* [PATCH net-next 1/3] net: phy: add support for disabling PHY-autonomous EEE
From: Nicolai Buchwitz @ 2026-04-06 7:13 UTC (permalink / raw)
To: Andrew Lunn, Heiner Kallweit, Russell King, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Florian Fainelli,
Broadcom internal kernel review list
Cc: netdev, linux-kernel, Nicolai Buchwitz
In-Reply-To: <20260406-devel-autonomous-eee-v1-0-b335e7143711@tipi-net.de>
Some PHYs (e.g. Broadcom BCM54xx, Realtek RTL8211F) implement
autonomous EEE where the PHY manages LPI signaling without forwarding
it to the MAC. This conflicts with MAC drivers that implement their own
LPI control.
Add a .disable_autonomous_eee callback to struct phy_driver and call it
from phy_support_eee(). When a MAC driver indicates it supports EEE via
phy_support_eee(), the PHY's autonomous EEE is automatically disabled so
the MAC can manage LPI entry/exit.
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
---
drivers/net/phy/phy_device.c | 22 ++++++++++++++++++++++
include/linux/phy.h | 14 ++++++++++++++
2 files changed, 36 insertions(+)
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 0edff47478c20dd8537d4b94806be13b2409c711..cda4abf4e68cddb25b4ac69c35c8e095fac3e31c 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1375,6 +1375,14 @@ int phy_init_hw(struct phy_device *phydev)
return ret;
}
+ /* Re-apply autonomous EEE disable after soft reset */
+ if (phydev->autonomous_eee_disabled &&
+ phydev->drv->disable_autonomous_eee) {
+ ret = phydev->drv->disable_autonomous_eee(phydev);
+ if (ret)
+ return ret;
+ }
+
return 0;
}
EXPORT_SYMBOL(phy_init_hw);
@@ -2898,6 +2906,20 @@ void phy_support_eee(struct phy_device *phydev)
linkmode_copy(phydev->advertising_eee, phydev->supported_eee);
phydev->eee_cfg.tx_lpi_enabled = true;
phydev->eee_cfg.eee_enabled = true;
+
+ /* If the PHY supports autonomous EEE, disable it so the MAC can
+ * manage LPI signaling instead. The flag is stored so it can be
+ * re-applied after a PHY soft reset (e.g. suspend/resume).
+ */
+ if (phydev->drv && phydev->drv->disable_autonomous_eee) {
+ int ret = phydev->drv->disable_autonomous_eee(phydev);
+
+ if (ret)
+ phydev_warn(phydev, "Failed to disable autonomous EEE: %pe\n",
+ ERR_PTR(ret));
+ else
+ phydev->autonomous_eee_disabled = true;
+ }
}
EXPORT_SYMBOL(phy_support_eee);
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 5de4b172cd0ba0048039d73d049b0ff24e8b2e44..199a7aaa341bfd9b13731e996a8de7e1aea586ff 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -612,6 +612,8 @@ struct phy_oatc14_sqi_capability {
* @advertising_eee: Currently advertised EEE linkmodes
* @enable_tx_lpi: When True, MAC should transmit LPI to PHY
* @eee_active: phylib private state, indicating that EEE has been negotiated
+ * @autonomous_eee_disabled: Set when autonomous EEE has been disabled,
+ * used to re-apply after PHY soft reset
* @eee_cfg: User configuration of EEE
* @lp_advertising: Current link partner advertised linkmodes
* @host_interfaces: PHY interface modes supported by host
@@ -739,6 +741,7 @@ struct phy_device {
__ETHTOOL_DECLARE_LINK_MODE_MASK(eee_disabled_modes);
bool enable_tx_lpi;
bool eee_active;
+ bool autonomous_eee_disabled;
struct eee_config eee_cfg;
/* Host supported PHY interface types. Should be ignored if empty. */
@@ -1359,6 +1362,17 @@ struct phy_driver {
void (*get_stats)(struct phy_device *dev,
struct ethtool_stats *stats, u64 *data);
+ /**
+ * @disable_autonomous_eee: Disable PHY-autonomous EEE
+ *
+ * Some PHYs manage EEE autonomously, preventing the MAC from
+ * controlling LPI signaling. This callback disables autonomous
+ * EEE at the PHY.
+ *
+ * Return: 0 on success, negative errno on failure.
+ */
+ int (*disable_autonomous_eee)(struct phy_device *dev);
+
/* Get and Set PHY tunables */
/** @get_tunable: Return the value of a tunable */
int (*get_tunable)(struct phy_device *dev,
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 2/3] net: phy: broadcom: implement .disable_autonomous_eee for BCM54xx
From: Nicolai Buchwitz @ 2026-04-06 7:13 UTC (permalink / raw)
To: Andrew Lunn, Heiner Kallweit, Russell King, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Florian Fainelli,
Broadcom internal kernel review list
Cc: netdev, linux-kernel, Nicolai Buchwitz
In-Reply-To: <20260406-devel-autonomous-eee-v1-0-b335e7143711@tipi-net.de>
Implement the .disable_autonomous_eee callback for the BCM54210E.
In AutogrEEEn mode the PHY manages EEE autonomously. Clearing the
AutogrEEEn enable bit in MII_BUF_CNTL_0 switches the PHY to Native
EEE mode.
Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de>
---
drivers/net/phy/broadcom.c | 7 +++++++
include/linux/brcmphy.h | 3 +++
2 files changed, 10 insertions(+)
diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
index cb306f9e80cca6f810afcab967923dd1896638dd..bf0c6a04481ee23110e249118bbe086ffe8e7a8f 100644
--- a/drivers/net/phy/broadcom.c
+++ b/drivers/net/phy/broadcom.c
@@ -1452,6 +1452,12 @@ static int bcm54811_read_status(struct phy_device *phydev)
return genphy_read_status(phydev);
}
+static int bcm54xx_disable_autonomous_eee(struct phy_device *phydev)
+{
+ return bcm_phy_modify_exp(phydev, BCM54XX_TOP_MISC_MII_BUF_CNTL0,
+ BCM54XX_MII_BUF_CNTL0_AUTOGREEEN_EN, 0);
+}
+
static struct phy_driver broadcom_drivers[] = {
{
PHY_ID_MATCH_MODEL(PHY_ID_BCM5411),
@@ -1495,6 +1501,7 @@ static struct phy_driver broadcom_drivers[] = {
.get_wol = bcm54xx_phy_get_wol,
.set_wol = bcm54xx_phy_set_wol,
.led_brightness_set = bcm_phy_led_brightness_set,
+ .disable_autonomous_eee = bcm54xx_disable_autonomous_eee,
}, {
PHY_ID_MATCH_MODEL(PHY_ID_BCM5461),
.name = "Broadcom BCM5461",
diff --git a/include/linux/brcmphy.h b/include/linux/brcmphy.h
index 115a964f3006965e9bfd247eb969b9ca586ae675..174687c4c80a8b12eb841cdb4e8865813bb34adc 100644
--- a/include/linux/brcmphy.h
+++ b/include/linux/brcmphy.h
@@ -266,6 +266,9 @@
#define BCM54XX_TOP_MISC_IDDQ_SD (1 << 2)
#define BCM54XX_TOP_MISC_IDDQ_SR (1 << 3)
+#define BCM54XX_TOP_MISC_MII_BUF_CNTL0 (MII_BCM54XX_EXP_SEL_TOP + 0x00)
+#define BCM54XX_MII_BUF_CNTL0_AUTOGREEEN_EN BIT(0)
+
#define BCM54XX_TOP_MISC_LED_CTL (MII_BCM54XX_EXP_SEL_TOP + 0x0C)
#define BCM54XX_LED4_SEL_INTR BIT(1)
--
2.51.0
^ permalink raw reply related
* [PATCH net-next 0/3] net: phy: add support for disabling autonomous EEE
From: Nicolai Buchwitz @ 2026-04-06 7:13 UTC (permalink / raw)
To: Andrew Lunn, Heiner Kallweit, Russell King, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Florian Fainelli,
Broadcom internal kernel review list
Cc: netdev, linux-kernel, Nicolai Buchwitz
Some PHYs implement autonomous EEE where the PHY manages EEE
independently, preventing the MAC from controlling LPI signaling.
This conflicts with MACs that implement their own LPI control.
This series adds a .disable_autonomous_eee callback to struct phy_driver
and calls it from phy_support_eee(). When a MAC indicates it supports
EEE, the PHY's autonomous EEE is automatically disabled. The setting is
persisted across suspend/resume by re-applying it in phy_init_hw() after
soft reset, following the same pattern suggested by Russell King for PHY
tunables [1].
Patch 1 adds the phylib infrastructure.
Patch 2 implements it for Broadcom BCM54xx (AutogrEEEn).
Patch 3 converts the Realtek RTL8211F, which previously unconditionally
disabled PHY-mode EEE in config_init.
This came up while adding EEE support to the Cadence macb driver (used
on Raspberry Pi 5 with a BCM54210PE PHY). The PHY's AutogrEEEn mode
prevented the MAC from tracking LPI state. The Realtek RTL8211F has
the same pattern, unconditionally disabling PHY-mode EEE with the
comment "Disable PHY-mode EEE so LPI is passed to the MAC".
Other BCM54xx PHYs likely have the same AutogrEEEn register layout,
but I only have access to the BCM54210PE/BCM54213PE datasheets. It
would be appreciated if Florian or others could confirm which other
BCM54xx variants share this register so we can wire them up too.
Tested on Raspberry Pi CM4 (bcmgenet + BCM54210PE),
Raspberry Pi CM5 (Cadence GEM + BCM54210PE) and
Raspberry Pi 5 (Cadence GEM + BCM54213PE).
[1] https://lore.kernel.org/netdev/acuwvoydmJusuj9x@shell.armlinux.org.uk/
Previous versions:
RFC: https://lore.kernel.org/netdev/20260403090656.733985-1-nb@tipi-net.de/
Discussion: https://lore.kernel.org/netdev/d86c53213a6328b701b8aabbde5d1c83@tipi-net.de/
Changes since RFC:
- Simplify kdoc and commit messages, remove references to specific
callers (Andrew Lunn)
---
Nicolai Buchwitz (3):
net: phy: add support for disabling PHY-autonomous EEE
net: phy: broadcom: implement .disable_autonomous_eee for BCM54xx
net: phy: realtek: convert RTL8211F to .disable_autonomous_eee
drivers/net/phy/broadcom.c | 7 +++++++
drivers/net/phy/phy_device.c | 22 ++++++++++++++++++++++
drivers/net/phy/realtek/realtek_main.c | 7 ++++---
include/linux/brcmphy.h | 3 +++
include/linux/phy.h | 14 ++++++++++++++
5 files changed, 50 insertions(+), 3 deletions(-)
---
base-commit: 3741f8fa004bf598cd5032b0ff240984332d6f05
change-id: 20260406-devel-autonomous-eee-dffa292e9bb2
Best regards,
--
Nicolai Buchwitz <nb@tipi-net.de>
^ permalink raw reply
* Re: [PATCH net-next v2 4/4] net: dsa: initial support for MT7628 embedded switch
From: Joris Vaisvila @ 2026-04-06 7:13 UTC (permalink / raw)
To: Jakub Kicinski
Cc: netdev, horms, pabeni, edumazet, davem, olteanv, andrew,
devicetree, robh, krzk+dt, conor+dt
In-Reply-To: <20260402033103.911409-1-kuba@kernel.org>
Hi Jakub, thank you for the review.
On Wed, Apr 01, 2026 at 08:31:03PM -0700, Jakub Kicinski wrote:
> This is an AI-generated review of your patch. The human sending this
> email has considered the AI review valid, or at least plausible.
> ---
> net: dsa: initial support for MT7628 embedded switch
>
> Add support for the MT7628 embedded switch.
> The switch has 5 built-in 100Mbps user ports (ports 0-4) and one 1Gbps
> port that is internally attached to the SoCs CPU MAC and serves as the
> CPU port.
>
> > diff --git a/drivers/net/dsa/Kconfig b/drivers/net/dsa/Kconfig
> > --- a/drivers/net/dsa/Kconfig
> > +++ b/drivers/net/dsa/Kconfig
> > @@ -28,6 +28,14 @@ source "drivers/net/dsa/hirschmann/Kconfig"
> >
> > source "drivers/net/dsa/lantiq/Kconfig"
> >
> > +config NET_DSA_MT7628
> > + tristate "MediaTek MT7628 Embedded Ethernet switch support"
> > + select NET_DSA_TAG_MT7628
> > + select MEDIATEK_FE_SOC_PHY
>
> Does this configuration need to select NET_DSA_TAG_8021Q?
>
> The driver relies on the tag_8021q mechanism for switch port isolation. If
> the kernel is configured without NET_DSA_TAG_8021Q, dsa_tag_8021q_register()
> will return -EOPNOTSUPP, causing the switch to boot with broken port
> isolation.
>
tag_8021q.o is in DSA core, there's no option to enable or disable it.
> [ ... ]
> > +static int mt7628_mii_read(struct mii_bus *bus, int port, int regnum)
> > +{
> > + struct mt7628_esw *esw = bus->priv;
> > + int ret;
> > + u32 val;
> > +
> > + ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> > + !(val & MT7628_ESW_PCR1_RD_DONE), 10,
> > + 5000);
>
> Will this polling logic cause an MDIO timeout?
>
> If RD_DONE is a completion status bit that remains 1 after a successful
> operation, this first poll will wait indefinitely for the bit to become 0.
>
> If RD_DONE is an active-low busy bit, the second poll below waits for the
> controller to become busy instead of waiting for it to be idle.
>
RD_DONE gets set when the read operations completes and is reset on
register read, so this will not cause a timeout.
> > + if (ret)
> > + goto out;
> > +
> > + ret = regmap_write(esw->regmap, MT7628_ESW_REG_PCR0,
> > + FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_REG,
> > + regnum) |
> > + FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_ADDR,
> > + port) | MT7628_ESW_PCR0_RD_PHY_CMD);
> > + if (ret)
> > + goto out;
> > +
> > + ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> > + (val & MT7628_ESW_PCR1_RD_DONE), 10,
> > + 5000);
> > +out:
> > + if (ret) {
> > + dev_err(&bus->dev, "read failed. MDIO timeout?\n");
> > + return ret;
> > + }
> > + return FIELD_GET(MT7628_ESW_PCR1_RD_DATA, val);
> > +}
> > +
> > +static int mt7628_mii_write(struct mii_bus *bus, int port, int regnum, u16 dat)
> > +{
> > + struct mt7628_esw *esw = bus->priv;
> > + u32 val;
> > + int ret;
> > +
> > + ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> > + !(val & MT7628_ESW_PCR1_WT_DONE), 10,
> > + 5000);
> > + if (ret)
> > + goto out;
> > +
> > + ret = regmap_write(esw->regmap, MT7628_ESW_REG_PCR0,
> > + FIELD_PREP(MT7628_ESW_PCR0_WT_NWAY_DATA, dat) |
> > + FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_REG,
> > + regnum) |
> > + FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_ADDR,
> > + port) | MT7628_ESW_PCR0_WT_PHY_CMD);
> > + if (ret)
> > + goto out;
> > +
> > + ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> > + (val & MT7628_ESW_PCR1_WT_DONE), 10,
> > + 5000);
>
> Is this second poll waiting for the controller to become busy instead of
> idle, similar to the read function?
>
WT_DONE is set when the data is ready and reset on read, same as
RD_DONE.
> > +out:
> > + if (ret) {
> > + dev_err(&bus->dev, "write failed. MDIO timeout?\n");
> > + return ret;
> > + }
> > + return 0;
> > +}
> > +
> > +static int mt7628_setup_internal_mdio(struct dsa_switch *ds)
> > +{
> > + struct mt7628_esw *esw = ds->priv;
> > + struct device_node *mdio;
> > + struct mii_bus *bus;
> > + int ret = 0;
> > +
> > + mdio = of_get_available_child_by_name(ds->dev->of_node, "mdio");
> > +
> > + bus = devm_mdiobus_alloc(esw->dev);
>
> Can allocating devm_ resources in the DSA .setup callback cause a sysfs name
> collision?
>
> The .setup callback is executed whenever the DSA tree binds. Since devm_
> resources are tied to the platform device (esw->dev) rather than the DSA
> tree lifecycle, they are not released when the DSA tree unbinds. On a
> subsequent re-bind, allocating a new MDIO bus with the same ID will fail
> because the original bus was never unregistered.
>
I'm not sure how this would work. Other switches appear to be doing the
same. For example mt7530-mmio.c does `priv->dev = &pdev->dev` and later
uses priv->dev to register the mdio bus. Is this a real issue?
> [ ... ]
> > +static int mt7628_setup(struct dsa_switch *ds)
> > +{
> > + struct mt7628_esw *esw = ds->priv;
> > + int ret;
> > +
> > + reset_control_reset(esw->rst_esw);
> > + usleep_range(1000, 2000);
> > + reset_control_reset(esw->rst_ephy);
> > + usleep_range(1000, 2000);
> > + /*
> > + * all MMIO reads hang if esw is not out of reset
> > + * ephy needs extra time to get out of reset or it ends up misconfigured
> > + */
> > + mt7628_switch_init(ds);
> > + rtnl_lock();
> > + dsa_tag_8021q_register(ds, htons(ETH_P_8021Q));
>
> Is it safe to ignore the return value of dsa_tag_8021q_register()?
>
> If the registration fails, the core function frees the allocated context but
> does not clear ds->tag_8021q_ctx. The setup will continue, and the DSA core
> will later dereference the non-NULL ds->tag_8021q_ctx, leading to a
> use-after-free crash.
>
> Also, if mt7628_setup_internal_mdio() below fails, the setup returns an
> error without unregistering the tagger, which leaks the tag_8021q context.
>
No, will fix in v3.
> > + rtnl_unlock();
> > +
> > + ret = mt7628_setup_internal_mdio(ds);
> > + return ret;
> > +}
> [ ... ]
> > +static struct dsa_switch_ops mt7628_switch_ops = {
> > + .get_tag_protocol = mt7628_get_tag_proto,
> > + .setup = mt7628_setup,
>
> Does this switch ops structure need a .teardown callback?
>
> Without calling dsa_tag_8021q_unregister() in a .teardown callback, the
> tag_8021q context memory allocated during .setup will be permanently leaked
> whenever the DSA switch is unbound or the module is removed.
>
Yes, will fix in V3.
Thanks,
Joris
^ permalink raw reply
* Re: [PATCH bpf v2 1/2] bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
From: Jiayuan Chen @ 2026-04-06 4:54 UTC (permalink / raw)
To: bot+bpf-ci, bpf
Cc: 2022090917019, dddddd, M202472210, dzm91, emil, ast, daniel,
andrii, martin.lau, eddyz87, memxor, song, yonghong.song, jolsa,
john.fastabend, sdf, davem, edumazet, kuba, pabeni, horms, shuah,
linux-kernel, netdev, linux-kselftest, martin.lau, clm,
ihor.solodrai
In-Reply-To: <913274772cd62d8d93e6cfb2c251c2388b73f24f90d05be3c9994207ac7048bf@mail.kernel.org>
On 4/6/26 11:47 AM, bot+bpf-ci@kernel.org wrote:
> This Fixes: tag covers the SOCK_OPS_GET_SK() portion of the fix,
> since 84f44df664e9 introduced that macro. However, the identical
> bug in SOCK_OPS_GET_FIELD() was introduced by an earlier commit:
>
> fd09af010788 ("bpf: sock_ops ctx access may stomp registers in corner case")
>
> That commit added the dst_reg == src_reg handling to
> SOCK_OPS_GET_FIELD() with the same missing zeroing in the
> !fullsock path. Should this also carry:
>
> Fixes: fd09af010788 ("bpf: sock_ops ctx access may stomp registers in corner case")
>
> Without it, kernels that have fd09af010788 but not 84f44df664e9
> would not receive the SOCK_OPS_GET_FIELD() fix via stable backport.
>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See:https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary:https://github.com/kernel-patches/bpf/actions/runs/24017481706
Well, it's true. However, fd09af010788 and 84f44df664e9 are from the
same patchset (same author, same minute), so any stable branch carrying
one will have both. That's why I only included a single Fixes tag.
But if you prefer carrying both explicitly, I'm happy to add it in next
version.
^ permalink raw reply
* Re: [PATCH] rxrpc/proc: size address buffers for %pISpc output
From: Anderson Nascimento @ 2026-04-06 4:12 UTC (permalink / raw)
To: Pengpeng Hou, David Howells, Marc Dionne, anderson
Cc: Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
linux-afs, netdev, linux-kernel
In-Reply-To: <20260406141000.1-rxrpc-proc-reply-pengpeng@iscas.ac.cn>
On 4/6/26 3:10 AM, Pengpeng Hou wrote:
> Hi,
>
> Yes. My original changelog example was too loose, and your quick test is
> right for a fully expanded plain IPv6 form such as
>
> [ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]:65535
>
> That form is only 47 visible characters, so it fits in the current
> char[50] buffers.
>
> The reason I still think the bug is real is the current %pISpc
> implementation in lib/vsprintf.c.
>
> For AF_INET6, %pISpc goes through ip6_addr_string_sa(), and the compressed
> path uses ip6_compressed_string(). That helper switches to a dotted-quad
> tail not only for v4mapped addresses, but also for ISATAP addresses:
>
> useIPv4 = ipv6_addr_v4mapped(&in6) || ipv6_addr_is_isatap(&in6);
>
> So a current-tree case such as
>
> [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535
>
> is possible. That string is 50 visible characters, i.e. 51 bytes
> including the trailing NUL, which does not fit in the existing char[50]
> buffers used by the rxrpc procfs helpers.
>
> So I agree the example in my changelog should be corrected, but I do not
> think the underlying bug goes away. The claim should be framed around the
> ISATAP case rather than the plain IPv6 or mapped-v4 examples I used
> originally.
>
> If that makes sense, I can resend with the changelog corrected to cite the
> actual maximum case explicitly.
>
> Thanks,
> Pengpeng
Thanks! I confirm the ISATAP case really triggers the issue. It ends up
writing 51 bytes, including the NULL byte.
$ cat /proc/net/rxrpc/locals
Proto Local Use Act RxQ
UDP [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65 1 1 0
$
Regards,
Anderson Nascimento
^ permalink raw reply
* Re: [PATCH bpf v2 1/2] bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
From: bot+bpf-ci @ 2026-04-06 3:47 UTC (permalink / raw)
To: jiayuan.chen, bpf
Cc: jiayuan.chen, 2022090917019, dddddd, M202472210, dzm91, emil, ast,
daniel, andrii, martin.lau, eddyz87, memxor, song, yonghong.song,
jolsa, john.fastabend, sdf, davem, edumazet, kuba, pabeni, horms,
shuah, linux-kernel, netdev, linux-kselftest, ast, andrii, daniel,
martin.lau, eddyz87, yonghong.song, clm, ihor.solodrai
In-Reply-To: <20260406031330.187630-1-jiayuan.chen@linux.dev>
[-- Attachment #1: Type: text/plain, Size: 982 bytes --]
> Fixes: 84f44df664e9 ("bpf: sock_ops sk access may stomp registers when dst_reg = src_reg")
This Fixes: tag covers the SOCK_OPS_GET_SK() portion of the fix,
since 84f44df664e9 introduced that macro. However, the identical
bug in SOCK_OPS_GET_FIELD() was introduced by an earlier commit:
fd09af010788 ("bpf: sock_ops ctx access may stomp registers in corner case")
That commit added the dst_reg == src_reg handling to
SOCK_OPS_GET_FIELD() with the same missing zeroing in the
!fullsock path. Should this also carry:
Fixes: fd09af010788 ("bpf: sock_ops ctx access may stomp registers in corner case")
Without it, kernels that have fd09af010788 but not 84f44df664e9
would not receive the SOCK_OPS_GET_FIELD() fix via stable backport.
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24017481706
^ permalink raw reply
* [PATCH net v2] mptcp: fix slab-use-after-free in __inet_lookup_established
From: Jiayuan Chen @ 2026-04-06 3:15 UTC (permalink / raw)
To: mptcp
Cc: Jiayuan Chen, stable, Matthieu Baerts, Mat Martineau,
Geliang Tang, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, netdev, linux-kernel
The ehash table lookups are lockless and rely on
SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability
during RCU read-side critical sections. Both tcp_prot and
tcpv6_prot have their slab caches created with this flag
via proto_register().
However, MPTCP's mptcp_subflow_init() copies tcpv6_prot into
tcpv6_prot_override during inet_init() (fs_initcall, level 5),
before inet6_init() (module_init/device_initcall, level 6) has
called proto_register(&tcpv6_prot). At that point,
tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab
remains NULL permanently.
This causes MPTCP v6 subflow child sockets to be allocated via
kmalloc (falling into kmalloc-4k) instead of the TCPv6 slab
cache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so
when these sockets are freed without SOCK_RCU_FREE (which is
cleared for child sockets by design), the memory can be
immediately reused. Concurrent ehash lookups under
rcu_read_lock can then access freed memory, triggering a
slab-use-after-free in __inet_lookup_established.
Fix this by splitting the IPv6-specific initialization out of
mptcp_subflow_init() into a new mptcp_subflow_v6_init(), called
from mptcp_proto_v6_init() before protocol registration. This
ensures tcpv6_prot_override.slab correctly inherits the
SLAB_TYPESAFE_BY_RCU slab cache.
Fixes: b19bc2945b40 ("mptcp: implement delegated actions")
Cc: stable@vger.kernel.org
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
net/mptcp/protocol.c | 2 ++
net/mptcp/protocol.h | 1 +
net/mptcp/subflow.c | 15 +++++++++------
3 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 65c3bb8016f4..614c3f583ca0 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -4660,6 +4660,8 @@ int __init mptcp_proto_v6_init(void)
{
int err;
+ mptcp_subflow_v6_init();
+
mptcp_v6_prot = mptcp_prot;
strscpy(mptcp_v6_prot.name, "MPTCPv6", sizeof(mptcp_v6_prot.name));
mptcp_v6_prot.slab = NULL;
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 0bd1ee860316..ec15e503da8b 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -875,6 +875,7 @@ static inline void mptcp_subflow_tcp_fallback(struct sock *sk,
void __init mptcp_proto_init(void);
#if IS_ENABLED(CONFIG_MPTCP_IPV6)
int __init mptcp_proto_v6_init(void);
+void __init mptcp_subflow_v6_init(void);
#endif
struct sock *mptcp_sk_clone_init(const struct sock *sk,
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 6716970693e9..4ff5863aa9fd 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -2165,7 +2165,15 @@ void __init mptcp_subflow_init(void)
tcp_prot_override.psock_update_sk_prot = NULL;
#endif
+ mptcp_diag_subflow_init(&subflow_ulp_ops);
+
+ if (tcp_register_ulp(&subflow_ulp_ops) != 0)
+ panic("MPTCP: failed to register subflows to ULP\n");
+}
+
#if IS_ENABLED(CONFIG_MPTCP_IPV6)
+void __init mptcp_subflow_v6_init(void)
+{
/* In struct mptcp_subflow_request_sock, we assume the TCP request sock
* structures for v4 and v6 have the same size. It should not changed in
* the future but better to make sure to be warned if it is no longer
@@ -2204,10 +2212,5 @@ void __init mptcp_subflow_init(void)
/* Disable sockmap processing for subflows */
tcpv6_prot_override.psock_update_sk_prot = NULL;
#endif
-#endif
-
- mptcp_diag_subflow_init(&subflow_ulp_ops);
-
- if (tcp_register_ulp(&subflow_ulp_ops) != 0)
- panic("MPTCP: failed to register subflows to ULP\n");
}
+#endif
--
2.43.0
^ permalink raw reply related
* [PATCH bpf v2 2/2] selftests/bpf: Add tests for sock_ops ctx access with same src/dst register
From: Jiayuan Chen @ 2026-04-06 3:12 UTC (permalink / raw)
To: bpf
Cc: Jiayuan Chen, Martin KaFai Lau, Daniel Borkmann, John Fastabend,
Stanislav Fomichev, Alexei Starovoitov, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Song Liu,
Yonghong Song, Jiri Olsa, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Shuah Khan,
linux-kernel, netdev, linux-kselftest
In-Reply-To: <20260406031330.187630-1-jiayuan.chen@linux.dev>
Add selftests to verify SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD()
correctly return NULL/zero when dst_reg == src_reg and is_fullsock == 0.
Three subtests are included:
- get_sk: ctx->sk with same src/dst register (SOCK_OPS_GET_SK)
- get_field: ctx->snd_cwnd with same src/dst register (SOCK_OPS_GET_FIELD)
- get_sk_diff_reg: ctx->sk with different src/dst register (baseline)
Each BPF program uses inline asm (__naked) to force specific register
allocation, reads is_fullsock first, then loads the field using the same
(or different) register. The test triggers TCP_NEW_SYN_RECV via a TCP
handshake and checks that the result is NULL/zero when is_fullsock == 0.
Test:
./test_progs -a sock_ops_get_sk -v
test_sock_ops_get_sk:PASS:join_cgroup 0 nsec
test_sock_ops_get_sk:PASS:skel_open_load 0 nsec
run_sock_ops_test:PASS:prog_attach 0 nsec
run_sock_ops_test:PASS:start_server 0 nsec
run_sock_ops_test:PASS:connect_to_fd 0 nsec
test_sock_ops_get_sk:PASS:null_seen 0 nsec
test_sock_ops_get_sk:PASS:bug_not_detected 0 nsec
#419/1 sock_ops_get_sk/get_sk:OK
run_sock_ops_test:PASS:prog_attach 0 nsec
run_sock_ops_test:PASS:start_server 0 nsec
run_sock_ops_test:PASS:connect_to_fd 0 nsec
test_sock_ops_get_sk:PASS:field_null_seen 0 nsec
test_sock_ops_get_sk:PASS:field_bug_not_detected 0 nsec
#419/2 sock_ops_get_sk/get_field:OK
run_sock_ops_test:PASS:prog_attach 0 nsec
run_sock_ops_test:PASS:start_server 0 nsec
run_sock_ops_test:PASS:connect_to_fd 0 nsec
test_sock_ops_get_sk:PASS:diff_reg_null_seen 0 nsec
test_sock_ops_get_sk:PASS:diff_reg_bug_not_detected 0 nsec
#419/3 sock_ops_get_sk/get_sk_diff_reg:OK
#419 sock_ops_get_sk:OK
Summary: 1/3 PASSED, 0 SKIPPED, 0 FAILED
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
.../bpf/prog_tests/sock_ops_get_sk.c | 77 ++++++++++++
.../selftests/bpf/progs/sock_ops_get_sk.c | 117 ++++++++++++++++++
2 files changed, 194 insertions(+)
create mode 100644 tools/testing/selftests/bpf/prog_tests/sock_ops_get_sk.c
create mode 100644 tools/testing/selftests/bpf/progs/sock_ops_get_sk.c
diff --git a/tools/testing/selftests/bpf/prog_tests/sock_ops_get_sk.c b/tools/testing/selftests/bpf/prog_tests/sock_ops_get_sk.c
new file mode 100644
index 0000000000000..e086f7abb197e
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/sock_ops_get_sk.c
@@ -0,0 +1,77 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <test_progs.h>
+#include "cgroup_helpers.h"
+#include "network_helpers.h"
+#include "sock_ops_get_sk.skel.h"
+
+/* See progs/sock_ops_get_sk.c for the bug description. */
+static void run_sock_ops_test(struct sock_ops_get_sk *skel, int cgroup_fd,
+ int prog_fd)
+{
+ int server_fd, client_fd, err;
+
+ err = bpf_prog_attach(prog_fd, cgroup_fd, BPF_CGROUP_SOCK_OPS, 0);
+ if (!ASSERT_OK(err, "prog_attach"))
+ return;
+
+ server_fd = start_server(AF_INET, SOCK_STREAM, NULL, 0, 0);
+ if (!ASSERT_GE(server_fd, 0, "start_server"))
+ goto detach;
+
+ /* Trigger TCP handshake which causes TCP_NEW_SYN_RECV state where
+ * is_fullsock == 0 and is_locked_tcp_sock == 0.
+ */
+ client_fd = connect_to_fd(server_fd, 0);
+ if (!ASSERT_GE(client_fd, 0, "connect_to_fd"))
+ goto close_server;
+
+ close(client_fd);
+
+close_server:
+ close(server_fd);
+detach:
+ bpf_prog_detach(cgroup_fd, BPF_CGROUP_SOCK_OPS);
+}
+
+void test_sock_ops_get_sk(void)
+{
+ struct sock_ops_get_sk *skel;
+ int cgroup_fd;
+
+ cgroup_fd = test__join_cgroup("/sock_ops_get_sk");
+ if (!ASSERT_GE(cgroup_fd, 0, "join_cgroup"))
+ return;
+
+ skel = sock_ops_get_sk__open_and_load();
+ if (!ASSERT_OK_PTR(skel, "skel_open_load"))
+ goto close_cgroup;
+
+ /* Test SOCK_OPS_GET_SK with same src/dst register */
+ if (test__start_subtest("get_sk")) {
+ run_sock_ops_test(skel, cgroup_fd,
+ bpf_program__fd(skel->progs.sock_ops_get_sk_same_reg));
+ ASSERT_EQ(skel->bss->null_seen, 1, "null_seen");
+ ASSERT_EQ(skel->bss->bug_detected, 0, "bug_not_detected");
+ }
+
+ /* Test SOCK_OPS_GET_FIELD with same src/dst register */
+ if (test__start_subtest("get_field")) {
+ run_sock_ops_test(skel, cgroup_fd,
+ bpf_program__fd(skel->progs.sock_ops_get_field_same_reg));
+ ASSERT_EQ(skel->bss->field_null_seen, 1, "field_null_seen");
+ ASSERT_EQ(skel->bss->field_bug_detected, 0, "field_bug_not_detected");
+ }
+
+ /* Test SOCK_OPS_GET_SK with different src/dst register */
+ if (test__start_subtest("get_sk_diff_reg")) {
+ run_sock_ops_test(skel, cgroup_fd,
+ bpf_program__fd(skel->progs.sock_ops_get_sk_diff_reg));
+ ASSERT_EQ(skel->bss->diff_reg_null_seen, 1, "diff_reg_null_seen");
+ ASSERT_EQ(skel->bss->diff_reg_bug_detected, 0, "diff_reg_bug_not_detected");
+ }
+
+ sock_ops_get_sk__destroy(skel);
+close_cgroup:
+ close(cgroup_fd);
+}
diff --git a/tools/testing/selftests/bpf/progs/sock_ops_get_sk.c b/tools/testing/selftests/bpf/progs/sock_ops_get_sk.c
new file mode 100644
index 0000000000000..3a0689f8ce7ca
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/sock_ops_get_sk.c
@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include "vmlinux.h"
+#include <bpf/bpf_helpers.h>
+#include "bpf_misc.h"
+
+/*
+ * Test the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros in
+ * sock_ops_convert_ctx_access() when dst_reg == src_reg.
+ *
+ * When dst_reg == src_reg, the macros borrow a temporary register to load
+ * is_fullsock / is_locked_tcp_sock, because dst_reg holds the ctx pointer
+ * and cannot be clobbered before ctx->sk / ctx->field is read. If
+ * is_fullsock == 0 (e.g., TCP_NEW_SYN_RECV with a request_sock), the macro
+ * must still zero dst_reg so the verifier's PTR_TO_SOCKET_OR_NULL /
+ * SCALAR_VALUE type is correct at runtime. A missing clear leaves a stale
+ * ctx pointer in dst_reg that passes NULL checks (GET_SK) or leaks a kernel
+ * address as a scalar (GET_FIELD).
+ *
+ * When dst_reg != src_reg, dst_reg itself is used to load is_fullsock, so
+ * the JEQ (dst_reg == 0) naturally leaves it zeroed on the !fullsock path.
+ */
+
+int bug_detected;
+int null_seen;
+
+SEC("sockops")
+__naked void sock_ops_get_sk_same_reg(void)
+{
+ asm volatile (
+ "r7 = *(u32 *)(r1 + %[is_fullsock_off]);"
+ "r1 = *(u64 *)(r1 + %[sk_off]);"
+ "if r7 != 0 goto 2f;"
+ "if r1 == 0 goto 1f;"
+ "r1 = %[bug_detected] ll;"
+ "r2 = 1;"
+ "*(u32 *)(r1 + 0) = r2;"
+ "goto 2f;"
+ "1:"
+ "r1 = %[null_seen] ll;"
+ "r2 = 1;"
+ "*(u32 *)(r1 + 0) = r2;"
+ "2:"
+ "r0 = 1;"
+ "exit;"
+ :
+ : __imm_const(is_fullsock_off, offsetof(struct bpf_sock_ops, is_fullsock)),
+ __imm_const(sk_off, offsetof(struct bpf_sock_ops, sk)),
+ __imm_addr(bug_detected),
+ __imm_addr(null_seen)
+ : __clobber_all);
+}
+
+/* SOCK_OPS_GET_FIELD: same-register, is_locked_tcp_sock == 0 path. */
+int field_bug_detected;
+int field_null_seen;
+
+SEC("sockops")
+__naked void sock_ops_get_field_same_reg(void)
+{
+ asm volatile (
+ "r7 = *(u32 *)(r1 + %[is_fullsock_off]);"
+ "r1 = *(u32 *)(r1 + %[snd_cwnd_off]);"
+ "if r7 != 0 goto 2f;"
+ "if r1 == 0 goto 1f;"
+ "r1 = %[field_bug_detected] ll;"
+ "r2 = 1;"
+ "*(u32 *)(r1 + 0) = r2;"
+ "goto 2f;"
+ "1:"
+ "r1 = %[field_null_seen] ll;"
+ "r2 = 1;"
+ "*(u32 *)(r1 + 0) = r2;"
+ "2:"
+ "r0 = 1;"
+ "exit;"
+ :
+ : __imm_const(is_fullsock_off, offsetof(struct bpf_sock_ops, is_fullsock)),
+ __imm_const(snd_cwnd_off, offsetof(struct bpf_sock_ops, snd_cwnd)),
+ __imm_addr(field_bug_detected),
+ __imm_addr(field_null_seen)
+ : __clobber_all);
+}
+
+/* SOCK_OPS_GET_SK: different-register, is_fullsock == 0 path. */
+int diff_reg_bug_detected;
+int diff_reg_null_seen;
+
+SEC("sockops")
+__naked void sock_ops_get_sk_diff_reg(void)
+{
+ asm volatile (
+ "r7 = r1;"
+ "r6 = *(u32 *)(r7 + %[is_fullsock_off]);"
+ "r2 = *(u64 *)(r7 + %[sk_off]);"
+ "if r6 != 0 goto 2f;"
+ "if r2 == 0 goto 1f;"
+ "r1 = %[diff_reg_bug_detected] ll;"
+ "r3 = 1;"
+ "*(u32 *)(r1 + 0) = r3;"
+ "goto 2f;"
+ "1:"
+ "r1 = %[diff_reg_null_seen] ll;"
+ "r3 = 1;"
+ "*(u32 *)(r1 + 0) = r3;"
+ "2:"
+ "r0 = 1;"
+ "exit;"
+ :
+ : __imm_const(is_fullsock_off, offsetof(struct bpf_sock_ops, is_fullsock)),
+ __imm_const(sk_off, offsetof(struct bpf_sock_ops, sk)),
+ __imm_addr(diff_reg_bug_detected),
+ __imm_addr(diff_reg_null_seen)
+ : __clobber_all);
+}
+
+char _license[] SEC("license") = "GPL";
--
2.43.0
^ permalink raw reply related
* [PATCH bpf v2 1/2] bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
From: Jiayuan Chen @ 2026-04-06 3:12 UTC (permalink / raw)
To: bpf
Cc: Jiayuan Chen, Quan Sun, Yinhao Hu, Kaiyan Mei, Dongliang Mu,
Emil Tsalapatis, Alexei Starovoitov, Daniel Borkmann,
Andrii Nakryiko, Martin KaFai Lau, Eduard Zingerman,
Kumar Kartikeya Dwivedi, Song Liu, Yonghong Song, Jiri Olsa,
John Fastabend, Stanislav Fomichev, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Shuah Khan,
linux-kernel, netdev, linux-kselftest
When a BPF sock_ops program accesses ctx fields with dst_reg == src_reg,
the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the
destination register in the !fullsock / !locked_tcp_sock path.
Both macros borrow a temporary register to check is_fullsock /
is_locked_tcp_sock when dst_reg == src_reg, because dst_reg holds the
ctx pointer. When the check is false (e.g., TCP_NEW_SYN_RECV state with
a request_sock), dst_reg should be zeroed but is not, leaving the stale
ctx pointer:
- SOCK_OPS_GET_SK: dst_reg retains the ctx pointer, passes NULL checks
as PTR_TO_SOCKET_OR_NULL, and can be used as a bogus socket pointer,
leading to stack-out-of-bounds access in helpers like
bpf_skc_to_tcp6_sock().
- SOCK_OPS_GET_FIELD: dst_reg retains the ctx pointer which the
verifier believes is a SCALAR_VALUE, leaking a kernel pointer.
Fix both macros by:
- Changing JMP_A(1) to JMP_A(2) in the fullsock path to skip the
added instruction.
- Adding BPF_MOV64_IMM(si->dst_reg, 0) after the temp register
restore in the !fullsock path, placed after the restore because
dst_reg == src_reg means we need src_reg intact to read ctx->temp.
Fixes: 84f44df664e9 ("bpf: sock_ops sk access may stomp registers when dst_reg = src_reg")
Reported-by: Quan Sun <2022090917019@std.uestc.edu.cn>
Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
Reported-by: Dongliang Mu <dzm91@hust.edu.cn>
Closes: https://lore.kernel.org/bpf/6fe1243e-149b-4d3b-99c7-fcc9e2f75787@std.uestc.edu.cn/T/#u
Suggested-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
---
net/core/filter.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index 78b548158fb05..53ce06ed4a88e 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -10581,10 +10581,11 @@ static u32 sock_ops_convert_ctx_access(enum bpf_access_type type,
si->dst_reg, si->dst_reg, \
offsetof(OBJ, OBJ_FIELD)); \
if (si->dst_reg == si->src_reg) { \
- *insn++ = BPF_JMP_A(1); \
+ *insn++ = BPF_JMP_A(2); \
*insn++ = BPF_LDX_MEM(BPF_DW, reg, si->src_reg, \
offsetof(struct bpf_sock_ops_kern, \
temp)); \
+ *insn++ = BPF_MOV64_IMM(si->dst_reg, 0); \
} \
} while (0)
@@ -10618,10 +10619,11 @@ static u32 sock_ops_convert_ctx_access(enum bpf_access_type type,
si->dst_reg, si->src_reg, \
offsetof(struct bpf_sock_ops_kern, sk));\
if (si->dst_reg == si->src_reg) { \
- *insn++ = BPF_JMP_A(1); \
+ *insn++ = BPF_JMP_A(2); \
*insn++ = BPF_LDX_MEM(BPF_DW, reg, si->src_reg, \
offsetof(struct bpf_sock_ops_kern, \
temp)); \
+ *insn++ = BPF_MOV64_IMM(si->dst_reg, 0); \
} \
} while (0)
--
2.43.0
^ permalink raw reply related
* Re: [PATCH bpf v1 1/2] bpf: Fix SOCK_OPS_GET_SK same-register OOB read in sock_ops
From: Emil Tsalapatis @ 2026-04-06 3:13 UTC (permalink / raw)
To: Jiayuan Chen, Emil Tsalapatis, bpf
Cc: Quan Sun, Yinhao Hu, Kaiyan Mei, Dongliang Mu, Martin KaFai Lau,
Daniel Borkmann, John Fastabend, Stanislav Fomichev,
Alexei Starovoitov, Andrii Nakryiko, Eduard Zingerman,
Kumar Kartikeya Dwivedi, Song Liu, Yonghong Song, Jiri Olsa,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Shuah Khan, linux-kernel, netdev, linux-kselftest
In-Reply-To: <346597fc-1703-45d7-bcef-55f5d4a7579c@linux.dev>
On Sun Apr 5, 2026 at 10:58 PM EDT, Jiayuan Chen wrote:
>
> On 4/6/26 7:54 AM, Emil Tsalapatis wrote:
>> On Sun Apr 5, 2026 at 7:49 PM EDT, Emil Tsalapatis wrote:
>>> On Sat Apr 4, 2026 at 10:09 AM EDT, Jiayuan Chen wrote:
>>>> When a BPF sock_ops program reads ctx->sk with dst_reg == src_reg
>>>> (e.g., r1 = *(u64 *)(r1 + offsetof(sk))), the SOCK_OPS_GET_SK() macro
>>>> fails to zero the destination register in the is_fullsock == 0 path.
>>>>
>>>> The macro saves/restores a temporary register and checks is_fullsock.
>>>> When is_fullsock == 0 (e.g., TCP_NEW_SYN_RECV state with a request_sock),
>>>> it should set dst_reg = 0 (NULL) so the verifier's PTR_TO_SOCKET_OR_NULL
>>>> type is correct at runtime. Instead, dst_reg retains the original ctx
>>>> pointer, which passes subsequent NULL checks and can be used as a bogus
>>>> socket pointer, leading to stack-out-of-bounds access in helpers like
>>>> bpf_skc_to_tcp6_sock().
>>>>
>>>> Fix by:
>>>> - Changing JMP_A(1) to JMP_A(2) in the fullsock path to skip the
>>>> added instruction.
>>>> - Adding BPF_MOV64_IMM(si->dst_reg, 0) after the temp register
>>>> restore in the !fullsock path, placed after the restore because
>>>> dst_reg == src_reg means we need src_reg intact to read ctx->temp.
>>>>
>>>> Fixes: 84f44df664e9 ("bpf: sock_ops sk access may stomp registers when dst_reg = src_reg")
>>>> Reported-by: Quan Sun <2022090917019@std.uestc.edu.cn>
>>>> Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
>>>> Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
>>>> Reported-by: Dongliang Mu <dzm91@hust.edu.cn>
>>>> Closes: https://lore.kernel.org/bpf/6fe1243e-149b-4d3b-99c7-fcc9e2f75787@std.uestc.edu.cn/T/#u
>>>> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
>>> This patch only seems to fix the problem when dst_reg == src_reg.
>>> Why is this not an issue when is_fullsock == 0, but dst_reg != src_reg?
>>> In that case the dst_reg is unmodified by the whole macro but is still
>>> marked as PTR_TO_SOCKET_OR_NULL. Isn't that a problem? Can you add
>>> a test case for is_fullsock == 0 but dst_reg != src_reg in patch 2?
>> Sorry for the double post, but also check sashiko.dev:
>> SOSK_OPTS_GET_FIELD seems to have the same issue as the
>> SOCK_OPTS_GET_SK. Can you add the same fix to it?
>>
>
> Thanks for the review!
>
> The AI reviewer's observation about SOCK_OPS_GET_FIELD() is correct —
> it has the same bug when dst_reg == src_reg and is_locked_tcp_sock == 0.
> I've folded that fix into patch 1 in v2.
>
> Regarding dst_reg != src_reg: this case is actually safe. When
> dst_reg != src_reg, fullsock_reg is dst_reg itself, and the generated
> sequence is:
>
> LDX_MEM dst_reg = is_fullsock
> JEQ dst_reg == 0, +jmp
> LDX_MEM dst_reg = sk
>
Yes, I missed the dst is the is_fullsock_reg assignment. v1 looks
correct then.
> The JEQ only branches when dst_reg == 0, so dst_reg is naturally
> zeroed on that path — no extra MOV_IMM needed. The same-register bug
> exists precisely because dst_reg == src_reg forces the macro to borrow
> a temporary register for the is_fullsock check, leaving dst_reg (the
> ctx pointer) untouched.
>
> I will add a get_sk_diff_reg subtest in v2.
>
> The other suggestions (moving the detailed comment to the BPF program
> file, avoiding vague "the fix" wording) are good points — addressed
> in v2 as well.
With the changes, feel free to add to both patches:
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
^ permalink raw reply
* [PATCH net-next v5 10/10] selftests: net: Add tests for team driver decoupled tx and rx control
From: Marc Harvey @ 2026-04-06 3:03 UTC (permalink / raw)
To: Jiri Pirko, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Shuah Khan, Simon Horman
Cc: netdev, linux-kernel, linux-kselftest, Marc Harvey
In-Reply-To: <20260406-teaming-driver-internal-v5-0-e8a3f348a1c5@google.com>
Use ping and tcpdump to verify that independent rx and tx enablement
of team driver member interfaces works as intended.
Signed-off-by: Marc Harvey <marcharvey@google.com>
---
Changes in v5:
- Minor typo fixes in both test files.
- Link to v4: https://lore.kernel.org/netdev/20260403-teaming-driver-internal-v4-10-d3032f33ca25@google.com/
Changes in v4:
- None
Changes in v3:
- None
Changes in v2:
- Fix shellcheck failures.
- Link to v1: https://lore.kernel.org/all/20260331053353.2504254-8-marcharvey@google.com/
---
tools/testing/selftests/drivers/net/team/Makefile | 1 +
.../drivers/net/team/decoupled_enablement.sh | 249 +++++++++++++++++++++
.../testing/selftests/drivers/net/team/options.sh | 99 +++++++-
3 files changed, 348 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/drivers/net/team/Makefile b/tools/testing/selftests/drivers/net/team/Makefile
index dab922d7f83d..7c58cf82121e 100644
--- a/tools/testing/selftests/drivers/net/team/Makefile
+++ b/tools/testing/selftests/drivers/net/team/Makefile
@@ -2,6 +2,7 @@
# Makefile for net selftests
TEST_PROGS := \
+ decoupled_enablement.sh \
dev_addr_lists.sh \
non_ether_header_ops.sh \
options.sh \
diff --git a/tools/testing/selftests/drivers/net/team/decoupled_enablement.sh b/tools/testing/selftests/drivers/net/team/decoupled_enablement.sh
new file mode 100755
index 000000000000..0d3d9c98e9f5
--- /dev/null
+++ b/tools/testing/selftests/drivers/net/team/decoupled_enablement.sh
@@ -0,0 +1,249 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+# These tests verify the decoupled RX and TX enablement of team driver member
+# interfaces.
+#
+# Topology
+#
+# +---------------------+ NS1
+# | test_team1 |
+# | | |
+# | eth0 |
+# | | |
+# | | |
+# +---------------------+
+# |
+# +---------------------+ NS2
+# | | |
+# | | |
+# | eth0 |
+# | | |
+# | test_team2 |
+# +---------------------+
+
+export ALL_TESTS="
+ team_test_tx_enablement
+ team_test_rx_enablement
+"
+
+test_dir="$(dirname "$0")"
+# shellcheck disable=SC1091
+source "${test_dir}/../../../net/lib.sh"
+# shellcheck disable=SC1091
+source "${test_dir}/team_lib.sh"
+
+NS1=""
+NS2=""
+export NODAD="nodad"
+PREFIX_LENGTH="64"
+NS1_IP="fd00::1"
+NS2_IP="fd00::2"
+NS1_IP4="192.168.0.1"
+NS2_IP4="192.168.0.2"
+MEMBERS=("eth0")
+PING_COUNT=5
+PING_TIMEOUT_S=1
+PING_INTERVAL=0.1
+
+while getopts "4" opt; do
+ case $opt in
+ 4)
+ echo "IPv4 mode selected."
+ export NODAD=
+ PREFIX_LENGTH="24"
+ NS1_IP="${NS1_IP4}"
+ NS2_IP="${NS2_IP4}"
+ ;;
+ \?)
+ echo "Invalid option: -$OPTARG" >&2
+ exit 1
+ ;;
+ esac
+done
+
+# This has to be sourced after opts are gathered...
+export REQUIRE_MZ=no
+export NUM_NETIFS=0
+# shellcheck disable=SC1091
+source "${test_dir}/../../../net/forwarding/lib.sh"
+
+# Create the network namespaces, veth pair, and team devices in the specified
+# mode.
+# Globals:
+# RET - Used by test infra, set by `check_err` functions.
+# Arguments:
+# mode - The team driver mode to use for the team devices.
+environment_create()
+{
+ trap cleanup_all_ns EXIT
+ setup_ns ns1 ns2
+ NS1="${NS_LIST[0]}"
+ NS2="${NS_LIST[1]}"
+
+ # Create the interfaces.
+ ip -n "${NS1}" link add eth0 type veth peer name eth0 netns "${NS2}"
+ ip -n "${NS1}" link add test_team1 type team
+ ip -n "${NS2}" link add test_team2 type team
+
+ # Set up the receiving network namespace's team interface.
+ setup_team "${NS2}" test_team2 roundrobin "${NS2_IP}" \
+ "${PREFIX_LENGTH}" "${MEMBERS[@]}"
+}
+
+# Set a particular option value for team or team port.
+# Arguments:
+# namespace - The namespace name that has the team.
+# option_name - The option name to set.
+# option_value - The value to set the option to.
+# team_name - The name of team to set the option for.
+# member_name - The (optional) optional name of the member port.
+set_option_value()
+{
+ local namespace="$1"
+ local option_name="$2"
+ local option_value="$3"
+ local team_name="$4"
+ local member_name="$5"
+ local port_flag="--port=${member_name}"
+
+ ip netns exec "${namespace}" teamnl "${team_name}" setoption \
+ "${option_name}" "${option_value}" "${port_flag}"
+ return $?
+}
+
+# Send some pings and return the ping command return value.
+try_ping()
+{
+ ip netns exec "${NS1}" ping -i "${PING_INTERVAL}" -c "${PING_COUNT}" \
+ "${NS2_IP}" -W "${PING_TIMEOUT_S}"
+}
+
+# Checks tcpdump output from net/forwarding lib, and checks if there are any
+# ICMP(4 or 6) packets.
+# Arguments:
+# interface - The interface name to search for.
+# ip_address - The destination IP address (4 or 6) to search for.
+did_interface_receive_icmp()
+{
+ local interface="$1"
+ local ip_address="$2"
+ local packet_count
+
+ packet_count=$(tcpdump_show "$interface" | grep -c \
+ "> ${ip_address}: ICMP")
+ echo "Packet count for ${interface} was ${packet_count}"
+
+ if [[ "$packet_count" -gt 0 ]]; then
+ true
+ else
+ false
+ fi
+}
+
+# Test JUST tx enablement with a given mode.
+# Globals:
+# RET - Used by test infra, set by `check_err` functions.
+# Arguments:
+# mode - The mode to set the team interfaces to.
+team_test_mode_tx_enablement()
+{
+ local mode="$1"
+ export RET=0
+
+ # Set up the sender team with the correct mode.
+ setup_team "${NS1}" test_team1 "${mode}" "${NS1_IP}" \
+ "${PREFIX_LENGTH}" "${MEMBERS[@]}"
+ check_err $? "Failed to set up sender team"
+
+ ### Scenario 1: Member interface initially enabled.
+ # Expect ping to pass
+ try_ping
+ check_err $? "Ping failed when TX enabled"
+
+ ### Scenario 2: One tx-side interface disabled.
+ # Expect ping to fail.
+ set_option_value "${NS1}" tx_enabled false test_team1 eth0
+ check_err $? "Failed to disable TX"
+ tcpdump_start eth0 "${NS2}"
+ try_ping
+ check_fail $? "Ping succeeded when TX disabled"
+ tcpdump_stop eth0
+ # Expect no packets to be transmitted, since TX is disabled.
+ did_interface_receive_icmp eth0 "${NS2_IP}"
+ check_fail $? "eth0 IS transmitting when TX disabled"
+ tcpdump_cleanup eth0
+
+ ### Scenario 3: The interface has tx re-enabled.
+ # Expect ping to pass.
+ set_option_value "${NS1}" tx_enabled true test_team1 eth0
+ check_err $? "Failed to reenable TX"
+ try_ping
+ check_err $? "Ping failed when TX reenabled"
+
+ log_test "TX failover of '${mode}' test"
+}
+
+# Test JUST rx enablement with a given mode.
+# Globals:
+# RET - Used by test infra, set by `check_err` functions.
+# Arguments:
+# mode - The mode to set the team interfaces to.
+team_test_mode_rx_enablement()
+{
+ local mode="$1"
+ export RET=0
+
+ # Set up the sender team with the correct mode.
+ setup_team "${NS1}" test_team1 "${mode}" "${NS1_IP}" \
+ "${PREFIX_LENGTH}" "${MEMBERS[@]}"
+ check_err $? "Failed to set up sender team"
+
+ ### Scenario 1: Member interface initially enabled.
+ # Expect ping to pass
+ try_ping
+ check_err $? "Ping failed when RX enabled"
+
+ ### Scenario 2: One rx-side interface disabled.
+ # Expect ping to fail.
+ set_option_value "${NS1}" rx_enabled false test_team1 eth0
+ check_err $? "Failed to disable RX"
+ tcpdump_start eth0 "${NS2}"
+ try_ping
+ check_fail $? "Ping succeeded when RX disabled"
+ tcpdump_stop eth0
+ # Expect packets to be transmitted, since only RX is disabled.
+ did_interface_receive_icmp eth0 "${NS2_IP}"
+ check_err $? "eth0 not transmitting when RX disabled"
+ tcpdump_cleanup eth0
+
+ ### Scenario 3: The interface has rx re-enabled.
+ # Expect ping to pass.
+ set_option_value "${NS1}" rx_enabled true test_team1 eth0
+ check_err $? "Failed to reenable RX"
+ try_ping
+ check_err $? "Ping failed when RX reenabled"
+
+ log_test "RX failover of '${mode}' test"
+}
+
+team_test_tx_enablement()
+{
+ team_test_mode_tx_enablement broadcast
+ team_test_mode_tx_enablement roundrobin
+ team_test_mode_tx_enablement random
+}
+
+team_test_rx_enablement()
+{
+ team_test_mode_rx_enablement broadcast
+ team_test_mode_rx_enablement roundrobin
+ team_test_mode_rx_enablement random
+}
+
+require_command teamnl
+require_command tcpdump
+require_command ping
+environment_create
+tests_run
+exit "${EXIT_STATUS}"
diff --git a/tools/testing/selftests/drivers/net/team/options.sh b/tools/testing/selftests/drivers/net/team/options.sh
index 44888f32b513..66c0cb896dad 100755
--- a/tools/testing/selftests/drivers/net/team/options.sh
+++ b/tools/testing/selftests/drivers/net/team/options.sh
@@ -11,10 +11,14 @@ if [[ $# -eq 0 ]]; then
exit $?
fi
-ALL_TESTS="
+export ALL_TESTS="
team_test_options
+ team_test_enabled_implicit_changes
+ team_test_rx_enabled_implicit_changes
+ team_test_tx_enabled_implicit_changes
"
+# shellcheck disable=SC1091
source "${test_dir}/../../../net/lib.sh"
TEAM_PORT="team0"
@@ -176,12 +180,105 @@ team_test_options()
team_test_option mcast_rejoin_count 0 5
team_test_option mcast_rejoin_interval 0 5
team_test_option enabled true false "${MEMBER_PORT}"
+ team_test_option rx_enabled true false "${MEMBER_PORT}"
+ team_test_option tx_enabled true false "${MEMBER_PORT}"
team_test_option user_linkup true false "${MEMBER_PORT}"
team_test_option user_linkup_enabled true false "${MEMBER_PORT}"
team_test_option priority 10 20 "${MEMBER_PORT}"
team_test_option queue_id 0 1 "${MEMBER_PORT}"
}
+team_test_enabled_implicit_changes()
+{
+ export RET=0
+
+ attach_port_if_specified "${MEMBER_PORT}"
+ check_err $? "Couldn't attach ${MEMBER_PORT} to master"
+
+ # Set enabled to true.
+ set_and_check_get enabled true "--port=${MEMBER_PORT}"
+ check_err $? "Failed to set 'enabled' to true"
+
+ # Show that both rx enabled and tx enabled are true.
+ get_and_check_value rx_enabled true "--port=${MEMBER_PORT}"
+ check_err $? "'Rx_enabled' wasn't implicitly set to true"
+ get_and_check_value tx_enabled true "--port=${MEMBER_PORT}"
+ check_err $? "'Tx_enabled' wasn't implicitly set to true"
+
+ # Set enabled to false.
+ set_and_check_get enabled false "--port=${MEMBER_PORT}"
+ check_err $? "Failed to set 'enabled' to false"
+
+ # Show that both rx enabled and tx enabled are false.
+ get_and_check_value rx_enabled false "--port=${MEMBER_PORT}"
+ check_err $? "'Rx_enabled' wasn't implicitly set to false"
+ get_and_check_value tx_enabled false "--port=${MEMBER_PORT}"
+ check_err $? "'Tx_enabled' wasn't implicitly set to false"
+
+ log_test "'Enabled' implicit changes"
+}
+
+team_test_rx_enabled_implicit_changes()
+{
+ export RET=0
+
+ attach_port_if_specified "${MEMBER_PORT}"
+ check_err $? "Couldn't attach ${MEMBER_PORT} to master"
+
+ # Set enabled to true.
+ set_and_check_get enabled true "--port=${MEMBER_PORT}"
+ check_err $? "Failed to set 'enabled' to true"
+
+ # Set rx_enabled to false.
+ set_and_check_get rx_enabled false "--port=${MEMBER_PORT}"
+ check_err $? "Failed to set 'rx_enabled' to false"
+
+ # Show that enabled is false.
+ get_and_check_value enabled false "--port=${MEMBER_PORT}"
+ check_err $? "'enabled' wasn't implicitly set to false"
+
+ # Set rx_enabled to true.
+ set_and_check_get rx_enabled true "--port=${MEMBER_PORT}"
+ check_err $? "Failed to set 'rx_enabled' to true"
+
+ # Show that enabled is true.
+ get_and_check_value enabled true "--port=${MEMBER_PORT}"
+ check_err $? "'enabled' wasn't implicitly set to true"
+
+ log_test "'Rx_enabled' implicit changes"
+}
+
+team_test_tx_enabled_implicit_changes()
+{
+ export RET=0
+
+ attach_port_if_specified "${MEMBER_PORT}"
+ check_err $? "Couldn't attach ${MEMBER_PORT} to master"
+
+ # Set enabled to true.
+ set_and_check_get enabled true "--port=${MEMBER_PORT}"
+ check_err $? "Failed to set 'enabled' to true"
+
+ # Set tx_enabled to false.
+ set_and_check_get tx_enabled false "--port=${MEMBER_PORT}"
+ check_err $? "Failed to set 'tx_enabled' to false"
+
+ # Show that enabled is false.
+ get_and_check_value enabled false "--port=${MEMBER_PORT}"
+ check_err $? "'enabled' wasn't implicitly set to false"
+
+ # Set tx_enabled to true.
+ set_and_check_get tx_enabled true "--port=${MEMBER_PORT}"
+ check_err $? "Failed to set 'tx_enabled' to true"
+
+ # Show that enabled is true.
+ get_and_check_value enabled true "--port=${MEMBER_PORT}"
+ check_err $? "'enabled' wasn't implicitly set to true"
+
+ log_test "'Tx_enabled' implicit changes"
+}
+
+
require_command teamnl
setup
tests_run
--
2.53.0.1185.g05d4b7b318-goog
^ permalink raw reply related
* [PATCH net-next v5 09/10] net: team: Add new tx_enabled team port option
From: Marc Harvey @ 2026-04-06 3:03 UTC (permalink / raw)
To: Jiri Pirko, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Shuah Khan, Simon Horman
Cc: netdev, linux-kernel, linux-kselftest, Marc Harvey
In-Reply-To: <20260406-teaming-driver-internal-v5-0-e8a3f348a1c5@google.com>
This option allows independent control over tx enablement without
affecting rx enablement. Like the rx_enabled option, this also
implicitly affects the enabled option.
If this option is not used, then the enabled option will continue to
behave as it did before.
Tested in a follow-up patch with a new selftest.
Signed-off-by: Marc Harvey <marcharvey@google.com>
---
Changes in v5:
- None
Changes in v4:
- New patch: split from the original monolithic v3 patch "net: team:
Decouple rx and tx enablement in the team driver".
- Link to v3: https://lore.kernel.org/netdev/20260402-teaming-driver-internal-v3-6-e8cfdec3b5c2@google.com/
---
drivers/net/team/team_core.c | 55 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 55 insertions(+)
diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index 67f77de4cf10..0c87f9972457 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -978,6 +978,21 @@ static void __team_port_enable_tx(struct team *team,
team_tx_port_index_hash(team, port->tx_index));
}
+static void team_port_enable_tx(struct team *team,
+ struct team_port *port)
+{
+ if (team_port_tx_enabled(port))
+ return;
+
+ __team_port_enable_tx(team, port);
+ team_adjust_ops(team);
+ team_queue_override_port_add(team, port);
+
+ /* Don't rejoin multicast, since this port might not be receiving. */
+ team_notify_peers(team);
+ team_lower_state_changed(port);
+}
+
static void __reconstruct_port_hlist(struct team *team, int rm_index)
{
struct hlist_head *tx_port_index_hash;
@@ -1007,6 +1022,19 @@ static void __team_port_disable_tx(struct team *team,
WRITE_ONCE(team->tx_en_port_count, team->tx_en_port_count - 1);
}
+static void team_port_disable_tx(struct team *team,
+ struct team_port *port)
+{
+ if (!team_port_tx_enabled(port))
+ return;
+
+ __team_port_disable_tx(team, port);
+
+ team_queue_override_port_del(team, port);
+ team_adjust_ops(team);
+ team_lower_state_changed(port);
+}
+
/*
* Enable TX AND RX on the port.
*/
@@ -1529,6 +1557,26 @@ static int team_port_rx_en_option_set(struct team *team,
return 0;
}
+static void team_port_tx_en_option_get(struct team *team,
+ struct team_gsetter_ctx *ctx)
+{
+ struct team_port *port = ctx->info->port;
+
+ ctx->data.bool_val = team_port_tx_enabled(port);
+}
+
+static int team_port_tx_en_option_set(struct team *team,
+ struct team_gsetter_ctx *ctx)
+{
+ struct team_port *port = ctx->info->port;
+
+ if (ctx->data.bool_val)
+ team_port_enable_tx(team, port);
+ else
+ team_port_disable_tx(team, port);
+ return 0;
+}
+
static void team_user_linkup_option_get(struct team *team,
struct team_gsetter_ctx *ctx)
{
@@ -1657,6 +1705,13 @@ static const struct team_option team_options[] = {
.getter = team_port_rx_en_option_get,
.setter = team_port_rx_en_option_set,
},
+ {
+ .name = "tx_enabled",
+ .type = TEAM_OPTION_TYPE_BOOL,
+ .per_port = true,
+ .getter = team_port_tx_en_option_get,
+ .setter = team_port_tx_en_option_set,
+ },
{
.name = "user_linkup",
.type = TEAM_OPTION_TYPE_BOOL,
--
2.53.0.1185.g05d4b7b318-goog
^ permalink raw reply related
* [PATCH net-next v5 08/10] net: team: Add new rx_enabled team port option
From: Marc Harvey @ 2026-04-06 3:03 UTC (permalink / raw)
To: Jiri Pirko, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Shuah Khan, Simon Horman
Cc: netdev, linux-kernel, linux-kselftest, Marc Harvey
In-Reply-To: <20260406-teaming-driver-internal-v5-0-e8a3f348a1c5@google.com>
Allow independent control over rx enablement via the rx_enabled option
without affecting tx enablement. This affects the normal enabled
option since a port is only considered enabled if both tx and rx are
enabled.
If this option is not used, then the enabled option will continue to
behave exactly as it did before.
Tested in a follow-up patch with a new selftest.
Signed-off-by: Marc Harvey <marcharvey@google.com>
---
Changes in v5:
- None
Changes in v4:
- New patch: split from the original monolithic v3 patch "net: team:
Decouple rx and tx enablement in the team driver".
- Link to v3: https://lore.kernel.org/netdev/20260402-teaming-driver-internal-v3-6-e8cfdec3b5c2@google.com/
---
drivers/net/team/team_core.c | 49 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 49 insertions(+)
diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index e437099a5a17..67f77de4cf10 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -941,6 +941,28 @@ static void __team_port_disable_rx(struct team *team,
WRITE_ONCE(port->rx_enabled, false);
}
+static void team_port_enable_rx(struct team *team,
+ struct team_port *port)
+{
+ if (team_port_rx_enabled(port))
+ return;
+
+ __team_port_enable_rx(team, port);
+ team_adjust_ops(team);
+ team_notify_peers(team);
+ team_mcast_rejoin(team);
+}
+
+static void team_port_disable_rx(struct team *team,
+ struct team_port *port)
+{
+ if (!team_port_rx_enabled(port))
+ return;
+
+ __team_port_disable_rx(team, port);
+ team_adjust_ops(team);
+}
+
/*
* Enable just TX on the port by adding to tx-enabled port hashlist and
* setting port->tx_index (Might be racy so reader could see incorrect
@@ -1487,6 +1509,26 @@ static int team_port_en_option_set(struct team *team,
return 0;
}
+static void team_port_rx_en_option_get(struct team *team,
+ struct team_gsetter_ctx *ctx)
+{
+ struct team_port *port = ctx->info->port;
+
+ ctx->data.bool_val = team_port_rx_enabled(port);
+}
+
+static int team_port_rx_en_option_set(struct team *team,
+ struct team_gsetter_ctx *ctx)
+{
+ struct team_port *port = ctx->info->port;
+
+ if (ctx->data.bool_val)
+ team_port_enable_rx(team, port);
+ else
+ team_port_disable_rx(team, port);
+ return 0;
+}
+
static void team_user_linkup_option_get(struct team *team,
struct team_gsetter_ctx *ctx)
{
@@ -1608,6 +1650,13 @@ static const struct team_option team_options[] = {
.getter = team_port_en_option_get,
.setter = team_port_en_option_set,
},
+ {
+ .name = "rx_enabled",
+ .type = TEAM_OPTION_TYPE_BOOL,
+ .per_port = true,
+ .getter = team_port_rx_en_option_get,
+ .setter = team_port_rx_en_option_set,
+ },
{
.name = "user_linkup",
.type = TEAM_OPTION_TYPE_BOOL,
--
2.53.0.1185.g05d4b7b318-goog
^ permalink raw reply related
* [PATCH net-next v5 06/10] net: team: Rename enablement functions and struct members to tx
From: Marc Harvey @ 2026-04-06 3:03 UTC (permalink / raw)
To: Jiri Pirko, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Shuah Khan, Simon Horman
Cc: netdev, linux-kernel, linux-kselftest, Marc Harvey
In-Reply-To: <20260406-teaming-driver-internal-v5-0-e8a3f348a1c5@google.com>
Add no functional changes, but rename enablement functions, variables
etc. that are used in teaming driver transmit decisions.
Since rx and tx enablement are still coupled, some of the variables
renamed in this patch are still used for the rx path, but that will
change in a follow-up patch.
Signed-off-by: Marc Harvey <marcharvey@google.com>
---
Changes in v5:
- None
Changes in v4:
- New patch: split from the original monolithic v3 patch "net: team:
Decouple rx and tx enablement in the team driver".
- Link to v3: https://lore.kernel.org/netdev/20260402-teaming-driver-internal-v3-6-e8cfdec3b5c2@google.com/
---
drivers/net/team/team_core.c | 44 +++++++++++++++---------------
drivers/net/team/team_mode_loadbalance.c | 2 +-
drivers/net/team/team_mode_random.c | 4 +--
drivers/net/team/team_mode_roundrobin.c | 2 +-
include/linux/if_team.h | 46 +++++++++++++++++---------------
5 files changed, 51 insertions(+), 47 deletions(-)
diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index 2ce31999c99f..826769473878 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -532,13 +532,13 @@ static void team_adjust_ops(struct team *team)
* correct ops are always set.
*/
- if (!team->en_port_count || !team_is_mode_set(team) ||
+ if (!team->tx_en_port_count || !team_is_mode_set(team) ||
!team->mode->ops->transmit)
team->ops.transmit = team_dummy_transmit;
else
team->ops.transmit = team->mode->ops->transmit;
- if (!team->en_port_count || !team_is_mode_set(team) ||
+ if (!team->tx_en_port_count || !team_is_mode_set(team) ||
!team->mode->ops->receive)
team->ops.receive = team_dummy_receive;
else
@@ -831,7 +831,7 @@ static bool team_queue_override_port_has_gt_prio_than(struct team_port *port,
return true;
if (port->priority > cur->priority)
return false;
- if (port->index < cur->index)
+ if (port->tx_index < cur->tx_index)
return true;
return false;
}
@@ -929,7 +929,7 @@ static bool team_port_find(const struct team *team,
/*
* Enable/disable port by adding to enabled port hashlist and setting
- * port->index (Might be racy so reader could see incorrect ifindex when
+ * port->tx_index (Might be racy so reader could see incorrect ifindex when
* processing a flying packet, but that is not a problem). Write guarded
* by RTNL.
*/
@@ -938,10 +938,10 @@ static void team_port_enable(struct team *team,
{
if (team_port_enabled(port))
return;
- WRITE_ONCE(port->index, team->en_port_count);
- WRITE_ONCE(team->en_port_count, team->en_port_count + 1);
- hlist_add_head_rcu(&port->hlist,
- team_port_index_hash(team, port->index));
+ WRITE_ONCE(port->tx_index, team->tx_en_port_count);
+ WRITE_ONCE(team->tx_en_port_count, team->tx_en_port_count + 1);
+ hlist_add_head_rcu(&port->tx_hlist,
+ team_tx_port_index_hash(team, port->tx_index));
team_adjust_ops(team);
team_queue_override_port_add(team, port);
team_notify_peers(team);
@@ -951,15 +951,17 @@ static void team_port_enable(struct team *team,
static void __reconstruct_port_hlist(struct team *team, int rm_index)
{
- int i;
+ struct hlist_head *tx_port_index_hash;
struct team_port *port;
+ int i;
- for (i = rm_index + 1; i < team->en_port_count; i++) {
- port = team_get_port_by_index(team, i);
- hlist_del_rcu(&port->hlist);
- WRITE_ONCE(port->index, port->index - 1);
- hlist_add_head_rcu(&port->hlist,
- team_port_index_hash(team, port->index));
+ for (i = rm_index + 1; i < team->tx_en_port_count; i++) {
+ port = team_get_port_by_tx_index(team, i);
+ hlist_del_rcu(&port->tx_hlist);
+ WRITE_ONCE(port->tx_index, port->tx_index - 1);
+ tx_port_index_hash = team_tx_port_index_hash(team,
+ port->tx_index);
+ hlist_add_head_rcu(&port->tx_hlist, tx_port_index_hash);
}
}
@@ -970,10 +972,10 @@ static void team_port_disable(struct team *team,
return;
if (team->ops.port_tx_disabled)
team->ops.port_tx_disabled(team, port);
- hlist_del_rcu(&port->hlist);
- __reconstruct_port_hlist(team, port->index);
- WRITE_ONCE(port->index, -1);
- WRITE_ONCE(team->en_port_count, team->en_port_count - 1);
+ hlist_del_rcu(&port->tx_hlist);
+ __reconstruct_port_hlist(team, port->tx_index);
+ WRITE_ONCE(port->tx_index, -1);
+ WRITE_ONCE(team->tx_en_port_count, team->tx_en_port_count - 1);
team_queue_override_port_del(team, port);
team_adjust_ops(team);
team_lower_state_changed(port);
@@ -1244,7 +1246,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
netif_addr_unlock_bh(dev);
}
- WRITE_ONCE(port->index, -1);
+ WRITE_ONCE(port->tx_index, -1);
list_add_tail_rcu(&port->list, &team->port_list);
team_port_enable(team, port);
netdev_compute_master_upper_features(dev, true);
@@ -1595,7 +1597,7 @@ static int team_init(struct net_device *dev)
return -ENOMEM;
for (i = 0; i < TEAM_PORT_HASHENTRIES; i++)
- INIT_HLIST_HEAD(&team->en_port_hlist[i]);
+ INIT_HLIST_HEAD(&team->tx_en_port_hlist[i]);
INIT_LIST_HEAD(&team->port_list);
err = team_queue_override_init(team);
if (err)
diff --git a/drivers/net/team/team_mode_loadbalance.c b/drivers/net/team/team_mode_loadbalance.c
index 840f409d250b..4833fbfe241e 100644
--- a/drivers/net/team/team_mode_loadbalance.c
+++ b/drivers/net/team/team_mode_loadbalance.c
@@ -120,7 +120,7 @@ static struct team_port *lb_hash_select_tx_port(struct team *team,
{
int port_index = team_num_to_port_index(team, hash);
- return team_get_port_by_index_rcu(team, port_index);
+ return team_get_port_by_tx_index_rcu(team, port_index);
}
/* Hash to port mapping select tx port */
diff --git a/drivers/net/team/team_mode_random.c b/drivers/net/team/team_mode_random.c
index 169a7bc865b2..370e974f3dca 100644
--- a/drivers/net/team/team_mode_random.c
+++ b/drivers/net/team/team_mode_random.c
@@ -16,8 +16,8 @@ static bool rnd_transmit(struct team *team, struct sk_buff *skb)
struct team_port *port;
int port_index;
- port_index = get_random_u32_below(READ_ONCE(team->en_port_count));
- port = team_get_port_by_index_rcu(team, port_index);
+ port_index = get_random_u32_below(READ_ONCE(team->tx_en_port_count));
+ port = team_get_port_by_tx_index_rcu(team, port_index);
if (unlikely(!port))
goto drop;
port = team_get_first_port_txable_rcu(team, port);
diff --git a/drivers/net/team/team_mode_roundrobin.c b/drivers/net/team/team_mode_roundrobin.c
index dd405d82c6ac..ecbeef28c221 100644
--- a/drivers/net/team/team_mode_roundrobin.c
+++ b/drivers/net/team/team_mode_roundrobin.c
@@ -27,7 +27,7 @@ static bool rr_transmit(struct team *team, struct sk_buff *skb)
port_index = team_num_to_port_index(team,
rr_priv(team)->sent_packets++);
- port = team_get_port_by_index_rcu(team, port_index);
+ port = team_get_port_by_tx_index_rcu(team, port_index);
if (unlikely(!port))
goto drop;
port = team_get_first_port_txable_rcu(team, port);
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index 740cb3100dfc..c777170ef552 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -27,10 +27,10 @@ struct team;
struct team_port {
struct net_device *dev;
- struct hlist_node hlist; /* node in enabled ports hash list */
+ struct hlist_node tx_hlist; /* node in tx-enabled ports hash list */
struct list_head list; /* node in ordinary list */
struct team *team;
- int index; /* index of enabled port. If disabled, it's set to -1 */
+ int tx_index; /* index of tx enabled port. If disabled, -1 */
bool linkup; /* either state.linkup or user.linkup */
@@ -77,7 +77,7 @@ static inline struct team_port *team_port_get_rcu(const struct net_device *dev)
static inline bool team_port_enabled(struct team_port *port)
{
- return READ_ONCE(port->index) != -1;
+ return READ_ONCE(port->tx_index) != -1;
}
static inline bool team_port_txable(struct team_port *port)
@@ -190,10 +190,10 @@ struct team {
const struct header_ops *header_ops_cache;
/*
- * List of enabled ports and their count
+ * List of tx-enabled ports and counts of rx and tx-enabled ports.
*/
- int en_port_count;
- struct hlist_head en_port_hlist[TEAM_PORT_HASHENTRIES];
+ int tx_en_port_count;
+ struct hlist_head tx_en_port_hlist[TEAM_PORT_HASHENTRIES];
struct list_head port_list; /* list of all ports */
@@ -237,41 +237,43 @@ static inline int team_dev_queue_xmit(struct team *team, struct team_port *port,
return dev_queue_xmit(skb);
}
-static inline struct hlist_head *team_port_index_hash(struct team *team,
- int port_index)
+static inline struct hlist_head *team_tx_port_index_hash(struct team *team,
+ int tx_port_index)
{
- return &team->en_port_hlist[port_index & (TEAM_PORT_HASHENTRIES - 1)];
+ unsigned int list_entry = tx_port_index & (TEAM_PORT_HASHENTRIES - 1);
+
+ return &team->tx_en_port_hlist[list_entry];
}
-static inline struct team_port *team_get_port_by_index(struct team *team,
- int port_index)
+static inline struct team_port *team_get_port_by_tx_index(struct team *team,
+ int tx_port_index)
{
+ struct hlist_head *head = team_tx_port_index_hash(team, tx_port_index);
struct team_port *port;
- struct hlist_head *head = team_port_index_hash(team, port_index);
- hlist_for_each_entry(port, head, hlist)
- if (port->index == port_index)
+ hlist_for_each_entry(port, head, tx_hlist)
+ if (port->tx_index == tx_port_index)
return port;
return NULL;
}
static inline int team_num_to_port_index(struct team *team, unsigned int num)
{
- int en_port_count = READ_ONCE(team->en_port_count);
+ int tx_en_port_count = READ_ONCE(team->tx_en_port_count);
- if (unlikely(!en_port_count))
+ if (unlikely(!tx_en_port_count))
return 0;
- return num % en_port_count;
+ return num % tx_en_port_count;
}
-static inline struct team_port *team_get_port_by_index_rcu(struct team *team,
- int port_index)
+static inline struct team_port *team_get_port_by_tx_index_rcu(struct team *team,
+ int tx_port_index)
{
+ struct hlist_head *head = team_tx_port_index_hash(team, tx_port_index);
struct team_port *port;
- struct hlist_head *head = team_port_index_hash(team, port_index);
- hlist_for_each_entry_rcu(port, head, hlist)
- if (READ_ONCE(port->index) == port_index)
+ hlist_for_each_entry_rcu(port, head, tx_hlist)
+ if (READ_ONCE(port->tx_index) == tx_port_index)
return port;
return NULL;
}
--
2.53.0.1185.g05d4b7b318-goog
^ permalink raw reply related
* [PATCH net-next v5 07/10] net: team: Track rx enablement separately from tx enablement
From: Marc Harvey @ 2026-04-06 3:03 UTC (permalink / raw)
To: Jiri Pirko, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Shuah Khan, Simon Horman
Cc: netdev, linux-kernel, linux-kselftest, Marc Harvey
In-Reply-To: <20260406-teaming-driver-internal-v5-0-e8a3f348a1c5@google.com>
Separate the rx and tx enablement/disablement into different
functions so that it is easier to interact with them independently
later.
Although this patch changes receive and transmit paths, the actual
behavior of the teaming driver should remain unchanged, since there
is no option introduced yet to change rx or tx enablement
independently. Those options will be added in follow-up patches.
Signed-off-by: Marc Harvey <marcharvey@google.com>
---
Changes in v5:
- Reorder function calls in team_port_enable() to make sure the call
order stays the same as before.
- Link to v4: https://lore.kernel.org/netdev/20260403-teaming-driver-internal-v4-7-d3032f33ca25@google.com/
Changes in v4:
- New patch: split from the original monolithic v3 patch "net: team:
Decouple rx and tx enablement in the team driver".
- Link to v3: https://lore.kernel.org/netdev/20260402-teaming-driver-internal-v3-6-e8cfdec3b5c2@google.com/
---
drivers/net/team/team_core.c | 104 ++++++++++++++++++++++++-------
drivers/net/team/team_mode_loadbalance.c | 2 +-
include/linux/if_team.h | 16 ++++-
3 files changed, 95 insertions(+), 27 deletions(-)
diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index 826769473878..e437099a5a17 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -87,7 +87,7 @@ static void team_lower_state_changed(struct team_port *port)
struct netdev_lag_lower_state_info info;
info.link_up = port->linkup;
- info.tx_enabled = team_port_enabled(port);
+ info.tx_enabled = team_port_tx_enabled(port);
netdev_lower_state_changed(port->dev, &info);
}
@@ -538,7 +538,7 @@ static void team_adjust_ops(struct team *team)
else
team->ops.transmit = team->mode->ops->transmit;
- if (!team->tx_en_port_count || !team_is_mode_set(team) ||
+ if (!team->rx_en_port_count || !team_is_mode_set(team) ||
!team->mode->ops->receive)
team->ops.receive = team_dummy_receive;
else
@@ -734,7 +734,7 @@ static rx_handler_result_t team_handle_frame(struct sk_buff **pskb)
port = team_port_get_rcu(skb->dev);
team = port->team;
- if (!team_port_enabled(port)) {
+ if (!team_port_rx_enabled(port)) {
if (is_link_local_ether_addr(eth_hdr(skb)->h_dest))
/* link-local packets are mostly useful when stack receives them
* with the link they arrive on.
@@ -876,7 +876,7 @@ static void __team_queue_override_enabled_check(struct team *team)
static void team_queue_override_port_prio_changed(struct team *team,
struct team_port *port)
{
- if (!port->queue_id || !team_port_enabled(port))
+ if (!port->queue_id || !team_port_tx_enabled(port))
return;
__team_queue_override_port_del(team, port);
__team_queue_override_port_add(team, port);
@@ -887,7 +887,7 @@ static void team_queue_override_port_change_queue_id(struct team *team,
struct team_port *port,
u16 new_queue_id)
{
- if (team_port_enabled(port)) {
+ if (team_port_tx_enabled(port)) {
__team_queue_override_port_del(team, port);
port->queue_id = new_queue_id;
__team_queue_override_port_add(team, port);
@@ -927,26 +927,33 @@ static bool team_port_find(const struct team *team,
return false;
}
+static void __team_port_enable_rx(struct team *team,
+ struct team_port *port)
+{
+ team->rx_en_port_count++;
+ WRITE_ONCE(port->rx_enabled, true);
+}
+
+static void __team_port_disable_rx(struct team *team,
+ struct team_port *port)
+{
+ team->rx_en_port_count--;
+ WRITE_ONCE(port->rx_enabled, false);
+}
+
/*
- * Enable/disable port by adding to enabled port hashlist and setting
- * port->tx_index (Might be racy so reader could see incorrect ifindex when
- * processing a flying packet, but that is not a problem). Write guarded
- * by RTNL.
+ * Enable just TX on the port by adding to tx-enabled port hashlist and
+ * setting port->tx_index (Might be racy so reader could see incorrect
+ * ifindex when processing a flying packet, but that is not a problem).
+ * Write guarded by RTNL.
*/
-static void team_port_enable(struct team *team,
- struct team_port *port)
+static void __team_port_enable_tx(struct team *team,
+ struct team_port *port)
{
- if (team_port_enabled(port))
- return;
WRITE_ONCE(port->tx_index, team->tx_en_port_count);
WRITE_ONCE(team->tx_en_port_count, team->tx_en_port_count + 1);
hlist_add_head_rcu(&port->tx_hlist,
team_tx_port_index_hash(team, port->tx_index));
- team_adjust_ops(team);
- team_queue_override_port_add(team, port);
- team_notify_peers(team);
- team_mcast_rejoin(team);
- team_lower_state_changed(port);
}
static void __reconstruct_port_hlist(struct team *team, int rm_index)
@@ -965,20 +972,69 @@ static void __reconstruct_port_hlist(struct team *team, int rm_index)
}
}
-static void team_port_disable(struct team *team,
- struct team_port *port)
+static void __team_port_disable_tx(struct team *team,
+ struct team_port *port)
{
- if (!team_port_enabled(port))
- return;
if (team->ops.port_tx_disabled)
team->ops.port_tx_disabled(team, port);
+
hlist_del_rcu(&port->tx_hlist);
__reconstruct_port_hlist(team, port->tx_index);
+
WRITE_ONCE(port->tx_index, -1);
WRITE_ONCE(team->tx_en_port_count, team->tx_en_port_count - 1);
- team_queue_override_port_del(team, port);
+}
+
+/*
+ * Enable TX AND RX on the port.
+ */
+static void team_port_enable(struct team *team,
+ struct team_port *port)
+{
+ bool rx_was_enabled;
+ bool tx_was_enabled;
+
+ if (team_port_enabled(port))
+ return;
+
+ rx_was_enabled = team_port_rx_enabled(port);
+ tx_was_enabled = team_port_tx_enabled(port);
+
+ if (!rx_was_enabled)
+ __team_port_enable_rx(team, port);
+ if (!tx_was_enabled)
+ __team_port_enable_tx(team, port);
+
+ team_adjust_ops(team);
+ if (!tx_was_enabled)
+ team_queue_override_port_add(team, port);
+ team_notify_peers(team);
+ if (!rx_was_enabled)
+ team_mcast_rejoin(team);
+ if (!tx_was_enabled)
+ team_lower_state_changed(port);
+}
+
+static void team_port_disable(struct team *team,
+ struct team_port *port)
+{
+ bool rx_was_enabled = team_port_rx_enabled(port);
+ bool tx_was_enabled = team_port_tx_enabled(port);
+
+ if (!tx_was_enabled && !rx_was_enabled)
+ return;
+
+ if (tx_was_enabled) {
+ __team_port_disable_tx(team, port);
+ team_queue_override_port_del(team, port);
+ }
+ if (rx_was_enabled)
+ __team_port_disable_rx(team, port);
+
team_adjust_ops(team);
- team_lower_state_changed(port);
+
+ if (tx_was_enabled)
+ team_lower_state_changed(port);
}
static int team_port_enter(struct team *team, struct team_port *port)
diff --git a/drivers/net/team/team_mode_loadbalance.c b/drivers/net/team/team_mode_loadbalance.c
index 4833fbfe241e..38a459649569 100644
--- a/drivers/net/team/team_mode_loadbalance.c
+++ b/drivers/net/team/team_mode_loadbalance.c
@@ -380,7 +380,7 @@ static int lb_tx_hash_to_port_mapping_set(struct team *team,
list_for_each_entry(port, &team->port_list, list) {
if (ctx->data.u32_val == port->dev->ifindex &&
- team_port_enabled(port)) {
+ team_port_tx_enabled(port)) {
rcu_assign_pointer(LB_HTPM_PORT_BY_HASH(lb_priv, hash),
port);
return 0;
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index c777170ef552..3d21e06fda67 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -31,6 +31,7 @@ struct team_port {
struct list_head list; /* node in ordinary list */
struct team *team;
int tx_index; /* index of tx enabled port. If disabled, -1 */
+ bool rx_enabled;
bool linkup; /* either state.linkup or user.linkup */
@@ -75,14 +76,24 @@ static inline struct team_port *team_port_get_rcu(const struct net_device *dev)
return rcu_dereference(dev->rx_handler_data);
}
-static inline bool team_port_enabled(struct team_port *port)
+static inline bool team_port_rx_enabled(struct team_port *port)
+{
+ return READ_ONCE(port->rx_enabled);
+}
+
+static inline bool team_port_tx_enabled(struct team_port *port)
{
return READ_ONCE(port->tx_index) != -1;
}
+static inline bool team_port_enabled(struct team_port *port)
+{
+ return team_port_rx_enabled(port) && team_port_tx_enabled(port);
+}
+
static inline bool team_port_txable(struct team_port *port)
{
- return port->linkup && team_port_enabled(port);
+ return port->linkup && team_port_tx_enabled(port);
}
static inline bool team_port_dev_txable(const struct net_device *port_dev)
@@ -193,6 +204,7 @@ struct team {
* List of tx-enabled ports and counts of rx and tx-enabled ports.
*/
int tx_en_port_count;
+ int rx_en_port_count;
struct hlist_head tx_en_port_hlist[TEAM_PORT_HASHENTRIES];
struct list_head port_list; /* list of all ports */
--
2.53.0.1185.g05d4b7b318-goog
^ permalink raw reply related
* [PATCH net-next v5 05/10] selftests: net: Add test for enablement of ports with teamd
From: Marc Harvey @ 2026-04-06 3:03 UTC (permalink / raw)
To: Jiri Pirko, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Shuah Khan, Simon Horman
Cc: netdev, linux-kernel, linux-kselftest, Marc Harvey
In-Reply-To: <20260406-teaming-driver-internal-v5-0-e8a3f348a1c5@google.com>
There are no tests that verify enablement and disablement of team driver
ports with teamd. This should work even with changes to the enablement
option, so it is important to test.
This test sets up an active-backup network configuration across two
network namespaces, and tries to send traffic while changing which
link is the active one.
Signed-off-by: Marc Harvey <marcharvey@google.com>
---
Changes in v5:
- Make test wait for inactive link to stop receiving traffic after
setting it to inactive, since there was a race condition.
- Change test teardown to try graceful shutdown first, then use
sigkill if needed.
- Manually delete leftover teamd files during teardown.
- Use tcpdump instead of checking rx counters.
- Link to v4: https://lore.kernel.org/netdev/20260403-teaming-driver-internal-v4-5-d3032f33ca25@google.com/
Changes in v4:
- None
Changed in v3:
- Make test cleanup kill teamd instead of terminate.
- Link to v2: https://lore.kernel.org/netdev/20260401-teaming-driver-internal-v2-5-f80c1291727b@google.com/
Changes in v2:
- Fix shellcheck failures.
- Remove dependency on net forwarding lib and pipe viewer tools.
- Use iperf3 for tcp instead of netcat.
- Link to v1: https://lore.kernel.org/all/20260331053353.2504254-6-marcharvey@google.com/
---
tools/testing/selftests/drivers/net/team/Makefile | 1 +
.../testing/selftests/drivers/net/team/team_lib.sh | 26 +++
.../drivers/net/team/teamd_activebackup.sh | 251 +++++++++++++++++++++
tools/testing/selftests/net/lib.sh | 13 ++
4 files changed, 291 insertions(+)
diff --git a/tools/testing/selftests/drivers/net/team/Makefile b/tools/testing/selftests/drivers/net/team/Makefile
index 777da2e0429e..dab922d7f83d 100644
--- a/tools/testing/selftests/drivers/net/team/Makefile
+++ b/tools/testing/selftests/drivers/net/team/Makefile
@@ -7,6 +7,7 @@ TEST_PROGS := \
options.sh \
propagation.sh \
refleak.sh \
+ teamd_activebackup.sh \
transmit_failover.sh \
# end of TEST_PROGS
diff --git a/tools/testing/selftests/drivers/net/team/team_lib.sh b/tools/testing/selftests/drivers/net/team/team_lib.sh
index a3102bdcb99c..43db0be19a42 100644
--- a/tools/testing/selftests/drivers/net/team/team_lib.sh
+++ b/tools/testing/selftests/drivers/net/team/team_lib.sh
@@ -144,3 +144,29 @@ did_interface_receive()
false
fi
}
+
+# Return true if the given interface in the given namespace does NOT receive
+# traffic over a 1 second period.
+# Arguments:
+# interface - The name of the interface.
+# ip_address - The destination IP address.
+# namespace - The name of the namespace that the interface is in.
+check_no_traffic()
+{
+ local interface="$1"
+ local ip_address="$2"
+ local namespace="$3"
+ local rc
+
+ save_tcpdump_outputs "${namespace}" "${interface}"
+ did_interface_receive "${interface}" "${ip_address}"
+ rc=$?
+
+ clear_tcpdump_outputs "${interface}"
+
+ if [[ "${rc}" -eq 0 ]]; then
+ return 1
+ else
+ return 0
+ fi
+}
diff --git a/tools/testing/selftests/drivers/net/team/teamd_activebackup.sh b/tools/testing/selftests/drivers/net/team/teamd_activebackup.sh
new file mode 100755
index 000000000000..9061fdcdfc1b
--- /dev/null
+++ b/tools/testing/selftests/drivers/net/team/teamd_activebackup.sh
@@ -0,0 +1,251 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+# These tests verify that teamd is able to enable and disable ports via the
+# active backup runner.
+#
+# Topology:
+#
+# +-------------------------+ NS1
+# | test_team1 |
+# | + |
+# | eth0 | eth1 |
+# | +---+---+ |
+# | | | |
+# +-------------------------+
+# | |
+# +-------------------------+ NS2
+# | | | |
+# | +-------+ |
+# | eth0 | eth1 |
+# | + |
+# | test_team2 |
+# +-------------------------+
+
+export ALL_TESTS="teamd_test_active_backup"
+
+test_dir="$(dirname "$0")"
+# shellcheck disable=SC1091
+source "${test_dir}/../../../net/lib.sh"
+# shellcheck disable=SC1091
+source "${test_dir}/team_lib.sh"
+
+NS1=""
+NS2=""
+export NODAD="nodad"
+PREFIX_LENGTH="64"
+NS1_IP="fd00::1"
+NS2_IP="fd00::2"
+NS1_IP4="192.168.0.1"
+NS2_IP4="192.168.0.2"
+NS1_TEAMD_CONF=""
+NS2_TEAMD_CONF=""
+NS1_TEAMD_PID=""
+NS2_TEAMD_PID=""
+
+while getopts "4" opt; do
+ case $opt in
+ 4)
+ echo "IPv4 mode selected."
+ export NODAD=
+ PREFIX_LENGTH="24"
+ NS1_IP="${NS1_IP4}"
+ NS2_IP="${NS2_IP4}"
+ ;;
+ \?)
+ echo "Invalid option: -${OPTARG}" >&2
+ exit 1
+ ;;
+ esac
+done
+
+teamd_config_create()
+{
+ local runner=$1
+ local dev=$2
+ local conf
+
+ conf=$(mktemp)
+
+ cat > "${conf}" <<-EOF
+ {
+ "device": "${dev}",
+ "runner": {"name": "${runner}"},
+ "ports": {
+ "eth0": {},
+ "eth1": {}
+ }
+ }
+ EOF
+ echo "${conf}"
+}
+
+# Create the network namespaces, veth pair, and team devices in the specified
+# runner.
+# Globals:
+# RET - Used by test infra, set by `check_err` functions.
+# Arguments:
+# runner - The Teamd runner to use for the Team devices.
+environment_create()
+{
+ local runner=$1
+
+ echo "Setting up two-link aggregation for runner ${runner}"
+ echo "Teamd version is: $(teamd --version)"
+ trap environment_destroy EXIT
+
+ setup_ns ns1 ns2
+ NS1="${NS_LIST[0]}"
+ NS2="${NS_LIST[1]}"
+
+ for link in $(seq 0 1); do
+ ip -n "${NS1}" link add "eth${link}" type veth peer name \
+ "eth${link}" netns "${NS2}"
+ check_err $? "Failed to create veth pair"
+ done
+
+ NS1_TEAMD_CONF=$(teamd_config_create "${runner}" "test_team1")
+ NS2_TEAMD_CONF=$(teamd_config_create "${runner}" "test_team2")
+ echo "Conf files are ${NS1_TEAMD_CONF} and ${NS2_TEAMD_CONF}"
+
+ ip netns exec "${NS1}" teamd -d -f "${NS1_TEAMD_CONF}"
+ check_err $? "Failed to create team device in ${NS1}"
+ NS1_TEAMD_PID=$(pgrep -f "teamd -d -f ${NS1_TEAMD_CONF}")
+
+ ip netns exec "${NS2}" teamd -d -f "${NS2_TEAMD_CONF}"
+ check_err $? "Failed to create team device in ${NS2}"
+ NS2_TEAMD_PID=$(pgrep -f "teamd -d -f ${NS2_TEAMD_CONF}")
+
+ echo "Created team devices"
+ echo "Teamd PIDs are ${NS1_TEAMD_PID} and ${NS2_TEAMD_PID}"
+
+ for link in $(seq 0 1); do
+ in_all_ns "ip link set eth${link} up"
+ check_err $? "Failed to set eth${link} up"
+ done
+
+ ip -n "${NS1}" link set test_team1 up
+ check_err $? "Failed to set test_team1 up in ${NS1}"
+ ip -n "${NS2}" link set test_team2 up
+ check_err $? "Failed to set test_team2 up in ${NS2}"
+
+ ip -n "${NS1}" addr add "${NS1_IP}/${PREFIX_LENGTH}" "${NODAD}" dev \
+ test_team1
+ check_err $? "Failed to add address to team device in ${NS1}"
+ ip -n "${NS2}" addr add "${NS2_IP}/${PREFIX_LENGTH}" "${NODAD}" dev \
+ test_team2
+ check_err $? "Failed to add address to team device in ${NS2}"
+
+ slowwait 2 timeout 0.5 ip netns exec "${NS1}" ping -W 1 -c 1 "${NS2_IP}"
+}
+
+# Tear down the environment: kill teamd and delete network namespaces.
+environment_destroy()
+{
+ echo "Tearing down two-link aggregation"
+
+ rm "${NS1_TEAMD_CONF}"
+ rm "${NS2_TEAMD_CONF}"
+
+ # First, try graceful teamd teardown.
+ ip netns exec "${NS1}" teamd -k -t test_team1
+ ip netns exec "${NS2}" teamd -k -t test_team2
+
+ # If teamd can't be killed gracefully, then sigkill.
+ if kill -0 "${NS1_TEAMD_PID}" 2>/dev/null; then
+ echo "Sending sigkill to teamd for test_team1"
+ kill -9 "${NS1_TEAMD_PID}"
+ rm /var/run/teamd/test_team1.{pid,sock}
+ fi
+ if kill -0 "${NS2_TEAMD_PID}" 2>/dev/null; then
+ echo "Sending sigkill to teamd for test_team2"
+ kill -9 "${NS2_TEAMD_PID}"
+ rm /var/run/teamd/test_team2.{pid,sock}
+ fi
+ cleanup_all_ns
+}
+
+# Change the active port for an active-backup mode team.
+# Arguments:
+# namespace - The network namespace that the team is in.
+# team - The name of the team.
+# active_port - The port to make active.
+set_active_port()
+{
+ local namespace=$1
+ local team=$2
+ local active_port=$3
+
+ ip netns exec "${namespace}" teamdctl "${team}" state item set \
+ runner.active_port "${active_port}"
+ slowwait 2 bash -c "ip netns exec ${namespace} teamdctl ${team} state \
+ item get runner.active_port | grep -q ${active_port}"
+}
+
+# Wait for an interface to stop receiving traffic. If it keeps receiving traffic
+# for the duration of the timeout, then return an error.
+# Arguments:
+# - namespace - The network namespace that the interface is in.
+# - interface - The name of the interface.
+wait_to_stop_receiving()
+{
+ local namespace=$1
+ local interface=$2
+
+ echo "Waiting for ${interface} in ${namespace} to stop receiving"
+ slowwait 10 check_no_traffic "${interface}" "${NS2_IP}" \
+ "${namespace}"
+}
+
+# Test that active backup runner can change active ports.
+# Globals:
+# RET - Used by test infra, set by `check_err` functions.
+teamd_test_active_backup()
+{
+ export RET=0
+
+ start_listening_and_sending
+
+ ### Scenario 1: Don't manually set active port, just make sure team
+ # works.
+ save_tcpdump_outputs "${NS2}" test_team2
+ did_interface_receive test_team2 "${NS2_IP}"
+ check_err $? "Traffic did not reach team interface in NS2."
+ clear_tcpdump_outputs test_team2
+
+ ### Scenario 2: Choose active port.
+ set_active_port "${NS1}" test_team1 eth1
+ set_active_port "${NS2}" test_team2 eth1
+
+ wait_to_stop_receiving "${NS2}" eth0
+ save_tcpdump_outputs "${NS2}" eth0 eth1
+ did_interface_receive eth0 "${NS2_IP}"
+ check_fail $? "eth0 IS transmitting when inactive"
+ did_interface_receive eth1 "${NS2_IP}"
+ check_err $? "eth1 not transmitting when active"
+ clear_tcpdump_outputs eth0 eth1
+
+ ### Scenario 3: Change active port.
+ set_active_port "${NS1}" test_team1 eth0
+ set_active_port "${NS2}" test_team2 eth0
+
+ wait_to_stop_receiving "${NS2}" eth1
+ save_tcpdump_outputs "${NS2}" eth0 eth1
+ did_interface_receive eth0 "${NS2_IP}"
+ check_err $? "eth0 not transmitting when active"
+ did_interface_receive eth1 "${NS2_IP}"
+ check_fail $? "eth1 IS transmitting when inactive"
+ clear_tcpdump_outputs eth0 eth1
+
+ log_test "teamd active backup runner test"
+
+ stop_sending_and_listening
+}
+
+require_command teamd
+require_command teamdctl
+require_command iperf3
+require_command tcpdump
+environment_create activebackup
+tests_run
+exit "${EXIT_STATUS}"
diff --git a/tools/testing/selftests/net/lib.sh b/tools/testing/selftests/net/lib.sh
index e915386daf1b..b3827b43782b 100644
--- a/tools/testing/selftests/net/lib.sh
+++ b/tools/testing/selftests/net/lib.sh
@@ -224,6 +224,19 @@ setup_ns()
NS_LIST+=("${ns_list[@]}")
}
+in_all_ns()
+{
+ local ret=0
+ local ns_list=("${NS_LIST[@]}")
+
+ for ns in "${ns_list[@]}"; do
+ ip netns exec "${ns}" "$@"
+ (( ret = ret || $? ))
+ done
+
+ return "${ret}"
+}
+
# Create netdevsim with given id and net namespace.
create_netdevsim() {
local id="$1"
--
2.53.0.1185.g05d4b7b318-goog
^ permalink raw reply related
* [PATCH net-next v5 04/10] selftests: net: Add tests for failover of team-aggregated ports
From: Marc Harvey @ 2026-04-06 3:03 UTC (permalink / raw)
To: Jiri Pirko, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Shuah Khan, Simon Horman
Cc: netdev, linux-kernel, linux-kselftest, Marc Harvey
In-Reply-To: <20260406-teaming-driver-internal-v5-0-e8a3f348a1c5@google.com>
There are currently no kernel tests that verify the effect of setting
the enabled team driver option. In a followup patch, there will be
changes to this option, so it will be important to make sure it still
behaves as it does now.
The test verifies that tcp continues to work across two different team
devices in separate network namespaces, even when member links are
manually disabled.
Signed-off-by: Marc Harvey <marcharvey@google.com>
---
Changes in v5:
- Use tcpdump for collecting traffic, rather than reading rx counters.
- Link to v4: https://lore.kernel.org/netdev/20260403-teaming-driver-internal-v4-4-d3032f33ca25@google.com/
Changes in v4:
- None
Changes in v3:
- None
Changes in v2:
- Fix shellcheck failures.
- Remove dependency on net forwarding lib and pipe viewer tools.
- Use iperf3 for tcp instead of netcat.
- Link to v1: https://lore.kernel.org/all/20260331053353.2504254-5-marcharvey@google.com/
---
tools/testing/selftests/drivers/net/team/Makefile | 2 +
tools/testing/selftests/drivers/net/team/config | 4 +
.../testing/selftests/drivers/net/team/team_lib.sh | 146 +++++++++++++++++++
.../drivers/net/team/transmit_failover.sh | 158 +++++++++++++++++++++
tools/testing/selftests/net/forwarding/lib.sh | 7 +-
5 files changed, 316 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/drivers/net/team/Makefile b/tools/testing/selftests/drivers/net/team/Makefile
index 02d6f51d5a06..777da2e0429e 100644
--- a/tools/testing/selftests/drivers/net/team/Makefile
+++ b/tools/testing/selftests/drivers/net/team/Makefile
@@ -7,9 +7,11 @@ TEST_PROGS := \
options.sh \
propagation.sh \
refleak.sh \
+ transmit_failover.sh \
# end of TEST_PROGS
TEST_INCLUDES := \
+ team_lib.sh \
../bonding/lag_lib.sh \
../../../net/forwarding/lib.sh \
../../../net/in_netns.sh \
diff --git a/tools/testing/selftests/drivers/net/team/config b/tools/testing/selftests/drivers/net/team/config
index 5d36a22ef080..8f04ae419c53 100644
--- a/tools/testing/selftests/drivers/net/team/config
+++ b/tools/testing/selftests/drivers/net/team/config
@@ -6,4 +6,8 @@ CONFIG_NETDEVSIM=m
CONFIG_NET_IPGRE=y
CONFIG_NET_TEAM=y
CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=y
+CONFIG_NET_TEAM_MODE_BROADCAST=y
CONFIG_NET_TEAM_MODE_LOADBALANCE=y
+CONFIG_NET_TEAM_MODE_RANDOM=y
+CONFIG_NET_TEAM_MODE_ROUNDROBIN=y
+CONFIG_VETH=y
diff --git a/tools/testing/selftests/drivers/net/team/team_lib.sh b/tools/testing/selftests/drivers/net/team/team_lib.sh
new file mode 100644
index 000000000000..a3102bdcb99c
--- /dev/null
+++ b/tools/testing/selftests/drivers/net/team/team_lib.sh
@@ -0,0 +1,146 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+test_dir="$(dirname "$0")"
+export REQUIRE_MZ=no
+export NUM_NETIFS=0
+# shellcheck disable=SC1091
+source "${test_dir}/../../../net/forwarding/lib.sh"
+
+# Create a team interface inside of a given network namespace with a given
+# mode, members, and IP address.
+# Arguments:
+# namespace - Network namespace to put the team interface into.
+# team - The name of the team interface to setup.
+# mode - The team mode of the interface.
+# ip_address - The IP address to assign to the team interface.
+# prefix_length - The prefix length for the IP address subnet.
+# $@ - members - The member interfaces of the aggregation.
+setup_team()
+{
+ local namespace=$1
+ local team=$2
+ local mode=$3
+ local ip_address=$4
+ local prefix_length=$5
+ shift 5
+ local members=("$@")
+
+ # Prerequisite: team must have no members
+ for member in "${members[@]}"; do
+ ip -n "${namespace}" link set "${member}" nomaster
+ done
+
+ # Prerequisite: team must have no address in order to set it
+ # shellcheck disable=SC2086
+ ip -n "${namespace}" addr del "${ip_address}/${prefix_length}" \
+ ${NODAD} dev "${team}"
+
+ echo "Setting team in ${namespace} to mode ${mode}"
+
+ if ! ip -n "${namespace}" link set "${team}" down; then
+ echo "Failed to bring team device down"
+ return 1
+ fi
+ if ! ip netns exec "${namespace}" teamnl "${team}" setoption mode \
+ "${mode}"; then
+ echo "Failed to set ${team} mode to '${mode}'"
+ return 1
+ fi
+
+ # Aggregate the members into teams.
+ for member in "${members[@]}"; do
+ ip -n "${namespace}" link set "${member}" master "${team}"
+ done
+
+ # Bring team devices up and give them addresses.
+ if ! ip -n "${namespace}" link set "${team}" up; then
+ echo "Failed to set ${team} up"
+ return 1
+ fi
+
+ # shellcheck disable=SC2086
+ if ! ip -n "${namespace}" addr add "${ip_address}/${prefix_length}" \
+ ${NODAD} dev "${team}"; then
+ echo "Failed to give ${team} IP address in ${namespace}"
+ return 1
+ fi
+}
+
+# This is global used to keep track of the sender's iperf3 process, so that it
+# can be terminated.
+declare sender_pid
+
+# Start sending and receiving TCP traffic with iperf3.
+# Globals:
+# sender_pid - The process ID of the iperf3 sender process. Used to kill it
+# later.
+start_listening_and_sending()
+{
+ ip netns exec "${NS2}" iperf3 -s -p 1234 --logfile /dev/null &
+ # Wait for server to become reachable before starting client.
+ slowwait 5 ip netns exec "${NS1}" iperf3 -c "${NS2_IP}" -p 1234 -t 1 \
+ --logfile /dev/null
+ ip netns exec "${NS1}" iperf3 -c "${NS2_IP}" -p 1234 -b 1M -l 1K -t 0 \
+ --logfile /dev/null &
+ sender_pid=$!
+}
+
+# Stop sending TCP traffic with iperf3.
+# Globals:
+# sender_pid - The process ID of the iperf3 sender process.
+stop_sending_and_listening()
+{
+ kill "${sender_pid}" && wait "${sender_pid}" 2>/dev/null || true
+}
+
+# Monitor for TCP traffic with Tcpdump, save results to temp files.
+# Arguments:
+# namespace - The network namespace to run tcpdump inside of.
+# $@ - interfaces - The interfaces to listen to.
+save_tcpdump_outputs()
+{
+ local namespace=$1
+ shift 1
+ local interfaces=("$@")
+
+ for interface in "${interfaces[@]}"; do
+ tcpdump_start "${interface}" "${namespace}"
+ done
+
+ sleep 1
+
+ for interface in "${interfaces[@]}"; do
+ tcpdump_stop_nosleep "${interface}"
+ done
+}
+
+clear_tcpdump_outputs()
+{
+ local interfaces=("$@")
+
+ for interface in "${interfaces[@]}"; do
+ tcpdump_cleanup "${interface}"
+ done
+}
+
+# Read Tcpdump output, determine packet counts.
+# Arguments:
+# interface - The name of the interface to count packets for.
+# ip_address - The destination IP address.
+did_interface_receive()
+{
+ local interface="$1"
+ local ip_address="$2"
+ local packet_count
+
+ packet_count=$(tcpdump_show "$interface" | grep -c \
+ "> ${ip_address}.1234")
+ echo "Packet count for ${interface} was ${packet_count}"
+
+ if [[ "${packet_count}" -gt 0 ]]; then
+ true
+ else
+ false
+ fi
+}
diff --git a/tools/testing/selftests/drivers/net/team/transmit_failover.sh b/tools/testing/selftests/drivers/net/team/transmit_failover.sh
new file mode 100755
index 000000000000..b2bdcd27bc98
--- /dev/null
+++ b/tools/testing/selftests/drivers/net/team/transmit_failover.sh
@@ -0,0 +1,158 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+# These tests verify the basic failover capability of the team driver via the
+# `enabled` team driver option across different team driver modes. This does not
+# rely on teamd, and instead just uses teamnl to set the `enabled` option
+# directly.
+#
+# Topology:
+#
+# +-------------------------+ NS1
+# | test_team1 |
+# | + |
+# | eth0 | eth1 |
+# | +---+---+ |
+# | | | |
+# +-------------------------+
+# | |
+# +-------------------------+ NS2
+# | | | |
+# | +-------+ |
+# | eth0 | eth1 |
+# | + |
+# | test_team2 |
+# +-------------------------+
+
+export ALL_TESTS="team_test_failover"
+
+test_dir="$(dirname "$0")"
+# shellcheck disable=SC1091
+source "${test_dir}/../../../net/lib.sh"
+# shellcheck disable=SC1091
+source "${test_dir}/team_lib.sh"
+
+NS1=""
+NS2=""
+export NODAD="nodad"
+PREFIX_LENGTH="64"
+NS1_IP="fd00::1"
+NS2_IP="fd00::2"
+NS1_IP4="192.168.0.1"
+NS2_IP4="192.168.0.2"
+MEMBERS=("eth0" "eth1")
+
+while getopts "4" opt; do
+ case $opt in
+ 4)
+ echo "IPv4 mode selected."
+ export NODAD=
+ PREFIX_LENGTH="24"
+ NS1_IP="${NS1_IP4}"
+ NS2_IP="${NS2_IP4}"
+ ;;
+ \?)
+ echo "Invalid option: -$OPTARG" >&2
+ exit 1
+ ;;
+ esac
+done
+
+# Create the network namespaces, veth pair, and team devices in the specified
+# mode.
+# Globals:
+# RET - Used by test infra, set by `check_err` functions.
+# Arguments:
+# mode - The team driver mode to use for the team devices.
+environment_create()
+{
+ trap cleanup_all_ns EXIT
+ setup_ns ns1 ns2
+ NS1="${NS_LIST[0]}"
+ NS2="${NS_LIST[1]}"
+
+ # Create the interfaces.
+ ip -n "${NS1}" link add eth0 type veth peer name eth0 netns "${NS2}"
+ ip -n "${NS1}" link add eth1 type veth peer name eth1 netns "${NS2}"
+ ip -n "${NS1}" link add test_team1 type team
+ ip -n "${NS2}" link add test_team2 type team
+
+ # Set up the receiving network namespace's team interface.
+ setup_team "${NS2}" test_team2 roundrobin "${NS2_IP}" \
+ "${PREFIX_LENGTH}" "${MEMBERS[@]}"
+}
+
+
+# Check that failover works for a specific team driver mode.
+# Globals:
+# RET - Used by test infra, set by `check_err` functions.
+# Arguments:
+# mode - The mode to set the team interfaces to.
+team_test_mode_failover()
+{
+ local mode="$1"
+ export RET=0
+
+ # Set up the sender team with the correct mode.
+ setup_team "${NS1}" test_team1 "${mode}" "${NS1_IP}" \
+ "${PREFIX_LENGTH}" "${MEMBERS[@]}"
+ check_err $? "Failed to set up sender team"
+
+ start_listening_and_sending
+
+ ### Scenario 1: All interfaces initially enabled.
+ save_tcpdump_outputs "${NS2}" "${MEMBERS[@]}"
+ did_interface_receive eth0 "${NS2_IP}"
+ check_err $? "eth0 not transmitting when both links enabled"
+ did_interface_receive eth1 "${NS2_IP}"
+ check_err $? "eth1 not transmitting when both links enabled"
+ clear_tcpdump_outputs "${MEMBERS[@]}"
+
+ ### Scenario 2: One tx-side interface disabled.
+ ip netns exec "${NS1}" teamnl test_team1 setoption enabled false \
+ --port=eth1
+ slowwait 2 bash -c "ip netns exec ${NS1} teamnl test_team1 getoption \
+ enabled --port=eth1 | grep -q false"
+
+ save_tcpdump_outputs "${NS2}" "${MEMBERS[@]}"
+ did_interface_receive eth0 "${NS2_IP}"
+ check_err $? "eth0 not transmitting when enabled"
+ did_interface_receive eth1 "${NS2_IP}"
+ check_fail $? "eth1 IS transmitting when disabled"
+ clear_tcpdump_outputs "${MEMBERS[@]}"
+
+ ### Scenario 3: The interface is re-enabled.
+ ip netns exec "${NS1}" teamnl test_team1 setoption enabled true \
+ --port=eth1
+ slowwait 2 bash -c "ip netns exec ${NS1} teamnl test_team1 getoption \
+ enabled --port=eth1 | grep -q true"
+
+ save_tcpdump_outputs "${NS2}" "${MEMBERS[@]}"
+ did_interface_receive eth0 "${NS2_IP}"
+ check_err $? "eth0 not transmitting when both links enabled"
+ did_interface_receive eth1 "${NS2_IP}"
+ check_err $? "eth1 not transmitting when both links enabled"
+ clear_tcpdump_outputs "${MEMBERS[@]}"
+
+ log_test "Failover of '${mode}' test"
+
+ # Clean up
+ stop_sending_and_listening
+}
+
+team_test_failover()
+{
+ team_test_mode_failover broadcast
+ team_test_mode_failover roundrobin
+ team_test_mode_failover random
+ # Don't test `activebackup` or `loadbalance` modes, since they are too
+ # complicated for just setting `enabled` to work. They use more than
+ # the `enabled` option for transmit.
+}
+
+require_command teamnl
+require_command iperf3
+require_command tcpdump
+environment_create
+tests_run
+exit "${EXIT_STATUS}"
diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
index d8cc4c64148d..a1017b11e3ea 100644
--- a/tools/testing/selftests/net/forwarding/lib.sh
+++ b/tools/testing/selftests/net/forwarding/lib.sh
@@ -1749,12 +1749,17 @@ tcpdump_start()
sleep 1
}
-tcpdump_stop()
+tcpdump_stop_nosleep()
{
local if_name=$1
local pid=${cappid[$if_name]}
$ns_cmd kill "$pid" && wait "$pid"
+}
+
+tcpdump_stop()
+{
+ tcpdump_stop_nosleep "$1"
sleep 1
}
--
2.53.0.1185.g05d4b7b318-goog
^ permalink raw reply related
* [PATCH net-next v5 03/10] net: team: Rename port_disabled team mode op to port_tx_disabled
From: Marc Harvey @ 2026-04-06 3:03 UTC (permalink / raw)
To: Jiri Pirko, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Shuah Khan, Simon Horman
Cc: netdev, linux-kernel, linux-kselftest, Marc Harvey
In-Reply-To: <20260406-teaming-driver-internal-v5-0-e8a3f348a1c5@google.com>
This team mode op is only used by the load balance mode, and it only
uses it in the tx path.
Signed-off-by: Marc Harvey <marcharvey@google.com>
---
Changes in v5:
- None
Changes in v4:
- None
Changes in v3:
- None
Changes in v2:
- None
---
drivers/net/team/team_core.c | 4 ++--
drivers/net/team/team_mode_loadbalance.c | 4 ++--
include/linux/if_team.h | 2 +-
3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index e54bd21bd068..2ce31999c99f 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -968,8 +968,8 @@ static void team_port_disable(struct team *team,
{
if (!team_port_enabled(port))
return;
- if (team->ops.port_disabled)
- team->ops.port_disabled(team, port);
+ if (team->ops.port_tx_disabled)
+ team->ops.port_tx_disabled(team, port);
hlist_del_rcu(&port->hlist);
__reconstruct_port_hlist(team, port->index);
WRITE_ONCE(port->index, -1);
diff --git a/drivers/net/team/team_mode_loadbalance.c b/drivers/net/team/team_mode_loadbalance.c
index 684954c2a8de..840f409d250b 100644
--- a/drivers/net/team/team_mode_loadbalance.c
+++ b/drivers/net/team/team_mode_loadbalance.c
@@ -655,7 +655,7 @@ static void lb_port_leave(struct team *team, struct team_port *port)
free_percpu(lb_port_priv->pcpu_stats);
}
-static void lb_port_disabled(struct team *team, struct team_port *port)
+static void lb_port_tx_disabled(struct team *team, struct team_port *port)
{
lb_tx_hash_to_port_mapping_null_port(team, port);
}
@@ -665,7 +665,7 @@ static const struct team_mode_ops lb_mode_ops = {
.exit = lb_exit,
.port_enter = lb_port_enter,
.port_leave = lb_port_leave,
- .port_disabled = lb_port_disabled,
+ .port_tx_disabled = lb_port_tx_disabled,
.receive = lb_receive,
.transmit = lb_transmit,
};
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index a761f5282bcf..740cb3100dfc 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -121,7 +121,7 @@ struct team_mode_ops {
int (*port_enter)(struct team *team, struct team_port *port);
void (*port_leave)(struct team *team, struct team_port *port);
void (*port_change_dev_addr)(struct team *team, struct team_port *port);
- void (*port_disabled)(struct team *team, struct team_port *port);
+ void (*port_tx_disabled)(struct team *team, struct team_port *port);
};
extern int team_modeop_port_enter(struct team *team, struct team_port *port);
--
2.53.0.1185.g05d4b7b318-goog
^ permalink raw reply related
* [PATCH net-next v5 02/10] net: team: Remove unused team_mode_op, port_enabled
From: Marc Harvey @ 2026-04-06 3:03 UTC (permalink / raw)
To: Jiri Pirko, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Shuah Khan, Simon Horman
Cc: netdev, linux-kernel, linux-kselftest, Marc Harvey
In-Reply-To: <20260406-teaming-driver-internal-v5-0-e8a3f348a1c5@google.com>
This team_mode_op wasn't used by any of the team modes, so remove it.
Signed-off-by: Marc Harvey <marcharvey@google.com>
---
Changes in v5:
- None
Changes in v4:
- None
Changes in v3:
- None
Changes in v2:
- None
---
drivers/net/team/team_core.c | 2 --
include/linux/if_team.h | 1 -
2 files changed, 3 deletions(-)
diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index becd066279a6..e54bd21bd068 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -944,8 +944,6 @@ static void team_port_enable(struct team *team,
team_port_index_hash(team, port->index));
team_adjust_ops(team);
team_queue_override_port_add(team, port);
- if (team->ops.port_enabled)
- team->ops.port_enabled(team, port);
team_notify_peers(team);
team_mcast_rejoin(team);
team_lower_state_changed(port);
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index 06f4d7400c1e..a761f5282bcf 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -121,7 +121,6 @@ struct team_mode_ops {
int (*port_enter)(struct team *team, struct team_port *port);
void (*port_leave)(struct team *team, struct team_port *port);
void (*port_change_dev_addr)(struct team *team, struct team_port *port);
- void (*port_enabled)(struct team *team, struct team_port *port);
void (*port_disabled)(struct team *team, struct team_port *port);
};
--
2.53.0.1185.g05d4b7b318-goog
^ permalink raw reply related
* [PATCH net-next v5 01/10] net: team: Annotate reads and writes for mixed lock accessed values
From: Marc Harvey @ 2026-04-06 3:03 UTC (permalink / raw)
To: Jiri Pirko, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Shuah Khan, Simon Horman
Cc: netdev, linux-kernel, linux-kselftest, Marc Harvey
In-Reply-To: <20260406-teaming-driver-internal-v5-0-e8a3f348a1c5@google.com>
The team_port's "index" and the team's "en_port_count" are read in
the hot transmit path, but are only written to when holding the rtnl
lock.
Use READ_ONCE() for all lockless reads of these values, and use
WRITE_ONCE() for all writes.
Signed-off-by: Marc Harvey <marcharvey@google.com>
---
Changes in v5:
- None
Changes in v4:
- None
Changes in v3:
- None
Changes in v2:
- None
---
drivers/net/team/team_core.c | 11 ++++++-----
drivers/net/team/team_mode_random.c | 2 +-
include/linux/if_team.h | 4 ++--
3 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index 566a5d102c23..becd066279a6 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -938,7 +938,8 @@ static void team_port_enable(struct team *team,
{
if (team_port_enabled(port))
return;
- port->index = team->en_port_count++;
+ WRITE_ONCE(port->index, team->en_port_count);
+ WRITE_ONCE(team->en_port_count, team->en_port_count + 1);
hlist_add_head_rcu(&port->hlist,
team_port_index_hash(team, port->index));
team_adjust_ops(team);
@@ -958,7 +959,7 @@ static void __reconstruct_port_hlist(struct team *team, int rm_index)
for (i = rm_index + 1; i < team->en_port_count; i++) {
port = team_get_port_by_index(team, i);
hlist_del_rcu(&port->hlist);
- port->index--;
+ WRITE_ONCE(port->index, port->index - 1);
hlist_add_head_rcu(&port->hlist,
team_port_index_hash(team, port->index));
}
@@ -973,8 +974,8 @@ static void team_port_disable(struct team *team,
team->ops.port_disabled(team, port);
hlist_del_rcu(&port->hlist);
__reconstruct_port_hlist(team, port->index);
- port->index = -1;
- team->en_port_count--;
+ WRITE_ONCE(port->index, -1);
+ WRITE_ONCE(team->en_port_count, team->en_port_count - 1);
team_queue_override_port_del(team, port);
team_adjust_ops(team);
team_lower_state_changed(port);
@@ -1245,7 +1246,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
netif_addr_unlock_bh(dev);
}
- port->index = -1;
+ WRITE_ONCE(port->index, -1);
list_add_tail_rcu(&port->list, &team->port_list);
team_port_enable(team, port);
netdev_compute_master_upper_features(dev, true);
diff --git a/drivers/net/team/team_mode_random.c b/drivers/net/team/team_mode_random.c
index 53d0ce34b8ce..169a7bc865b2 100644
--- a/drivers/net/team/team_mode_random.c
+++ b/drivers/net/team/team_mode_random.c
@@ -16,7 +16,7 @@ static bool rnd_transmit(struct team *team, struct sk_buff *skb)
struct team_port *port;
int port_index;
- port_index = get_random_u32_below(team->en_port_count);
+ port_index = get_random_u32_below(READ_ONCE(team->en_port_count));
port = team_get_port_by_index_rcu(team, port_index);
if (unlikely(!port))
goto drop;
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index ccb5327de26d..06f4d7400c1e 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -77,7 +77,7 @@ static inline struct team_port *team_port_get_rcu(const struct net_device *dev)
static inline bool team_port_enabled(struct team_port *port)
{
- return port->index != -1;
+ return READ_ONCE(port->index) != -1;
}
static inline bool team_port_txable(struct team_port *port)
@@ -272,7 +272,7 @@ static inline struct team_port *team_get_port_by_index_rcu(struct team *team,
struct hlist_head *head = team_port_index_hash(team, port_index);
hlist_for_each_entry_rcu(port, head, hlist)
- if (port->index == port_index)
+ if (READ_ONCE(port->index) == port_index)
return port;
return NULL;
}
--
2.53.0.1185.g05d4b7b318-goog
^ permalink raw reply related
* [PATCH net-next v5 00/10] Decouple receive and transmit enablement in team driver
From: Marc Harvey @ 2026-04-06 3:03 UTC (permalink / raw)
To: Jiri Pirko, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Shuah Khan, Simon Horman
Cc: netdev, linux-kernel, linux-kselftest, Marc Harvey
Allow independent control over receive and transmit enablement states
for aggregated ports in the team driver.
The motivation is that IEE 802.3ad LACP "independent control" can't
be implemented for the team driver currently. This was added to the
bonding driver in commit 240fd405528b ("bonding: Add independent
control state machine").
This series also has a few patches that add tests to show that the old
coupled enablement still works and that the new decoupled enablement
works as intended (4, 5, and 10).
There are three patches with small fixes as well, with the goal of
making the final decoupling patch clearer (1, 2, and 3).
Signed-off-by: Marc Harvey <marcharvey@google.com>
---
Changes in v5:
- Change teamd activebackup selftest in patch 5 to try graceful teamd
teardown before using sigkill.
- Make the teamd activebackup selftest in patch 5 delete leftover
teamd files during teardown.
- Reorder function calls in team_port_enable function in patch 7,
since the enablement behavior shouldn't change.
- Make selftests use tcpdump instead of checking rx counters.
- Fix minor typos in patch 10.
- Link to v4: https://lore.kernel.org/r/20260403-teaming-driver-internal-v4-0-d3032f33ca25@google.com
Changes in v4:
- Split the large v3 patch "net: team: Decouple rx and tx enablement
in the team driver" into 4 smaller patches.
- Link to v3: https://lore.kernel.org/r/20260402-teaming-driver-internal-v3-0-e8cfdec3b5c2@google.com
Changes in v3:
- Patch 5: In test cleanup, kill teamd to fix timeout.
- Link to v2: https://lore.kernel.org/r/20260401-teaming-driver-internal-v2-0-f80c1291727b@google.com
Changes in v2:
- Patch 4 and 5: Fix shellcheck errors and warnings, use iperf3
instead of netcat+pv, fix dependency checking.
- Patch 7: Fix shellcheck errors and warnings, fix dependency
checking.
- Link to v1: https://lore.kernel.org/all/20260331053353.2504254-1-marcharvey@google.com/
---
Marc Harvey (10):
net: team: Annotate reads and writes for mixed lock accessed values
net: team: Remove unused team_mode_op, port_enabled
net: team: Rename port_disabled team mode op to port_tx_disabled
selftests: net: Add tests for failover of team-aggregated ports
selftests: net: Add test for enablement of ports with teamd
net: team: Rename enablement functions and struct members to tx
net: team: Track rx enablement separately from tx enablement
net: team: Add new rx_enabled team port option
net: team: Add new tx_enabled team port option
selftests: net: Add tests for team driver decoupled tx and rx control
drivers/net/team/team_core.c | 237 +++++++++++++++----
drivers/net/team/team_mode_loadbalance.c | 8 +-
drivers/net/team/team_mode_random.c | 4 +-
drivers/net/team/team_mode_roundrobin.c | 2 +-
include/linux/if_team.h | 63 ++++--
tools/testing/selftests/drivers/net/team/Makefile | 4 +
tools/testing/selftests/drivers/net/team/config | 4 +
.../drivers/net/team/decoupled_enablement.sh | 249 ++++++++++++++++++++
.../testing/selftests/drivers/net/team/options.sh | 99 +++++++-
.../testing/selftests/drivers/net/team/team_lib.sh | 172 ++++++++++++++
.../drivers/net/team/teamd_activebackup.sh | 251 +++++++++++++++++++++
.../drivers/net/team/transmit_failover.sh | 158 +++++++++++++
tools/testing/selftests/net/forwarding/lib.sh | 7 +-
tools/testing/selftests/net/lib.sh | 13 ++
14 files changed, 1199 insertions(+), 72 deletions(-)
---
base-commit: 3741f8fa004bf598cd5032b0ff240984332d6f05
change-id: 20260401-teaming-driver-internal-83f2f0074d68
Best regards,
--
Marc Harvey <marcharvey@google.com>
^ permalink raw reply
* Re: [PATCH bpf v1 1/2] bpf: Fix SOCK_OPS_GET_SK same-register OOB read in sock_ops
From: Jiayuan Chen @ 2026-04-06 2:58 UTC (permalink / raw)
To: Emil Tsalapatis, bpf
Cc: Quan Sun, Yinhao Hu, Kaiyan Mei, Dongliang Mu, Martin KaFai Lau,
Daniel Borkmann, John Fastabend, Stanislav Fomichev,
Alexei Starovoitov, Andrii Nakryiko, Eduard Zingerman,
Kumar Kartikeya Dwivedi, Song Liu, Yonghong Song, Jiri Olsa,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Shuah Khan, linux-kernel, netdev, linux-kselftest
In-Reply-To: <DHLMKFBINRKW.BS0BEK9AMU86@etsalapatis.com>
On 4/6/26 7:54 AM, Emil Tsalapatis wrote:
> On Sun Apr 5, 2026 at 7:49 PM EDT, Emil Tsalapatis wrote:
>> On Sat Apr 4, 2026 at 10:09 AM EDT, Jiayuan Chen wrote:
>>> When a BPF sock_ops program reads ctx->sk with dst_reg == src_reg
>>> (e.g., r1 = *(u64 *)(r1 + offsetof(sk))), the SOCK_OPS_GET_SK() macro
>>> fails to zero the destination register in the is_fullsock == 0 path.
>>>
>>> The macro saves/restores a temporary register and checks is_fullsock.
>>> When is_fullsock == 0 (e.g., TCP_NEW_SYN_RECV state with a request_sock),
>>> it should set dst_reg = 0 (NULL) so the verifier's PTR_TO_SOCKET_OR_NULL
>>> type is correct at runtime. Instead, dst_reg retains the original ctx
>>> pointer, which passes subsequent NULL checks and can be used as a bogus
>>> socket pointer, leading to stack-out-of-bounds access in helpers like
>>> bpf_skc_to_tcp6_sock().
>>>
>>> Fix by:
>>> - Changing JMP_A(1) to JMP_A(2) in the fullsock path to skip the
>>> added instruction.
>>> - Adding BPF_MOV64_IMM(si->dst_reg, 0) after the temp register
>>> restore in the !fullsock path, placed after the restore because
>>> dst_reg == src_reg means we need src_reg intact to read ctx->temp.
>>>
>>> Fixes: 84f44df664e9 ("bpf: sock_ops sk access may stomp registers when dst_reg = src_reg")
>>> Reported-by: Quan Sun <2022090917019@std.uestc.edu.cn>
>>> Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
>>> Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
>>> Reported-by: Dongliang Mu <dzm91@hust.edu.cn>
>>> Closes: https://lore.kernel.org/bpf/6fe1243e-149b-4d3b-99c7-fcc9e2f75787@std.uestc.edu.cn/T/#u
>>> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
>> This patch only seems to fix the problem when dst_reg == src_reg.
>> Why is this not an issue when is_fullsock == 0, but dst_reg != src_reg?
>> In that case the dst_reg is unmodified by the whole macro but is still
>> marked as PTR_TO_SOCKET_OR_NULL. Isn't that a problem? Can you add
>> a test case for is_fullsock == 0 but dst_reg != src_reg in patch 2?
> Sorry for the double post, but also check sashiko.dev:
> SOSK_OPTS_GET_FIELD seems to have the same issue as the
> SOCK_OPTS_GET_SK. Can you add the same fix to it?
>
Thanks for the review!
The AI reviewer's observation about SOCK_OPS_GET_FIELD() is correct —
it has the same bug when dst_reg == src_reg and is_locked_tcp_sock == 0.
I've folded that fix into patch 1 in v2.
Regarding dst_reg != src_reg: this case is actually safe. When
dst_reg != src_reg, fullsock_reg is dst_reg itself, and the generated
sequence is:
LDX_MEM dst_reg = is_fullsock
JEQ dst_reg == 0, +jmp
LDX_MEM dst_reg = sk
The JEQ only branches when dst_reg == 0, so dst_reg is naturally
zeroed on that path — no extra MOV_IMM needed. The same-register bug
exists precisely because dst_reg == src_reg forces the macro to borrow
a temporary register for the is_fullsock check, leaving dst_reg (the
ctx pointer) untouched.
I will add a get_sk_diff_reg subtest in v2.
The other suggestions (moving the detailed comment to the BPF program
file, avoiding vague "the fix" wording) are good points — addressed
in v2 as well.
^ permalink raw reply
* [PATCH net-next v3] selftests/net: convert so_txtime to drv-net
From: Willem de Bruijn @ 2026-04-06 2:49 UTC (permalink / raw)
To: netdev; +Cc: davem, kuba, edumazet, pabeni, horms, Willem de Bruijn
From: Willem de Bruijn <willemb@google.com>
In preparation for extending to pacing hardware offload, convert the
so_txtime.sh test to a drv-net test that can be run against netdevsim
and real hardware.
Also update so_txtime.c to not exit on first failure, but run to
completion and report exit code there. This helps with debugging
unexpected results, especially when processing multiple packets,
as in the "reverse_order" testcase.
Signed-off-by: Willem de Bruijn <willemb@google.com>
----
v2 -> v3
- Makefile: move so_txtime from YNL_GEN_FILES to TEST_GEN_FILES
v2: https://lore.kernel.org/netdev/20260405014458.1038165-1-willemdebruijn.kernel@gmail.com/
v1 -> v2
- move so_txtime.c for net/lib to drivers/net (Jakub)
- fix drivers/net/config order (Jakub)
- detect passing when failure is expected (Jakub, Sashiko)
- pass pylint --disable=R (Jakub)
- only call ksft_run once (Jakub)
- do not sleep if waiting time is negative (Sashiko)
- add \n when converting error() to fprintf() (Sashiko)
- 4 space indentation, instead of 2 space
- increase sync delay from 100 to 200ms, to fix rare vng flakes
v1: https://lore.kernel.org/netdev/20260403175047.152646-1-willemdebruijn.kernel@gmail.com/
---
.../testing/selftests/drivers/net/.gitignore | 1 +
tools/testing/selftests/drivers/net/Makefile | 2 +
tools/testing/selftests/drivers/net/config | 2 +
.../selftests/{ => drivers}/net/so_txtime.c | 24 +++-
.../selftests/drivers/net/so_txtime.py | 88 ++++++++++++++
tools/testing/selftests/net/.gitignore | 1 -
tools/testing/selftests/net/Makefile | 2 -
tools/testing/selftests/net/so_txtime.sh | 110 ------------------
8 files changed, 112 insertions(+), 118 deletions(-)
rename tools/testing/selftests/{ => drivers}/net/so_txtime.c (96%)
create mode 100755 tools/testing/selftests/drivers/net/so_txtime.py
delete mode 100755 tools/testing/selftests/net/so_txtime.sh
diff --git a/tools/testing/selftests/drivers/net/.gitignore b/tools/testing/selftests/drivers/net/.gitignore
index 585ecb4d5dc4..e5314ce4bb2d 100644
--- a/tools/testing/selftests/drivers/net/.gitignore
+++ b/tools/testing/selftests/drivers/net/.gitignore
@@ -1,3 +1,4 @@
# SPDX-License-Identifier: GPL-2.0-only
napi_id_helper
psp_responder
+so_txtime
diff --git a/tools/testing/selftests/drivers/net/Makefile b/tools/testing/selftests/drivers/net/Makefile
index 7c7fa75b80c2..49a61b506f53 100644
--- a/tools/testing/selftests/drivers/net/Makefile
+++ b/tools/testing/selftests/drivers/net/Makefile
@@ -7,6 +7,7 @@ TEST_INCLUDES := $(wildcard lib/py/*.py) \
TEST_GEN_FILES := \
napi_id_helper \
+ so_txtime \
# end of TEST_GEN_FILES
TEST_PROGS := \
@@ -20,6 +21,7 @@ TEST_PROGS := \
queues.py \
ring_reconfig.py \
shaper.py \
+ so_txtime.py \
stats.py \
xdp.py \
# end of TEST_PROGS
diff --git a/tools/testing/selftests/drivers/net/config b/tools/testing/selftests/drivers/net/config
index 77ccf83d87e0..2d39f263e03b 100644
--- a/tools/testing/selftests/drivers/net/config
+++ b/tools/testing/selftests/drivers/net/config
@@ -7,4 +7,6 @@ CONFIG_NETCONSOLE=m
CONFIG_NETCONSOLE_DYNAMIC=y
CONFIG_NETCONSOLE_EXTENDED_LOG=y
CONFIG_NETDEVSIM=m
+CONFIG_NET_SCH_ETF=m
+CONFIG_NET_SCH_FQ=m
CONFIG_XDP_SOCKETS=y
diff --git a/tools/testing/selftests/net/so_txtime.c b/tools/testing/selftests/drivers/net/so_txtime.c
similarity index 96%
rename from tools/testing/selftests/net/so_txtime.c
rename to tools/testing/selftests/drivers/net/so_txtime.c
index b76df1efc2ef..7d144001ecf2 100644
--- a/tools/testing/selftests/net/so_txtime.c
+++ b/tools/testing/selftests/drivers/net/so_txtime.c
@@ -33,6 +33,8 @@
#include <unistd.h>
#include <poll.h>
+#include "kselftest.h"
+
static int cfg_clockid = CLOCK_TAI;
static uint16_t cfg_port = 8000;
static int cfg_variance_us = 4000;
@@ -43,6 +45,8 @@ static bool cfg_rx;
static uint64_t glob_tstart;
static uint64_t tdeliver_max;
+static int errors;
+
/* encode one timed transmission (of a 1B payload) */
struct timed_send {
char data;
@@ -131,13 +135,15 @@ static void do_recv_one(int fdr, struct timed_send *ts)
fprintf(stderr, "payload:%c delay:%lld expected:%lld (us)\n",
rbuf[0], (long long)tstop, (long long)texpect);
- if (rbuf[0] != ts->data)
- error(1, 0, "payload mismatch. expected %c", ts->data);
+ if (rbuf[0] != ts->data) {
+ fprintf(stderr, "payload mismatch. expected %c\n", ts->data);
+ errors++;
+ }
if (llabs(tstop - texpect) > cfg_variance_us) {
fprintf(stderr, "exceeds variance (%d us)\n", cfg_variance_us);
if (!getenv("KSFT_MACHINE_SLOW"))
- exit(1);
+ errors++;
}
}
@@ -255,8 +261,11 @@ static void start_time_wait(void)
return;
now = gettime_ns(CLOCK_REALTIME);
- if (cfg_start_time_ns < now)
+ if (cfg_start_time_ns < now) {
+ fprintf(stderr, "FAIL: start time already passed\n");
+ errors++;
return;
+ }
err = usleep((cfg_start_time_ns - now) / 1000);
if (err)
@@ -513,5 +522,10 @@ int main(int argc, char **argv)
else
do_test_tx((void *)&cfg_src_addr, cfg_alen);
- return 0;
+ if (errors) {
+ fprintf(stderr, "FAIL: %d errors\n", errors);
+ return KSFT_FAIL;
+ }
+
+ return KSFT_PASS;
}
diff --git a/tools/testing/selftests/drivers/net/so_txtime.py b/tools/testing/selftests/drivers/net/so_txtime.py
new file mode 100755
index 000000000000..31b95a7b5b8b
--- /dev/null
+++ b/tools/testing/selftests/drivers/net/so_txtime.py
@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0
+
+"""Regression tests for the SO_TXTIME interface.
+
+Test delivery time in FQ and ETF qdiscs.
+"""
+
+import time
+
+from lib.py import ksft_exit, ksft_run, ksft_variants
+from lib.py import KsftNamedVariant, KsftSkipEx
+from lib.py import NetDrvEpEnv, bkg, cmd
+
+
+def test_so_txtime(cfg, clockid, ipver, args_tx, args_rx, expect_fail):
+ """Main function. Run so_txtime as sender and receiver."""
+ bin_path = cfg.test_dir / "so_txtime"
+
+ tstart = time.time_ns() + 200_000_000
+
+ cmd_addr = f"-S {cfg.addr_v[ipver]} -D {cfg.remote_addr_v[ipver]}"
+ cmd_base = f"{bin_path} -{ipver} -c {clockid} -t {tstart} {cmd_addr}"
+ cmd_rx = f"{cmd_base} {args_rx} -r"
+ cmd_tx = f"{cmd_base} {args_tx}"
+
+ with bkg(cmd_rx, host=cfg.remote, fail=(not expect_fail), exit_wait=True):
+ cmd(cmd_tx)
+
+
+def _test_variants_mono():
+ for ipver in ["4", "6"]:
+ for testcase in [
+ ["no_delay", "a,-1", "a,-1"],
+ ["zero_delay", "a,0", "a,0"],
+ ["one_pkt", "a,10", "a,10"],
+ ["in_order", "a,10,b,20", "a,10,b,20"],
+ ["reverse_order", "a,20,b,10", "b,20,a,20"],
+ ]:
+ name = f"_v{ipver}_{testcase[0]}"
+ yield KsftNamedVariant(name, ipver, testcase[1], testcase[2])
+
+
+@ksft_variants(_test_variants_mono())
+def test_so_txtime_mono(cfg, ipver, args_tx, args_rx):
+ """Run all variants of monotonic (fq) tests."""
+ cmd(f"tc qdisc replace dev {cfg.ifname} root fq")
+ test_so_txtime(cfg, "mono", ipver, args_tx, args_rx, False)
+
+
+def _test_variants_etf():
+ for ipver in ["4", "6"]:
+ for testcase in [
+ ["no_delay", "a,-1", "a,-1", True],
+ ["zero_delay", "a,0", "a,0", True],
+ ["one_pkt", "a,10", "a,10", False],
+ ["in_order", "a,10,b,20", "a,10,b,20", False],
+ ["reverse_order", "a,20,b,10", "b,10,a,20", False],
+ ]:
+ name = f"_v{ipver}_{testcase[0]}"
+ yield KsftNamedVariant(
+ name, ipver, testcase[1], testcase[2], testcase[3]
+ )
+
+
+@ksft_variants(_test_variants_etf())
+def test_so_txtime_etf(cfg, ipver, args_tx, args_rx, expect_fail):
+ """Run all variants of etf tests."""
+ try:
+ # ETF does not support change, so remove and re-add it instead.
+ cmd_prefix = f"tc qdisc replace dev {cfg.ifname} root"
+ cmd(f"{cmd_prefix} pfifo_fast")
+ cmd(f"{cmd_prefix} etf clockid CLOCK_TAI delta 400000")
+ except Exception as e:
+ raise KsftSkipEx("tc does not support qdisc etf. skipping") from e
+
+ test_so_txtime(cfg, "tai", ipver, args_tx, args_rx, expect_fail)
+
+
+def main() -> None:
+ """Boilerplate ksft main."""
+ with NetDrvEpEnv(__file__) as cfg:
+ ksft_run([test_so_txtime_mono, test_so_txtime_etf], args=(cfg,))
+ ksft_exit()
+
+
+if __name__ == "__main__":
+ main()
diff --git a/tools/testing/selftests/net/.gitignore b/tools/testing/selftests/net/.gitignore
index 97ad4d551d44..02ad4c99a2b4 100644
--- a/tools/testing/selftests/net/.gitignore
+++ b/tools/testing/selftests/net/.gitignore
@@ -40,7 +40,6 @@ skf_net_off
socket
so_incoming_cpu
so_netns_cookie
-so_txtime
so_rcv_listener
stress_reuseport_listen
tap
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index 6bced3ed798b..b7f51e8f190f 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -81,7 +81,6 @@ TEST_PROGS := \
rxtimestamp.sh \
sctp_vrf.sh \
skf_net_off.sh \
- so_txtime.sh \
srv6_end_dt46_l3vpn_test.sh \
srv6_end_dt4_l3vpn_test.sh \
srv6_end_dt6_l3vpn_test.sh \
@@ -154,7 +153,6 @@ TEST_GEN_FILES := \
skf_net_off \
so_netns_cookie \
so_rcv_listener \
- so_txtime \
socket \
stress_reuseport_listen \
tcp_fastopen_backup_key \
diff --git a/tools/testing/selftests/net/so_txtime.sh b/tools/testing/selftests/net/so_txtime.sh
deleted file mode 100755
index 5e861ad32a42..000000000000
--- a/tools/testing/selftests/net/so_txtime.sh
+++ /dev/null
@@ -1,110 +0,0 @@
-#!/bin/bash
-# SPDX-License-Identifier: GPL-2.0
-#
-# Regression tests for the SO_TXTIME interface
-
-set -e
-
-readonly ksft_skip=4
-readonly DEV="veth0"
-readonly BIN="./so_txtime"
-
-readonly RAND="$(mktemp -u XXXXXX)"
-readonly NSPREFIX="ns-${RAND}"
-readonly NS1="${NSPREFIX}1"
-readonly NS2="${NSPREFIX}2"
-
-readonly SADDR4='192.168.1.1'
-readonly DADDR4='192.168.1.2'
-readonly SADDR6='fd::1'
-readonly DADDR6='fd::2'
-
-cleanup() {
- ip netns del "${NS2}"
- ip netns del "${NS1}"
-}
-
-trap cleanup EXIT
-
-# Create virtual ethernet pair between network namespaces
-ip netns add "${NS1}"
-ip netns add "${NS2}"
-
-ip link add "${DEV}" netns "${NS1}" type veth \
- peer name "${DEV}" netns "${NS2}"
-
-# Bring the devices up
-ip -netns "${NS1}" link set "${DEV}" up
-ip -netns "${NS2}" link set "${DEV}" up
-
-# Set fixed MAC addresses on the devices
-ip -netns "${NS1}" link set dev "${DEV}" address 02:02:02:02:02:02
-ip -netns "${NS2}" link set dev "${DEV}" address 06:06:06:06:06:06
-
-# Add fixed IP addresses to the devices
-ip -netns "${NS1}" addr add 192.168.1.1/24 dev "${DEV}"
-ip -netns "${NS2}" addr add 192.168.1.2/24 dev "${DEV}"
-ip -netns "${NS1}" addr add fd::1/64 dev "${DEV}" nodad
-ip -netns "${NS2}" addr add fd::2/64 dev "${DEV}" nodad
-
-run_test() {
- local readonly IP="$1"
- local readonly CLOCK="$2"
- local readonly TXARGS="$3"
- local readonly RXARGS="$4"
-
- if [[ "${IP}" == "4" ]]; then
- local readonly SADDR="${SADDR4}"
- local readonly DADDR="${DADDR4}"
- elif [[ "${IP}" == "6" ]]; then
- local readonly SADDR="${SADDR6}"
- local readonly DADDR="${DADDR6}"
- else
- echo "Invalid IP version ${IP}"
- exit 1
- fi
-
- local readonly START="$(date +%s%N --date="+ 0.1 seconds")"
-
- ip netns exec "${NS2}" "${BIN}" -"${IP}" -c "${CLOCK}" -t "${START}" -S "${SADDR}" -D "${DADDR}" "${RXARGS}" -r &
- ip netns exec "${NS1}" "${BIN}" -"${IP}" -c "${CLOCK}" -t "${START}" -S "${SADDR}" -D "${DADDR}" "${TXARGS}"
- wait "$!"
-}
-
-do_test() {
- run_test $@
- [ $? -ne 0 ] && ret=1
-}
-
-do_fail_test() {
- run_test $@
- [ $? -eq 0 ] && ret=1
-}
-
-ip netns exec "${NS1}" tc qdisc add dev "${DEV}" root fq
-set +e
-ret=0
-do_test 4 mono a,-1 a,-1
-do_test 6 mono a,0 a,0
-do_test 6 mono a,10 a,10
-do_test 4 mono a,10,b,20 a,10,b,20
-do_test 6 mono a,20,b,10 b,20,a,20
-
-if ip netns exec "${NS1}" tc qdisc replace dev "${DEV}" root etf clockid CLOCK_TAI delta 400000; then
- do_fail_test 4 tai a,-1 a,-1
- do_fail_test 6 tai a,0 a,0
- do_test 6 tai a,10 a,10
- do_test 4 tai a,10,b,20 a,10,b,20
- do_test 6 tai a,20,b,10 b,10,a,20
-else
- echo "tc ($(tc -V)) does not support qdisc etf. skipping"
- [ $ret -eq 0 ] && ret=$ksft_skip
-fi
-
-if [ $ret -eq 0 ]; then
- echo OK. All tests passed
-elif [[ $ret -ne $ksft_skip && -n "$KSFT_MACHINE_SLOW" ]]; then
- echo "Ignoring errors due to slow environment" 1>&2
- ret=0
-fi
-exit $ret
--
2.53.0.1213.gd9a14994de-goog
^ permalink raw reply related
* Re: [PATCH net-next v2 3/4] bpf-timestamp: keep track of the skb when wait_for_space occurs
From: Willem de Bruijn @ 2026-04-06 2:28 UTC (permalink / raw)
To: Jason Xing, davem, edumazet, kuba, pabeni, horms, willemb,
martin.lau
Cc: netdev, bpf, Jason Xing, Yushan Zhou
In-Reply-To: <20260404150452.83904-4-kerneljasonxing@gmail.com>
Jason Xing wrote:
> From: Jason Xing <kernelxing@tencent.com>
>
> The patch is the 1/2 part of push-level granularity feature.
>
> Tag the skb in tcp_sendmsg_locked() when wait_for_space occurs even
> though it might not carry the last byte of the sendmsg.
>
> Prior to the patch, BPF timestamping cannot cover this case:
> The following steps reproduce this:
> 1) skb A is the current last skb before entering wait_for_space process
> 2) tcp_push() pushes A without any tag
> 3) A is transmitted from TCP to driver without putting any skb carrying
> timestamps in the error queue, like SCHED, DRV/HARDWARE.
> 4) sk_stream_wait_memory() sleeps for a while and then returns with an
> error code. Note that the socket lock is released.
> 5) skb A finally gets acked and removed from the rtx queue.
> 6) continue with the rest of tcp_sendmsg_locked(): it will jump to(goto)
> 'do_error' label and then 'out' label.
> 7) at this moment, skb A turns out to be the last one in this send
> syscall, and miss the following tcp_bpf_tx_timestamp() opportunity
> before the final tcp_push()
> 8) BPF script fails to see any timestamps this time
>
> Signed-off-by: Yushan Zhou <katrinzhou@tencent.com>
> Signed-off-by: Jason Xing <kernelxing@tencent.com>
> ---
> net/ipv4/tcp.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index c603b90057f6..7d030a11d004 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -1400,9 +1400,11 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
> wait_for_space:
> set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
> tcp_remove_empty_skb(sk);
> - if (copied)
> + if (copied) {
> + tcp_bpf_tx_timestamp(sk);
> tcp_push(sk, flags & ~MSG_MORE, mss_now,
> TCP_NAGLE_PUSH, size_goal);
Now the number of skbs that will be tracked will be unpredictable,
varying based on memory pressure.
That sounds hard to use to me. Especially if these extra pushes
cannot be identified as such.
Perhaps if all skbs from the same sendmsg call can be identified,
that would help explain pattern in data resulting from these
uncommon extra data points.
> + }
>
> err = sk_stream_wait_memory(sk, &timeo);
> if (err != 0)
> --
> 2.41.3
>
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox