren,
On Fri, Apr 3, 2026 at 4:05 AM Ren Wei <n05ec@lzu.edu.cn> wrote:
>
> From: Jiexun Wang <wangjiexun2025@gmail.com>
>
> bt_sock_poll() walks the accept queue without synchronization, while
> child teardown can unlink the same socket and drop its last reference.
>
> Protect accept_q with a dedicated lock for queue updates and polling.
> Also rework bt_accept_dequeue() to take temporary child references under
> the queue lock before dropping it and locking the child socket.
>
> Fixes: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ("Linux-2.6.12-rc2")
> Reported-by: Yifan Wu <yifanwucs@gmail.com>
> Reported-by: Juefei Pu <tomapufckgml@gmail.com>
> Co-developed-by: Yuan Tan <yuantan098@gmail.com>
> Signed-off-by: Yuan Tan <yuantan098@gmail.com>
> Suggested-by: Xin Liu <bird@lzu.edu.cn>
> Tested-by: Ren Wei <enjou1224z@gmail.com>
> Signed-off-by: Jiexun Wang <wangjiexun2025@gmail.com>
> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
> ---
> Changes in v2:
> - add Tested-by: Ren Wei <enjou1224z@gmail.com>
> - resend to the public Bluetooth/netdev lists
>
> include/net/bluetooth/bluetooth.h | 1 +
> net/bluetooth/af_bluetooth.c | 85 +++++++++++++++++++++++--------
> 2 files changed, 66 insertions(+), 20 deletions(-)
>
> diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
> index 69eed69f7f26..3faea66b1979 100644
> --- a/include/net/bluetooth/bluetooth.h
> +++ b/include/net/bluetooth/bluetooth.h
> @@ -398,6 +398,7 @@ void baswap(bdaddr_t *dst, const bdaddr_t *src);
> struct bt_sock {
> struct sock sk;
> struct list_head accept_q;
> + spinlock_t accept_q_lock; /* protects accept_q */
> struct sock *parent;
> unsigned long flags;
> void (*skb_msg_name)(struct sk_buff *, void *, int *);
> diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
> index 2b94e2077203..f44e1ecc83d8 100644
> --- a/net/bluetooth/af_bluetooth.c
> +++ b/net/bluetooth/af_bluetooth.c
> @@ -154,6 +154,7 @@ struct sock *bt_sock_alloc(struct net *net, struct socket *sock,
>
> sock_init_data(sock, sk);
> INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
> + spin_lock_init(&bt_sk(sk)->accept_q_lock);
>
> sock_reset_flag(sk, SOCK_ZAPPED);
>
> @@ -214,6 +215,7 @@ void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh)
> {
> const struct cred *old_cred;
> struct pid *old_pid;
> + struct bt_sock *par = bt_sk(parent);
>
> BT_DBG("parent %p, sk %p", parent, sk);
>
> @@ -224,9 +226,12 @@ void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh)
> else
> lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
>
> - list_add_tail(&bt_sk(sk)->accept_q, &bt_sk(parent)->accept_q);
> bt_sk(sk)->parent = parent;
>
> + spin_lock_bh(&par->accept_q_lock);
> + list_add_tail(&bt_sk(sk)->accept_q, &par->accept_q);
> + spin_unlock_bh(&par->accept_q_lock);
> +
> /* Copy credentials from parent since for incoming connections the
> * socket is allocated by the kernel.
> */
> @@ -254,45 +259,73 @@ EXPORT_SYMBOL(bt_accept_enqueue);
> */
> void bt_accept_unlink(struct sock *sk)
> {
> + struct sock *parent = bt_sk(sk)->parent;
> +
> BT_DBG("sk %p state %d", sk, sk->sk_state);
>
> + spin_lock_bh(&bt_sk(parent)->accept_q_lock);
> list_del_init(&bt_sk(sk)->accept_q);
> - sk_acceptq_removed(bt_sk(sk)->parent);
> + spin_unlock_bh(&bt_sk(parent)->accept_q_lock);
> +
> + sk_acceptq_removed(parent);
> bt_sk(sk)->parent = NULL;
> sock_put(sk);
> }
> EXPORT_SYMBOL(bt_accept_unlink);
>
> +static struct sock *bt_accept_get(struct sock *parent, struct sock *sk)
> +{
> + struct bt_sock *bt = bt_sk(parent);
> + struct sock *next = NULL;
> +
> + /* accept_q is modified from child teardown paths too, so take a
> + * temporary reference before dropping the queue lock.
> + */
> + spin_lock_bh(&bt->accept_q_lock);
> +
> + if (sk) {
> + if (bt_sk(sk)->parent != parent)
> + goto out;
> +
> + if (!list_is_last(&bt_sk(sk)->accept_q, &bt->accept_q)) {
> + next = &list_next_entry(bt_sk(sk), accept_q)->sk;
> + sock_hold(next);
> + }
> + } else if (!list_empty(&bt->accept_q)) {
> + next = &list_first_entry(&bt->accept_q,
> + struct bt_sock, accept_q)->sk;
> + sock_hold(next);
> + }
> +
> +out:
> + spin_unlock_bh(&bt->accept_q_lock);
> + return next;
> +}
> +
> struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock)
> {
> - struct bt_sock *s, *n;
> - struct sock *sk;
> + struct sock *sk, *next;
>
> BT_DBG("parent %p", parent);
>
> restart:
> - list_for_each_entry_safe(s, n, &bt_sk(parent)->accept_q, accept_q) {
> - sk = (struct sock *)s;
> -
> + for (sk = bt_accept_get(parent, NULL); sk; sk = next) {
> /* Prevent early freeing of sk due to unlink and sock_kill */
> - sock_hold(sk);
> lock_sock(sk);
>
> /* Check sk has not already been unlinked via
> * bt_accept_unlink() due to serialisation caused by sk locking
> */
> - if (!bt_sk(sk)->parent) {
> + if (bt_sk(sk)->parent != parent) {
> BT_DBG("sk %p, already unlinked", sk);
> release_sock(sk);
> sock_put(sk);
>
> - /* Restart the loop as sk is no longer in the list
> - * and also avoid a potential infinite loop because
> - * list_for_each_entry_safe() is not thread safe.
> - */
> goto restart;
> }
>
> + next = bt_accept_get(parent, sk);
> +
> /* sk is safely in the parent list so reduce reference count */
> sock_put(sk);
>
> @@ -310,6 +343,8 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock)
> sock_graft(sk, newsock);
>
> release_sock(sk);
> + if (next)
> + sock_put(next);
> return sk;
> }
>
> @@ -518,18 +553,28 @@ EXPORT_SYMBOL(bt_sock_stream_recvmsg);
>
> static inline __poll_t bt_accept_poll(struct sock *parent)
> {
> - struct bt_sock *s, *n;
> + struct bt_sock *bt = bt_sk(parent);
> + struct bt_sock *s;
> struct sock *sk;
> + __poll_t mask = 0;
> +
> + spin_lock_bh(&bt->accept_q_lock);
> + list_for_each_entry(s, &bt->accept_q, accept_q) {
> + int state;
>
> - list_for_each_entry_safe(s, n, &bt_sk(parent)->accept_q, accept_q) {
> sk = (struct sock *)s;
> - if (sk->sk_state == BT_CONNECTED ||
> - (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags) &&
> - sk->sk_state == BT_CONNECT2))
> - return EPOLLIN | EPOLLRDNORM;
> + state = READ_ONCE(sk->sk_state);
> +
> + if (state == BT_CONNECTED ||
> + (test_bit(BT_SK_DEFER_SETUP, &bt->flags) &&
> + state == BT_CONNECT2)) {
> + mask = EPOLLIN | EPOLLRDNORM;
> + break;
> + }
> }
> + spin_unlock_bh(&bt->accept_q_lock);
>
> - return 0;
> + return mask;
> }
>
> __poll_t bt_sock_poll(struct file *file, struct socket *sock,
> --
> 2.34.1
https://sashiko.dev/#/patchset/06a6b4549acba207847ce532dedbf1c95ab22d13.1774925231.git.wangjiexun2025%40gmail.com
Seem valid to me.
--
Luiz Augusto von Dentz
^ permalink raw reply
* Re: [PATCH v9 02/10] x86/bhi: Make clear_bhb_loop() effective on newer CPUs
From: Jim Mattson @ 2026-04-03 18:10 UTC (permalink / raw)
To: Pawan Gupta
Cc: x86, Jon Kohler, Nikolay Borisov, H. Peter Anvin, Josh Poimboeuf,
David Kaplan, Sean Christopherson, Borislav Petkov, Dave Hansen,
Peter Zijlstra, Alexei Starovoitov, Daniel Borkmann,
Andrii Nakryiko, KP Singh, Jiri Olsa, David S. Miller,
David Laight, Andy Lutomirski, Thomas Gleixner, Ingo Molnar,
David Ahern, Martin KaFai Lau, Eduard Zingerman, Song Liu,
Yonghong Song, John Fastabend, Stanislav Fomichev, Hao Luo,
Paolo Bonzini, Jonathan Corbet, linux-kernel, kvm, Asit Mallick,
Tao Zhang, bpf, netdev, linux-doc
In-Reply-To: <20260402-vmscape-bhb-v9-2-94d16bc29774@linux.intel.com>
On Thu, Apr 2, 2026 at 5:32 PM Pawan Gupta
<pawan.kumar.gupta@linux.intel.com> wrote:
>
> As a mitigation for BHI, clear_bhb_loop() executes branches that overwrite
> the Branch History Buffer (BHB). On Alder Lake and newer parts this
> sequence is not sufficient because it doesn't clear enough entries. This
> was not an issue because these CPUs use the BHI_DIS_S hardware mitigation
> in the kernel.
>
> Now with VMSCAPE (BHI variant) it is also required to isolate branch
> history between guests and userspace. Since BHI_DIS_S only protects the
> kernel, the newer CPUs also use IBPB.
>
> A cheaper alternative to the current IBPB mitigation is clear_bhb_loop().
> But it currently does not clear enough BHB entries to be effective on newer
> CPUs with larger BHB. At boot, dynamically set the loop count of
> clear_bhb_loop() such that it is effective on newer CPUs too. Use the
> X86_FEATURE_BHI_CTRL feature flag to select the appropriate loop count.
>
> Suggested-by: Dave Hansen <dave.hansen@linux.intel.com>
> Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
> ---
> arch/x86/entry/entry_64.S | 8 +++++---
> arch/x86/include/asm/nospec-branch.h | 2 ++
> arch/x86/kernel/cpu/bugs.c | 13 +++++++++++++
> 3 files changed, 20 insertions(+), 3 deletions(-)
>
> diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
> index 3a180a36ca0e..bbd4b1c7ec04 100644
> --- a/arch/x86/entry/entry_64.S
> +++ b/arch/x86/entry/entry_64.S
> @@ -1536,7 +1536,9 @@ SYM_FUNC_START(clear_bhb_loop)
> ANNOTATE_NOENDBR
> push %rbp
> mov %rsp, %rbp
> - movl $5, %ecx
> +
> + movzbl bhb_seq_outer_loop(%rip), %ecx
> +
> ANNOTATE_INTRA_FUNCTION_CALL
> call 1f
> jmp 5f
> @@ -1556,8 +1558,8 @@ SYM_FUNC_START(clear_bhb_loop)
> * This should be ideally be: .skip 32 - (.Lret2 - 2f), 0xcc
> * but some Clang versions (e.g. 18) don't like this.
> */
> - .skip 32 - 18, 0xcc
> -2: movl $5, %eax
> + .skip 32 - 20, 0xcc
> +2: movzbl bhb_seq_inner_loop(%rip), %eax
> 3: jmp 4f
> nop
> 4: sub $1, %eax
> diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
> index 70b377fcbc1c..87b83ae7c97f 100644
> --- a/arch/x86/include/asm/nospec-branch.h
> +++ b/arch/x86/include/asm/nospec-branch.h
> @@ -548,6 +548,8 @@ DECLARE_PER_CPU(u64, x86_spec_ctrl_current);
> extern void update_spec_ctrl_cond(u64 val);
> extern u64 spec_ctrl_current(void);
>
> +extern u8 bhb_seq_inner_loop, bhb_seq_outer_loop;
> +
> /*
> * With retpoline, we must use IBRS to restrict branch prediction
> * before calling into firmware.
> diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
> index 83f51cab0b1e..2cb4a96247d8 100644
> --- a/arch/x86/kernel/cpu/bugs.c
> +++ b/arch/x86/kernel/cpu/bugs.c
> @@ -2047,6 +2047,10 @@ enum bhi_mitigations {
> static enum bhi_mitigations bhi_mitigation __ro_after_init =
> IS_ENABLED(CONFIG_MITIGATION_SPECTRE_BHI) ? BHI_MITIGATION_AUTO : BHI_MITIGATION_OFF;
>
> +/* Default to short BHB sequence values */
> +u8 bhb_seq_outer_loop __ro_after_init = 5;
> +u8 bhb_seq_inner_loop __ro_after_init = 5;
> +
> static int __init spectre_bhi_parse_cmdline(char *str)
> {
> if (!str)
> @@ -3242,6 +3246,15 @@ void __init cpu_select_mitigations(void)
> x86_spec_ctrl_base &= ~SPEC_CTRL_MITIGATIONS_MASK;
> }
>
> + /*
> + * Switch to long BHB clear sequence on newer CPUs (with BHI_CTRL
> + * support), see Intel's BHI guidance.
> + */
> + if (cpu_feature_enabled(X86_FEATURE_BHI_CTRL)) {
> + bhb_seq_outer_loop = 12;
> + bhb_seq_inner_loop = 7;
> + }
> +
How does this work for VMs in a heterogeneous migration pool that
spans the Alder Lake boundary? They can't advertise BHI_CTRL, because
it isn't available on all hosts in the migration pool, but they need
the long sequence when running on Alder Lake or newer.
Previously, I considered such a migration pool infeasible, because of
the change in MAXPHYADDR, but I now predict that I will lose that
battle.
> x86_arch_cap_msr = x86_read_arch_cap_msr();
>
> cpu_print_attack_vectors();
>
> --
> 2.34.1
>
>
>
^ permalink raw reply
* Re: [RFC PATCH net-next 1/3] net: phy: add support for disabling PHY-autonomous EEE
From: Nicolai Buchwitz @ 2026-04-03 18:47 UTC (permalink / raw)
To: Andrew Lunn
Cc: netdev, Russell King, Florian Fainelli, Heiner Kallweit,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
linux-kernel
In-Reply-To: <fcf80c9b-de04-469f-b66b-b39760fc9af4@lunn.ch>
On 3.4.2026 17:27, Andrew Lunn wrote:
>> + * @autonomous_eee_disabled: Set when autonomous EEE has been
>> disabled via
>> + * phy_support_eee(), used to re-apply after PHY soft reset
>
> Thinking ahead to when autonomous EEE is supported, there will be
> other reasons to disable it than just phy_support_eee(). So i would
> not say this here.
Makes sense. I will amend all comments accordingly.
>
>> * @eee_cfg: User configuration of EEE
>> * @lp_advertising: Current link partner advertised linkmodes
>> * @host_interfaces: PHY interface modes supported by host
>> @@ -739,6 +741,7 @@ struct phy_device {
>> __ETHTOOL_DECLARE_LINK_MODE_MASK(eee_disabled_modes);
>> bool enable_tx_lpi;
>> bool eee_active;
>> + bool autonomous_eee_disabled;
>> struct eee_config eee_cfg;
>>
>> /* Host supported PHY interface types. Should be ignored if empty.
>> */
>> @@ -1359,6 +1362,21 @@ struct phy_driver {
>> void (*get_stats)(struct phy_device *dev,
>> struct ethtool_stats *stats, u64 *data);
>>
>> + /**
>> + * @disable_autonomous_eee: Disable PHY-autonomous EEE
>> + *
>> + * Some PHYs manage EEE LPI autonomously without forwarding LPI
>> + * signaling to the MAC.
>
> My understanding is that LPI is always from the MAC to the PHY?
Probably not the right wording, agreed. I was thinking of the RX LPI
counter on macb, which wasn't incrementing until I noticed that the PHY
had AutogrEEEn enabled. After disabling it, the RX LPI signaling
worked.
>
>
>> + * Called by phy_support_eee() when the MAC indicates it supports
>> + * EEE. PHY drivers that implement autonomous EEE should provide
>> + * this callback.
>
> Again, there will be other reasons to call this, than just
> phy_support_eee().
Will do.
>
> Andrew
>
> ---
> pw-bot: cr
Thanks for the prompt review
Nicolai
^ permalink raw reply
* Re: [PATCH net-next v2] net: phy: realtek: support MDI swapping for RTL8226-CG
From: Jan Hoffmann @ 2026-04-03 18:49 UTC (permalink / raw)
To: Russell King (Oracle)
Cc: Andrew Lunn, Heiner Kallweit, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Daniel Golle, Markus Stockhausen,
Damien Dejean, netdev, linux-kernel
In-Reply-To: <acvOOnuc709EhdSo@shell.armlinux.org.uk>
Hi Russell,
On 2026-03-31 at 15:38, Russell King (Oracle) wrote:
> On Fri, Mar 27, 2026 at 08:32:28PM +0100, Jan Hoffmann wrote:
>> +static int rtl8226_config_init(struct phy_device *phydev)
>> +{
>> + int ret;
>> +
>> + ret = rtl8226_config_mdi_order(phydev);
>> + if (ret)
>> + return ret;
>
> As I've been pointing out in other patches, putting this "defaulting"
> here is not a good idea - this path gets called when the PHY is attached
> to the netdev and also when the PHY is being resumed - which will wipe
> out the user's configuration just because their system suspended.
>
> I don't think that gives the user a good experience.
In this case, there is no user configuration which could be overwritten.
Whether MDI swapping needs to be enabled depends only on the board
layout (the feature exists to avoid PCB traces having to cross).
But there is indeed no need to configure it on every resume, just once
should be enough. Do I understand correctly that .probe would be the
right place to do this then?
Thanks,
Jan
^ permalink raw reply
* Re: [PATCH v9 02/10] x86/bhi: Make clear_bhb_loop() effective on newer CPUs
From: Pawan Gupta @ 2026-04-03 18:52 UTC (permalink / raw)
To: Jim Mattson
Cc: x86, Jon Kohler, Nikolay Borisov, H. Peter Anvin, Josh Poimboeuf,
David Kaplan, Sean Christopherson, Borislav Petkov, Dave Hansen,
Peter Zijlstra, Alexei Starovoitov, Daniel Borkmann,
Andrii Nakryiko, KP Singh, Jiri Olsa, David S. Miller,
David Laight, Andy Lutomirski, Thomas Gleixner, Ingo Molnar,
David Ahern, Martin KaFai Lau, Eduard Zingerman, Song Liu,
Yonghong Song, John Fastabend, Stanislav Fomichev, Hao Luo,
Paolo Bonzini, Jonathan Corbet, linux-kernel, kvm, Asit Mallick,
Tao Zhang, bpf, netdev, linux-doc
In-Reply-To: <CALMp9eSLVvr00mJ0J2f2_SPeCW-VS58kxMcxHgUW6etML+_+QA@mail.gmail.com>
On Fri, Apr 03, 2026 at 11:10:08AM -0700, Jim Mattson wrote:
> On Thu, Apr 2, 2026 at 5:32 PM Pawan Gupta
> <pawan.kumar.gupta@linux.intel.com> wrote:
> >
> > As a mitigation for BHI, clear_bhb_loop() executes branches that overwrite
> > the Branch History Buffer (BHB). On Alder Lake and newer parts this
> > sequence is not sufficient because it doesn't clear enough entries. This
> > was not an issue because these CPUs use the BHI_DIS_S hardware mitigation
> > in the kernel.
> >
> > Now with VMSCAPE (BHI variant) it is also required to isolate branch
> > history between guests and userspace. Since BHI_DIS_S only protects the
> > kernel, the newer CPUs also use IBPB.
> >
> > A cheaper alternative to the current IBPB mitigation is clear_bhb_loop().
> > But it currently does not clear enough BHB entries to be effective on newer
> > CPUs with larger BHB. At boot, dynamically set the loop count of
> > clear_bhb_loop() such that it is effective on newer CPUs too. Use the
> > X86_FEATURE_BHI_CTRL feature flag to select the appropriate loop count.
> >
> > Suggested-by: Dave Hansen <dave.hansen@linux.intel.com>
> > Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
> > ---
> > arch/x86/entry/entry_64.S | 8 +++++---
> > arch/x86/include/asm/nospec-branch.h | 2 ++
> > arch/x86/kernel/cpu/bugs.c | 13 +++++++++++++
> > 3 files changed, 20 insertions(+), 3 deletions(-)
> >
> > diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
> > index 3a180a36ca0e..bbd4b1c7ec04 100644
> > --- a/arch/x86/entry/entry_64.S
> > +++ b/arch/x86/entry/entry_64.S
> > @@ -1536,7 +1536,9 @@ SYM_FUNC_START(clear_bhb_loop)
> > ANNOTATE_NOENDBR
> > push %rbp
> > mov %rsp, %rbp
> > - movl $5, %ecx
> > +
> > + movzbl bhb_seq_outer_loop(%rip), %ecx
> > +
> > ANNOTATE_INTRA_FUNCTION_CALL
> > call 1f
> > jmp 5f
> > @@ -1556,8 +1558,8 @@ SYM_FUNC_START(clear_bhb_loop)
> > * This should be ideally be: .skip 32 - (.Lret2 - 2f), 0xcc
> > * but some Clang versions (e.g. 18) don't like this.
> > */
> > - .skip 32 - 18, 0xcc
> > -2: movl $5, %eax
> > + .skip 32 - 20, 0xcc
> > +2: movzbl bhb_seq_inner_loop(%rip), %eax
> > 3: jmp 4f
> > nop
> > 4: sub $1, %eax
> > diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
> > index 70b377fcbc1c..87b83ae7c97f 100644
> > --- a/arch/x86/include/asm/nospec-branch.h
> > +++ b/arch/x86/include/asm/nospec-branch.h
> > @@ -548,6 +548,8 @@ DECLARE_PER_CPU(u64, x86_spec_ctrl_current);
> > extern void update_spec_ctrl_cond(u64 val);
> > extern u64 spec_ctrl_current(void);
> >
> > +extern u8 bhb_seq_inner_loop, bhb_seq_outer_loop;
> > +
> > /*
> > * With retpoline, we must use IBRS to restrict branch prediction
> > * before calling into firmware.
> > diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
> > index 83f51cab0b1e..2cb4a96247d8 100644
> > --- a/arch/x86/kernel/cpu/bugs.c
> > +++ b/arch/x86/kernel/cpu/bugs.c
> > @@ -2047,6 +2047,10 @@ enum bhi_mitigations {
> > static enum bhi_mitigations bhi_mitigation __ro_after_init =
> > IS_ENABLED(CONFIG_MITIGATION_SPECTRE_BHI) ? BHI_MITIGATION_AUTO : BHI_MITIGATION_OFF;
> >
> > +/* Default to short BHB sequence values */
> > +u8 bhb_seq_outer_loop __ro_after_init = 5;
> > +u8 bhb_seq_inner_loop __ro_after_init = 5;
> > +
> > static int __init spectre_bhi_parse_cmdline(char *str)
> > {
> > if (!str)
> > @@ -3242,6 +3246,15 @@ void __init cpu_select_mitigations(void)
> > x86_spec_ctrl_base &= ~SPEC_CTRL_MITIGATIONS_MASK;
> > }
> >
> > + /*
> > + * Switch to long BHB clear sequence on newer CPUs (with BHI_CTRL
> > + * support), see Intel's BHI guidance.
> > + */
> > + if (cpu_feature_enabled(X86_FEATURE_BHI_CTRL)) {
> > + bhb_seq_outer_loop = 12;
> > + bhb_seq_inner_loop = 7;
> > + }
> > +
>
> How does this work for VMs in a heterogeneous migration pool that
> spans the Alder Lake boundary? They can't advertise BHI_CTRL, because
> it isn't available on all hosts in the migration pool, but they need
> the long sequence when running on Alder Lake or newer.
As we discussed elsewhere, support for migration pool is much more
involved. It should be dealt in a separate QEMU/KVM focused series.
A quickfix could be adding support for spectre_bhi=long that guests in a
migration pool can use?
> Previously, I considered such a migration pool infeasible, because of
> the change in MAXPHYADDR, but I now predict that I will lose that
> battle.
^ permalink raw reply
* [PATCH] netfilter: xt_dscp: replace -EDOM with -EINVAL and unify match functions
From: Marino Dzalto @ 2026-04-03 18:53 UTC (permalink / raw)
To: pablo, fw; +Cc: netfilter-devel, coreteam, netdev, linux-kernel, Marino Dzalto
From: Marino Dzalto <marino.dzalto@icloud.com>
Signed-off-by: Marino Dzalto <marino.dzalto@icloud.com>
---
net/netfilter/xt_dscp.c | 18 +++++++-----------
1 file changed, 7 insertions(+), 11 deletions(-)
diff --git a/net/netfilter/xt_dscp.c b/net/netfilter/xt_dscp.c
index fb0169a8f..00137bff3 100644
--- a/net/netfilter/xt_dscp.c
+++ b/net/netfilter/xt_dscp.c
@@ -25,16 +25,12 @@ static bool
dscp_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
const struct xt_dscp_info *info = par->matchinfo;
- u_int8_t dscp = ipv4_get_dsfield(ip_hdr(skb)) >> XT_DSCP_SHIFT;
+ u8 dscp;
- return (dscp == info->dscp) ^ !!info->invert;
-}
-
-static bool
-dscp_mt6(const struct sk_buff *skb, struct xt_action_param *par)
-{
- const struct xt_dscp_info *info = par->matchinfo;
- u_int8_t dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> XT_DSCP_SHIFT;
+ if (xt_family(par) == NFPROTO_IPV4)
+ dscp = ipv4_get_dsfield(ip_hdr(skb)) >> XT_DSCP_SHIFT;
+ else
+ dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> XT_DSCP_SHIFT;
return (dscp == info->dscp) ^ !!info->invert;
}
@@ -44,7 +40,7 @@ static int dscp_mt_check(const struct xt_mtchk_param *par)
const struct xt_dscp_info *info = par->matchinfo;
if (info->dscp > XT_DSCP_MAX)
- return -EDOM;
+ return -EINVAL;
return 0;
}
@@ -74,7 +70,7 @@ static struct xt_match dscp_mt_reg[] __read_mostly = {
.name = "dscp",
.family = NFPROTO_IPV6,
.checkentry = dscp_mt_check,
- .match = dscp_mt6,
+ .match = dscp_mt,
.matchsize = sizeof(struct xt_dscp_info),
.me = THIS_MODULE,
},
--
2.50.1 (Apple Git-155)
^ permalink raw reply related
* Re: [PATCH net v2] net/sched: cls_fw: fix NULL dereference of "old" filters before change()
From: Jamal Hadi Salim @ 2026-04-03 18:59 UTC (permalink / raw)
To: Davide Caratti
Cc: Jiri Pirko, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Xiang Mei, netdev, Victor Nogueira
In-Reply-To: <dcd085bd504ec1d0698690e08e2e1c4d0edff8e4.1775232030.git.dcaratti@redhat.com>
On Fri, Apr 3, 2026 at 12:04 PM Davide Caratti <dcaratti@redhat.com> wrote:
>
> Like pointed out by Sashiko [1],
Just found out about this ;-> So bye-bye old AI? ;->
I must say, finding this specific bug is impressive.
>TC filters are added to a shared block
> before their ->change() function is called. This is a problem for cls_fw:
> an invalid filter created with the "old" method can still classify some
> packets before it is destroyed by the validation logic added by Xiang.
>
I think the real issue is that the filter is exposed to the datapath
before change() is invoked. i.e as you noted 1. init() was invoked, 2.
then the filter was exposed and 3. The change() was initiated.
So the packet arrived somewhere between step 2 and 3 and boom.
In the past - before commit ed76f5edccc9
(https://lore.kernel.org/netdev/20190204123301.4223-7-vladbu@mellanox.com/)
you couldnt expose the filter to the datapath before the change() was
completed..
Observation on consistency pov:
You will always get a "q" when you invoke tcf_block_q() if there are
no shared blocks attached. But that doesnt mean the "create"
configuration is complete; it is only complete if step 3 above
completes. This is because we are not sure if change() will result in
"old" or "new" lookup setup. So the check you added for q may be
inconsistent from that perspective and fw should have returned -1 like
all classifiers...
I cant think of a simple solution to verify if the config is
"inconsistent" other than to add something that gets checked in the
datapath (and when absent, return -1)
From that perspective, your check is not catastrophic, so it may be ok.
At minimal the Fixes: needs to change to Vlads commit? Good news is
only fw _seems_ to suffer from this challenge...
cheers,
jamal
> Therefore, insisting with repeated runs of the following script:
>
> # ip link add dev crash0 type dummy
> # ip link set dev crash0 up
> # mausezahn crash0 -c 100000 -P 10 \
> > -A 4.3.2.1 -B 1.2.3.4 -t udp "dp=1234" -q &
> # sleep 1
> # tc qdisc add dev crash0 egress_block 1 clsact
> # tc filter add block 1 protocol ip prio 1 matchall \
> > action skbedit mark 65536 continue
> # tc filter add block 1 protocol ip prio 2 fw
> # ip link del dev crash0
>
> can still make fw_classify() hit the WARN_ON() in [2]:
>
> WARNING: ./include/net/pkt_cls.h:88 at fw_classify+0x244/0x250 [cls_fw], CPU#18: mausezahn/1399
> Modules linked in: cls_fw(E) act_skbedit(E)
> CPU: 18 UID: 0 PID: 1399 Comm: mausezahn Tainted: G E 7.0.0-rc6-virtme #17 PREEMPT(full)
> Tainted: [E]=UNSIGNED_MODULE
> Hardware name: Red Hat KVM, BIOS 1.16.3-2.el9 04/01/2014
> RIP: 0010:fw_classify+0x244/0x250 [cls_fw]
> Code: 5c 49 c7 45 00 00 00 00 00 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 5b b8 ff ff ff ff 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 90 <0f> 0b 90 eb a0 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90
> RSP: 0018:ffffd1b7026bf8a8 EFLAGS: 00010202
> RAX: ffff8c5ac9c60800 RBX: ffff8c5ac99322c0 RCX: 0000000000000004
> RDX: 0000000000000001 RSI: ffff8c5b74d7a000 RDI: ffff8c5ac8284f40
> RBP: ffffd1b7026bf8d0 R08: 0000000000000000 R09: ffffd1b7026bf9b0
> R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000010000
> R13: ffffd1b7026bf930 R14: ffff8c5ac8284f40 R15: 0000000000000000
> FS: 00007fca40c37740(0000) GS:ffff8c5b74d7a000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fca40e822a0 CR3: 0000000005ca0001 CR4: 0000000000172ef0
> Call Trace:
> <TASK>
> tcf_classify+0x17d/0x5c0
> tc_run+0x9d/0x150
> __dev_queue_xmit+0x2ab/0x14d0
> ip_finish_output2+0x340/0x8f0
> ip_output+0xa4/0x250
> raw_sendmsg+0x147d/0x14b0
> __sys_sendto+0x1cc/0x1f0
> __x64_sys_sendto+0x24/0x30
> do_syscall_64+0x126/0xf80
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fca40e822ba
> Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
> RSP: 002b:00007ffc248a42c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
> RAX: ffffffffffffffda RBX: 000055ef233289d0 RCX: 00007fca40e822ba
> RDX: 000000000000001e RSI: 000055ef23328c30 RDI: 0000000000000003
> RBP: 000055ef233289d0 R08: 00007ffc248a42d0 R09: 0000000000000010
> R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000001e
> R13: 00000000000186a0 R14: 0000000000000000 R15: 00007fca41043000
> </TASK>
> irq event stamp: 1045778
> hardirqs last enabled at (1045784): [<ffffffff864ec042>] __up_console_sem+0x52/0x60
> hardirqs last disabled at (1045789): [<ffffffff864ec027>] __up_console_sem+0x37/0x60
> softirqs last enabled at (1045426): [<ffffffff874d48c7>] __alloc_skb+0x207/0x260
> softirqs last disabled at (1045434): [<ffffffff874fe8f8>] __dev_queue_xmit+0x78/0x14d0
>
> Then, because of the value in the packet's mark, dereference on 'q->handle'
> with NULL 'q' occurs:
>
> BUG: kernel NULL pointer dereference, address: 0000000000000038
> [...]
> RIP: 0010:fw_classify+0x1fe/0x250 [cls_fw]
> [...]
>
> Skip "old-style" classification on shared blocks, so that the NULL
> dereference is fixed and WARN_ON() is not hit anymore in the short
> lifetime of invalid cls_fw "old-style" filters.
>
> V2: avoid NULL dereference without hitting WARN_ON() anymore (Sashiko)
>
> [1] https://sashiko.dev/#/patchset/20260331050217.504278-1-xmei5%40asu.edu
> [2] https://elixir.bootlin.com/linux/v7.0-rc6/source/include/net/pkt_cls.h#L86
>
> Fixes: faeea8bbf6e9 ("net/sched: cls_fw: fix NULL pointer dereference on shared blocks")
> Signed-off-by: Davide Caratti <dcaratti@redhat.com>
> ---
> net/sched/cls_fw.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
> index 23884ef8b80c..646a730dca93 100644
> --- a/net/sched/cls_fw.c
> +++ b/net/sched/cls_fw.c
> @@ -74,9 +74,13 @@ TC_INDIRECT_SCOPE int fw_classify(struct sk_buff *skb,
> }
> }
> } else {
> - struct Qdisc *q = tcf_block_q(tp->chain->block);
> + struct Qdisc *q;
>
> /* Old method: classify the packet using its skb mark. */
> + if (tcf_block_shared(tp->chain->block))
> + return -1;
> +
> + q = tcf_block_q(tp->chain->block);
> if (id && (TC_H_MAJ(id) == 0 ||
> !(TC_H_MAJ(id ^ q->handle)))) {
> res->classid = id;
> --
> 2.52.0
>
^ permalink raw reply
* [PATCH 0/2] Add USB Ethernet controller (LAN7500) node in VAR-SOM-OM44 devicetree
From: Thomas Richard @ 2026-04-03 19:02 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Aaro Koskinen, Andreas Kemnade, Kevin Hilman, Roger Quadros,
Tony Lindgren
Cc: Thomas Petazzoni, netdev, devicetree, linux-kernel, linux-omap,
Thomas Richard
The goal of this series is to add the USB Ethernet controller node in the
VAR-SOM-OM44 devicetree in order to allow the bootloader to patch the
devicetree and pass a MAC address to the smsc75xx driver. This was also a
good opportunity to create the schema file for LAN75XX devices.
Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
---
Thomas Richard (2):
dt-bindings: net: Add schema for LAN75XX compatible USB Ethernet controllers
ARM: dts: ti: var-som-om44: Add USB Ethernet controller node
.../devicetree/bindings/net/microchip,lan75xx.yaml | 52 ++++++++++++++++++++++
arch/arm/boot/dts/ti/omap/omap4-var-som-om44.dtsi | 14 ++++++
2 files changed, 66 insertions(+)
---
base-commit: 6fa0f2cbadc046c57fdd2aa1dad81553cca08963
change-id: 20260330-b4-var-som-om44-lan7500-09dfdc713d39
Best regards,
--
Thomas Richard <thomas.richard@bootlin.com>
^ permalink raw reply
* [PATCH 1/2] dt-bindings: net: Add schema for LAN75XX compatible USB Ethernet controllers
From: Thomas Richard @ 2026-04-03 19:02 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Aaro Koskinen, Andreas Kemnade, Kevin Hilman, Roger Quadros,
Tony Lindgren
Cc: Thomas Petazzoni, netdev, devicetree, linux-kernel, linux-omap,
Thomas Richard
In-Reply-To: <20260403-b4-var-som-om44-lan7500-v1-0-0dadde850143@bootlin.com>
Create schema for LAN75XX compatible USB Ethernet controllers. The smsc75xx
driver only supports LAN7500 and LAN7505 devices.
Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
---
.../devicetree/bindings/net/microchip,lan75xx.yaml | 52 ++++++++++++++++++++++
1 file changed, 52 insertions(+)
diff --git a/Documentation/devicetree/bindings/net/microchip,lan75xx.yaml b/Documentation/devicetree/bindings/net/microchip,lan75xx.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..b84022976044ffec2024cff9fc0aa5016723abed
--- /dev/null
+++ b/Documentation/devicetree/bindings/net/microchip,lan75xx.yaml
@@ -0,0 +1,52 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/net/microchip,lan75xx.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Microchip LAN7500/LAN7505 USB Ethernet Controllers
+
+maintainers:
+ - Thomas Richard <thomas.richard@bootlin.com>
+
+description:
+ Device tree properties for LAN75XX compatible USB Ethernet controller.
+
+allOf:
+ - $ref: ethernet-controller.yaml#
+
+properties:
+ compatible:
+ items:
+ - enum:
+ - usb424,7500
+ - usb424,7505
+
+ reg:
+ maxItems: 1
+
+ local-mac-address: true
+ mac-address: true
+ nvmem-cells: true
+ nvmem-cell-names: true
+
+required:
+ - compatible
+ - reg
+
+additionalProperties: false
+
+examples:
+ - |
+ #include <dt-bindings/gpio/gpio.h>
+
+ usb {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ ethernet@1 {
+ compatible = "usb424,7500";
+ reg = <1>;
+ local-mac-address = [00 00 00 00 00 00];
+ };
+ };
--
2.53.0
^ permalink raw reply related
* [PATCH 2/2] ARM: dts: ti: var-som-om44: Add USB Ethernet controller node
From: Thomas Richard @ 2026-04-03 19:02 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Aaro Koskinen, Andreas Kemnade, Kevin Hilman, Roger Quadros,
Tony Lindgren
Cc: Thomas Petazzoni, netdev, devicetree, linux-kernel, linux-omap,
Thomas Richard
In-Reply-To: <20260403-b4-var-som-om44-lan7500-v1-0-0dadde850143@bootlin.com>
Add USB tree description, including the Gigabit Ethernet controller
(LAN7500). Adding the LAN7500 node will allow the bootloader to patch the
devicetree and set the MAC address.
Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
---
arch/arm/boot/dts/ti/omap/omap4-var-som-om44.dtsi | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/arch/arm/boot/dts/ti/omap/omap4-var-som-om44.dtsi b/arch/arm/boot/dts/ti/omap/omap4-var-som-om44.dtsi
index 37d56b3010cff0f6ea6208289da0aba7328067d5..9e04aa70f98227ac0054fea6cd4521ed1323ecbd 100644
--- a/arch/arm/boot/dts/ti/omap/omap4-var-som-om44.dtsi
+++ b/arch/arm/boot/dts/ti/omap/omap4-var-som-om44.dtsi
@@ -322,4 +322,18 @@ &usbhshost {
&usbhsehci {
phys = <&hsusb1_phy>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ usbhub: hub@1 {
+ compatible = "usb424,2514";
+ reg = <1>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ ethernet: ethernet@3 {
+ compatible = "usb424,7500";
+ reg = <3>;
+ };
+ };
};
--
2.53.0
^ permalink raw reply related
* Re: [PATCH net v3 0/7] net/sched: Fix packet loops in mirred and netem
From: Stephen Hemminger @ 2026-04-03 19:03 UTC (permalink / raw)
To: Jakub Kicinski; +Cc: netdev
In-Reply-To: <20260402174906.0ee218f2@kernel.org>
On Thu, 2 Apr 2026 17:49:06 -0700
Jakub Kicinski <kuba@kernel.org> wrote:
> On Thu, 2 Apr 2026 13:16:18 -0700 Stephen Hemminger wrote:
> > Why is this marked Changes Requested.
>
> Is this a question.
Yes a process question what is the blocker? What needs to change?
More review?
^ permalink raw reply
* Re: [PATCH 5/6] arm64: dts: qcom: milos: Add IPA node
From: Dmitry Baryshkov @ 2026-04-03 19:27 UTC (permalink / raw)
To: Luca Weiss
Cc: Alex Elder, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Bjorn Andersson, Konrad Dybcio, Alexander Koskovich,
~postmarketos/upstreaming, phone-devel, netdev, linux-kernel,
linux-arm-msm, devicetree
In-Reply-To: <20260403-milos-ipa-v1-5-01e9e4e03d3e@fairphone.com>
On Fri, Apr 03, 2026 at 06:43:51PM +0200, Luca Weiss wrote:
> Add the description of the IPA block in the Milos SoC.
>
> Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
> ---
> arch/arm64/boot/dts/qcom/milos.dtsi | 44 +++++++++++++++++++++++++++++++++++++
> 1 file changed, 44 insertions(+)
>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
--
With best wishes
Dmitry
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox