* Re: [PATCH net 00/14] Netfilter/IPVS fixes for net
From: Pablo Neira Ayuso @ 2026-04-16 7:25 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev, kuba, pabeni, edumazet, fw, horms
In-Reply-To: <20260416013101.221555-1-pablo@netfilter.org>
Hi,
I am preparing a v2 to address so AI generated comment, I should be
ready in a few hours.
Thanks.
On Thu, Apr 16, 2026 at 03:30:47AM +0200, Pablo Neira Ayuso wrote:
> Hi,
>
> The following patchset contains Netfilter/IPVS fixes for net: Mostly
> addressing very old bugs in the SIP conntrack helper string parser,
> unsafe arp_tables match support with legacy IEEE1394, restrict xt_realm
> to IPv4 and incorrect use of RCU lists in nat core and nftables. This
> batch also includes one IPVS MTU fix. The exception is a fix for a
> recent issue related to broken double-tagged vlan in the flowtable.
>
> 1) Fix possible stack recursion in nft_fwd_netdev from egress path,
> from Weiming Shi.
>
> 2) Fix unsafe port parser in SIP helper, from Jenny Guanni Qu.
>
> 3) Fix arp_tables match with IEEE1394 ARP payload, allowing to
> reach bytes off the skb boundary, from Weiming Shi.
>
> 4) Reject unsafe nfnetlink_osf configurations from control plane,
> this is addressing a possible division by zero, from Xiang Mei.
>
> 5) nft_osf actually only supports IPv4, restrict it.
>
> 6) Fix double-tagged-vlan support (again) in the flowtable, from
> Eric Woudstra.
>
> 7) Remove unsafe use of sprintf to fix possible buffer overflow
> in the SIP NAT helper, from Florian Westphal.
>
> 8) Restrict xt_mac, xt_owner and xt_physdev to inet families only;
> xt_realm is only for ipv4, otherwise null-pointer-deref is possible.
>
> 9) Use kfree_rcu() in nat core to release hooks, this can be an issue
> once nfnetlink_hook gets support to dump NAT hook information,
> not currently a real issue but better fix it now.
>
> 10) Fix MTU checks in IPVS, from Yingnan Zhang.
>
> 11) Use list_del_rcu() in chain and flowtable hook unregistration,
> concurrent RCU reader could be walking over the hook list,
> from Florian Westphal.
>
> 12) Add list_splice_rcu(), this is required to fix unsafe
> splice to RCU protected hook list. Reviewed by Paul McKenney.
>
> 13) Use list_splice_rcu() to splice new chain and flowtable hooks.
>
> 14) Add shim nft_trans_hook object to track chain and flowtable
> hook deletions and flag them as removed, instead of unsafely
> moving around hooks in the RCU-protected hook list. This allows
> to restore the previous state from the abort path.
>
> Please, pull these changes from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-04-16
>
> Thanks.
>
> ----------------------------------------------------------------
>
> The following changes since commit 2dddb34dd0d07b01fa770eca89480a4da4f13153:
>
> net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers (2026-04-12 15:22:58 -0700)
>
> are available in the Git repository at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-26-04-16
>
> for you to fetch changes up to e349f90da812aeddd22c3914a2cc639b51e4eb48:
>
> netfilter: nf_tables: add hook transactions for device deletions (2026-04-16 02:47:58 +0200)
>
> ----------------------------------------------------------------
> netfilter pull request 26-04-16
>
> ----------------------------------------------------------------
> Eric Woudstra (1):
> netfilter: nf_flow_table_ip: Introduce nf_flow_vlan_push()
>
> Florian Westphal (2):
> netfilter: conntrack: remove sprintf usage
> netfilter: nf_tables: use list_del_rcu for netlink hooks
>
> Jenny Guanni Qu (1):
> netfilter: nf_conntrack_sip: add bounds-checked port parsing helper
>
> Pablo Neira Ayuso (6):
> netfilter: nft_osf: restrict it to ipv4
> netfilter: xtables: restrict several matches to inet family
> netfilter: nat: use kfree_rcu to release ops
> rculist: add list_splice_rcu() for private lists
> netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase
> netfilter: nf_tables: add hook transactions for device deletions
>
> Weiming Shi (2):
> netfilter: nft_fwd_netdev: use recursion counter in neigh egress path
> netfilter: arp_tables: fix IEEE1394 ARP payload parsing in arp_packet_match()
>
> Xiang Mei (1):
> netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
>
> Yingnan Zhang (1):
> ipvs: fix MTU check for GSO packets in tunnel mode
>
> include/linux/rculist.h | 29 ++++++
> include/net/netfilter/nf_dup_netdev.h | 13 +++
> include/net/netfilter/nf_tables.h | 13 +++
> net/ipv4/netfilter/arp_tables.c | 14 ++-
> net/ipv4/netfilter/iptable_nat.c | 2 +-
> net/ipv6/netfilter/ip6table_nat.c | 2 +-
> net/netfilter/ipvs/ip_vs_xmit.c | 19 +++-
> net/netfilter/nf_conntrack_sip.c | 80 +++++++++++-----
> net/netfilter/nf_dup_netdev.c | 16 ----
> net/netfilter/nf_flow_table_ip.c | 25 ++++-
> net/netfilter/nf_nat_amanda.c | 2 +-
> net/netfilter/nf_nat_core.c | 10 +-
> net/netfilter/nf_nat_sip.c | 33 ++++---
> net/netfilter/nf_tables_api.c | 168 ++++++++++++++++++++++++----------
> net/netfilter/nfnetlink_osf.c | 4 +
> net/netfilter/nft_fwd_netdev.c | 7 ++
> net/netfilter/nft_osf.c | 6 +-
> net/netfilter/xt_mac.c | 34 ++++---
> net/netfilter/xt_owner.c | 37 +++++---
> net/netfilter/xt_physdev.c | 29 ++++--
> net/netfilter/xt_realm.c | 2 +-
> 21 files changed, 393 insertions(+), 152 deletions(-)
>
^ permalink raw reply
* [PATCH net v3 0/3] net: airoha: Fix airoha_qdma_cleanup_tx_queue() processing
From: Lorenzo Bianconi @ 2026-04-16 7:27 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Lorenzo Bianconi, Simon Horman
Cc: linux-arm-kernel, linux-mediatek, netdev
Add missing bits in airoha_qdma_cleanup_tx_queue routine.
Fix airoha_qdma_cleanup_tx_queue processing errors intorduced in commit
'3f47e67dff1f7 ("net: airoha: Add the capability to consume out-of-order
DMA tx descriptors")'.
---
Changes in v3:
- Move ndesc initialization fix in a dedicated patch.
- Add patch 2/3 to move entries to queue head in case of DMA mapping
failure in airoha_dev_xmit().
- Cosmetics.
- Link to v2: https://lore.kernel.org/r/20260414-airoha_qdma_cleanup_tx_queue-fix-net-v2-1-875de57cc022@kernel.org
Changes in v2:
- Move q->ndesc initialization at end of airoha_qdma_init_tx routine in
order to avoid any possible NULL pointer dereference in
airoha_qdma_cleanup_tx_queue()
- Check if q->tx_list is empty in airoha_qdma_cleanup_tx_queue()
- Link to v1: https://lore.kernel.org/r/20260410-airoha_qdma_cleanup_tx_queue-fix-net-v1-1-b7171c8f1e78@kernel.org
---
Lorenzo Bianconi (3):
net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx()
net: airoha: Move entries to queue head in case of DMA mapping failure in airoha_dev_xmit()
net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()
drivers/net/ethernet/airoha/airoha_eth.c | 42 ++++++++++++++++++++++++++------
1 file changed, 35 insertions(+), 7 deletions(-)
---
base-commit: 3f20012a3964f487ae1e9ff942e2f35d4e9595bf
change-id: 20260410-airoha_qdma_cleanup_tx_queue-fix-net-93375f5ee80f
Best regards,
--
Lorenzo Bianconi <lorenzo@kernel.org>
^ permalink raw reply
* [PATCH net v3 1/3] net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx()
From: Lorenzo Bianconi @ 2026-04-16 7:27 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Lorenzo Bianconi, Simon Horman
Cc: linux-arm-kernel, linux-mediatek, netdev
In-Reply-To: <20260416-airoha_qdma_cleanup_tx_queue-fix-net-v3-0-2b69f5788580@kernel.org>
If queue entry list allocation fails in airoha_qdma_init_tx_queue routine,
airoha_qdma_cleanup_tx_queue() will trigger a NULL pointer dereference
accessing the queue entry array. The issue is due to the early ndesc
initialization in airoha_qdma_init_tx_queue(). Fix the issue moving ndesc
initialization at end of airoha_qdma_init_tx routine.
Fixes: 3f47e67dff1f7 ("net: airoha: Add the capability to consume out-of-order DMA tx descriptors")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
drivers/net/ethernet/airoha/airoha_eth.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/airoha/airoha_eth.c b/drivers/net/ethernet/airoha/airoha_eth.c
index e1ab15f1ee7d..690bfaf8d7d9 100644
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
@@ -954,27 +954,27 @@ static int airoha_qdma_init_tx_queue(struct airoha_queue *q,
dma_addr_t dma_addr;
spin_lock_init(&q->lock);
- q->ndesc = size;
q->qdma = qdma;
q->free_thr = 1 + MAX_SKB_FRAGS;
INIT_LIST_HEAD(&q->tx_list);
- q->entry = devm_kzalloc(eth->dev, q->ndesc * sizeof(*q->entry),
+ q->entry = devm_kzalloc(eth->dev, size * sizeof(*q->entry),
GFP_KERNEL);
if (!q->entry)
return -ENOMEM;
- q->desc = dmam_alloc_coherent(eth->dev, q->ndesc * sizeof(*q->desc),
+ q->desc = dmam_alloc_coherent(eth->dev, size * sizeof(*q->desc),
&dma_addr, GFP_KERNEL);
if (!q->desc)
return -ENOMEM;
- for (i = 0; i < q->ndesc; i++) {
+ for (i = 0; i < size; i++) {
u32 val = FIELD_PREP(QDMA_DESC_DONE_MASK, 1);
list_add_tail(&q->entry[i].list, &q->tx_list);
WRITE_ONCE(q->desc[i].ctrl, cpu_to_le32(val));
}
+ q->ndesc = size;
/* xmit ring drop default setting */
airoha_qdma_set(qdma, REG_TX_RING_BLOCKING(qid),
--
2.53.0
^ permalink raw reply related
* [PATCH net v3 2/3] net: airoha: Move entries to queue head in case of DMA mapping failure in airoha_dev_xmit()
From: Lorenzo Bianconi @ 2026-04-16 7:27 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Lorenzo Bianconi, Simon Horman
Cc: linux-arm-kernel, linux-mediatek, netdev
In-Reply-To: <20260416-airoha_qdma_cleanup_tx_queue-fix-net-v3-0-2b69f5788580@kernel.org>
In order to respect the original descriptor order and avoid any
potential IOMMU fault or memory corruption, move pending queue entries
to the head of hw queue tx_list if the DMA mapping of current inflight
packet fails in airoha_dev_xmit routine.
Fixes: 3f47e67dff1f7 ("net: airoha: Add the capability to consume out-of-order DMA tx descriptors")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
drivers/net/ethernet/airoha/airoha_eth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/airoha/airoha_eth.c b/drivers/net/ethernet/airoha/airoha_eth.c
index 690bfaf8d7d9..dfe8a0bd2abd 100644
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
@@ -2053,7 +2053,7 @@ static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb,
dma_unmap_single(dev->dev.parent, e->dma_addr, e->dma_len,
DMA_TO_DEVICE);
e->dma_addr = 0;
- list_move_tail(&e->list, &q->tx_list);
+ list_move(&e->list, &q->tx_list);
}
spin_unlock_bh(&q->lock);
--
2.53.0
^ permalink raw reply related
* [PATCH net v3 3/3] net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()
From: Lorenzo Bianconi @ 2026-04-16 7:27 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Lorenzo Bianconi, Simon Horman
Cc: linux-arm-kernel, linux-mediatek, netdev
In-Reply-To: <20260416-airoha_qdma_cleanup_tx_queue-fix-net-v3-0-2b69f5788580@kernel.org>
Similar to airoha_qdma_cleanup_rx_queue(), reset DMA TX descriptors in
airoha_qdma_cleanup_tx_queue routine. Moreover, reset TX_DMA_IDX to
TX_CPU_IDX to notify the NIC the QDMA TX ring is empty.
Fixes: 23020f0493270 ("net: airoha: Introduce ethernet support for EN7581 SoC")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
drivers/net/ethernet/airoha/airoha_eth.c | 32 ++++++++++++++++++++++++++++++--
1 file changed, 30 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/airoha/airoha_eth.c b/drivers/net/ethernet/airoha/airoha_eth.c
index dfe8a0bd2abd..903682e88e89 100644
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
@@ -1039,12 +1039,15 @@ static int airoha_qdma_init_tx(struct airoha_qdma *qdma)
static void airoha_qdma_cleanup_tx_queue(struct airoha_queue *q)
{
- struct airoha_eth *eth = q->qdma->eth;
- int i;
+ struct airoha_qdma *qdma = q->qdma;
+ struct airoha_eth *eth = qdma->eth;
+ int i, qid = q - &qdma->q_tx[0];
+ u16 index = 0;
spin_lock_bh(&q->lock);
for (i = 0; i < q->ndesc; i++) {
struct airoha_queue_entry *e = &q->entry[i];
+ struct airoha_qdma_desc *desc = &q->desc[i];
if (!e->dma_addr)
continue;
@@ -1055,8 +1058,33 @@ static void airoha_qdma_cleanup_tx_queue(struct airoha_queue *q)
e->dma_addr = 0;
e->skb = NULL;
list_add_tail(&e->list, &q->tx_list);
+
+ /* Reset DMA descriptor */
+ WRITE_ONCE(desc->ctrl, 0);
+ WRITE_ONCE(desc->addr, 0);
+ WRITE_ONCE(desc->data, 0);
+ WRITE_ONCE(desc->msg0, 0);
+ WRITE_ONCE(desc->msg1, 0);
+ WRITE_ONCE(desc->msg2, 0);
+
q->queued--;
}
+
+ if (!list_empty(&q->tx_list)) {
+ struct airoha_queue_entry *e;
+
+ e = list_first_entry(&q->tx_list, struct airoha_queue_entry,
+ list);
+ index = e - q->entry;
+ }
+ /* Set TX_DMA_IDX to TX_CPU_IDX to notify the hw the QDMA TX ring is
+ * empty.
+ */
+ airoha_qdma_rmw(qdma, REG_TX_CPU_IDX(qid), TX_RING_CPU_IDX_MASK,
+ FIELD_PREP(TX_RING_CPU_IDX_MASK, index));
+ airoha_qdma_rmw(qdma, REG_TX_DMA_IDX(qid), TX_RING_DMA_IDX_MASK,
+ FIELD_PREP(TX_RING_DMA_IDX_MASK, index));
+
spin_unlock_bh(&q->lock);
}
--
2.53.0
^ permalink raw reply related
* Re: [PATCH net] net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops
From: Maxime Chevallier @ 2026-04-16 7:34 UTC (permalink / raw)
To: Stanislav Fomichev, netdev
Cc: davem, edumazet, kuba, pabeni, andrew, olteanv, horms, sdf,
linux-kernel
In-Reply-To: <20260414231035.1917035-1-sdf@fomichev.me>
Hi Stanislav,
On 15/04/2026 01:10, Stanislav Fomichev wrote:
> DSA replaces the conduit (master) device's ethtool_ops with its own
> wrappers that aggregate stats from both the conduit and DSA switch
> ports. Taking the lock again inside the DSA wrappers causes a deadlock.
>
> Stumbled upon this when booting qemu with fbnic and CONFIG_NET_DSA_LOOP=y
> (which looks like some kind of testing device that auto-populates the ports
> of eth0). `ethtool -i` is enough to deadlock. This means we have basically zero
> coverage for DSA stuff with real ops locked devs.
True, indeed I don't have physical devices here with locked ops, looking
at the current devices that use it (fbnic, bnxt, gve, mlx5, bnge) that's
not too surprising, I don't think these are often used with DSA.
>
> Remove the redundant netdev_lock_ops()/netdev_unlock_ops() calls from
> the DSA conduit ethtool wrappers.
>
> Cc: Maxime Chevallier <maxime.chevallier@bootlin.com>
> Fixes: 2bcf4772e45a ("net: ethtool: try to protect all callback with netdev instance lock")
> Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
> (cherry picked from commit 1538c00ab3212273240112bd53692d54d95f2dd5)
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Maxime
> ---
> net/dsa/conduit.c | 16 +---------------
> 1 file changed, 1 insertion(+), 15 deletions(-)
>
> diff --git a/net/dsa/conduit.c b/net/dsa/conduit.c
> index a1b044467bd6..8398d72d7e4d 100644
> --- a/net/dsa/conduit.c
> +++ b/net/dsa/conduit.c
> @@ -27,9 +27,7 @@ static int dsa_conduit_get_regs_len(struct net_device *dev)
> int len;
>
> if (ops && ops->get_regs_len) {
> - netdev_lock_ops(dev);
> len = ops->get_regs_len(dev);
> - netdev_unlock_ops(dev);
> if (len < 0)
> return len;
> ret += len;
> @@ -60,15 +58,11 @@ static void dsa_conduit_get_regs(struct net_device *dev,
> int len;
>
> if (ops && ops->get_regs_len && ops->get_regs) {
> - netdev_lock_ops(dev);
> len = ops->get_regs_len(dev);
> - if (len < 0) {
> - netdev_unlock_ops(dev);
> + if (len < 0)
> return;
> - }
> regs->len = len;
> ops->get_regs(dev, regs, data);
> - netdev_unlock_ops(dev);
> data += regs->len;
> }
>
> @@ -115,10 +109,8 @@ static void dsa_conduit_get_ethtool_stats(struct net_device *dev,
> int count, mcount = 0;
>
> if (ops && ops->get_sset_count && ops->get_ethtool_stats) {
> - netdev_lock_ops(dev);
> mcount = ops->get_sset_count(dev, ETH_SS_STATS);
> ops->get_ethtool_stats(dev, stats, data);
> - netdev_unlock_ops(dev);
> }
>
> list_for_each_entry(dp, &dst->ports, list) {
> @@ -149,10 +141,8 @@ static void dsa_conduit_get_ethtool_phy_stats(struct net_device *dev,
> if (count >= 0)
> phy_ethtool_get_stats(dev->phydev, stats, data);
> } else if (ops && ops->get_sset_count && ops->get_ethtool_phy_stats) {
> - netdev_lock_ops(dev);
> count = ops->get_sset_count(dev, ETH_SS_PHY_STATS);
> ops->get_ethtool_phy_stats(dev, stats, data);
> - netdev_unlock_ops(dev);
> }
>
> if (count < 0)
> @@ -176,13 +166,11 @@ static int dsa_conduit_get_sset_count(struct net_device *dev, int sset)
> struct dsa_switch_tree *dst = cpu_dp->dst;
> int count = 0;
>
> - netdev_lock_ops(dev);
> if (sset == ETH_SS_PHY_STATS && dev->phydev &&
> (!ops || !ops->get_ethtool_phy_stats))
> count = phy_ethtool_get_sset_count(dev->phydev);
> else if (ops && ops->get_sset_count)
> count = ops->get_sset_count(dev, sset);
> - netdev_unlock_ops(dev);
>
> if (count < 0)
> count = 0;
> @@ -239,7 +227,6 @@ static void dsa_conduit_get_strings(struct net_device *dev, u32 stringset,
> struct dsa_switch_tree *dst = cpu_dp->dst;
> int count, mcount = 0;
>
> - netdev_lock_ops(dev);
> if (stringset == ETH_SS_PHY_STATS && dev->phydev &&
> !ops->get_ethtool_phy_stats) {
> mcount = phy_ethtool_get_sset_count(dev->phydev);
> @@ -253,7 +240,6 @@ static void dsa_conduit_get_strings(struct net_device *dev, u32 stringset,
> mcount = 0;
> ops->get_strings(dev, stringset, data);
> }
> - netdev_unlock_ops(dev);
>
> list_for_each_entry(dp, &dst->ports, list) {
> if (!dsa_port_is_dsa(dp) && !dsa_port_is_cpu(dp))
^ permalink raw reply
* Re: [syzbot ci] Re: net: tunnel: fix stale transport header after GRE/TEB decap
From: Jiayuan Chen @ 2026-04-16 7:49 UTC (permalink / raw)
To: davem, dsahern, edumazet, horms, kuba, linux-kernel, netdev,
pabeni, pshelar, syzbot, tom
Cc: syzkaller-bugs
In-Reply-To: <69e08a0a.a70a0220.259bc5.0019.GAE@google.com>
On 4/16/26 3:04 PM, syzbot ci wrote:
> syzbot ci has tested the following series
>
> [v1] net: tunnel: fix stale transport header after GRE/TEB decap
> https://lore.kernel.org/all/20260416034610.8873-1-jiayuan.chen@linux.dev
> * [PATCH net v1 1/2] net: tunnel: fix stale transport header after GRE/TEB decap
> * [PATCH net-next v1 2/2] net: add DEBUG_NET_WARN_ON_ONCE for negative transport offset
>
> and found the following issue:
> WARNING in udpv6_err
>
> Full report is available here:
> https://ci.syzbot.org/series/3886f2f1-a6d5-4c5c-8dc8-bc1cec577567
>
> ***
>
> WARNING in udpv6_err
>
> tree: net
> URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/net.git
> base: 1f5ffc672165ff851063a5fd044b727ab2517ae3
> arch: amd64
> compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
> config: https://ci.syzbot.org/builds/06cf41a2-60fe-4f9b-8f68-57eb6d1e48cc/config
>
> ------------[ cut here ]------------
> off < 0
> WARNING: ./include/linux/skbuff.h:3239 at udpv6_err+0x1521/0x16d0, CPU#0: kworker/u9:2/51
> Modules linked in:
icmpv6_rcv
pskb_pull ==> skb_transport_offset() = -8
icmpv6_notify
udpv6_err
__udp6_lib_err_encap(skb) ==> WARNING
^ permalink raw reply
* [PATCH bpf-next v4 0/6] bpf: decap flags and GSO state updates
From: Nick Hudson @ 2026-04-16 7:55 UTC (permalink / raw)
To: bpf, netdev, Willem de Bruijn, Martin KaFai Lau
Cc: Nick Hudson, Max Tottenham, Anna Glasgall
This series extends bpf_skb_adjust_room() with decapsulation-specific
flags and tunnel GSO state updates for decap use cases.
Motivation
----------
When BPF decapsulates tunneled packets, skb GSO state needs to be updated
to match the removed tunnel layer. This includes clearing the corresponding
tunnel GSO type bits and resetting encapsulation state once no tunnel GSO
flags remain.
Series Overview
---------------
- Name the adjust_room flag enum for CO-RE lookups.
- Refactor adjust_room helper masks for maintainable validation logic.
- Add new DECAP flags to UAPI.
- Add guard rails for incompatible/invalid decap flag combinations.
- Implement decap GSO flag clearing.
- Add selftests to validate decap GSO state transitions.
Changes v3 -> v4:
- Patch 5: drop SKB_GSO_TUNNEL_REMCSUM handling from this series.
- Patch 5: clear encap_hdr_csum and remcsum_offload directly on UDP decap.
Changes v2 -> v3:
- Add a new selftests patch to validate decap GSO state behavior.
- Reorder the series so helper-mask refactoring precedes UAPI DECAP flag additions.
- Refresh patch 2 and patch 3 split to keep refactoring behavior-neutral.
- Patch 5: add decap tunnel GSO-state checks in
"bpf: clear decap tunnel GSO state in skb_adjust_room" (per Gemini/sashiko).
Changes v1 -> v2:
- Patch 3: decap flag acceptance intentionally remains L3-only while adding helper masks.
- Patch 4: decap with L4/IPXIP support enabled with guard rails.
Co-developed-by: Max Tottenham <mtottenh@akamai.com>
Signed-off-by: Max Tottenham <mtottenh@akamai.com>
Co-developed-by: Anna Glasgall <aglasgal@akamai.com>
Signed-off-by: Anna Glasgall <aglasgal@akamai.com>
Signed-off-by: Nick Hudson <nhudson@akamai.com>
Nick Hudson (6):
bpf: name the enum for BPF_FUNC_skb_adjust_room flags
bpf: refactor masks for ADJ_ROOM flags and encap validation
bpf: add BPF_F_ADJ_ROOM_DECAP_* flags for tunnel decapsulation
bpf: allow new DECAP flags and add guard rails
bpf: clear decap tunnel GSO state in skb_adjust_room
selftests/bpf: tc_tunnel validate decap GSO state
include/uapi/linux/bpf.h | 36 +++++-
net/core/filter.c | 118 +++++++++++++++---
tools/include/uapi/linux/bpf.h | 36 +++++-
.../selftests/bpf/progs/test_tc_tunnel.c | 58 +++++++++
4 files changed, 225 insertions(+), 23 deletions(-)
--
2.34.1
^ permalink raw reply
* [PATCH bpf-next v4 2/6] bpf: refactor masks for ADJ_ROOM flags and encap validation
From: Nick Hudson @ 2026-04-16 7:55 UTC (permalink / raw)
To: bpf, netdev, Willem de Bruijn, Martin KaFai Lau
Cc: Nick Hudson, Max Tottenham, Anna Glasgall, Daniel Borkmann,
Alexei Starovoitov, Andrii Nakryiko, Eduard Zingerman,
Kumar Kartikeya Dwivedi, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, linux-kernel
In-Reply-To: <20260416075514.927101-1-nhudson@akamai.com>
Refactor the helper masks for bpf_skb_adjust_room() flags to simplify
validation logic and introduce:
- BPF_F_ADJ_ROOM_ENCAP_MASK
- BPF_F_ADJ_ROOM_DECAP_MASK
Refactor existing validation checks in bpf_skb_net_shrink()
and bpf_skb_adjust_room() to use the new masks (no behavior change).
This is in preparation for supporting the new decap flags.
Co-developed-by: Max Tottenham <mtottenh@akamai.com>
Signed-off-by: Max Tottenham <mtottenh@akamai.com>
Co-developed-by: Anna Glasgall <aglasgal@akamai.com>
Signed-off-by: Anna Glasgall <aglasgal@akamai.com>
Signed-off-by: Nick Hudson <nhudson@akamai.com>
---
---
net/core/filter.c | 38 +++++++++++++++++++++-----------------
1 file changed, 21 insertions(+), 17 deletions(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index 78b548158fb0..4e860da4381d 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3490,14 +3490,19 @@ static u32 bpf_skb_net_base_len(const struct sk_buff *skb)
#define BPF_F_ADJ_ROOM_DECAP_L3_MASK (BPF_F_ADJ_ROOM_DECAP_L3_IPV4 | \
BPF_F_ADJ_ROOM_DECAP_L3_IPV6)
-#define BPF_F_ADJ_ROOM_MASK (BPF_F_ADJ_ROOM_FIXED_GSO | \
- BPF_F_ADJ_ROOM_ENCAP_L3_MASK | \
+#define BPF_F_ADJ_ROOM_ENCAP_MASK (BPF_F_ADJ_ROOM_ENCAP_L3_MASK | \
BPF_F_ADJ_ROOM_ENCAP_L4_GRE | \
BPF_F_ADJ_ROOM_ENCAP_L4_UDP | \
BPF_F_ADJ_ROOM_ENCAP_L2_ETH | \
BPF_F_ADJ_ROOM_ENCAP_L2( \
- BPF_ADJ_ROOM_ENCAP_L2_MASK) | \
- BPF_F_ADJ_ROOM_DECAP_L3_MASK)
+ BPF_ADJ_ROOM_ENCAP_L2_MASK))
+
+#define BPF_F_ADJ_ROOM_DECAP_MASK (BPF_F_ADJ_ROOM_DECAP_L3_MASK)
+
+#define BPF_F_ADJ_ROOM_MASK (BPF_F_ADJ_ROOM_FIXED_GSO | \
+ BPF_F_ADJ_ROOM_ENCAP_MASK | \
+ BPF_F_ADJ_ROOM_DECAP_MASK | \
+ BPF_F_ADJ_ROOM_NO_CSUM_RESET)
static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
u64 flags)
@@ -3618,8 +3623,8 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 off, u32 len_diff,
{
int ret;
- if (unlikely(flags & ~(BPF_F_ADJ_ROOM_FIXED_GSO |
- BPF_F_ADJ_ROOM_DECAP_L3_MASK |
+ if (unlikely(flags & ~(BPF_F_ADJ_ROOM_DECAP_MASK |
+ BPF_F_ADJ_ROOM_FIXED_GSO |
BPF_F_ADJ_ROOM_NO_CSUM_RESET)))
return -EINVAL;
@@ -3715,8 +3720,7 @@ BPF_CALL_4(bpf_skb_adjust_room, struct sk_buff *, skb, s32, len_diff,
u32 off;
int ret;
- if (unlikely(flags & ~(BPF_F_ADJ_ROOM_MASK |
- BPF_F_ADJ_ROOM_NO_CSUM_RESET)))
+ if (unlikely(flags & ~BPF_F_ADJ_ROOM_MASK))
return -EINVAL;
if (unlikely(len_diff_abs > 0xfffU))
return -EFAULT;
@@ -3735,20 +3739,20 @@ BPF_CALL_4(bpf_skb_adjust_room, struct sk_buff *, skb, s32, len_diff,
return -ENOTSUPP;
}
- if (flags & BPF_F_ADJ_ROOM_DECAP_L3_MASK) {
+ if (flags & BPF_F_ADJ_ROOM_DECAP_MASK) {
if (!shrink)
return -EINVAL;
- switch (flags & BPF_F_ADJ_ROOM_DECAP_L3_MASK) {
- case BPF_F_ADJ_ROOM_DECAP_L3_IPV4:
+ /* Reject mutually exclusive decap flag pairs. */
+ if ((flags & BPF_F_ADJ_ROOM_DECAP_L3_MASK) ==
+ BPF_F_ADJ_ROOM_DECAP_L3_MASK)
+ return -EINVAL;
+
+ if (flags & BPF_F_ADJ_ROOM_DECAP_L3_IPV4)
len_min = sizeof(struct iphdr);
- break;
- case BPF_F_ADJ_ROOM_DECAP_L3_IPV6:
+
+ if (flags & BPF_F_ADJ_ROOM_DECAP_L3_IPV6)
len_min = sizeof(struct ipv6hdr);
- break;
- default:
- return -EINVAL;
- }
}
len_cur = skb->len - skb_network_offset(skb);
--
2.34.1
^ permalink raw reply related
* [PATCH bpf-next v4 5/6] bpf: clear decap tunnel GSO state in skb_adjust_room
From: Nick Hudson @ 2026-04-16 7:55 UTC (permalink / raw)
To: bpf, netdev, Willem de Bruijn, Martin KaFai Lau
Cc: Nick Hudson, Max Tottenham, Anna Glasgall, Daniel Borkmann,
Alexei Starovoitov, Andrii Nakryiko, Eduard Zingerman,
Kumar Kartikeya Dwivedi, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, linux-kernel
In-Reply-To: <20260416075514.927101-1-nhudson@akamai.com>
On shrink in bpf_skb_adjust_room(), clear tunnel-specific GSO flags
according to the decapsulation flags:
- BPF_F_ADJ_ROOM_DECAP_L4_UDP clears SKB_GSO_UDP_TUNNEL{,_CSUM}
- BPF_F_ADJ_ROOM_DECAP_L4_GRE clears SKB_GSO_GRE{,_CSUM}
- BPF_F_ADJ_ROOM_DECAP_IPXIP4 clears SKB_GSO_IPXIP4
- BPF_F_ADJ_ROOM_DECAP_IPXIP6 clears SKB_GSO_IPXIP6
When all tunnel-related GSO bits are cleared, also clear
skb->encapsulation.
Handle the ESP inside a UDP tunnel case where encapsulation should remain
set.
If UDP decap is performed, clear encap_hdr_csum and remcsum_offload.
Co-developed-by: Max Tottenham <mtottenh@akamai.com>
Signed-off-by: Max Tottenham <mtottenh@akamai.com>
Co-developed-by: Anna Glasgall <aglasgal@akamai.com>
Signed-off-by: Anna Glasgall <aglasgal@akamai.com>
Signed-off-by: Nick Hudson <nhudson@akamai.com>
---
net/core/filter.c | 38 ++++++++++++++++++++++++++++++++++++++
1 file changed, 38 insertions(+)
diff --git a/net/core/filter.c b/net/core/filter.c
index 7f8d43420afb..e113ae2f3f14 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3667,6 +3667,44 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 off, u32 len_diff,
if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO))
skb_increase_gso_size(shinfo, len_diff);
+ /* Selective GSO flag clearing based on decap type.
+ * Only clear the flags for the tunnel layer being removed.
+ */
+ if ((flags & BPF_F_ADJ_ROOM_DECAP_L4_UDP) &&
+ (shinfo->gso_type & (SKB_GSO_UDP_TUNNEL |
+ SKB_GSO_UDP_TUNNEL_CSUM)))
+ shinfo->gso_type &= ~(SKB_GSO_UDP_TUNNEL |
+ SKB_GSO_UDP_TUNNEL_CSUM);
+ if ((flags & BPF_F_ADJ_ROOM_DECAP_L4_GRE) &&
+ (shinfo->gso_type & (SKB_GSO_GRE | SKB_GSO_GRE_CSUM)))
+ shinfo->gso_type &= ~(SKB_GSO_GRE |
+ SKB_GSO_GRE_CSUM);
+ if ((flags & BPF_F_ADJ_ROOM_DECAP_IPXIP4) &&
+ (shinfo->gso_type & SKB_GSO_IPXIP4))
+ shinfo->gso_type &= ~SKB_GSO_IPXIP4;
+ if ((flags & BPF_F_ADJ_ROOM_DECAP_IPXIP6) &&
+ (shinfo->gso_type & SKB_GSO_IPXIP6))
+ shinfo->gso_type &= ~SKB_GSO_IPXIP6;
+
+ /* Clear encapsulation flag only when no tunnel GSO flags remain */
+ if (flags & (BPF_F_ADJ_ROOM_DECAP_L4_MASK |
+ BPF_F_ADJ_ROOM_DECAP_IPXIP_MASK)) {
+ if (!(shinfo->gso_type & (SKB_GSO_UDP_TUNNEL |
+ SKB_GSO_UDP_TUNNEL_CSUM |
+ SKB_GSO_GRE |
+ SKB_GSO_GRE_CSUM |
+ SKB_GSO_IPXIP4 |
+ SKB_GSO_IPXIP6 |
+ SKB_GSO_ESP)))
+ if (skb->encapsulation)
+ skb->encapsulation = 0;
+
+ if (flags & BPF_F_ADJ_ROOM_DECAP_L4_UDP) {
+ skb->encap_hdr_csum = 0;
+ skb->remcsum_offload = 0;
+ }
+ }
+
/* Header must be checked, and gso_segs recomputed. */
shinfo->gso_type |= SKB_GSO_DODGY;
shinfo->gso_segs = 0;
--
2.34.1
^ permalink raw reply related
* Re: [PATCH v12 net-next 00/11] nbl driver for Nebulamatrix NICs
From: Paolo Abeni @ 2026-04-16 8:01 UTC (permalink / raw)
To: illusion.wang, netdev; +Cc: open list
In-Reply-To: <20260415033608.2438-1-illusion.wang@nebula-matrix.com>
On 4/15/26 10:29 AM, illusion.wang wrote:
> This patch series represents the first phase. We plan to integrate it in
> two phases: the first phase covers mailbox and chip configuration,
> while the second phase involves net dev configuration.
> Together, they will provide basic PF-based Ethernet port transmission and
> reception capabilities.
>
> After that, we will consider other features, such as ethtool support,
> flow management, adminq messaging, VF support, debugfs support, etc.
>
> changes v11->v12
> Link to v10:https://lore.kernel.org/netdev/20260408093739.56001-1-illusion.wang@nebula-matrix.com/
> AI review issues
> changes v10->v11
> Link to v10:https://lore.kernel.org/netdev/20260401022318.28550-1-illusion.wang@nebula-matrix.com/
> 1.Issues found by Mohsin
> 2.AI review issues
> changes v9->v10
> Link to v9:https://lore.kernel.org/netdev/20260325040048.2313-1-illusion.wang@nebula-matrix.com/
> 1.Issues found by Jakub
> 2.AI review issue
> changes v8->v9
> Link to v8:https://lore.kernel.org/netdev/20260317034533.5600-1-illusion.wang@nebula-matrix.com/
> 1.Issues found by Jakub
> 2.AI review issue
> Changes v7→v8
> Link to v7:https://lore.kernel.org/netdev/20260310120959.22015-1-illusion.wang@nebula-matrix.com/
> 1.Issues found by Paolo
> Changes v6->v7
> Link to v6:https://lore.kernel.org/netdev/20260306033451.5196-1-illusion.wang@nebula-matrix.com/
> 1.Issue found by Jakub
> 2.AI review issue
> Changes v5->v6
> Link to V5:https://lore.kernel.org/netdev/20260226073840.3222-1-illusion.wang@nebula-matrix.com/
> 1.put all standard linux includes files the .c file which needs it & others
> --Andrew
> 2.AI review issue
> Changes v4->v5
> Link to V4:https://lore.kernel.org/netdev/20260206021608.85381-1-illusion.wang@nebula-matrix.com/
> 1.change nbl_core to nbl & change ** pointers to *pointers & others
> --Andrew
> 2.AI review issue
> Changes v3->v4
> Link to v3: https://lore.kernel.org/netdev/20260123011804.31263-1-illusion.wang@nebula-matrix.com
> 1.cut down to part of a mini driver(mailbox and chip init)
> --Jakub Kicinski Simon Horman(some sort of staged approached)
> 2.modify issues found by ai.
> 3. Reverse Christmas tree/nbl_err/devm_kfree/remove some macros/
> void type to real type/others
> --Andrew Lunn
> 4.change deprecated pci_enable_msix_range to pci_alloc_irq_vectors
> 5.delete service layer
> 6.the style of kconfig---Randy Dunlap
> 7.add to Documentation/networking/device_drivers/ethernet/index.rst
> --Simon Horman
> Changes v2 →v3
> Link to v2: https://lore.kernel.org/netdev/20260109100146.63569-1-illusion.wang@nebula-matrix.com/
> 1.cut down to a mini driver:
> delete vf support
> use promisc mode to cut down flow management
> drop patch15 in v2
> delete adminq msg
> delete abnormal handling
> delete some unimportant interfaces
> 2.modify issues found by ai review
> Changes v1->v2
> Link to v1: https://lore.kernel.org/netdev/20251223035113.31122-1-illusion.wang@nebula-matrix.com/
> 1.Format Issues and Compilation Issues
> - Paolo Abeni
> 2.add sysfs patch and drop coexisting patch
> - Andrew Lunn
> 3.delete some unimportant ndo operations
> 4.add machine generated headers patch
> 5.Modify the issues found in patch1-2 and apply the same fixes to other
> patches
> 6.modify issues found by nipa
## Form letter - net-next-closed
We have already submitted our pull request with net-next material for
v7.1, and therefore net-next is closed for new drivers, features, code
refactoring and optimizations. We are currently accepting bug fixes only.
Please repost when net-next reopens after Apr 26th.
RFC patches sent for review only are obviously welcome at any time.
See:
https://www.kernel.org/doc/html/next/process/maintainer-netdev.html#development-cycle
^ permalink raw reply
* Re: [PATCH net-next v7 0/7] net: bcmgenet: add XDP support
From: Paolo Abeni @ 2026-04-16 8:06 UTC (permalink / raw)
To: Nicolai Buchwitz, netdev
Cc: Justin Chen, Simon Horman, Mohsin Bashir, Doug Berger,
Florian Fainelli, Broadcom internal kernel review list,
Andrew Lunn, Eric Dumazet, Alexei Starovoitov, Daniel Borkmann,
David S. Miller, Jakub Kicinski, Jesper Dangaard Brouer,
John Fastabend, Stanislav Fomichev, bpf
In-Reply-To: <20260416054743.1289191-1-nb@tipi-net.de>
On 4/16/26 7:47 AM, Nicolai Buchwitz wrote:
> Add XDP support to the bcmgenet driver, covering XDP_PASS, XDP_DROP,
> XDP_TX, XDP_REDIRECT, and ndo_xdp_xmit.
>
> The first patch converts the RX path from the existing kmalloc-based
> allocation to page_pool, which is a prerequisite for XDP. The remaining
> patches incrementally add XDP functionality and per-action statistics.
>
> Tested on Raspberry Pi CM4 (BCM2711, bcmgenet, 1Gbps link):
> - XDP_PASS: 943 Mbit/s TX, 935 Mbit/s RX (no regression vs baseline)
> - XDP_PASS latency: 0.164ms avg, 0% packet loss
> - XDP_DROP: all inbound traffic blocked as expected
> - XDP_TX: TX counter increments (packet reflection working)
> - Link flap with XDP attached: no errors
> - Program swap under iperf3 load: no errors
> - Upstream XDP selftests (xdp.py): pass_sb, drop_sb, tx_sb passing
> - XDP-based EtherCAT master (~37 kHz cycle rate, all packet processing
> in BPF/XDP), stable over multiple days
## Form letter - net-next-closed
We have already submitted our pull request with net-next material for
v7.1, and therefore net-next is closed for new drivers, features, code
refactoring and optimizations. We are currently accepting bug fixes only.
Please repost when net-next reopens after Apr 26th.
RFC patches sent for review only are obviously welcome at any time.
See:
https://www.kernel.org/doc/html/next/process/maintainer-netdev.html#development-cycle
^ permalink raw reply
* Re: [PATCHv3] selftests: Use ktap helpers for runner.sh
From: Qingfang Deng @ 2026-04-16 8:07 UTC (permalink / raw)
To: Hangbin Liu; +Cc: Brendan Jackman, Shuah Khan, linux-kselftest, netdev
Hi, Hangbin
This patch broke selftests run with `make -C tools/testing/selftests` as
make uses /bin/sh by default:
/bin/sh: 5:
/home/qf/linux-next/tools/testing/selftests/kselftest/runner.sh: Bad
substitution
Add `SHELL := /bin/bash` to the start of lib.mk to fix this.
^ permalink raw reply
* Re: [PATCH net 1/3] octeontx2-af: npc: cn20k: Handle npc_mcam_idx_2_key_type() failures
From: Dan Carpenter @ 2026-04-16 8:08 UTC (permalink / raw)
To: Ratheesh Kannoth
Cc: netdev, linux-kernel, sgoutham, davem, edumazet, kuba, pabeni,
andrew+netdev, dan.carpenter
In-Reply-To: <20260416035352.333808-2-rkannoth@marvell.com>
On Thu, Apr 16, 2026 at 09:23:50AM +0530, Ratheesh Kannoth wrote:
> npc_mcam_idx_2_key_type() can fail; ignoring its return value left
> kw_type unchecked in MCAM enable, configure, copy, and read paths.
> Return early on error so we do not program or interpret MCAM state
> with an invalid key type.
>
> CC: Dan Carpenter <error27@gmail.com>
> Fixes: 6d1e70282f76 ("octeontx2-af: npc: cn20k: Use common APIs")
> Link: https://lore.kernel.org/netdev/adiQJvuKlEhq2ILx@stanley.mountain/
> Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
Thanks. That silences the uninitialized variable warning.
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH net,v2 1/1] net: stmmac: Update default_an_inband before passing value to phylink_config
From: Paolo Abeni @ 2026-04-16 8:12 UTC (permalink / raw)
To: KhaiWenTan, andrew+netdev, davem, edumazet, kuba, mcoquelin.stm32,
alexandre.torgue, rmk+kernel, maxime.chevallier, ovidiu.panait.rb,
vladimir.oltean
Cc: netdev, linux-stm32, linux-arm-kernel, linux-kernel,
yoong.siang.song, hong.aun.looi, khai.wen.tan
In-Reply-To: <20260413020339.68426-1-khai.wen.tan@linux.intel.com>
On 4/13/26 4:03 AM, KhaiWenTan wrote:
> get_interfaces() will update both the plat->phy_interfaces and
> mdio_bus_data->default_an_inband based on reading a SERDES register. As
> get_interfaces() will be called after default_an_inband had already been
> read, dwmac-intel regressed as a result with incorrect default_an_inband
> value in phylink_config.
>
> Therefore, we moved the priv->plat->get_interfaces() to be executed first
> before assigning mdio_bus_data->default_an_inband to
> config->default_an_inband to ensure default_an_inband is in correct value.
>
> Fixes: d3836052fe09 ("net: stmmac: intel: convert speed_mode_2500() to get_interfaces()")
> Signed-off-by: KhaiWenTan <khai.wen.tan@linux.intel.com>
Since Jakub sent the net-next PR and forwarded the trees, this patch
does not apply anymore. Please rebase and repost. You can retain
Russell's reviewed-by tag.
Thanks,
Paolo
^ permalink raw reply
* Re: [PATCH net v2] RDS: Fix memory leak in rds_rdma_extra_size()
From: Paolo Abeni @ 2026-04-16 8:20 UTC (permalink / raw)
To: Xiaobo Liu, Allison Henderson, David S. Miller
Cc: Eric Dumazet, Jakub Kicinski, Simon Horman, netdev, linux-rdma,
rds-devel, linux-kernel
In-Reply-To: <20260413070005.15272-1-cppcoffee@gmail.com>
On 4/13/26 9:00 AM, Xiaobo Liu wrote:
> @@ -595,11 +600,20 @@ int rds_rdma_extra_size(struct rds_rdma_args *args,
> * nr_pages for one entry is limited to (UINT_MAX>>PAGE_SHIFT)+1,
> * so tot_pages cannot overflow without first going negative.
> */
> - if (tot_pages < 0)
> - return -EINVAL;
> + if (tot_pages < 0) {
> + ret = -EINVAL;
> + goto out;
> + }
> }
>
> - return tot_pages * sizeof(struct scatterlist);
> + ret = tot_pages * sizeof(struct scatterlist);
> +
> +out:
> + if (ret < 0) {
> + kfree(iov->iov);
> + iov->iov = NULL;
Is this really needed?!? AFAICS rds_rdma_extra_size() is invoked only
via: rds_sendmsg() -> rds_rm_size() -> rds_rdma_extra_size(), and the
rds_sendmsg() error path already frees any non NULL iov.
/P
^ permalink raw reply
* Re: [PATCH net,v2 1/1] net: stmmac: Update default_an_inband before passing value to phylink_config
From: KhaiWenTan @ 2026-04-16 8:22 UTC (permalink / raw)
To: Paolo Abeni, andrew+netdev, davem, edumazet, kuba,
mcoquelin.stm32, alexandre.torgue, rmk+kernel, maxime.chevallier,
ovidiu.panait.rb, vladimir.oltean
Cc: netdev, linux-stm32, linux-arm-kernel, linux-kernel,
yoong.siang.song, hong.aun.looi, khai.wen.tan
In-Reply-To: <72d1b0b7-c8df-463e-a2d9-bf5ff04ba33c@redhat.com>
On 4/16/2026 4:12 PM, Paolo Abeni wrote:
> On 4/13/26 4:03 AM, KhaiWenTan wrote:
>> get_interfaces() will update both the plat->phy_interfaces and
>> mdio_bus_data->default_an_inband based on reading a SERDES register. As
>> get_interfaces() will be called after default_an_inband had already been
>> read, dwmac-intel regressed as a result with incorrect default_an_inband
>> value in phylink_config.
>>
>> Therefore, we moved the priv->plat->get_interfaces() to be executed first
>> before assigning mdio_bus_data->default_an_inband to
>> config->default_an_inband to ensure default_an_inband is in correct value.
>>
>> Fixes: d3836052fe09 ("net: stmmac: intel: convert speed_mode_2500() to get_interfaces()")
>> Signed-off-by: KhaiWenTan <khai.wen.tan@linux.intel.com>
> Since Jakub sent the net-next PR and forwarded the trees, this patch
> does not apply anymore. Please rebase and repost. You can retain
> Russell's reviewed-by tag.
>
> Thanks,
>
> Paolo
Thank you Paolo, will be rebasing the patch and update a v3.
^ permalink raw reply
* RE: [Intel-wired-lan] [PATCH net] ice: fix VF queue configuration with low MTU values
From: Romanowski, Rafal @ 2026-04-16 8:23 UTC (permalink / raw)
To: Paul Menzel, Jose Ignacio Tornos Martinez
Cc: intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org,
Nguyen, Anthony L, Kitszel, Przemyslaw, Andrew Lunn,
David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Keller, Jacob E, Loktionov, Aleksandr, Michal Swiatkowski,
Ertman, David M, Michal Kubiak, stable@vger.kernel.org
In-Reply-To: <22f2d325-fc2a-4801-91b5-b64fac4d86e9@molgen.mpg.de>
> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of Paul
> Menzel
> Sent: Wednesday, April 8, 2026 8:25 AM
> To: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
> Cc: intel-wired-lan@lists.osuosl.org; netdev@vger.kernel.org; Nguyen, Anthony L
> <anthony.l.nguyen@intel.com>; Kitszel, Przemyslaw
> <przemyslaw.kitszel@intel.com>; Andrew Lunn <andrew+netdev@lunn.ch>;
> David S . Miller <davem@davemloft.net>; Eric Dumazet
> <edumazet@google.com>; Jakub Kicinski <kuba@kernel.org>; Paolo Abeni
> <pabeni@redhat.com>; Keller, Jacob E <jacob.e.keller@intel.com>; Loktionov,
> Aleksandr <aleksandr.loktionov@intel.com>; Michal Swiatkowski
> <michal.swiatkowski@linux.intel.com>; Ertman, David M
> <david.m.ertman@intel.com>; Michal Kubiak <michal.kubiak@intel.com>;
> stable@vger.kernel.org
> Subject: Re: [Intel-wired-lan] [PATCH net] ice: fix VF queue configuration with low
> MTU values
>
> Dear Jose,
>
>
> Thank you for the patch.
>
> Am 06.04.26 um 16:56 schrieb Jose Ignacio Tornos Martinez:
> > The ice driver's VF queue configuration validation rejects
> > databuffer_size values below 1024 bytes, which prevents VFs from using
> > MTU values below 871 bytes.
> >
> > The iavf driver calculates databuffer_size based on the MTU using:
> > databuffer_size = ALIGN(MTU + LIBETH_RX_LL_LEN, 128)
> >
> > where LIBETH_RX_LL_LEN = 26 (ETH_HLEN + 2*VLAN_HLEN + ETH_FCS_LEN).
> >
> > For MTU values below 871:
> > MTU 870: 870 + 26 = 896, aligned to 128 = 896 (< 1024, rejected)
> > MTU 871: 871 + 26 = 897, aligned to 128 = 1024 (>= 1024, accepted)
> >
> > The 1024-byte minimum seems unnecessarily restrictive, because the
> > hardware supports databuffer_size as low as 128 bytes (the alignment
> > boundary), which should allow MTU values down to the standard minimum of
> 68 bytes.
> >
> > I haven't found the reason why the limit was configured in the commit
> > 9c7dd7566d18 ("ice: add validation in OP_CONFIG_VSI_QUEUES VF
> > message"), so with no more information and since it is working, change
> > the minimum databuffer_size validation from 1024 to 128 bytes to allow
> > standard low MTU values while still preventing invalid configurations.
>
> Should you resend, having the reproducer script would be nice to have.
>
> > Fixes: 9c7dd7566d18 ("ice: add validation in OP_CONFIG_VSI_QUEUES VF
> > message")
> > cc: stable@vger.kernel.org
> > Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
> > ---
> > drivers/net/ethernet/intel/ice/virt/queues.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/net/ethernet/intel/ice/virt/queues.c
> > b/drivers/net/ethernet/intel/ice/virt/queues.c
> > index f73d5a3e83d4..31be2f76181c 100644
> > --- a/drivers/net/ethernet/intel/ice/virt/queues.c
> > +++ b/drivers/net/ethernet/intel/ice/virt/queues.c
> > @@ -840,7 +840,7 @@ int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)
> >
> > if (qpi->rxq.databuffer_size != 0 &&
> > (qpi->rxq.databuffer_size > ((16 * 1024) - 128) ||
> > - qpi->rxq.databuffer_size < 1024))
> > + qpi->rxq.databuffer_size < 128))
> > goto error_param;
> >
> > ring->rx_buf_len = qpi->rxq.databuffer_size;
>
> Either way:
>
> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
>
>
> Kind regards,
>
> Paul
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
^ permalink raw reply
* [PATCH bpf-next v4 6/6] selftests/bpf: tc_tunnel validate decap GSO state
From: Nick Hudson @ 2026-04-16 7:55 UTC (permalink / raw)
To: bpf, netdev, Willem de Bruijn, Martin KaFai Lau
Cc: Nick Hudson, Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Shuah Khan,
linux-kselftest, linux-kernel
In-Reply-To: <20260416075514.927101-1-nhudson@akamai.com>
Require BPF_F_ADJ_ROOM_DECAP_L4_UDP and BPF_F_ADJ_ROOM_DECAP_L4_GRE enum
values at runtime using CO-RE enum existence checks so missing kernel
support fails fast instead of silently proceeding.
After bpf_skb_adjust_room() decapsulation, inspect skb_shared_info and
sk_buff state for GSO packets and assert that the expected tunnel GSO
bits are cleared and encapsulation matches the remaining tunnel state.
Signed-off-by: Nick Hudson <nhudson@akamai.com>
---
.../selftests/bpf/progs/test_tc_tunnel.c | 58 +++++++++++++++++++
1 file changed, 58 insertions(+)
diff --git a/tools/testing/selftests/bpf/progs/test_tc_tunnel.c b/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
index 7376df405a6b..74dfb694a210 100644
--- a/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
+++ b/tools/testing/selftests/bpf/progs/test_tc_tunnel.c
@@ -6,6 +6,7 @@
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>
+#include <bpf/bpf_core_read.h>
#include "bpf_tracing_net.h"
#include "bpf_compiler.h"
@@ -37,6 +38,23 @@ struct vxlanhdr___local {
#define EXTPROTO_VXLAN 0x1
+#define SKB_GSO_UDP_TUNNEL_MASK (SKB_GSO_UDP_TUNNEL | \
+ SKB_GSO_UDP_TUNNEL_CSUM | \
+ SKB_GSO_TUNNEL_REMCSUM)
+
+#define SKB_GSO_TUNNEL_MASK (SKB_GSO_UDP_TUNNEL_MASK | \
+ SKB_GSO_GRE | \
+ SKB_GSO_GRE_CSUM | \
+ SKB_GSO_IPXIP4 | \
+ SKB_GSO_IPXIP6 | \
+ SKB_GSO_ESP)
+
+#define BPF_F_ADJ_ROOM_DECAP_L4_MASK (BPF_F_ADJ_ROOM_DECAP_L4_UDP | \
+ BPF_F_ADJ_ROOM_DECAP_L4_GRE)
+
+#define BPF_F_ADJ_ROOM_DECAP_IPXIP_MASK (BPF_F_ADJ_ROOM_DECAP_IPXIP4 | \
+ BPF_F_ADJ_ROOM_DECAP_IPXIP6)
+
#define VXLAN_FLAGS bpf_htonl(1<<27)
#define VNI_ID 1
#define VXLAN_VNI bpf_htonl(VNI_ID << 8)
@@ -592,6 +610,8 @@ int __encap_ip6vxlan_eth(struct __sk_buff *skb)
static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
{
__u64 flags = BPF_F_ADJ_ROOM_FIXED_GSO;
+ struct sk_buff *kskb;
+ struct skb_shared_info *shinfo;
struct ipv6_opt_hdr ip6_opt_hdr;
struct gre_hdr greh;
struct udphdr udph;
@@ -621,6 +641,11 @@ static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
break;
case IPPROTO_GRE:
olen += sizeof(struct gre_hdr);
+ if (!bpf_core_enum_value_exists(enum bpf_adj_room_flags,
+ BPF_F_ADJ_ROOM_DECAP_L4_GRE))
+ return TC_ACT_SHOT;
+ flags |= BPF_F_ADJ_ROOM_DECAP_L4_GRE;
+
if (bpf_skb_load_bytes(skb, off + len, &greh, sizeof(greh)) < 0)
return TC_ACT_OK;
switch (bpf_ntohs(greh.protocol)) {
@@ -634,6 +659,10 @@ static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
break;
case IPPROTO_UDP:
olen += sizeof(struct udphdr);
+ if (!bpf_core_enum_value_exists(enum bpf_adj_room_flags,
+ BPF_F_ADJ_ROOM_DECAP_L4_UDP))
+ return TC_ACT_SHOT;
+ flags |= BPF_F_ADJ_ROOM_DECAP_L4_UDP;
if (bpf_skb_load_bytes(skb, off + len, &udph, sizeof(udph)) < 0)
return TC_ACT_OK;
switch (bpf_ntohs(udph.dest)) {
@@ -655,6 +684,35 @@ static int decap_internal(struct __sk_buff *skb, int off, int len, char proto)
if (bpf_skb_adjust_room(skb, -olen, BPF_ADJ_ROOM_MAC, flags))
return TC_ACT_SHOT;
+ kskb = bpf_cast_to_kern_ctx(skb);
+ shinfo = bpf_core_cast(kskb->head + kskb->end, struct skb_shared_info);
+ if (!shinfo->gso_size)
+ return TC_ACT_OK;
+
+ if ((flags & BPF_F_ADJ_ROOM_DECAP_L4_UDP) &&
+ (shinfo->gso_type & SKB_GSO_UDP_TUNNEL_MASK))
+ return TC_ACT_SHOT;
+
+ if ((flags & BPF_F_ADJ_ROOM_DECAP_L4_GRE) &&
+ (shinfo->gso_type & (SKB_GSO_GRE | SKB_GSO_GRE_CSUM)))
+ return TC_ACT_SHOT;
+
+ if ((flags & BPF_F_ADJ_ROOM_DECAP_IPXIP4) &&
+ (shinfo->gso_type & SKB_GSO_IPXIP4))
+ return TC_ACT_SHOT;
+
+ if ((flags & BPF_F_ADJ_ROOM_DECAP_IPXIP6) &&
+ (shinfo->gso_type & SKB_GSO_IPXIP6))
+ return TC_ACT_SHOT;
+
+ if (flags & (BPF_F_ADJ_ROOM_DECAP_L4_MASK |
+ BPF_F_ADJ_ROOM_DECAP_IPXIP_MASK)) {
+ if ((shinfo->gso_type & SKB_GSO_TUNNEL_MASK) && !kskb->encapsulation)
+ return TC_ACT_SHOT;
+ if (!(shinfo->gso_type & SKB_GSO_TUNNEL_MASK) && kskb->encapsulation)
+ return TC_ACT_SHOT;
+ }
+
return TC_ACT_OK;
}
--
2.34.1
^ permalink raw reply related
* [RFC net-next 1/3] ppp: use file.dead to check channel unregistration
From: Qingfang Deng @ 2026-04-16 8:26 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Qingfang Deng, Breno Leitao,
Sebastian Andrzej Siewior, Kuniyuki Iwashima, Kees Cook,
linux-ppp, netdev, linux-kernel
Cc: Paul Mackerras, Jaco Kroon, James Carlson
Currently, ppp_generic checks if pch->chan is NULL to determine if a
channel is being unregistered. However, struct ppp_file already has a
'dead' flag for this purpose, which is used by ppp units and other
parts of the driver.
Switch all pch->chan NULL checks to pch->file.dead checks. In
ppp_unregister_channel, move the setting of pch->file.dead inside the
locked section to ensure atomicity and remove the now redundant
pch->chan = NULL assignment.
This is a preparation to eventually unify 'struct ppp_channel' and
'struct channel' into a single struct.
Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
---
drivers/net/ppp/ppp_generic.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index b0d3bc49c685..fd2889e374c9 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -790,7 +790,7 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
down_read(&pch->chan_sem);
chan = pch->chan;
err = -ENOTTY;
- if (chan && chan->ops->ioctl)
+ if (!pch->file.dead && chan->ops->ioctl)
err = chan->ops->ioctl(chan, cmd, arg);
up_read(&pch->chan_sem);
}
@@ -2167,7 +2167,7 @@ static void __ppp_channel_push(struct channel *pch, struct ppp *ppp)
struct sk_buff *skb;
spin_lock(&pch->downl);
- if (pch->chan) {
+ if (!pch->file.dead) {
while (!skb_queue_empty(&pch->file.xq)) {
skb = skb_dequeue(&pch->file.xq);
if (!pch->chan->ops->start_xmit(pch->chan, skb)) {
@@ -2288,7 +2288,7 @@ static bool ppp_channel_bridge_input(struct channel *pch, struct sk_buff *skb)
goto out_rcu;
spin_lock_bh(&pchb->downl);
- if (!pchb->chan) {
+ if (pchb->file.dead) {
/* channel got unregistered */
kfree_skb(skb);
goto outl;
@@ -3002,7 +3002,7 @@ ppp_unregister_channel(struct ppp_channel *chan)
ppp_disconnect_channel(pch);
down_write(&pch->chan_sem);
spin_lock_bh(&pch->downl);
- pch->chan = NULL;
+ pch->file.dead = 1;
spin_unlock_bh(&pch->downl);
up_write(&pch->chan_sem);
@@ -3013,7 +3013,6 @@ ppp_unregister_channel(struct ppp_channel *chan)
ppp_unbridge_channels(pch);
- pch->file.dead = 1;
wake_up_interruptible(&pch->file.rwait);
ppp_release_channel(pch);
@@ -3505,7 +3504,7 @@ ppp_connect_channel(struct channel *pch, int unit)
ppp_lock(ppp);
spin_lock_bh(&pch->downl);
- if (!pch->chan) {
+ if (pch->file.dead) {
/* Don't connect unregistered channels */
spin_unlock_bh(&pch->downl);
ppp_unlock(ppp);
--
2.43.0
^ permalink raw reply related
* [RFC net-next 2/3] ppp: unify two channel structs
From: Qingfang Deng @ 2026-04-16 8:26 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Jiri Kosina, David Sterba, Greg Kroah-Hartman,
Jiri Slaby, Mitchell Blank Jr, Simon Horman, James Chapman,
Qingfang Deng, Kees Cook, Yue Haibing, Sebastian Andrzej Siewior,
Taegu Ha, Kuniyuki Iwashima, Guillaume Nault, Eric Woudstra,
Arnd Bergmann, Dawid Osuchowski, Breno Leitao, linux-ppp, netdev,
linux-kernel, linux-serial
Cc: Paul Mackerras, Jaco Kroon, James Carlson
In-Reply-To: <20260416082656.86963-1-qingfang.deng@linux.dev>
Historically, PPP maintained two separate structures for a channel:
'struct channel' was internal to ppp_generic.c, while 'struct ppp_channel'
was the public interface that drivers were required to embed. This
duplication was redundant and forced drivers to manage the lifecycle of
the public structure.
Unify these two structures into a single 'struct ppp_channel', which is
now internal to ppp_generic.c. Drivers now use a 'ppp_channel_conf'
structure to specify registration parameters and receive an opaque
pointer to the allocated channel.
Key changes:
- ppp_register_channel() and ppp_register_net_channel() now return
a 'struct ppp_channel *' instead of taking a pointer to a driver-
embedded structure.
- 'struct ppp_channel_ops' methods now take the driver's 'private'
pointer directly as their first argument, simplifying driver logic.
- ppp_unregister_channel() now takes the opaque pointer.
- Multilink-specific fields are unified and handled via the new
configuration structure.
This cleanup simplifies the driver interface and makes the channel
lifecycle management more robust by centralizing allocation in the PPP
generic layer.
Assisted-by: Gemini:gemini-3-flash
Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
---
drivers/net/ppp/ppp_async.c | 51 +++++-----
drivers/net/ppp/ppp_generic.c | 161 +++++++++++++++----------------
drivers/net/ppp/ppp_synctty.c | 51 +++++-----
drivers/net/ppp/pppoe.c | 34 ++++---
drivers/net/ppp/pppox.c | 4 +-
drivers/net/ppp/pptp.c | 40 ++++----
drivers/tty/ipwireless/network.c | 30 +++---
include/linux/if_pppox.h | 2 +-
include/linux/ppp_channel.h | 49 ++++++----
net/atm/pppoatm.c | 61 ++++++------
net/l2tp/l2tp_ppp.c | 34 ++++---
11 files changed, 271 insertions(+), 246 deletions(-)
diff --git a/drivers/net/ppp/ppp_async.c b/drivers/net/ppp/ppp_async.c
index 93a7b0f6c4e7..faa299cc3db9 100644
--- a/drivers/net/ppp/ppp_async.c
+++ b/drivers/net/ppp/ppp_async.c
@@ -67,7 +67,7 @@ struct asyncppp {
refcount_t refcnt;
struct completion dead;
- struct ppp_channel chan; /* interface to generic ppp layer */
+ struct ppp_channel *chan; /* interface to generic ppp layer */
unsigned char obuf[OBUFSIZE];
};
@@ -95,12 +95,12 @@ MODULE_ALIAS_LDISC(N_PPP);
* Prototypes.
*/
static int ppp_async_encode(struct asyncppp *ap);
-static int ppp_async_send(struct ppp_channel *chan, struct sk_buff *skb);
+static int ppp_async_send(void *private, struct sk_buff *skb);
static int ppp_async_push(struct asyncppp *ap);
static void ppp_async_flush_output(struct asyncppp *ap);
static void ppp_async_input(struct asyncppp *ap, const unsigned char *buf,
const u8 *flags, int count);
-static int ppp_async_ioctl(struct ppp_channel *chan, unsigned int cmd,
+static int ppp_async_ioctl(void *private, unsigned int cmd,
unsigned long arg);
static void ppp_async_process(struct tasklet_struct *t);
@@ -155,9 +155,10 @@ static void ap_put(struct asyncppp *ap)
static int
ppp_asynctty_open(struct tty_struct *tty)
{
+ struct ppp_channel_conf conf = {};
+ struct ppp_channel *chan;
struct asyncppp *ap;
int err;
- int speed;
if (tty->ops->write == NULL)
return -EOPNOTSUPP;
@@ -185,14 +186,18 @@ ppp_asynctty_open(struct tty_struct *tty)
refcount_set(&ap->refcnt, 1);
init_completion(&ap->dead);
- ap->chan.private = ap;
- ap->chan.ops = &async_ops;
- ap->chan.mtu = PPP_MRU;
- speed = tty_get_baud_rate(tty);
- ap->chan.speed = speed;
- err = ppp_register_channel(&ap->chan);
- if (err)
+ conf.private = ap;
+ conf.ops = &async_ops;
+#ifdef CONFIG_PPP_MULTILINK
+ conf.mtu = PPP_MRU;
+ conf.speed = tty_get_baud_rate(tty);
+#endif
+ chan = ppp_register_channel(&conf);
+ if (!chan) {
+ err = -ENOMEM;
goto out_free;
+ }
+ ap->chan = chan;
tty->disc_data = ap;
tty->receive_room = 65536;
@@ -235,7 +240,7 @@ ppp_asynctty_close(struct tty_struct *tty)
wait_for_completion(&ap->dead);
tasklet_kill(&ap->tsk);
- ppp_unregister_channel(&ap->chan);
+ ppp_unregister_channel(ap->chan);
kfree_skb(ap->rpkt);
skb_queue_purge(&ap->rqueue);
kfree_skb(ap->tpkt);
@@ -293,14 +298,14 @@ ppp_asynctty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
switch (cmd) {
case PPPIOCGCHAN:
err = -EFAULT;
- if (put_user(ppp_channel_index(&ap->chan), p))
+ if (put_user(ppp_channel_index(ap->chan), p))
break;
err = 0;
break;
case PPPIOCGUNIT:
err = -EFAULT;
- if (put_user(ppp_unit_number(&ap->chan), p))
+ if (put_user(ppp_unit_number(ap->chan), p))
break;
err = 0;
break;
@@ -391,9 +396,9 @@ ppp_async_init(void)
* The following routines provide the PPP channel interface.
*/
static int
-ppp_async_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg)
+ppp_async_ioctl(void *private, unsigned int cmd, unsigned long arg)
{
- struct asyncppp *ap = chan->private;
+ struct asyncppp *ap = private;
void __user *argp = (void __user *)arg;
int __user *p = argp;
int err, val;
@@ -491,13 +496,13 @@ static void ppp_async_process(struct tasklet_struct *t)
/* process received packets */
while ((skb = skb_dequeue(&ap->rqueue)) != NULL) {
if (skb->cb[0])
- ppp_input_error(&ap->chan);
- ppp_input(&ap->chan, skb);
+ ppp_input_error(ap->chan);
+ ppp_input(ap->chan, skb);
}
/* try to push more stuff out */
if (test_bit(XMIT_WAKEUP, &ap->xmit_flags) && ppp_async_push(ap))
- ppp_output_wakeup(&ap->chan);
+ ppp_output_wakeup(ap->chan);
}
/*
@@ -620,9 +625,9 @@ ppp_async_encode(struct asyncppp *ap)
* at some later time.
*/
static int
-ppp_async_send(struct ppp_channel *chan, struct sk_buff *skb)
+ppp_async_send(void *private, struct sk_buff *skb)
{
- struct asyncppp *ap = chan->private;
+ struct asyncppp *ap = private;
ppp_async_push(ap);
@@ -733,7 +738,7 @@ ppp_async_flush_output(struct asyncppp *ap)
}
spin_unlock_bh(&ap->xmit_lock);
if (done)
- ppp_output_wakeup(&ap->chan);
+ ppp_output_wakeup(ap->chan);
}
/*
@@ -992,7 +997,7 @@ static void async_lcp_peek(struct asyncppp *ap, unsigned char *data,
if (inbound)
ap->mru = val;
else
- ap->chan.mtu = val;
+ ppp_channel_update_mtu(ap->chan, val);
break;
case LCP_ASYNCMAP:
val = get_unaligned_be32(data + 2);
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index fd2889e374c9..882709551bbd 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -106,7 +106,7 @@ struct ppp_file {
#define PF_TO_X(pf, X) container_of(pf, X, file)
#define PF_TO_PPP(pf) PF_TO_X(pf, struct ppp)
-#define PF_TO_CHANNEL(pf) PF_TO_X(pf, struct channel)
+#define PF_TO_CHANNEL(pf) PF_TO_X(pf, struct ppp_channel)
struct ppp_xmit_recursion {
struct task_struct *owner;
@@ -172,10 +172,11 @@ struct ppp {
* Private data structure for each channel.
* This includes the data structure used for multilink.
*/
-struct channel {
+struct ppp_channel {
struct ppp_file file; /* stuff for read/write/poll */
struct list_head list; /* link in all/new_channels list */
- struct ppp_channel *chan; /* public channel data structure */
+ const struct ppp_channel_ops *ops; /* operations for this channel */
+ void *private; /* channel private data */
struct rw_semaphore chan_sem; /* protects `chan' during chan ioctl */
spinlock_t downl; /* protects `chan', file.xq dequeue */
struct ppp __rcu *ppp; /* ppp unit we're connected to */
@@ -183,11 +184,13 @@ struct channel {
netns_tracker ns_tracker;
struct list_head clist; /* link in list of channels per unit */
spinlock_t upl; /* protects `ppp' and 'bridge' */
- struct channel __rcu *bridge; /* "bridged" ppp channel */
+ struct ppp_channel __rcu *bridge; /* "bridged" ppp channel */
+ bool direct_xmit; /* no qdisc, xmit directly */
#ifdef CONFIG_PPP_MULTILINK
u8 avail; /* flag used in multilink stuff */
u8 had_frag; /* >= 1 fragments have been sent */
u32 lastseq; /* MP: last sequence # received */
+ int mtu; /* max transmit packet size */
int speed; /* speed of the corresponding ppp channel*/
#endif /* CONFIG_PPP_MULTILINK */
};
@@ -265,16 +268,16 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
static void ppp_xmit_process(struct ppp *ppp, struct sk_buff *skb);
static int ppp_prepare_tx_skb(struct ppp *ppp, struct sk_buff **pskb);
static int ppp_push(struct ppp *ppp, struct sk_buff *skb);
-static void ppp_channel_push(struct channel *pch);
+static void ppp_channel_push(struct ppp_channel *pch);
static void ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb,
- struct channel *pch);
+ struct ppp_channel *pch);
static void ppp_receive_error(struct ppp *ppp);
static void ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb);
static struct sk_buff *ppp_decompress_frame(struct ppp *ppp,
struct sk_buff *skb);
#ifdef CONFIG_PPP_MULTILINK
static void ppp_receive_mp_frame(struct ppp *ppp, struct sk_buff *skb,
- struct channel *pch);
+ struct ppp_channel *pch);
static void ppp_mp_insert(struct ppp *ppp, struct sk_buff *skb);
static struct sk_buff *ppp_mp_reconstruct(struct ppp *ppp);
static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb);
@@ -288,10 +291,10 @@ static int ppp_create_interface(struct net *net, struct file *file, int *unit);
static void init_ppp_file(struct ppp_file *pf, int kind);
static void ppp_release_interface(struct ppp *ppp);
static struct ppp *ppp_find_unit(struct ppp_net *pn, int unit);
-static struct channel *ppp_find_channel(struct ppp_net *pn, int unit);
-static int ppp_connect_channel(struct channel *pch, int unit);
-static int ppp_disconnect_channel(struct channel *pch);
-static void ppp_release_channel(struct channel *pch);
+static struct ppp_channel *ppp_find_channel(struct ppp_net *pn, int unit);
+static int ppp_connect_channel(struct ppp_channel *pch, int unit);
+static int ppp_disconnect_channel(struct ppp_channel *pch);
+static void ppp_release_channel(struct ppp_channel *pch);
static int unit_get(struct idr *p, void *ptr, int min);
static int unit_set(struct idr *p, void *ptr, int n);
static void unit_put(struct idr *p, int n);
@@ -638,7 +641,7 @@ static struct bpf_prog *compat_ppp_get_filter(struct sock_fprog32 __user *p)
* Once successfully bridged, each channel holds a reference on the other
* to prevent it being freed while the bridge is extant.
*/
-static int ppp_bridge_channels(struct channel *pch, struct channel *pchb)
+static int ppp_bridge_channels(struct ppp_channel *pch, struct ppp_channel *pchb)
{
spin_lock(&pch->upl);
if (rcu_dereference_protected(pch->ppp, lockdep_is_held(&pch->upl)) ||
@@ -676,9 +679,9 @@ static int ppp_bridge_channels(struct channel *pch, struct channel *pchb)
return -EALREADY;
}
-static int ppp_unbridge_channels(struct channel *pch)
+static int ppp_unbridge_channels(struct ppp_channel *pch)
{
- struct channel *pchb, *pchbb;
+ struct ppp_channel *pchb, *pchbb;
spin_lock(&pch->upl);
pchb = rcu_dereference_protected(pch->bridge, lockdep_is_held(&pch->upl));
@@ -745,8 +748,7 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
}
if (pf->kind == CHANNEL) {
- struct channel *pch, *pchb;
- struct ppp_channel *chan;
+ struct ppp_channel *pch, *pchb;
struct ppp_net *pn;
pch = PF_TO_CHANNEL(pf);
@@ -788,10 +790,9 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
default:
down_read(&pch->chan_sem);
- chan = pch->chan;
err = -ENOTTY;
- if (!pch->file.dead && chan->ops->ioctl)
- err = chan->ops->ioctl(chan, cmd, arg);
+ if (!pch->file.dead && pch->ops->ioctl)
+ err = pch->ops->ioctl(pch->private, cmd, arg);
up_read(&pch->chan_sem);
}
goto out;
@@ -1044,7 +1045,7 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
{
int unit, err = -EFAULT;
struct ppp *ppp;
- struct channel *chan;
+ struct ppp_channel *chan;
struct ppp_net *pn;
int __user *p = (int __user *)arg;
@@ -1586,21 +1587,19 @@ static int ppp_fill_forward_path(struct net_device_path_ctx *ctx,
struct net_device_path *path)
{
struct ppp *ppp = netdev_priv(ctx->dev);
- struct ppp_channel *chan;
- struct channel *pch;
+ struct ppp_channel *pch;
if (ppp->flags & SC_MULTILINK)
return -EOPNOTSUPP;
- pch = list_first_or_null_rcu(&ppp->channels, struct channel, clist);
+ pch = list_first_or_null_rcu(&ppp->channels, struct ppp_channel, clist);
if (!pch)
return -ENODEV;
- chan = pch->chan;
- if (!chan->ops->fill_forward_path)
+ if (!pch->ops->fill_forward_path)
return -EOPNOTSUPP;
- return chan->ops->fill_forward_path(ctx, path, chan);
+ return pch->ops->fill_forward_path(ctx, path, pch->private);
}
static const struct net_device_ops ppp_netdev_ops = {
@@ -1901,7 +1900,6 @@ static int
ppp_push(struct ppp *ppp, struct sk_buff *skb)
{
struct list_head *list;
- struct channel *pch;
list = &ppp->channels;
if (list_empty(list)) {
@@ -1911,15 +1909,14 @@ ppp_push(struct ppp *ppp, struct sk_buff *skb)
}
if ((ppp->flags & SC_MULTILINK) == 0) {
- struct ppp_channel *chan;
+ struct ppp_channel *pch;
int ret;
/* not doing multilink: send it down the first channel */
list = list->next;
- pch = list_entry(list, struct channel, clist);
+ pch = list_entry(list, struct ppp_channel, clist);
spin_lock(&pch->downl);
- chan = pch->chan;
- if (unlikely(!chan->direct_xmit && skb_linearize(skb))) {
+ if (unlikely(!pch->direct_xmit && skb_linearize(skb))) {
/* channel requires a linear skb but linearization
* failed
*/
@@ -1928,7 +1925,7 @@ ppp_push(struct ppp *ppp, struct sk_buff *skb)
goto out;
}
- ret = chan->ops->start_xmit(chan, skb);
+ ret = pch->ops->start_xmit(pch->private, skb);
out:
spin_unlock(&pch->downl);
@@ -1967,9 +1964,8 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
int totfree;
unsigned char *p, *q;
struct list_head *list;
- struct channel *pch;
+ struct ppp_channel *pch;
struct sk_buff *frag;
- struct ppp_channel *chan;
totspeed = 0; /*total bitrate of the bundle*/
nfree = 0; /* # channels which have no packet already queued */
@@ -1984,8 +1980,6 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
list_for_each_entry(pch, &ppp->channels, clist) {
pch->avail = 1;
navail++;
- pch->speed = pch->chan->speed;
-
if (skb_queue_empty(&pch->file.xq) || !pch->had_frag) {
if (pch->speed == 0)
nzero++;
@@ -2041,7 +2035,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
i = 0;
continue;
}
- pch = list_entry(list, struct channel, clist);
+ pch = list_entry(list, struct ppp_channel, clist);
++i;
if (!pch->avail)
continue;
@@ -2108,7 +2102,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
* MTU counts only the payload excluding the protocol field.
* (RFC1661 Section 2)
*/
- mtu = pch->chan->mtu - (hdrlen - 2);
+ mtu = pch->mtu - (hdrlen - 2);
if (mtu < 4)
mtu = 4;
if (flen > mtu)
@@ -2135,9 +2129,8 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
memcpy(q + hdrlen, p, flen);
/* try to send it down the channel */
- chan = pch->chan;
if (!skb_queue_empty(&pch->file.xq) ||
- !chan->ops->start_xmit(chan, frag))
+ !pch->ops->start_xmit(pch->private, frag))
skb_queue_tail(&pch->file.xq, frag);
pch->had_frag = 1;
p += flen;
@@ -2162,7 +2155,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
#endif /* CONFIG_PPP_MULTILINK */
/* Try to send data out on a channel */
-static void __ppp_channel_push(struct channel *pch, struct ppp *ppp)
+static void __ppp_channel_push(struct ppp_channel *pch, struct ppp *ppp)
{
struct sk_buff *skb;
@@ -2170,7 +2163,7 @@ static void __ppp_channel_push(struct channel *pch, struct ppp *ppp)
if (!pch->file.dead) {
while (!skb_queue_empty(&pch->file.xq)) {
skb = skb_dequeue(&pch->file.xq);
- if (!pch->chan->ops->start_xmit(pch->chan, skb)) {
+ if (!pch->ops->start_xmit(pch->private, skb)) {
/* put the packet back and try again later */
skb_queue_head(&pch->file.xq, skb);
break;
@@ -2192,7 +2185,7 @@ static void __ppp_channel_push(struct channel *pch, struct ppp *ppp)
}
}
-static void ppp_channel_push(struct channel *pch)
+static void ppp_channel_push(struct ppp_channel *pch)
{
struct ppp_xmit_recursion *xmit_recursion;
struct ppp *ppp;
@@ -2223,7 +2216,7 @@ struct ppp_mp_skb_parm {
#define PPP_MP_CB(skb) ((struct ppp_mp_skb_parm *)((skb)->cb))
static inline void
-ppp_do_recv(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
+ppp_do_recv(struct ppp *ppp, struct sk_buff *skb, struct ppp_channel *pch)
{
ppp_recv_lock(ppp);
if (!ppp->closing)
@@ -2278,9 +2271,9 @@ static bool ppp_decompress_proto(struct sk_buff *skb)
* If not, the caller must handle the frame by normal recv mechanisms.
* Returns true if the frame is consumed, false otherwise.
*/
-static bool ppp_channel_bridge_input(struct channel *pch, struct sk_buff *skb)
+static bool ppp_channel_bridge_input(struct ppp_channel *pch, struct sk_buff *skb)
{
- struct channel *pchb;
+ struct ppp_channel *pchb;
rcu_read_lock();
pchb = rcu_dereference(pch->bridge);
@@ -2295,7 +2288,7 @@ static bool ppp_channel_bridge_input(struct channel *pch, struct sk_buff *skb)
}
skb_scrub_packet(skb, !net_eq(pch->chan_net, pchb->chan_net));
- if (!pchb->chan->ops->start_xmit(pchb->chan, skb))
+ if (!pchb->ops->start_xmit(pchb->private, skb))
kfree_skb(skb);
outl:
@@ -2308,9 +2301,8 @@ static bool ppp_channel_bridge_input(struct channel *pch, struct sk_buff *skb)
}
void
-ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
+ppp_input(struct ppp_channel *pch, struct sk_buff *skb)
{
- struct channel *pch = chan->ppp;
struct ppp *ppp;
int proto;
@@ -2352,9 +2344,8 @@ ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
}
void
-ppp_input_error(struct ppp_channel *chan)
+ppp_input_error(struct ppp_channel *pch)
{
- struct channel *pch = chan->ppp;
struct ppp *ppp;
if (!pch)
@@ -2375,7 +2366,7 @@ ppp_input_error(struct ppp_channel *chan)
* The receive side of the ppp unit is locked.
*/
static void
-ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
+ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct ppp_channel *pch)
{
skb_checksum_complete_unset(skb);
#ifdef CONFIG_PPP_MULTILINK
@@ -2611,10 +2602,10 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb)
* as many completed frames as we can.
*/
static void
-ppp_receive_mp_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
+ppp_receive_mp_frame(struct ppp *ppp, struct sk_buff *skb, struct ppp_channel *pch)
{
u32 mask, seq;
- struct channel *ch;
+ struct ppp_channel *ch;
int mphdrlen = (ppp->flags & SC_MP_SHORTSEQ)? MPHDRLEN_SSN: MPHDRLEN;
if (!pskb_may_pull(skb, mphdrlen + 1) || ppp->mrru == 0)
@@ -2885,6 +2876,13 @@ ppp_mp_reconstruct(struct ppp *ppp)
return skb;
}
+
+/* Update the MTU of a multilink channel */
+void ppp_channel_update_mtu(struct ppp_channel *pch, int mtu)
+{
+ pch->mtu = mtu;
+}
+EXPORT_SYMBOL(ppp_channel_update_mtu);
#endif /* CONFIG_PPP_MULTILINK */
/*
@@ -2892,29 +2890,33 @@ ppp_mp_reconstruct(struct ppp *ppp)
*/
/* Create a new, unattached ppp channel. */
-int ppp_register_channel(struct ppp_channel *chan)
+struct ppp_channel *ppp_register_channel(const struct ppp_channel_conf *conf)
{
- return ppp_register_net_channel(current->nsproxy->net_ns, chan);
+ return ppp_register_net_channel(current->nsproxy->net_ns, conf);
}
/* Create a new, unattached ppp channel for specified net. */
-int ppp_register_net_channel(struct net *net, struct ppp_channel *chan)
+struct ppp_channel *ppp_register_net_channel(struct net *net,
+ const struct ppp_channel_conf *conf)
{
- struct channel *pch;
+ struct ppp_channel *pch;
struct ppp_net *pn;
- pch = kzalloc_obj(struct channel);
+ pch = kzalloc_obj(struct ppp_channel);
if (!pch)
- return -ENOMEM;
+ return NULL;
pn = ppp_pernet(net);
- pch->chan = chan;
pch->chan_net = get_net_track(net, &pch->ns_tracker, GFP_KERNEL);
- chan->ppp = pch;
init_ppp_file(&pch->file, CHANNEL);
- pch->file.hdrlen = chan->hdrlen;
+ pch->file.hdrlen = conf->hdrlen;
+ pch->ops = conf->ops;
+ pch->private = conf->private;
+ pch->direct_xmit = conf->direct_xmit;
#ifdef CONFIG_PPP_MULTILINK
+ pch->speed = conf->speed;
+ pch->mtu = conf->mtu;
pch->lastseq = -1;
#endif /* CONFIG_PPP_MULTILINK */
init_rwsem(&pch->chan_sem);
@@ -2927,16 +2929,14 @@ int ppp_register_net_channel(struct net *net, struct ppp_channel *chan)
atomic_inc(&channel_count);
spin_unlock_bh(&pn->all_channels_lock);
- return 0;
+ return pch;
}
/*
* Return the index of a channel.
*/
-int ppp_channel_index(struct ppp_channel *chan)
+int ppp_channel_index(struct ppp_channel *pch)
{
- struct channel *pch = chan->ppp;
-
if (pch)
return pch->file.index;
return -1;
@@ -2945,9 +2945,8 @@ int ppp_channel_index(struct ppp_channel *chan)
/*
* Return the PPP unit number to which a channel is connected.
*/
-int ppp_unit_number(struct ppp_channel *chan)
+int ppp_unit_number(struct ppp_channel *pch)
{
- struct channel *pch = chan->ppp;
struct ppp *ppp;
int unit = -1;
@@ -2965,9 +2964,8 @@ int ppp_unit_number(struct ppp_channel *chan)
* Return the PPP device interface name of a channel.
* Caller must hold RCU read lock.
*/
-char *ppp_dev_name(struct ppp_channel *chan)
+char *ppp_dev_name(struct ppp_channel *pch)
{
- struct channel *pch = chan->ppp;
char *name = NULL;
struct ppp *ppp;
@@ -2985,16 +2983,13 @@ char *ppp_dev_name(struct ppp_channel *chan)
* This must be called in process context.
*/
void
-ppp_unregister_channel(struct ppp_channel *chan)
+ppp_unregister_channel(struct ppp_channel *pch)
{
- struct channel *pch = chan->ppp;
struct ppp_net *pn;
if (!pch)
return; /* should never happen */
- chan->ppp = NULL;
-
/*
* This ensures that we have returned from any calls into
* the channel's start_xmit or ioctl routine before we proceed.
@@ -3023,10 +3018,8 @@ ppp_unregister_channel(struct ppp_channel *chan)
* This should be called at BH/softirq level, not interrupt level.
*/
void
-ppp_output_wakeup(struct ppp_channel *chan)
+ppp_output_wakeup(struct ppp_channel *pch)
{
- struct channel *pch = chan->ppp;
-
if (!pch)
return;
ppp_channel_push(pch);
@@ -3459,10 +3452,10 @@ ppp_find_unit(struct ppp_net *pn, int unit)
* we move it to the all_channels list. This is for speed
* when we have a lot of channels in use.
*/
-static struct channel *
+static struct ppp_channel *
ppp_find_channel(struct ppp_net *pn, int unit)
{
- struct channel *pch;
+ struct ppp_channel *pch;
list_for_each_entry(pch, &pn->new_channels, list) {
if (pch->file.index == unit) {
@@ -3483,7 +3476,7 @@ ppp_find_channel(struct ppp_net *pn, int unit)
* Connect a PPP channel to a PPP interface unit.
*/
static int
-ppp_connect_channel(struct channel *pch, int unit)
+ppp_connect_channel(struct ppp_channel *pch, int unit)
{
struct ppp *ppp;
struct ppp_net *pn;
@@ -3511,7 +3504,7 @@ ppp_connect_channel(struct channel *pch, int unit)
ret = -ENOTCONN;
goto outl;
}
- if (pch->chan->direct_xmit)
+ if (pch->direct_xmit)
ppp->dev->priv_flags |= IFF_NO_QUEUE;
else
ppp->dev->priv_flags &= ~IFF_NO_QUEUE;
@@ -3539,7 +3532,7 @@ ppp_connect_channel(struct channel *pch, int unit)
* Disconnect a channel from its ppp unit.
*/
static int
-ppp_disconnect_channel(struct channel *pch)
+ppp_disconnect_channel(struct ppp_channel *pch)
{
struct ppp *ppp;
int err = -EINVAL;
@@ -3565,7 +3558,7 @@ ppp_disconnect_channel(struct channel *pch)
* Drop a reference to a ppp channel and free its memory if the refcount reaches
* zero.
*/
-static void ppp_release_channel(struct channel *pch)
+static void ppp_release_channel(struct ppp_channel *pch)
{
if (!refcount_dec_and_test(&pch->file.refcnt))
return;
diff --git a/drivers/net/ppp/ppp_synctty.c b/drivers/net/ppp/ppp_synctty.c
index b7f243b416f8..d84c267f4da1 100644
--- a/drivers/net/ppp/ppp_synctty.c
+++ b/drivers/net/ppp/ppp_synctty.c
@@ -71,7 +71,7 @@ struct syncppp {
refcount_t refcnt;
struct completion dead_cmp;
- struct ppp_channel chan; /* interface to generic ppp layer */
+ struct ppp_channel *chan; /* interface to generic ppp layer */
};
/* Bit numbers in xmit_flags */
@@ -87,8 +87,8 @@ struct syncppp {
* Prototypes.
*/
static struct sk_buff* ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *);
-static int ppp_sync_send(struct ppp_channel *chan, struct sk_buff *skb);
-static int ppp_sync_ioctl(struct ppp_channel *chan, unsigned int cmd,
+static int ppp_sync_send(void *private, struct sk_buff *skb);
+static int ppp_sync_ioctl(void *private, unsigned int cmd,
unsigned long arg);
static void ppp_sync_process(struct tasklet_struct *t);
static int ppp_sync_push(struct syncppp *ap);
@@ -155,9 +155,10 @@ static void sp_put(struct syncppp *ap)
static int
ppp_sync_open(struct tty_struct *tty)
{
+ struct ppp_channel_conf conf = {};
+ struct ppp_channel *chan;
struct syncppp *ap;
int err;
- int speed;
if (tty->ops->write == NULL)
return -EOPNOTSUPP;
@@ -182,15 +183,19 @@ ppp_sync_open(struct tty_struct *tty)
refcount_set(&ap->refcnt, 1);
init_completion(&ap->dead_cmp);
- ap->chan.private = ap;
- ap->chan.ops = &sync_ops;
- ap->chan.mtu = PPP_MRU;
- ap->chan.hdrlen = 2; /* for A/C bytes */
- speed = tty_get_baud_rate(tty);
- ap->chan.speed = speed;
- err = ppp_register_channel(&ap->chan);
- if (err)
+ conf.private = ap;
+ conf.ops = &sync_ops;
+ conf.hdrlen = 2; /* for A/C bytes */
+#ifdef CONFIG_PPP_MULTILINK
+ conf.mtu = PPP_MRU;
+ conf.speed = tty_get_baud_rate(tty);
+#endif
+ chan = ppp_register_channel(&conf);
+ if (!chan) {
+ err = -ENOMEM;
goto out_free;
+ }
+ ap->chan = chan;
tty->disc_data = ap;
tty->receive_room = 65536;
@@ -233,7 +238,7 @@ ppp_sync_close(struct tty_struct *tty)
wait_for_completion(&ap->dead_cmp);
tasklet_kill(&ap->tsk);
- ppp_unregister_channel(&ap->chan);
+ ppp_unregister_channel(ap->chan);
skb_queue_purge(&ap->rqueue);
kfree_skb(ap->tpkt);
kfree(ap);
@@ -285,14 +290,14 @@ ppp_synctty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
switch (cmd) {
case PPPIOCGCHAN:
err = -EFAULT;
- if (put_user(ppp_channel_index(&ap->chan), p))
+ if (put_user(ppp_channel_index(ap->chan), p))
break;
err = 0;
break;
case PPPIOCGUNIT:
err = -EFAULT;
- if (put_user(ppp_unit_number(&ap->chan), p))
+ if (put_user(ppp_unit_number(ap->chan), p))
break;
err = 0;
break;
@@ -383,9 +388,9 @@ ppp_sync_init(void)
* The following routines provide the PPP channel interface.
*/
static int
-ppp_sync_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg)
+ppp_sync_ioctl(void *private, unsigned int cmd, unsigned long arg)
{
- struct syncppp *ap = chan->private;
+ struct syncppp *ap = private;
int err, val;
u32 accm[8];
void __user *argp = (void __user *)arg;
@@ -483,16 +488,16 @@ static void ppp_sync_process(struct tasklet_struct *t)
while ((skb = skb_dequeue(&ap->rqueue)) != NULL) {
if (skb->len == 0) {
/* zero length buffers indicate error */
- ppp_input_error(&ap->chan);
+ ppp_input_error(ap->chan);
kfree_skb(skb);
}
else
- ppp_input(&ap->chan, skb);
+ ppp_input(ap->chan, skb);
}
/* try to push more stuff out */
if (test_bit(XMIT_WAKEUP, &ap->xmit_flags) && ppp_sync_push(ap))
- ppp_output_wakeup(&ap->chan);
+ ppp_output_wakeup(ap->chan);
}
/*
@@ -562,9 +567,9 @@ ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *skb)
* at some later time.
*/
static int
-ppp_sync_send(struct ppp_channel *chan, struct sk_buff *skb)
+ppp_sync_send(void *private, struct sk_buff *skb)
{
- struct syncppp *ap = chan->private;
+ struct syncppp *ap = private;
ppp_sync_push(ap);
@@ -649,7 +654,7 @@ ppp_sync_flush_output(struct syncppp *ap)
}
spin_unlock_bh(&ap->xmit_lock);
if (done)
- ppp_output_wakeup(&ap->chan);
+ ppp_output_wakeup(ap->chan);
}
/*
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index d546a7af0d54..47d36d071775 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -357,7 +357,7 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
*/
if (sk->sk_state & PPPOX_BOUND) {
- ppp_input(&po->chan, skb);
+ ppp_input(po->chan, skb);
} else {
if (sock_queue_rcv_skb(sk, skb))
goto abort_kfree;
@@ -625,7 +625,7 @@ static int pppoe_connect(struct socket *sock, struct sockaddr_unsized *uservaddr
po->pppoe_ifindex = 0;
memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa));
- memset(&po->chan, 0, sizeof(po->chan));
+ po->chan = NULL;
po->next = NULL;
po->num = 0;
@@ -634,6 +634,9 @@ static int pppoe_connect(struct socket *sock, struct sockaddr_unsized *uservaddr
/* Re-bind in session stage only */
if (stage_session(sp->sa_addr.pppoe.sid)) {
+ struct ppp_channel_conf conf = {};
+ struct ppp_channel *chan;
+
error = -ENODEV;
net = sock_net(sk);
dev = dev_get_by_name(net, sp->sa_addr.pppoe.dev);
@@ -657,20 +660,23 @@ static int pppoe_connect(struct socket *sock, struct sockaddr_unsized *uservaddr
if (error < 0)
goto err_put;
- po->chan.hdrlen = (sizeof(struct pppoe_hdr) +
+ conf.hdrlen = (sizeof(struct pppoe_hdr) +
dev->hard_header_len);
+#ifdef CONFIG_PPP_MULTILINK
+ conf.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2;
+#endif
+ conf.private = sk;
+ conf.ops = &pppoe_chan_ops;
+ conf.direct_xmit = true;
- po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2;
- po->chan.private = sk;
- po->chan.ops = &pppoe_chan_ops;
- po->chan.direct_xmit = true;
-
- error = ppp_register_net_channel(dev_net(dev), &po->chan);
- if (error) {
+ chan = ppp_register_net_channel(dev_net(dev), &conf);
+ if (!chan) {
+ error = -ENOMEM;
delete_item(pn, po->pppoe_pa.sid,
po->pppoe_pa.remote, po->pppoe_ifindex);
goto err_put;
}
+ po->chan = chan;
sk->sk_state = PPPOX_CONNECTED;
}
@@ -891,17 +897,17 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
* sends PPP frame over PPPoE socket
*
***********************************************************************/
-static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+static int pppoe_xmit(void *private, struct sk_buff *skb)
{
- struct sock *sk = chan->private;
+ struct sock *sk = private;
return __pppoe_xmit(sk, skb);
}
static int pppoe_fill_forward_path(struct net_device_path_ctx *ctx,
struct net_device_path *path,
- const struct ppp_channel *chan)
+ void *private)
{
- struct sock *sk = chan->private;
+ struct sock *sk = private;
struct pppox_sock *po = pppox_sk(sk);
struct net_device *dev = po->pppoe_dev;
diff --git a/drivers/net/ppp/pppox.c b/drivers/net/ppp/pppox.c
index 5861a2f6ce3e..df4fb23a926d 100644
--- a/drivers/net/ppp/pppox.c
+++ b/drivers/net/ppp/pppox.c
@@ -55,7 +55,7 @@ void pppox_unbind_sock(struct sock *sk)
/* Clear connection to ppp device, if attached. */
if (sk->sk_state & (PPPOX_BOUND | PPPOX_CONNECTED)) {
- ppp_unregister_channel(&pppox_sk(sk)->chan);
+ ppp_unregister_channel(pppox_sk(sk)->chan);
sk->sk_state = PPPOX_DEAD;
}
}
@@ -80,7 +80,7 @@ int pppox_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
break;
rc = -EINVAL;
- index = ppp_channel_index(&po->chan);
+ index = ppp_channel_index(po->chan);
if (put_user(index , (int __user *) arg))
break;
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index cc8c102122d8..e49abbe63bf1 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -146,9 +146,9 @@ static struct rtable *pptp_route_output(const struct pppox_sock *po,
return ip_route_output_flow(net, fl4, sk);
}
-static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+static int pptp_xmit(void *private, struct sk_buff *skb)
{
- struct sock *sk = chan->private;
+ struct sock *sk = private;
struct pppox_sock *po = pppox_sk(sk);
struct net *net = sock_net(sk);
struct pptp_opt *opt = &po->proto.pptp;
@@ -338,7 +338,7 @@ static int pptp_rcv_core(struct sock *sk, struct sk_buff *skb)
skb->ip_summed = CHECKSUM_NONE;
skb_set_network_header(skb, skb->head-skb->data);
- ppp_input(&po->chan, skb);
+ ppp_input(po->chan, skb);
return NET_RX_SUCCESS;
}
@@ -422,6 +422,8 @@ static int pptp_connect(struct socket *sock, struct sockaddr_unsized *uservaddr,
struct sockaddr_pppox *sp = (struct sockaddr_pppox *) uservaddr;
struct pppox_sock *po = pppox_sk(sk);
struct pptp_opt *opt = &po->proto.pptp;
+ struct ppp_channel_conf conf = {};
+ struct ppp_channel *chan;
struct rtable *rt;
struct flowi4 fl4;
int error = 0;
@@ -453,9 +455,6 @@ static int pptp_connect(struct socket *sock, struct sockaddr_unsized *uservaddr,
goto end;
}
- po->chan.private = sk;
- po->chan.ops = &pptp_chan_ops;
-
rt = pptp_route_output(po, &fl4);
if (IS_ERR(rt)) {
error = -EHOSTUNREACH;
@@ -463,18 +462,23 @@ static int pptp_connect(struct socket *sock, struct sockaddr_unsized *uservaddr,
}
sk_setup_caps(sk, &rt->dst);
- po->chan.mtu = dst_mtu(&rt->dst);
- if (!po->chan.mtu)
- po->chan.mtu = PPP_MRU;
- po->chan.mtu -= PPTP_HEADER_OVERHEAD;
-
- po->chan.hdrlen = 2 + sizeof(struct pptp_gre_header);
- po->chan.direct_xmit = true;
- error = ppp_register_channel(&po->chan);
- if (error) {
+ conf.private = sk;
+ conf.ops = &pptp_chan_ops;
+ conf.hdrlen = 2 + sizeof(struct pptp_gre_header);
+ conf.direct_xmit = true;
+#ifdef CONFIG_PPP_MULTILINK
+ conf.mtu = dst_mtu(&rt->dst);
+ if (!conf.mtu)
+ conf.mtu = PPP_MRU;
+ conf.mtu -= PPTP_HEADER_OVERHEAD;
+#endif
+ chan = ppp_register_channel(&conf);
+ if (!chan) {
+ error = -ENOMEM;
pr_err("PPTP: failed to register PPP channel (%d)\n", error);
goto end;
}
+ po->chan = chan;
opt->dst_addr = sp->sa_addr.pptp;
sk->sk_state |= PPPOX_CONNECTED;
@@ -577,10 +581,10 @@ static int pptp_create(struct net *net, struct socket *sock, int kern)
return error;
}
-static int pptp_ppp_ioctl(struct ppp_channel *chan, unsigned int cmd,
- unsigned long arg)
+static int pptp_ppp_ioctl(void *private, unsigned int cmd,
+ unsigned long arg)
{
- struct sock *sk = chan->private;
+ struct sock *sk = private;
struct pppox_sock *po = pppox_sk(sk);
struct pptp_opt *opt = &po->proto.pptp;
void __user *argp = (void __user *)arg;
diff --git a/drivers/tty/ipwireless/network.c b/drivers/tty/ipwireless/network.c
index ad2c5157a018..7ac5a2d02d44 100644
--- a/drivers/tty/ipwireless/network.c
+++ b/drivers/tty/ipwireless/network.c
@@ -88,10 +88,10 @@ static void notify_packet_sent(void *callback_data, unsigned int packet_length)
/*
* Called by the ppp system when it has a packet to send to the hardware.
*/
-static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel,
+static int ipwireless_ppp_start_xmit(void *private,
struct sk_buff *skb)
{
- struct ipw_network *network = ppp_channel->private;
+ struct ipw_network *network = private;
unsigned long flags;
spin_lock_irqsave(&network->lock, flags);
@@ -153,10 +153,10 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel,
}
/* Handle an ioctl call that has come in via ppp. (copy of ppp_async_ioctl() */
-static int ipwireless_ppp_ioctl(struct ppp_channel *ppp_channel,
+static int ipwireless_ppp_ioctl(void *private,
unsigned int cmd, unsigned long arg)
{
- struct ipw_network *network = ppp_channel->private;
+ struct ipw_network *network = private;
int err, val;
u32 accm[8];
int __user *user_arg = (int __user *) arg;
@@ -254,19 +254,17 @@ static void do_go_online(struct work_struct *work_go_online)
spin_lock_irqsave(&network->lock, flags);
if (!network->ppp_channel) {
+ struct ppp_channel_conf conf = {};
struct ppp_channel *channel;
spin_unlock_irqrestore(&network->lock, flags);
- channel = kzalloc_obj(struct ppp_channel);
- if (!channel) {
- printk(KERN_ERR IPWIRELESS_PCCARD_NAME
- ": unable to allocate PPP channel\n");
- return;
- }
- channel->private = network;
- channel->mtu = 16384; /* Wild guess */
- channel->hdrlen = 2;
- channel->ops = &ipwireless_ppp_channel_ops;
+
+ conf.private = network;
+ conf.hdrlen = 2;
+ conf.ops = &ipwireless_ppp_channel_ops;
+#ifdef CONFIG_PPP_MULTILINK
+ conf.mtu = 16384; /* Wild guess */
+#endif
network->flags = 0;
network->rbits = 0;
@@ -275,10 +273,10 @@ static void do_go_online(struct work_struct *work_go_online)
network->xaccm[0] = ~0U;
network->xaccm[3] = 0x60000000U;
network->raccm = ~0U;
- if (ppp_register_channel(channel) < 0) {
+ channel = ppp_register_channel(&conf);
+ if (!channel) {
printk(KERN_ERR IPWIRELESS_PCCARD_NAME
": unable to register PPP channel\n");
- kfree(channel);
return;
}
spin_lock_irqsave(&network->lock, flags);
diff --git a/include/linux/if_pppox.h b/include/linux/if_pppox.h
index 594d6dc3f4c9..a1d7c11182ec 100644
--- a/include/linux/if_pppox.h
+++ b/include/linux/if_pppox.h
@@ -40,7 +40,7 @@ struct pptp_opt {
struct pppox_sock {
/* struct sock must be the first member of pppox_sock */
struct sock sk;
- struct ppp_channel chan;
+ struct ppp_channel *chan;
struct pppox_sock __rcu *next; /* for hash table */
union {
struct pppoe_opt pppoe;
diff --git a/include/linux/ppp_channel.h b/include/linux/ppp_channel.h
index 2f63e9a6cc88..e3a3d59d40dc 100644
--- a/include/linux/ppp_channel.h
+++ b/include/linux/ppp_channel.h
@@ -27,55 +27,64 @@ struct ppp_channel;
struct ppp_channel_ops {
/* Send a packet (or multilink fragment) on this channel.
Returns 1 if it was accepted, 0 if not. */
- int (*start_xmit)(struct ppp_channel *, struct sk_buff *);
+ int (*start_xmit)(void *private, struct sk_buff *skb);
/* Handle an ioctl call that has come in via /dev/ppp. */
- int (*ioctl)(struct ppp_channel *, unsigned int, unsigned long);
- int (*fill_forward_path)(struct net_device_path_ctx *,
- struct net_device_path *,
- const struct ppp_channel *);
+ int (*ioctl)(void *private, unsigned int cmd, unsigned long arg);
+ int (*fill_forward_path)(struct net_device_path_ctx *ctx,
+ struct net_device_path *path,
+ void *private);
};
-struct ppp_channel {
+struct ppp_channel_conf {
void *private; /* channel private data */
const struct ppp_channel_ops *ops; /* operations for this channel */
- int mtu; /* max transmit packet size */
int hdrlen; /* amount of headroom channel needs */
- void *ppp; /* opaque to channel */
- int speed; /* transfer rate (bytes/second) */
bool direct_xmit; /* no qdisc, xmit directly */
+#ifdef CONFIG_PPP_MULTILINK
+ int speed; /* transfer rate (bytes/second) */
+ int mtu; /* max transmit packet size */
+#endif
};
#ifdef __KERNEL__
/* Called by the channel when it can send some more data. */
-extern void ppp_output_wakeup(struct ppp_channel *);
+void ppp_output_wakeup(struct ppp_channel *pch);
/* Called by the channel to process a received PPP packet.
The packet should have just the 2-byte PPP protocol header. */
-extern void ppp_input(struct ppp_channel *, struct sk_buff *);
+void ppp_input(struct ppp_channel *pch, struct sk_buff *skb);
/* Called by the channel when an input error occurs, indicating
that we may have missed a packet. */
-extern void ppp_input_error(struct ppp_channel *);
+void ppp_input_error(struct ppp_channel *pch);
-/* Attach a channel to a given PPP unit in specified net. */
-extern int ppp_register_net_channel(struct net *, struct ppp_channel *);
+/* Create a new, unattached ppp channel for specified net. */
+struct ppp_channel *ppp_register_net_channel(struct net *net,
+ const struct ppp_channel_conf *chan);
-/* Attach a channel to a given PPP unit. */
-extern int ppp_register_channel(struct ppp_channel *);
+/* Create a new, unattached ppp channel. */
+struct ppp_channel *ppp_register_channel(const struct ppp_channel_conf *chan);
/* Detach a channel from its PPP unit (e.g. on hangup). */
-extern void ppp_unregister_channel(struct ppp_channel *);
+void ppp_unregister_channel(struct ppp_channel *pch);
/* Get the channel number for a channel */
-extern int ppp_channel_index(struct ppp_channel *);
+int ppp_channel_index(struct ppp_channel *pch);
/* Get the unit number associated with a channel, or -1 if none */
-extern int ppp_unit_number(struct ppp_channel *);
+int ppp_unit_number(struct ppp_channel *pch);
/* Get the device name associated with a channel, or NULL if none.
* Caller must hold RCU read lock.
*/
-extern char *ppp_dev_name(struct ppp_channel *);
+char *ppp_dev_name(struct ppp_channel *pch);
+
+/* Update the MTU of a multilink channel */
+#ifdef CONFIG_PPP_MULTILINK
+void ppp_channel_update_mtu(struct ppp_channel *pch, int mtu);
+#else
+static inline void ppp_channel_update_mtu(struct ppp_channel *pch, int mtu) {}
+#endif
/*
* SMP locking notes:
diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c
index e3c422dc533a..d801233700e7 100644
--- a/net/atm/pppoatm.c
+++ b/net/atm/pppoatm.c
@@ -64,7 +64,7 @@ struct pppoatm_vcc {
atomic_t inflight;
unsigned long blocked;
int flags; /* SC_COMP_PROT - compress protocol */
- struct ppp_channel chan; /* interface to generic ppp layer */
+ struct ppp_channel *chan; /* interface to generic ppp layer */
struct tasklet_struct wakeup_tasklet;
};
@@ -91,11 +91,6 @@ static inline struct pppoatm_vcc *atmvcc_to_pvcc(const struct atm_vcc *atmvcc)
return (struct pppoatm_vcc *) (atmvcc->user_back);
}
-static inline struct pppoatm_vcc *chan_to_pvcc(const struct ppp_channel *chan)
-{
- return (struct pppoatm_vcc *) (chan->private);
-}
-
/*
* We can't do this directly from our _pop handler, since the ppp code
* doesn't want to be called in interrupt context, so we do it from
@@ -105,7 +100,7 @@ static void pppoatm_wakeup_sender(struct tasklet_struct *t)
{
struct pppoatm_vcc *pvcc = from_tasklet(pvcc, t, wakeup_tasklet);
- ppp_output_wakeup(&pvcc->chan);
+ ppp_output_wakeup(pvcc->chan);
}
static void pppoatm_release_cb(struct atm_vcc *atmvcc)
@@ -172,7 +167,7 @@ static void pppoatm_unassign_vcc(struct atm_vcc *atmvcc)
atmvcc->pop = pvcc->old_pop;
atmvcc->release_cb = pvcc->old_release_cb;
tasklet_kill(&pvcc->wakeup_tasklet);
- ppp_unregister_channel(&pvcc->chan);
+ ppp_unregister_channel(pvcc->chan);
atmvcc->user_back = NULL;
kfree(pvcc);
}
@@ -201,7 +196,7 @@ static void pppoatm_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
skb_pull(skb, LLC_LEN);
break;
case e_autodetect:
- if (pvcc->chan.ppp == NULL) { /* Not bound yet! */
+ if (!pvcc->chan) { /* Not bound yet! */
kfree_skb(skb);
return;
}
@@ -215,7 +210,8 @@ static void pppoatm_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
!memcmp(skb->data, &pppllc[LLC_LEN],
sizeof(pppllc) - LLC_LEN)) {
pvcc->encaps = e_vc;
- pvcc->chan.mtu += LLC_LEN;
+ ppp_channel_update_mtu(pvcc->chan,
+ atmvcc->qos.txtp.max_sdu - PPP_HDRLEN);
break;
}
pr_debug("Couldn't autodetect yet (skb: %6ph)\n", skb->data);
@@ -223,12 +219,12 @@ static void pppoatm_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
case e_vc:
break;
}
- ppp_input(&pvcc->chan, skb);
+ ppp_input(pvcc->chan, skb);
return;
error:
kfree_skb(skb);
- ppp_input_error(&pvcc->chan);
+ ppp_input_error(pvcc->chan);
}
static int pppoatm_may_send(struct pppoatm_vcc *pvcc, int size)
@@ -286,9 +282,9 @@ static int pppoatm_may_send(struct pppoatm_vcc *pvcc, int size)
* as success, just to be clear what we're really doing.
*/
#define DROP_PACKET 1
-static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
+static int pppoatm_send(void *private, struct sk_buff *skb)
{
- struct pppoatm_vcc *pvcc = chan_to_pvcc(chan);
+ struct pppoatm_vcc *pvcc = private;
struct atm_vcc *vcc;
int ret;
@@ -367,16 +363,15 @@ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
}
/* This handles ioctls sent to the /dev/ppp interface */
-static int pppoatm_devppp_ioctl(struct ppp_channel *chan, unsigned int cmd,
- unsigned long arg)
+static int pppoatm_devppp_ioctl(void *private, unsigned int cmd,
+ unsigned long arg)
{
+ struct pppoatm_vcc *pvcc = private;
switch (cmd) {
case PPPIOCGFLAGS:
- return put_user(chan_to_pvcc(chan)->flags, (int __user *) arg)
- ? -EFAULT : 0;
+ return put_user(pvcc->flags, (int __user *)arg) ? -EFAULT : 0;
case PPPIOCSFLAGS:
- return get_user(chan_to_pvcc(chan)->flags, (int __user *) arg)
- ? -EFAULT : 0;
+ return get_user(pvcc->flags, (int __user *)arg) ? -EFAULT : 0;
}
return -ENOTTY;
}
@@ -388,9 +383,10 @@ static const struct ppp_channel_ops pppoatm_ops = {
static int pppoatm_assign_vcc(struct atm_vcc *atmvcc, void __user *arg)
{
+ struct ppp_channel_conf conf = {};
struct atm_backend_ppp be;
struct pppoatm_vcc *pvcc;
- int err;
+ struct ppp_channel *chan;
if (copy_from_user(&be, arg, sizeof be))
return -EFAULT;
@@ -409,16 +405,19 @@ static int pppoatm_assign_vcc(struct atm_vcc *atmvcc, void __user *arg)
pvcc->old_owner = atmvcc->owner;
pvcc->old_release_cb = atmvcc->release_cb;
pvcc->encaps = (enum pppoatm_encaps) be.encaps;
- pvcc->chan.private = pvcc;
- pvcc->chan.ops = &pppoatm_ops;
- pvcc->chan.mtu = atmvcc->qos.txtp.max_sdu - PPP_HDRLEN -
+ conf.private = pvcc;
+ conf.ops = &pppoatm_ops;
+#ifdef CONFIG_PPP_MULTILINK
+ conf.mtu = atmvcc->qos.txtp.max_sdu - PPP_HDRLEN -
(be.encaps == e_vc ? 0 : LLC_LEN);
+#endif
tasklet_setup(&pvcc->wakeup_tasklet, pppoatm_wakeup_sender);
- err = ppp_register_channel(&pvcc->chan);
- if (err != 0) {
+ chan = ppp_register_channel(&conf);
+ if (!chan) {
kfree(pvcc);
- return err;
+ return -ENOMEM;
}
+ pvcc->chan = chan;
atmvcc->user_back = pvcc;
atmvcc->push = pppoatm_push;
atmvcc->pop = pppoatm_pop;
@@ -458,11 +457,11 @@ static int pppoatm_ioctl(struct socket *sock, unsigned int cmd,
return pppoatm_assign_vcc(atmvcc, argp);
}
case PPPIOCGCHAN:
- return put_user(ppp_channel_index(&atmvcc_to_pvcc(atmvcc)->
- chan), (int __user *) argp) ? -EFAULT : 0;
+ return put_user(ppp_channel_index(atmvcc_to_pvcc(atmvcc)->chan),
+ (int __user *)argp) ? -EFAULT : 0;
case PPPIOCGUNIT:
- return put_user(ppp_unit_number(&atmvcc_to_pvcc(atmvcc)->
- chan), (int __user *) argp) ? -EFAULT : 0;
+ return put_user(ppp_unit_number(atmvcc_to_pvcc(atmvcc)->chan),
+ (int __user *)argp) ? -EFAULT : 0;
}
return -ENOIOCTLCMD;
}
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 99d6582f41de..6c7b08f4e49a 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -121,7 +121,7 @@ struct pppol2tp_session {
struct sock *__sk; /* Copy of .sk, for cleanup */
};
-static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);
+static int pppol2tp_xmit(void *private, struct sk_buff *skb);
static const struct ppp_channel_ops pppol2tp_chan_ops = {
.start_xmit = pppol2tp_xmit,
@@ -221,7 +221,7 @@ static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int
struct pppox_sock *po;
po = pppox_sk(sk);
- ppp_input(&po->chan, skb);
+ ppp_input(po->chan, skb);
} else {
if (sock_queue_rcv_skb(sk, skb) < 0) {
atomic_long_inc(&session->stats.rx_errors);
@@ -326,9 +326,9 @@ static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
* the skb it supplied, not our cloned skb. So we take care to always
* leave the original skb unfreed if we return an error.
*/
-static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+static int pppol2tp_xmit(void *private, struct sk_buff *skb)
{
- struct sock *sk = (struct sock *)chan->private;
+ struct sock *sk = private;
struct l2tp_session *session;
struct l2tp_tunnel *tunnel;
int uhlen, headroom;
@@ -504,7 +504,7 @@ static void pppol2tp_show(struct seq_file *m, void *arg)
if (sk) {
struct pppox_sock *po = pppox_sk(sk);
- seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan));
+ seq_printf(m, " interface %s\n", ppp_dev_name(po->chan));
}
rcu_read_unlock();
}
@@ -612,7 +612,7 @@ static int pppol2tp_sockaddr_get_info(const void *sa, int sa_len,
* numbers and no IP option. Not quite accurate, but the result is mostly
* unused anyway.
*/
-static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel)
+static int __maybe_unused pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel)
{
int mtu;
@@ -694,6 +694,8 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr_unsized *userva
struct l2tp_tunnel *tunnel;
struct pppol2tp_session *ps;
struct l2tp_session_cfg cfg = { 0, };
+ struct ppp_channel_conf conf = {};
+ struct ppp_channel *chan;
bool drop_refcnt = false;
bool new_session = false;
bool new_tunnel = false;
@@ -792,18 +794,22 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr_unsized *userva
* the net device's hard_header_len at registration, which must be
* sufficient regardless of whether sequence numbers are enabled later.
*/
- po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_SEQ;
+ conf.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_SEQ;
- po->chan.private = sk;
- po->chan.ops = &pppol2tp_chan_ops;
- po->chan.mtu = pppol2tp_tunnel_mtu(tunnel);
- po->chan.direct_xmit = true;
+ conf.private = sk;
+ conf.ops = &pppol2tp_chan_ops;
+#ifdef CONFIG_PPP_MULTILINK
+ conf.mtu = pppol2tp_tunnel_mtu(tunnel);
+#endif
+ conf.direct_xmit = true;
- error = ppp_register_net_channel(sock_net(sk), &po->chan);
- if (error) {
+ chan = ppp_register_net_channel(sock_net(sk), &conf);
+ if (!chan) {
+ error = -ENOMEM;
mutex_unlock(&ps->sk_lock);
goto end;
}
+ po->chan = chan;
out_no_ppp:
/* This is how we get the session context from the socket. */
@@ -1550,7 +1556,7 @@ static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
if (sk) {
struct pppox_sock *po = pppox_sk(sk);
- seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan));
+ seq_printf(m, " interface %s\n", ppp_dev_name(po->chan));
}
rcu_read_unlock();
}
--
2.43.0
^ permalink raw reply related
* [RFC net-next 3/3] docs: update ppp_generic.rst for API changes
From: Qingfang Deng @ 2026-04-16 8:26 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Jonathan Corbet, Shuah Khan, netdev, linux-doc,
linux-kernel
Cc: Paul Mackerras, linux-ppp, Jaco Kroon, James Carlson,
Qingfang Deng
In-Reply-To: <20260416082656.86963-1-qingfang.deng@linux.dev>
Document the new ppp_channel_conf struct and ppp_channel lifecycle
management changes.
Assisted-by: Gemini:gemini-3-flash
Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
---
Documentation/networking/ppp_generic.rst | 33 ++++++++++--------------
1 file changed, 13 insertions(+), 20 deletions(-)
diff --git a/Documentation/networking/ppp_generic.rst b/Documentation/networking/ppp_generic.rst
index 5a10abce5964..8d63f997fb3f 100644
--- a/Documentation/networking/ppp_generic.rst
+++ b/Documentation/networking/ppp_generic.rst
@@ -124,18 +124,19 @@ presented to the start_xmit() function contain only the 2-byte
protocol number and the data, and the skbuffs presented to ppp_input()
must be in the same format.
-The channel must provide an instance of a ppp_channel struct to
-represent the channel. The channel is free to use the ``private`` field
-however it wishes. The channel should initialize the ``mtu`` and
-``hdrlen`` fields before calling ppp_register_channel() and not change
-them until after ppp_unregister_channel() returns. The ``mtu`` field
-represents the maximum size of the data part of the PPP frames, that
-is, it does not include the 2-byte protocol number.
+The channel must provide an instance of a ppp_channel_conf struct to
+describe the channel during registration. The generic layer will
+allocate a ppp_channel struct and return a pointer to it. The
+ppp_channel struct is opaque to the channel driver. The ``mtu`` field
+(if multilink is enabled) represents the maximum size of the data part
+of the PPP frames, that is, it does not include the 2-byte protocol
+number. ppp_channel_update_mtu() can be called by the channel driver
+to update the ``mtu`` field once LCP MRU negotiation is complete.
If the channel needs some headroom in the skbuffs presented to it for
transmission (i.e., some space free in the skbuff data area before the
start of the PPP frame), it should set the ``hdrlen`` field of the
-ppp_channel struct to the amount of headroom required. The generic
+ppp_channel_conf struct to the amount of headroom required. The generic
PPP layer will attempt to provide that much headroom but the channel
should still check if there is sufficient headroom and copy the skbuff
if there isn't.
@@ -199,20 +200,12 @@ The PPP generic layer has been designed to be SMP-safe. Locks are
used around accesses to the internal data structures where necessary
to ensure their integrity. As part of this, the generic layer
requires that the channels adhere to certain requirements and in turn
-provides certain guarantees to the channels. Essentially the channels
-are required to provide the appropriate locking on the ppp_channel
-structures that form the basis of the communication between the
-channel and the generic layer. This is because the channel provides
-the storage for the ppp_channel structure, and so the channel is
-required to provide the guarantee that this storage exists and is
-valid at the appropriate times.
+provides certain guarantees to the channels. The generic layer manages
+the ppp_channel object, ensuring it exists and is valid while the
+channel is registered.
The generic layer requires these guarantees from the channel:
-* The ppp_channel object must exist from the time that
- ppp_register_channel() is called until after the call to
- ppp_unregister_channel() returns.
-
* No thread may be in a call to any of ppp_input(), ppp_input_error(),
ppp_output_wakeup(), ppp_channel_index() or ppp_unit_number() for a
channel at the time that ppp_unregister_channel() is called for that
@@ -453,4 +446,4 @@ an interface unit are:
fragments is disabled. This ioctl is only available if the
CONFIG_PPP_MULTILINK option is selected.
-Last modified: 7-feb-2002
+Last modified: 16-apr-2026
--
2.43.0
^ permalink raw reply related
* Re: [PATCH net-next v3] net: mctp: don't require received header reserved bits to be zero
From: Paolo Abeni @ 2026-04-16 8:30 UTC (permalink / raw)
To: wit_yuan, jk; +Cc: yuanzm2, matt, davem, edumazet, kuba, netdev, linux-kernel
In-Reply-To: <20260413080333.73086-1-yuanzhaoming901030@126.com>
On 4/13/26 10:03 AM, wit_yuan wrote:
> From: Yuan Zhaoming <yuanzm2@lenovo.com>
>
> From the MCTP Base specification (DSP0236 v1.2.1), the first byte of
> the MCTP header contains a 4 bit reserved field, and 4 bit version.
>
> On our current receive path, we require those 4 reserved bits to be
> zero, but the 9500-8i card is non-conformant, and may set these
> reserved bits.
>
> DSP0236 states that the reserved bits must be written as zero, and
> ignored when read. While the device might not conform to the former,
> we should accept these message to conform to the latter.
>
> Relax our check on the MCTP version byte to allow non-zero bits in the
> reserved field.
>
> Signed-off-by: Yuan Zhaoming <yuanzm2@lenovo.com>
The net-next tree is currently closed for the merge window, but IMHO
this change could be considered a fix. Please repost for 'net' and add a
suitable fixes tag.
> ---
> v2: https://lore.kernel.org/netdev/20260410144339.0d1b289a@kernel.org/T/#t
> v1: https://lore.kernel.org/netdev/ff147a3f0d27ef2aa6026cc86f9113d56a8c61ac.camel@codeconstruct.com.au/T/#t
> ---
> include/net/mctp.h | 3 +++
> net/mctp/route.c | 8 ++++++--
> 2 files changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/include/net/mctp.h b/include/net/mctp.h
> index e1e0a69..d8bf907 100644
> --- a/include/net/mctp.h
> +++ b/include/net/mctp.h
> @@ -26,6 +26,9 @@ struct mctp_hdr {
> #define MCTP_VER_MIN 1
> #define MCTP_VER_MAX 1
>
> +/* Definitions for ver field */
> +#define MCTP_HDR_VER_MASK GENMASK(3, 0)
> +
> /* Definitions for flags_seq_tag field */
> #define MCTP_HDR_FLAG_SOM BIT(7)
> #define MCTP_HDR_FLAG_EOM BIT(6)
> diff --git a/net/mctp/route.c b/net/mctp/route.c
> index e69c6f7..62517c9 100644
> --- a/net/mctp/route.c
> +++ b/net/mctp/route.c
> @@ -439,6 +439,7 @@ static int mctp_dst_input(struct mctp_dst *dst, struct sk_buff *skb)
> struct mctp_hdr *mh;
> unsigned int netid;
> unsigned long f;
> + u8 ver;
> u8 tag, flags;
> int rc;
Please respect the reverse christmas tree order above.
/P
^ permalink raw reply
* [PATCH bpf-next v4 4/6] bpf: allow new DECAP flags and add guard rails
From: Nick Hudson @ 2026-04-16 7:55 UTC (permalink / raw)
To: bpf, netdev, Willem de Bruijn, Martin KaFai Lau
Cc: Nick Hudson, Max Tottenham, Anna Glasgall, Alexei Starovoitov,
Daniel Borkmann, Andrii Nakryiko, Eduard Zingerman,
Kumar Kartikeya Dwivedi, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, linux-kernel
In-Reply-To: <20260416075514.927101-1-nhudson@akamai.com>
Add checks to require shrink-only decap, reject conflicting decap flag
combinations, and verify removed length is sufficient for claimed header
decapsulation.
Co-developed-by: Max Tottenham <mtottenh@akamai.com>
Signed-off-by: Max Tottenham <mtottenh@akamai.com>
Co-developed-by: Anna Glasgall <aglasgal@akamai.com>
Signed-off-by: Anna Glasgall <aglasgal@akamai.com>
Signed-off-by: Nick Hudson <nhudson@akamai.com>
---
net/core/filter.c | 44 +++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 43 insertions(+), 1 deletion(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index 4e860da4381d..7f8d43420afb 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -56,6 +56,7 @@
#include <net/sock_reuseport.h>
#include <net/busy_poll.h>
#include <net/tcp.h>
+#include <net/gre.h>
#include <net/xfrm.h>
#include <net/udp.h>
#include <linux/bpf_trace.h>
@@ -3490,6 +3491,12 @@ static u32 bpf_skb_net_base_len(const struct sk_buff *skb)
#define BPF_F_ADJ_ROOM_DECAP_L3_MASK (BPF_F_ADJ_ROOM_DECAP_L3_IPV4 | \
BPF_F_ADJ_ROOM_DECAP_L3_IPV6)
+#define BPF_F_ADJ_ROOM_DECAP_L4_MASK (BPF_F_ADJ_ROOM_DECAP_L4_UDP | \
+ BPF_F_ADJ_ROOM_DECAP_L4_GRE)
+
+#define BPF_F_ADJ_ROOM_DECAP_IPXIP_MASK (BPF_F_ADJ_ROOM_DECAP_IPXIP4 | \
+ BPF_F_ADJ_ROOM_DECAP_IPXIP6)
+
#define BPF_F_ADJ_ROOM_ENCAP_MASK (BPF_F_ADJ_ROOM_ENCAP_L3_MASK | \
BPF_F_ADJ_ROOM_ENCAP_L4_GRE | \
BPF_F_ADJ_ROOM_ENCAP_L4_UDP | \
@@ -3497,7 +3504,9 @@ static u32 bpf_skb_net_base_len(const struct sk_buff *skb)
BPF_F_ADJ_ROOM_ENCAP_L2( \
BPF_ADJ_ROOM_ENCAP_L2_MASK))
-#define BPF_F_ADJ_ROOM_DECAP_MASK (BPF_F_ADJ_ROOM_DECAP_L3_MASK)
+#define BPF_F_ADJ_ROOM_DECAP_MASK (BPF_F_ADJ_ROOM_DECAP_L3_MASK | \
+ BPF_F_ADJ_ROOM_DECAP_L4_MASK | \
+ BPF_F_ADJ_ROOM_DECAP_IPXIP_MASK)
#define BPF_F_ADJ_ROOM_MASK (BPF_F_ADJ_ROOM_FIXED_GSO | \
BPF_F_ADJ_ROOM_ENCAP_MASK | \
@@ -3740,6 +3749,8 @@ BPF_CALL_4(bpf_skb_adjust_room, struct sk_buff *, skb, s32, len_diff,
}
if (flags & BPF_F_ADJ_ROOM_DECAP_MASK) {
+ u32 len_decap_min = 0;
+
if (!shrink)
return -EINVAL;
@@ -3748,6 +3759,37 @@ BPF_CALL_4(bpf_skb_adjust_room, struct sk_buff *, skb, s32, len_diff,
BPF_F_ADJ_ROOM_DECAP_L3_MASK)
return -EINVAL;
+ if ((flags & BPF_F_ADJ_ROOM_DECAP_L4_MASK) ==
+ BPF_F_ADJ_ROOM_DECAP_L4_MASK)
+ return -EINVAL;
+
+ if ((flags & BPF_F_ADJ_ROOM_DECAP_IPXIP_MASK) ==
+ BPF_F_ADJ_ROOM_DECAP_IPXIP_MASK)
+ return -EINVAL;
+
+ /* Reject mutually exclusive decap tunnel type flags. */
+ if ((flags & BPF_F_ADJ_ROOM_DECAP_L4_MASK) &&
+ (flags & BPF_F_ADJ_ROOM_DECAP_IPXIP_MASK))
+ return -EINVAL;
+
+ if (flags & BPF_F_ADJ_ROOM_DECAP_L4_MASK)
+ len_decap_min += bpf_skb_net_base_len(skb);
+
+ if (flags & BPF_F_ADJ_ROOM_DECAP_L4_UDP)
+ len_decap_min += sizeof(struct udphdr);
+
+ if (flags & BPF_F_ADJ_ROOM_DECAP_L4_GRE)
+ len_decap_min += sizeof(struct gre_base_hdr);
+
+ if (flags & BPF_F_ADJ_ROOM_DECAP_IPXIP4)
+ len_decap_min += sizeof(struct iphdr);
+
+ if (flags & BPF_F_ADJ_ROOM_DECAP_IPXIP6)
+ len_decap_min += sizeof(struct ipv6hdr);
+
+ if (len_diff_abs < len_decap_min)
+ return -EINVAL;
+
if (flags & BPF_F_ADJ_ROOM_DECAP_L3_IPV4)
len_min = sizeof(struct iphdr);
--
2.34.1
^ permalink raw reply related
* Re: [PATCH bpf-next v4 5/6] bpf: clear decap tunnel GSO state in skb_adjust_room
From: bot+bpf-ci @ 2026-04-16 8:34 UTC (permalink / raw)
To: nhudson, bpf, netdev, willemb, martin.lau
Cc: nhudson, mtottenh, aglasgal, daniel, ast, andrii, eddyz87, memxor,
davem, edumazet, kuba, pabeni, linux-kernel, ast, andrii, daniel,
martin.lau, eddyz87, yonghong.song, clm, ihor.solodrai
In-Reply-To: <20260416075514.927101-6-nhudson@akamai.com>
[-- Attachment #1: Type: text/plain, Size: 2910 bytes --]
> diff --git a/net/core/filter.c b/net/core/filter.c
> index 1dac64b50de4..4e77e9c46f1a 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -3657,6 +3657,44 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 off, u32 len_diff,
> if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO))
> skb_increase_gso_size(shinfo, len_diff);
>
> + /* Selective GSO flag clearing based on decap type.
> + * Only clear the flags for the tunnel layer being removed.
> + */
> + if ((flags & BPF_F_ADJ_ROOM_DECAP_L4_UDP) &&
The symbols BPF_F_ADJ_ROOM_DECAP_L4_UDP, BPF_F_ADJ_ROOM_DECAP_L4_GRE,
BPF_F_ADJ_ROOM_DECAP_IPXIP4, BPF_F_ADJ_ROOM_DECAP_IPXIP6,
BPF_F_ADJ_ROOM_DECAP_L4_MASK, and BPF_F_ADJ_ROOM_DECAP_IPXIP_MASK
are used throughout this hunk but are not defined anywhere in the tree.
The series cover letter lists patch 3/6 "bpf: add
BPF_F_ADJ_ROOM_DECAP_* flags for tunnel decapsulation" which would
add these to include/uapi/linux/bpf.h, but that patch is not present.
Without it, this commit will not compile.
Additionally, even if these symbols were defined, BPF_F_ADJ_ROOM_MASK
and BPF_F_ADJ_ROOM_DECAP_MASK do not include the new flag bits. Both
bpf_skb_adjust_room():
if (unlikely(flags & ~BPF_F_ADJ_ROOM_MASK))
return -EINVAL;
and bpf_skb_net_shrink():
if (unlikely(flags & ~(BPF_F_ADJ_ROOM_DECAP_MASK |
BPF_F_ADJ_ROOM_FIXED_GSO |
BPF_F_ADJ_ROOM_NO_CSUM_RESET)))
return -EINVAL;
would reject any flags value containing these new bits, making the
new code unreachable. Patch 4/6 "bpf: allow new DECAP flags and add
guard rails" from the series would presumably update these masks, but
it is also not present.
Are patches 3/6 and 4/6 of the series missing from this tree?
> + (shinfo->gso_type & (SKB_GSO_UDP_TUNNEL |
> + SKB_GSO_UDP_TUNNEL_CSUM)))
> + shinfo->gso_type &= ~(SKB_GSO_UDP_TUNNEL |
> + SKB_GSO_UDP_TUNNEL_CSUM);
[ ... ]
> + /* Clear encapsulation flag only when no tunnel GSO flags remain */
> + if (flags & (BPF_F_ADJ_ROOM_DECAP_L4_MASK |
> + BPF_F_ADJ_ROOM_DECAP_IPXIP_MASK)) {
[ ... ]
> + if (flags & BPF_F_ADJ_ROOM_DECAP_L4_UDP) {
> + skb->encap_hdr_csum = 0;
> + skb->remcsum_offload = 0;
> + }
> + }
This isn't a bug, but the BPF subsystem convention is that multi-line
comments should have the opening /* on its own line:
> + /* Selective GSO flag clearing based on decap type.
> + * Only clear the flags for the tunnel layer being removed.
> + */
Should be:
/*
* Selective GSO flag clearing based on decap type.
* Only clear the flags for the tunnel layer being removed.
*/
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24499314045
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox