* [PATCH 1/6] lib: include crc32.h conditionally on CONFIG_CRC32
From: Yury Norov @ 2026-04-30 21:13 UTC (permalink / raw)
To: Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Yury Norov, Rasmus Villemoes, Arnd Bergmann, Andrew Lunn,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Andrew Morton, Alexei Starovoitov, Daniel Borkmann,
Jesper Dangaard Brouer, John Fastabend, Stanislav Fomichev,
Jinjie Ruan, linux-kernel, linux-riscv, linux-arch, netdev, bpf
Cc: Yury Norov, Nathan Chancellor
In-Reply-To: <20260430211351.658193-1-ynorov@nvidia.com>
Currently, bitreverse API is either declared based on
CONFIG_HAVE_ARCH_BITREVERSE, wired to arch implementation, or if the
arch has no bitreverse, based on generic implementation.
So, regardless of CONFIG_BITREVERSE=n, the corresponding API is always
declared. If that happens, the functions become declared but not
implemented, which is an error.
The following patches of the series make it possible to have bitreverse
API undeclared if CONFIG_BITREVERSE=n, thus spotting the problem when
building the tinyconfig:
$ make -skj"$(nproc)" ARCH=s390 CROSS_COMPILE=s390-linux- mrproper tinyconfig fs/select.o
In file included from include/linux/crc32.h:6,
from include/linux/etherdevice.h:23,
from include/linux/if_vlan.h:11,
from include/linux/filter.h:21,
from include/net/xdp.h:10,
from include/net/busy_poll.h:19,
from fs/select.c:33:
include/linux/etherdevice.h: In function 'eth_hw_addr_crc':
include/linux/bitrev.h:16:20: error: implicit declaration of function 'generic___bitrev32' [-Wimplicit-function-declaration]
16 | #define __bitrev32 generic___bitrev32
| ^~~~~~~~~~~~~~~~~~
include/linux/bitrev.h:67:9: note: in expansion of macro '__bitrev32'
67 | __bitrev32(__x); \
| ^~~~~~~~~~
include/linux/crc32.h:107:36: note: in expansion of macro 'bitrev32'
107 | #define ether_crc(length, data) bitrev32(crc32_le(~0, data, length))
| ^~~~~~~~
include/linux/etherdevice.h:292:16: note: in expansion of macro 'ether_crc'
292 | return ether_crc(ETH_ALEN, ha->addr);
| ^~~~~~~~~
make[5]: *** [scripts/Makefile.build:289: fs/select.o] Error 1
...
The current unconditionally enabled codebase doesn't use CRC32, neither
bitrev functionality, and if generic___bitrev32 prototype is provided,
the compilation and linkage phases are passed OK.
The only header requiring the crc32 and bitreverse prototypes is
include/linux/etherdevice.h. Thus, protect inclusion of corresponding
headers in the etherdevice with CONFIG_CRC32, together with the only
function depending on it.
Reported-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Yury Norov <ynorov@nvidia.com>
---
include/linux/etherdevice.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index df8f88f63a70..d35be27a91a5 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -20,7 +20,9 @@
#include <linux/if_ether.h>
#include <linux/netdevice.h>
#include <linux/random.h>
+#ifdef CONFIG_CRC32
#include <linux/crc32.h>
+#endif
#include <linux/unaligned.h>
#include <asm/bitsperlong.h>
@@ -281,6 +283,7 @@ static inline void eth_hw_addr_random(struct net_device *dev)
dev->addr_assign_type = NET_ADDR_RANDOM;
}
+#ifdef CONFIG_CRC32
/**
* eth_hw_addr_crc - Calculate CRC from netdev_hw_addr
* @ha: pointer to hardware address
@@ -291,6 +294,7 @@ static inline u32 eth_hw_addr_crc(struct netdev_hw_addr *ha)
{
return ether_crc(ETH_ALEN, ha->addr);
}
+#endif
/**
* ether_addr_copy - Copy an Ethernet address
--
2.51.0
^ permalink raw reply related
* [PATCH 0/6] lib: rework bitreverse
From: Yury Norov @ 2026-04-30 21:13 UTC (permalink / raw)
To: Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Yury Norov, Rasmus Villemoes, Arnd Bergmann, Andrew Lunn,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Andrew Morton, Alexei Starovoitov, Daniel Borkmann,
Jesper Dangaard Brouer, John Fastabend, Stanislav Fomichev,
Jinjie Ruan, linux-kernel, linux-riscv, linux-arch, netdev, bpf
Cc: Yury Norov
This series is a resend for Jinjie Ruan's "arch/riscv: Add bitrev.h file
to support rev8 and brev8" [1], my follow-up "lib: compile generic
bitrev based on GENERIC_BITREVERSE" [2], and the fix for a build error
reported by Nathan Chancellor [3].
No changes, except for combining pieces together and rebasing on top of
the tree.
[1] https://lore.kernel.org/all/20260421130752.607500-1-ruanjinjie@huawei.com/
[2] https://lore.kernel.org/all/20260427205210.397471-1-ynorov@nvidia.com/
[3] https://lore.kernel.org/all/20260429202922.GA3575295@ax162/
Build-tested against x86 tinyconfig and defconfig, having disabled and
enabiled CRC32 and BITREVERSE, correspondingly.
Jinjie Ruan (3):
lib/bitrev: Introduce GENERIC_BITREVERSE and cleanup Kconfig
bitops: Define generic __bitrev8/16/32 for reuse
arch/riscv: Add bitrev.h file to support rev8 and brev8
Yury Norov (3):
lib: include crc32.h conditionally on CONFIG_CRC32
lib: compile generic bitrev.c conditionally on GENERIC_BITREVERSE
MAINTAINERS: BITOPS: include bitrev.[ch]
MAINTAINERS | 2 ++
arch/riscv/Kconfig | 2 ++
arch/riscv/include/asm/bitrev.h | 51 +++++++++++++++++++++++++++
include/asm-generic/bitops/__bitrev.h | 25 +++++++++++++
include/linux/bitrev.h | 20 +++--------
include/linux/etherdevice.h | 4 +++
lib/Kconfig | 18 ++++++++++
lib/Makefile | 2 +-
lib/bitrev.c | 3 --
9 files changed, 107 insertions(+), 20 deletions(-)
create mode 100644 arch/riscv/include/asm/bitrev.h
create mode 100644 include/asm-generic/bitops/__bitrev.h
--
2.51.0
^ permalink raw reply
* [PATCH net-next v2] net: phy: broadcom: Save PHY counters during suspend
From: Justin Chen @ 2026-04-30 21:11 UTC (permalink / raw)
To: netdev
Cc: pabeni, kuba, edumazet, davem, linux, hkallweit1, andrew,
bcm-kernel-feedback-list, florian.fainelli, Justin Chen
The PHY counters can be lost if the PHY is reset during suspend. We
need to save the values into the shadow counters or the accounting
will be incorrect over multiple suspend and resume cycles.
Signed-off-by: Justin Chen <justin.chen@broadcom.com>
---
v2
- Removed hook into bcm7xxx_suspend(). We dont have phy stats for 40NM phys
nor shadow stats.
drivers/net/phy/bcm-phy-lib.c | 9 +++++++++
drivers/net/phy/bcm-phy-lib.h | 1 +
drivers/net/phy/bcm7xxx.c | 14 ++++++++++++++
drivers/net/phy/broadcom.c | 5 +++++
4 files changed, 29 insertions(+)
diff --git a/drivers/net/phy/bcm-phy-lib.c b/drivers/net/phy/bcm-phy-lib.c
index 5198d66dbbc0..b64beade8dd9 100644
--- a/drivers/net/phy/bcm-phy-lib.c
+++ b/drivers/net/phy/bcm-phy-lib.c
@@ -563,6 +563,15 @@ void bcm_phy_get_stats(struct phy_device *phydev, u64 *shadow,
}
EXPORT_SYMBOL_GPL(bcm_phy_get_stats);
+void bcm_phy_update_stats_shadow(struct phy_device *phydev, u64 *shadow)
+{
+ unsigned int i;
+
+ for (i = 0; i < ARRAY_SIZE(bcm_phy_hw_stats); i++)
+ bcm_phy_get_stat(phydev, shadow, i);
+}
+EXPORT_SYMBOL_GPL(bcm_phy_update_stats_shadow);
+
void bcm_phy_r_rc_cal_reset(struct phy_device *phydev)
{
/* Reset R_CAL/RC_CAL Engine */
diff --git a/drivers/net/phy/bcm-phy-lib.h b/drivers/net/phy/bcm-phy-lib.h
index bceddbc860eb..bba94ce96195 100644
--- a/drivers/net/phy/bcm-phy-lib.h
+++ b/drivers/net/phy/bcm-phy-lib.h
@@ -85,6 +85,7 @@ int bcm_phy_get_sset_count(struct phy_device *phydev);
void bcm_phy_get_strings(struct phy_device *phydev, u8 *data);
void bcm_phy_get_stats(struct phy_device *phydev, u64 *shadow,
struct ethtool_stats *stats, u64 *data);
+void bcm_phy_update_stats_shadow(struct phy_device *phydev, u64 *shadow);
void bcm_phy_r_rc_cal_reset(struct phy_device *phydev);
int bcm_phy_28nm_a0b0_afe_config_init(struct phy_device *phydev);
int bcm_phy_enable_jumbo(struct phy_device *phydev);
diff --git a/drivers/net/phy/bcm7xxx.c b/drivers/net/phy/bcm7xxx.c
index 00e8fa14aa77..71a163f62c0e 100644
--- a/drivers/net/phy/bcm7xxx.c
+++ b/drivers/net/phy/bcm7xxx.c
@@ -807,6 +807,17 @@ static void bcm7xxx_28nm_get_phy_stats(struct phy_device *phydev,
bcm_phy_get_stats(phydev, priv->stats, stats, data);
}
+static int bcm7xxx_28nm_suspend(struct phy_device *phydev)
+{
+ struct bcm7xxx_phy_priv *priv = phydev->priv;
+
+ mutex_lock(&phydev->lock);
+ bcm_phy_update_stats_shadow(phydev, priv->stats);
+ mutex_unlock(&phydev->lock);
+
+ return genphy_suspend(phydev);
+}
+
static int bcm7xxx_28nm_probe(struct phy_device *phydev)
{
struct bcm7xxx_phy_priv *priv;
@@ -849,6 +860,7 @@ static int bcm7xxx_28nm_probe(struct phy_device *phydev)
.flags = PHY_IS_INTERNAL, \
.config_init = bcm7xxx_28nm_config_init, \
.resume = bcm7xxx_28nm_resume, \
+ .suspend = bcm7xxx_28nm_suspend, \
.get_tunable = bcm7xxx_28nm_get_tunable, \
.set_tunable = bcm7xxx_28nm_set_tunable, \
.get_sset_count = bcm_phy_get_sset_count, \
@@ -866,6 +878,7 @@ static int bcm7xxx_28nm_probe(struct phy_device *phydev)
.flags = PHY_IS_INTERNAL, \
.config_init = bcm7xxx_28nm_ephy_config_init, \
.resume = bcm7xxx_28nm_ephy_resume, \
+ .suspend = bcm7xxx_28nm_suspend, \
.get_sset_count = bcm_phy_get_sset_count, \
.get_strings = bcm_phy_get_strings, \
.get_stats = bcm7xxx_28nm_get_phy_stats, \
@@ -902,6 +915,7 @@ static int bcm7xxx_28nm_probe(struct phy_device *phydev)
.config_aneg = genphy_config_aneg, \
.read_status = genphy_read_status, \
.resume = bcm7xxx_16nm_ephy_resume, \
+ .suspend = bcm7xxx_28nm_suspend, \
}
static struct phy_driver bcm7xxx_driver[] = {
diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
index bf0c6a04481e..d1a4edb34ad2 100644
--- a/drivers/net/phy/broadcom.c
+++ b/drivers/net/phy/broadcom.c
@@ -592,8 +592,13 @@ static int bcm54xx_set_wakeup_irq(struct phy_device *phydev, bool state)
static int bcm54xx_suspend(struct phy_device *phydev)
{
+ struct bcm54xx_phy_priv *priv = phydev->priv;
int ret = 0;
+ mutex_lock(&phydev->lock);
+ bcm_phy_update_stats_shadow(phydev, priv->stats);
+ mutex_unlock(&phydev->lock);
+
bcm54xx_ptp_stop(phydev);
/* Acknowledge any Wake-on-LAN interrupt prior to suspend */
--
2.34.1
^ permalink raw reply related
* Re: [PATCH v1 bpf 1/2] bpf: tcp: Fix type confusion in bpf_tcp_sock().
From: Daniel Borkmann @ 2026-04-30 21:00 UTC (permalink / raw)
To: Kuniyuki Iwashima, Martin KaFai Lau, Alexei Starovoitov,
Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi
Cc: John Fastabend, Stanislav Fomichev, Song Liu, Yonghong Song,
Jiri Olsa, Eric Dumazet, Kuniyuki Iwashima, bpf, netdev,
Damiano Melotti
In-Reply-To: <20260430184405.1227386-2-kuniyu@google.com>
On 4/30/26 8:43 PM, Kuniyuki Iwashima wrote:
> bpf_tcp_sock() only check if sk->sk_protocol is IPPROTO_TCP,
> but RAW socket can bypass it:
>
> socket(AF_INET, SOCK_RAW, IPPROTO_TCP)
>
> Calling bpf_setsockopt() in SOCKOPT prog triggers out-of-bounds
> access to another slab object. [0]
>
> Let's use sk_is_tcp().
>
> [0]:
> BUG: KASAN: slab-out-of-bounds in sol_tcp_sockopt (net/core/filter.c:5519)
> Read of size 8 at addr ffff88801083d760 by task test_progs/1259
>
> CPU: 1 UID: 0 PID: 1259 Comm: test_progs Tainted: G OE 7.0.0-11175-gb5c111f4967b #1 PREEMPT(full)
> Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
> Call Trace:
> <TASK>
> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
> print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
> kasan_report (mm/kasan/report.c:595)
> sol_tcp_sockopt (net/core/filter.c:5519)
> __bpf_getsockopt (net/core/filter.c:5633)
> bpf_sk_getsockopt (net/core/filter.c:5654)
> bpf_prog_629ba00a1601e9f2__setsockopt+0x86/0x22c
> __cgroup_bpf_run_filter_setsockopt (./include/linux/bpf.h:1402 ./include/linux/filter.h:722 ./include/linux/filter.h:729 kernel/bpf/cgroup.c:81 kernel/bpf/cgroup.c:2026)
> do_sock_setsockopt (net/socket.c:2363)
> __x64_sys_setsockopt (net/socket.c:2406)
> do_syscall_64 (arch/x86/entry/syscall_64.c:63)
> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
> RIP: 0033:0x7f85f82fe7de
> Code: 55 48 63 c9 48 63 ff 45 89 c9 48 89 e5 48 83 ec 08 6a 2c e8 34 69 f7 ff c9 c3 66 90 f3 0f 1e fa 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 e1
> RSP: 002b:00007ffe59dcecd8 EFLAGS: 00000202 ORIG_RAX: 0000000000000036
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f85f82fe7de
> RDX: 000000000000001c RSI: 0000000000000006 RDI: 000000000000000d
> RBP: 00007ffe59dcef20 R08: 000000000000003c R09: 0000000000000000
> R10: 00007ffe59dcef00 R11: 0000000000000202 R12: 00007ffe59dcf268
> R13: 0000000000000003 R14: 00007f85f9da5000 R15: 000055b2f3201400
> </TASK>
>
> The buggy address belongs to the object at ffff88801083d280
> which belongs to the cache RAW of size 1792
> The buggy address is located 1248 bytes inside of
> allocated 1792-byte region [ffff88801083d280, ffff88801083d980)
>
> Fixes: 655a51e536c0 ("bpf: Add struct bpf_tcp_sock and BPF_FUNC_tcp_sock")
> Reported-by: Damiano Melotti <melotti@google.com>
> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
First one lgtm:
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Thanks!
^ permalink raw reply
* Re: [PATCH net 0/2] net: mctp: test: minor kunit test fixes
From: patchwork-bot+netdevbpf @ 2026-04-30 21:00 UTC (permalink / raw)
To: Jeremy Kerr
Cc: matt, davem, edumazet, kuba, pabeni, horms, netdev, oliver.sang
In-Reply-To: <20260429-dev-mctp-test-fixes-v1-0-1127b7425809@codeconstruct.com.au>
Hello:
This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 29 Apr 2026 16:21:40 +0800 you wrote:
> This series provides two fixes in the MCTP kunit tests - one exposed by
> ktr, and one found while debugging the former on different VM configs.
>
> Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
> ---
> Jeremy Kerr (2):
> net: mctp: test: use a zeroed struct sockaddr_mctp
> net: mctp: test: Use dev_direct_xmit for TX to our test device
>
> [...]
Here is the summary with links:
- [net,1/2] net: mctp: test: use a zeroed struct sockaddr_mctp
https://git.kernel.org/netdev/net/c/18ed60e33e6c
- [net,2/2] net: mctp: test: Use dev_direct_xmit for TX to our test device
https://git.kernel.org/netdev/net/c/768729710641
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [Intel-wired-lan] [PATCH iwl-net v2] idpf: do not perform flow ops when netdev is detached
From: Li Li @ 2026-04-30 20:58 UTC (permalink / raw)
To: Jacob Keller
Cc: Simon Horman, anthony.l.nguyen, przemyslaw.kitszel, davem, kuba,
edumazet, intel-wired-lan, netdev, linux-kernel, decot,
anjali.singhai, sridhar.samudrala, brianvv, emil.s.tantilov,
stable
In-Reply-To: <25163a38-53b5-445c-936c-0cba94cb731f@intel.com>
On Thu, Apr 23, 2026 at 11:40 AM Jacob Keller <jacob.e.keller@intel.com> wrote:
>
> On 4/23/2026 9:33 AM, Simon Horman wrote:
> > From: 'Simon Horman' <horms@kernel.org>
> >
> > This is an AI-generated review of your patch. The human sending this
> > email has considered the AI review valid, or at least plausible.
> > Full review at: https://sashiko.dev
> > ---
> > idpf: do not perform flow ops when netdev is detached
> >
> > This commit adds checks to prevent crashes when out-of-tree modules bypass
> > ethtool core locks and call flow operations on detached netdevs during a
> > hardware reset. It introduces netdev and netif_device_present checks in
> > idpf_get_rxnfc and idpf_set_rxnfc.
> >
> >> Even though commit 2e281e1155fc ("idpf: detach and close netdevs while
> >> handling a reset") prevents ethtool -N/-n operations to operate on
> >> detached netdevs, we found that out-of-tree workflows like OpenOnload
> >> can bypass ethtool core locks and call idpf_set_rxnfc directly during
> >> an idpf HW reset.
> >
> > Is it acceptable to add defensive checks upstream solely to accommodate
> > out-of-tree modules that bypass core kernel locking?
> >
> > The core ethtool infrastructure manages locks like rtnl_lock for in-tree
> > callers to guarantee safety. Modifying the upstream driver to paper over
> > locking violations in out-of-tree modules might contradict upstream policies.
> >
> > Simon says: If this is to address OOT module behaviour then I am concerned.
> > And I would suggest that the correct approach is to fix
> > the OOT kernel module.
> >
>
> The commit message says: "OpenOnload can bypass ethtool core locks and
> call idpf_set_rxnfc directly". But if it somehow calls
> idpf_set_rxnfc_directly without holding the appropriate locks, then no
> amount of changes to the idpf driver will fix that issue. It is simply
> unsafe for that to be occurring, and this feels like it just patches one
> specific problem without addressing the root cause that something is
> calling the drivers ethtool function without correctly holding the
> expected locks.
>
>
> @Li Li, could you please explain more details about the workflow that
> triggers these behaviors? If it can't be reproduced with in-tree modules
> then I don't think we can accept this fix.
Yes, OpenOnload calls idpf_set_rxnfc directly without checking if the
netdev is detached first. I've discussed this with the team
internally, and we decided to fix OpenOnload directly, rather than
adding the check in idpf.
Please feel free to drop this patch, thank you!
^ permalink raw reply
* Re: [PATCH net 06/12] netfilter: nf_conntrack_expect: honor expectation helper field
From: Ilya Maximets @ 2026-04-30 20:58 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel, fw
Cc: davem, netdev, kuba, pabeni, edumazet, horms, i.maximets,
Eelco Chaudron, Aaron Conole
In-Reply-To: <20260326125153.685915-7-pablo@netfilter.org>
On 3/26/26 1:51 PM, Pablo Neira Ayuso wrote:
> The expectation helper field is mostly unused. As a result, the
> netfilter codebase relies on accessing the helper through exp->master.
>
> Always set on the expectation helper field so it can be used to reach
> the helper.
>
> nf_ct_expect_init() is called from packet path where the skb owns
> the ct object, therefore accessing exp->master for the newly created
> expectation is safe. This saves a lot of updates in all callsites
> to pass the ct object as parameter to nf_ct_expect_init().
>
> This is a preparation patches for follow up fixes.
>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
Hi, Pablo and Florian.
I was investigating FTP test failures in OVS with 7.0 kernel and bisected
the issue down to this commit. AFAIU, with this change all the related
connections over time gain their parents' helpers,. This is causing a change
visible to the userspace, because FTP data connections are now reported to
have helpers in the conntrack dump:
# conntrack -L
tcp 6 119 TIME_WAIT src=10.1.1.1 dst=10.1.1.2 sport=59534 dport=21 \
src=10.1.1.2 dst=10.1.1.1 sport=21 dport=59534 \
[ASSURED] mark=0 helper=ftp use=2
tcp 6 119 TIME_WAIT src=10.1.1.2 dst=10.1.1.1 sport=52709 dport=52381 \
src=10.1.1.1 dst=10.1.1.2 sport=52381 dport=52709 \
[ASSURED] mark=0 helper=ftp use=1
Before this commit only the control connection had helper=ftp reported in
the dump. The traffic seems to work fine, but our tests fail because we
do not expect the helper attached.
AFAIU, it's generally not something that should be happening, as helpers
on data connections do not really make much sense. But I'm just trying to
figure out if you would consider this as a regression and fix in the kernel
or if we should adjust our userspace components for this new dump content,
which would not be very straightforward to do if we want to be able to run
tests on both old and the new versions.
What do you think?
Best regards, Ilya Maximets.
^ permalink raw reply
* Re: [PATCH] net: stmmac: Add support for TX/RX channel interrupt
From: Andrew Lunn @ 2026-04-30 20:53 UTC (permalink / raw)
To: muhammad.nazim.amirul.nazle.asmade
Cc: netdev, davem, kuba, pabeni, edumazet, andrew+netdev,
linux-kernel
In-Reply-To: <20260429072728.13638-1-muhammad.nazim.amirul.nazle.asmade@altera.com>
> + /* For RX Channel */
> + for (i = 0; i < MTL_MAX_RX_QUEUES; i++) {
> + snprintf(irq_name, sizeof(irq_name), "dma_rx%i", i);
> + irq = platform_get_irq_byname_optional(pdev, irq_name);
> + if (irq == -EPROBE_DEFER)
> + return irq;
> + else if (irq < 0)
> + break;
It would be good to differentiate between real errors, and it not
being available. I think -ENOXIO is returned when it does not
exist. Anything else is a real error?
Andrew
^ permalink raw reply
* Re: [PATCH net-next] net: mctp: test: remove skb dumps from test output
From: patchwork-bot+netdevbpf @ 2026-04-30 20:50 UTC (permalink / raw)
To: Jeremy Kerr; +Cc: matt, davem, edumazet, kuba, pabeni, horms, netdev
In-Reply-To: <20260429-dev-mctp-test-skb-dump-v1-1-13fd5789ef71@codeconstruct.com.au>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 29 Apr 2026 16:27:31 +0800 you wrote:
> We're currently dumping skb info in our fragment input test, which makes
> interpreting the TAP test output a bit awkward.
>
> Remove the skb dumps.
>
> Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
>
> [...]
Here is the summary with links:
- [net-next] net: mctp: test: remove skb dumps from test output
https://git.kernel.org/netdev/net-next/c/8ca4bff2ff3e
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v1 bpf 2/2] selftest: bpf: Add test for bpf_tcp_sock() and RAW socket.
From: Kuniyuki Iwashima @ 2026-04-30 20:32 UTC (permalink / raw)
To: Martin KaFai Lau, Daniel Borkmann, Alexei Starovoitov,
Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi
Cc: John Fastabend, Stanislav Fomichev, Song Liu, Yonghong Song,
Jiri Olsa, Eric Dumazet, Kuniyuki Iwashima, bpf, netdev
In-Reply-To: <20260430184405.1227386-3-kuniyu@google.com>
On Thu, Apr 30, 2026 at 11:44 AM Kuniyuki Iwashima <kuniyu@google.com> wrote:
>
> Let's extend sockopt_sk.c to cover bpf_tcp_sock() for the
> wrong socket type.
>
> Before:
> # ./test_progs -t sockopt_sk
> [ 151.948613] ==================================================================
> [ 151.951376] BUG: KASAN: slab-out-of-bounds in sol_tcp_sockopt+0xc7/0x8e0
> [ 151.954159] Read of size 8 at addr ffff88801083d760 by task test_progs/1259
> ...
> run_test:FAIL:getsetsockopt unexpected error: -1 (errno 22)
> #427 sockopt_sk:FAIL
>
> After:
> #427 sockopt_sk:OK
>
> While at it, missing free() is fixed up.
>
> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
> ---
> .../selftests/bpf/prog_tests/sockopt_sk.c | 17 ++++++++++++++++-
> tools/testing/selftests/bpf/progs/sockopt_sk.c | 16 ++++++++++++++++
> 2 files changed, 32 insertions(+), 1 deletion(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c b/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c
> index 53637431ec5d..87e771c8991f 100644
> --- a/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c
> +++ b/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c
> @@ -190,7 +190,7 @@ static int getsetsockopt(void)
> fd = socket(AF_NETLINK, SOCK_RAW, 0);
> if (fd < 0) {
> log_err("Failed to create AF_NETLINK socket");
> - return -1;
> + goto err;
> }
>
> buf.u32 = 1;
> @@ -211,6 +211,21 @@ static int getsetsockopt(void)
> }
> ASSERT_EQ(optlen, 8, "Unexpected NETLINK_LIST_MEMBERSHIPS value");
>
> + /* Trick bpf_tcp_sock() with IPPROTO_TCP */
> + close(fd);
> + fd = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
> + if (fd < 0) {
> + log_err("Failed to create RAW socket");
> + goto err;
> + }
> +
> + optlen = 60;
> + err = setsockopt(fd, SOL_TCP, TCP_SAVED_SYN, &buf, optlen);
> + if (err) {
Ugh, I forgot to commit s/err/!err/ change.. :/
pw-bot: cr
^ permalink raw reply
* [PATCH net v2 2/2] selftest: net: Add test for TCP flow failover with ECMP routes.
From: Sagarika Sharma @ 2026-04-30 20:09 UTC (permalink / raw)
To: David S . Miller, David Ahern, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Shuah Khan, Simon Horman, Kuniyuki Iwashima, netdev,
linux-kselftest, Sagarika Sharma
In-Reply-To: <20260430200909.527827-1-sharmasagarika@google.com>
From: Kuniyuki Iwashima <kuniyu@google.com>
Without the previous commit, TCP failed to switch to alternative
IPv6 routes immediately upon carrier loss.
It would persist with the dead route until reaching the threshold
net.ipv4.tcp_retries1, leading to unnecessary delays in failover.
Let's add a selftest for this scenario to ensure TCP fails over
immediately upon a carrier loss event.
Before:
TEST: TCP IPv4 failover [ OK ]
TEST: TCP IPv6 failover [FAIL]
After:
TEST: TCP IPv4 failover [ OK ]
TEST: TCP IPv6 failover [ OK ]
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Sagarika Sharma <sharmasagarika@google.com>
---
v2: Add require_command, fix exit code and shellcheck warnings
except for SC2154 (netns allocation confuses shellcheck),
lower threshold of packets captured for success.
---
tools/testing/selftests/net/Makefile | 1 +
.../selftests/net/tcp_ecmp_failover.sh | 216 ++++++++++++++++++
2 files changed, 217 insertions(+)
create mode 100755 tools/testing/selftests/net/tcp_ecmp_failover.sh
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index a275ed584026..f3da38c54d27 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -96,6 +96,7 @@ TEST_PROGS := \
srv6_hl2encap_red_l2vpn_test.sh \
srv6_iptunnel_cache.sh \
stress_reuseport_listen.sh \
+ tcp_ecmp_failover.sh \
tcp_fastopen_backup_key.sh \
test_bpf.sh \
test_bridge_backup_port.sh \
diff --git a/tools/testing/selftests/net/tcp_ecmp_failover.sh b/tools/testing/selftests/net/tcp_ecmp_failover.sh
new file mode 100755
index 000000000000..5768aa8bff6a
--- /dev/null
+++ b/tools/testing/selftests/net/tcp_ecmp_failover.sh
@@ -0,0 +1,216 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Copyright 2026 Google LLC.
+#
+# This test verifies TCP flow failover between ECMP routes
+# upon carrier loss on the active device.
+#
+# socat -----------------------------> socat
+# |
+# .-- veth-c1 -|- veth-s1 --.
+# dummy0 -| | |-- dummy0
+# '-- veth-c2 -|- veth-s2 --'
+# |
+#
+
+REQUIRE_JQ=no
+REQUIRE_MZ=no
+NUM_NETIFS=0
+
+source forwarding/lib.sh
+
+CLIENT_IP="10.0.59.1"
+SERVER_IP="10.0.92.1"
+CLIENT_IP6="2001:db8:5a9a::1"
+SERVER_IP6="2001:db8:9292::1"
+
+setup_server()
+{
+ IP="ip -n $server"
+ NS_EXEC="ip netns exec $server"
+
+ $IP link add dummy0 type dummy
+ $IP link set dummy0 up
+
+ $IP -4 addr add $SERVER_IP/32 dev dummy0
+ $IP -6 addr add $SERVER_IP6/128 dev dummy0 nodad
+
+ $IP link set veth-s1 up
+ $IP link set veth-s2 up
+
+ $IP -4 addr add 192.168.1.2/24 dev veth-s1
+ $IP -4 addr add 192.168.2.2/24 dev veth-s2
+
+ $IP -4 route add $CLIENT_IP/32 \
+ nexthop via 192.168.1.1 dev veth-s1 weight 1 \
+ nexthop via 192.168.2.1 dev veth-s2 weight 1
+
+ $IP -6 addr add 2001:db8:1::2/64 dev veth-s1 nodad
+ $IP -6 addr add 2001:db8:2::2/64 dev veth-s2 nodad
+
+ $IP -6 route add $CLIENT_IP6/128 \
+ nexthop via 2001:db8:1::1 dev veth-s1 weight 1 \
+ nexthop via 2001:db8:2::1 dev veth-s2 weight 1
+}
+
+setup_client()
+{
+ IP="ip -n $client"
+ NS_EXEC="ip netns exec $client"
+
+ $IP link add dummy0 type dummy
+ $IP link set dummy0 up
+
+ $IP -4 addr add $CLIENT_IP/32 dev dummy0
+ $IP -6 addr add $CLIENT_IP6/128 dev dummy0 nodad
+
+ $IP link set veth-c1 up
+ $IP link set veth-c2 up
+
+ $IP -4 addr add 192.168.1.1/24 dev veth-c1
+ $IP -4 addr add 192.168.2.1/24 dev veth-c2
+
+ $IP -4 route add $SERVER_IP/32 \
+ nexthop via 192.168.1.2 dev veth-c1 weight 1 \
+ nexthop via 192.168.2.2 dev veth-c2 weight 1
+
+ $IP -6 addr add 2001:db8:1::1/64 dev veth-c1 nodad
+ $IP -6 addr add 2001:db8:2::1/64 dev veth-c2 nodad
+
+ $IP -6 route add $SERVER_IP6/128 \
+ nexthop via 2001:db8:1::2 dev veth-c1 weight 1 \
+ nexthop via 2001:db8:2::2 dev veth-c2 weight 1
+
+ # By default, tcp_retries1=3 triggers a route refresh
+ # after 3 retransmits (~5s). Ensure this never occurs
+ # for test stability.
+ $NS_EXEC sysctl -qw net.ipv4.tcp_retries1=100
+
+ # When NETDEV_CHANGE is issued for a dev tied to an ECMP
+ # route, RTNH_F_LINKDOWN is flagged and the sernum is
+ # bumped to invalidate the route via sk_dst_check().
+ #
+ # Without ignore_routes_with_linkdown=1, subsequent
+ # lookups may still select the same RTNH_F_LINKDOWN route.
+ $NS_EXEC sysctl -qw net.ipv4.conf.veth-c1.ignore_routes_with_linkdown=1
+ $NS_EXEC sysctl -qw net.ipv4.conf.veth-c2.ignore_routes_with_linkdown=1
+
+ $NS_EXEC sysctl -qw net.ipv6.conf.veth-c1.ignore_routes_with_linkdown=1
+ $NS_EXEC sysctl -qw net.ipv6.conf.veth-c2.ignore_routes_with_linkdown=1
+}
+
+setup()
+{
+ setup_ns client server
+
+ ip -n "$client" link add veth-c1 type veth peer veth-s1 netns "$server"
+ ip -n "$client" link add veth-c2 type veth peer veth-s2 netns "$server"
+
+ setup_server
+ setup_client
+}
+
+cleanup()
+{
+ cleanup_all_ns > /dev/null 2>&1
+}
+
+tcp_ecmp_failover()
+{
+ local pf=$1; shift
+ local server_ip=$1; shift
+ local client_ip=$1; shift
+
+ RET=0
+
+ tcpdump_start veth-s1 "$server"
+ tcpdump_start veth-s2 "$server"
+
+ ip netns exec "$server" \
+ socat -u TCP-LISTEN:8080,pf="$pf",bind="$server_ip",reuseaddr /dev/null &
+ server_pid=$!
+
+ # Wait for server to start listening.
+ # Sometimes client fails without this sleep.
+ sleep 1
+
+ ip netns exec "$client" \
+ socat -u /dev/zero TCP:"$server_ip":8080,pf="$pf",bind="$client_ip" &
+ client_pid=$!
+
+ # To capture enough packets.
+ sleep 3
+
+ tcpdump_stop veth-s1
+ tcpdump_stop veth-s2
+
+ pkts_s1=$(tcpdump_show veth-s1 | wc -l)
+ pkts_s2=$(tcpdump_show veth-s2 | wc -l)
+
+ tcpdump_cleanup veth-s1
+ tcpdump_cleanup veth-s2
+
+ # Detect the device chosen by the client
+ if [ "$pkts_s1" -gt "$pkts_s2" ]; then
+ veth_down=veth-s1
+ veth_up=veth-s2
+ else
+ veth_down=veth-s2
+ veth_up=veth-s1
+ fi
+
+ # Taking down $veth_down causes its peer to lose carrier,
+ # triggering NETDEV_CHANGE. This flags RTNH_F_LINKDOWN
+ # and bumps the sernum for the route associated with that
+ # peer, invalidating the cached dst in the TCP socket.
+ #
+ # Consequently, sk_dst_check() fails, forcing the subsequent
+ # lookup to select the remaining healthy route via $veth_up.
+ ip -n "$server" link set "$veth_down" down
+
+ tcpdump_start "$veth_up" "$server"
+
+ # To capture enough packets.
+ sleep 3
+
+ tcpdump_stop "$veth_up"
+
+ kill -9 "$client_pid" > /dev/null 2>&1
+ kill -9 "$server_pid" > /dev/null 2>&1
+ wait 2> /dev/null
+
+ pkts=$(tcpdump_show $veth_up | wc -l)
+
+ tcpdump_cleanup "$veth_up"
+
+ if [ "$pkts" -lt 1000 ]; then
+ RET=$ksft_fail
+ fi
+}
+
+test_ipv4()
+{
+ setup
+ tcp_ecmp_failover IPv4 $SERVER_IP $CLIENT_IP
+ log_test "TCP IPv4 failover"
+ cleanup
+}
+
+test_ipv6()
+{
+ setup
+ tcp_ecmp_failover IPv6 "[$SERVER_IP6]" "[$CLIENT_IP6]"
+ log_test "TCP IPv6 failover"
+ cleanup
+}
+
+require_command socat
+require_command tcpdump
+
+trap cleanup EXIT
+
+test_ipv4
+test_ipv6
+
+exit "$EXIT_STATUS"
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH net v2 1/2] ipv6: update route serial number on NETDEV_CHANGE
From: Sagarika Sharma @ 2026-04-30 20:09 UTC (permalink / raw)
To: David S . Miller, David Ahern, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Shuah Khan, Simon Horman, Kuniyuki Iwashima, netdev,
linux-kselftest, Sagarika Sharma, Ido Schimmel
In-Reply-To: <20260430200909.527827-1-sharmasagarika@google.com>
When using IPv6 ECMP routes, if a netdev listed as a nexthop experiences
a carrier change event (e.g., a bond device generating a NETDEV_CHANGE
event after its slaves go linkdown), established connections utilizing
that nexthop fail to fail over to other available nexthops. Instead,
these connections stall or drop.
This happens because the IPv6 FIB code does not invalidate the socket's
cached destination when a NETDEV_CHANGE event occurs. While
fib6_ifdown() correctly marks the nexthop with RTNH_F_LINKDOWN, it
leaves the route's serial number unchanged. As a result, sockets with a
previously cached dst do not realize the route is no longer viable and
continue to try using the non-functional nexthop.
This behavior contrasts with IPv4, which actively flushes cached
destinations on a NETDEV_CHANGE event (see fib_netdev_event() in
net/ipv4/fib_frontend.c).
Fix this by updating the route serial number in fib6_ifdown() when
setting RTNH_F_LINKDOWN. This invalidates stale cached destinations,
forcing sockets to perform a new route lookup and fail over to a
functioning nexthop.
Fixes: 51ebd3181572 ("ipv6: add support of equal cost multipath (ECMP)")
Signed-off-by: Sagarika Sharma <sharmasagarika@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
---
net/ipv6/route.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 19eb6b702227..0dc0316530ca 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -4995,6 +4995,7 @@ static int fib6_ifdown(struct fib6_info *rt, void *p_arg)
rt->fib6_flags & (RTF_LOCAL | RTF_ANYCAST))
break;
rt->fib6_nh->fib_nh_flags |= RTNH_F_LINKDOWN;
+ fib6_update_sernum(net, rt);
rt6_multipath_rebalance(rt);
break;
}
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH net v2 0/2] ipv6: fix ECMP route failover on carrier loss
From: Sagarika Sharma @ 2026-04-30 20:08 UTC (permalink / raw)
To: David S . Miller, David Ahern, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Shuah Khan, Simon Horman, Kuniyuki Iwashima, netdev,
linux-kselftest, Sagarika Sharma
This patchset resolves an issue where established IPv6 connections are
unable to transition to alternative ECMP nexthops upon carrier loss.
Unlike IPv4, the IPv6 routing subsystem does not actively invalidate
cached destinations during a NETDEV_CHANGE event. Sockets persist
with dead routes, leading to stalled traffic or connection drops.
This series introduces a fix to trigger route invalidation by
updating the route serial number on link carrier loss and provides
a corresponding selftest to validate the failover behavior for IPv4
and IPv6.
---
v2:
- Changes to selftest addressing Ido’s and sashiko’s suggestions:
require_command for socat and tcpdump, EXIT trap, lower threshold
for test success, and fix exit code.
v1: https://lore.kernel.org/netdev/20260427224243.3499162-1-sharmasagarika@google.com/
Kuniyuki Iwashima (1):
selftest: net: Add test for TCP flow failover with ECMP routes.
Sagarika Sharma (1):
ipv6: update route serial number on NETDEV_CHANGE
net/ipv6/route.c | 1 +
tools/testing/selftests/net/Makefile | 1 +
.../selftests/net/tcp_ecmp_failover.sh | 216 ++++++++++++++++++
3 files changed, 218 insertions(+)
create mode 100755 tools/testing/selftests/net/tcp_ecmp_failover.sh
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply
* Re: [PATCH net-next] selftests: drv-net: Enable ntuple-filters if supported
From: Joe Damato @ 2026-04-30 19:36 UTC (permalink / raw)
To: Dimitri Daskalakis
Cc: David S . Miller, Andrew Lunn, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Shuah Khan, Dimitri Daskalakis, David Wei,
Dragos Tatulea, Vishwanath Seshagiri, Pavel Begunkov,
Simon Horman, Pavan Chebbi, Michael Chan, Gal Pressman,
linux-kselftest, netdev
In-Reply-To: <20260430165217.3700469-1-dimitri.daskalakis1@gmail.com>
On Thu, Apr 30, 2026 at 09:52:17AM -0700, Dimitri Daskalakis wrote:
> From: Dimitri Daskalakis <daskald@meta.com>
>
> Certain devices which support ntuple-filters do not enable the feature
> by default. The existing tests will skip (if they check for the feature),
> or fail if they blindly attempt to install rules. Therefore, attempt to turn
> on ntuple-filters if the device supports them.
>
> Signed-off-by: Dimitri Daskalakis <daskald@meta.com>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> tools/testing/selftests/drivers/net/gro.py | 10 ++++++++++
> tools/testing/selftests/drivers/net/hw/gro_hw.py | 10 ++++++++++
> tools/testing/selftests/drivers/net/hw/iou-zcrx.py | 12 ++++++++++++
> tools/testing/selftests/drivers/net/hw/ntuple.py | 5 ++++-
> tools/testing/selftests/drivers/net/hw/rss_ctx.py | 7 ++++---
> 5 files changed, 40 insertions(+), 4 deletions(-)
I suppose a future cleanup might be able to add a generic helper for this for
all of the ethtool settings (tx-udp-segmentation, ntuple, etc) to
EthtoolFamily or something?
That said:
Reviewed-by: Joe Damato <joe@dama.to>
^ permalink raw reply
* Re: [PATCH net-next v3 2/3] net/ethernet/zte/dinghai: add logging infrastructure
From: Andrew Lunn @ 2026-04-30 19:36 UTC (permalink / raw)
To: Junyang Han
Cc: andrew+netdev, netdev, vadim.fedorenko, davem, edumazet, kuba,
pabeni, ran.ming, han.chengfei, zhang.yanze
In-Reply-To: <20260430151138.2813381-3-han.junyang@zte.com.cn>
> ret = pci_enable_device(dev->pdev);
> - if (ret)
> + if (ret) {
> + LOG_ERR(dev, "pci_enable_device failed: %d\n", ret);
I asked that your use dev_err().
Andrew
^ permalink raw reply
* Re: [PATCH net-next v3 1/3] net/ethernet: add ZTE network driver support
From: Andrew Lunn @ 2026-04-30 19:34 UTC (permalink / raw)
To: Junyang Han
Cc: andrew+netdev, netdev, vadim.fedorenko, davem, edumazet, kuba,
pabeni, ran.ming, han.chengfei, zhang.yanze
In-Reply-To: <20260430151138.2813381-2-han.junyang@zte.com.cn>
> + struct zxdh_pf_device *pf_dev = NULL;
Please don't initialise variables, unless they actual do need
initialising. It mask used before set warnings the compiler will
issue.
> +void dh_pf_pci_close(struct dh_core_dev *dev)
> +{
> + struct zxdh_pf_device *pf_dev = NULL;
Looks like you can just set it so dev->priv.
> +static int dh_pf_probe(struct pci_dev *pdev, const struct pci_device_id *id)
> +{
> + struct dh_core_dev *dh_dev;
> + struct zxdh_pf_device *pf_dev;
Reverse Christmas tree.
> + struct devlink *devlink;
> + int ret;
> +
> + devlink = devlink_alloc(&dh_pf_devlink_ops, sizeof(struct dh_core_dev),
> + &pdev->dev);
Wrong indentation. In fact, this seems to have spaces not tabs. What
does checkpatch say about these files? Or is you email still broken?
No point reviewing further if the basic are wrong.
Andrew
---
pw-bot: cr
^ permalink raw reply
* Re: [PATCH net-next v3 4/4] net: dsa: initial support for MT7628 embedded switch
From: Andrew Lunn @ 2026-04-30 19:19 UTC (permalink / raw)
To: Joris Vaisvila
Cc: netdev, horms, pabeni, kuba, edumazet, davem, olteanv, devicetree,
Rob Herring, Krzysztof Kozlowski, Conor Dooley
In-Reply-To: <20260428185510.261521-5-joey@tinyisr.com>
> source "drivers/net/dsa/lantiq/Kconfig"
>
> +config NET_DSA_MT7628
> + tristate "MediaTek MT7628 Embedded Ethernet switch support"
> + select NET_DSA_TAG_MT7628
> + select MEDIATEK_FE_SOC_PHY
> + help
> + This enables support for the built-in Ethernet switch found
> + in the MT7628 SoC.
> +
> config NET_DSA_MT7530
> tristate "MediaTek MT7530 and MT7531 Ethernet switch support"
NET_DSA_MT7628 is > NET_DSA_MT7530 so should come second.
> +static int mt7628_mii_read(struct mii_bus *bus, int port, int regnum)
> +{
> + struct mt7628_esw *esw = bus->priv;
> + int ret;
> + u32 val;
> +
> + ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> + !(val & MT7628_ESW_PCR1_RD_DONE), 10,
> + 5000);
> + if (ret)
> + goto out;
> +
> + ret = regmap_write(esw->regmap, MT7628_ESW_REG_PCR0,
> + FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_REG,
> + regnum) |
> + FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_ADDR,
> + port) | MT7628_ESW_PCR0_RD_PHY_CMD);
> + if (ret)
> + goto out;
> +
> + ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> + (val & MT7628_ESW_PCR1_RD_DONE), 10,
> + 5000);
> +out:
> + if (ret) {
> + dev_err(&bus->dev, "read failed. MDIO timeout?\n");
> + return ret;
> + }
> + return FIELD_GET(MT7628_ESW_PCR1_RD_DATA, val);
This works, but it is an unusual structure. Normally the label is
after the normal exist path, and only deals with errors.
> +}
> +
> +static int mt7628_mii_write(struct mii_bus *bus, int port, int regnum, u16 dat)
> +{
> + ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> + (val & MT7628_ESW_PCR1_WT_DONE), 10,
> + 5000);
> +out:
> + if (ret) {
> + dev_err(&bus->dev, "write failed. MDIO timeout?\n");
> + return ret;
> + }
> + return 0;
> +}
Same here.
Otherwise this looks O.K.
Andrew
^ permalink raw reply
* Re: [PATCH net-next v2 1/2] mv88e6xxx: Refactor 6352's serdes functions
From: Andrew Lunn @ 2026-04-30 19:06 UTC (permalink / raw)
To: Fidan Aliyeva
Cc: olteanv, davem, edumazet, kuba, pabeni, netdev, linux-kernel,
thomas.eckerman.ext
In-Reply-To: <20260430124907.3533344-2-fidan.aliyeva.ext@ericsson.com>
> @@ -185,7 +200,7 @@ size_t mv88e6352_serdes_get_stats(struct mv88e6xxx_chip *chip, int port,
>
> for (i = 0; i < ARRAY_SIZE(mv88e6352_serdes_hw_stats); i++) {
> stat = &mv88e6352_serdes_hw_stats[i];
> - value = mv88e6352_serdes_get_stat(chip, stat);
> + value = mv88e6352_serdes_get_stat(chip, MV88E6352_ADDR_SERDES, stat);
If you generalise this, you can use the same code for the mv88e6321.
> +void mv88e6352_serdes_get_regs(struct mv88e6xxx_chip *chip, int port, void *_p)
> +{
> + int err;
> +
> + err = mv88e6352_g2_scratch_port_has_serdes(chip, port);
> + if (err <= 0)
> + return;
> +
> + mv88e6352_serdes_get_regs_from_lane(chip, MV88E6352_ADDR_SERDES, _p);
Here as well.
This is however looking a lot better. Thanks for the generalisation
patch.
Andrew
---
pw-bot: cr
^ permalink raw reply
* [PATCH v1 bpf 2/2] selftest: bpf: Add test for bpf_tcp_sock() and RAW socket.
From: Kuniyuki Iwashima @ 2026-04-30 18:43 UTC (permalink / raw)
To: Martin KaFai Lau, Daniel Borkmann, Alexei Starovoitov,
Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi
Cc: John Fastabend, Stanislav Fomichev, Song Liu, Yonghong Song,
Jiri Olsa, Eric Dumazet, Kuniyuki Iwashima, Kuniyuki Iwashima,
bpf, netdev
In-Reply-To: <20260430184405.1227386-1-kuniyu@google.com>
Let's extend sockopt_sk.c to cover bpf_tcp_sock() for the
wrong socket type.
Before:
# ./test_progs -t sockopt_sk
[ 151.948613] ==================================================================
[ 151.951376] BUG: KASAN: slab-out-of-bounds in sol_tcp_sockopt+0xc7/0x8e0
[ 151.954159] Read of size 8 at addr ffff88801083d760 by task test_progs/1259
...
run_test:FAIL:getsetsockopt unexpected error: -1 (errno 22)
#427 sockopt_sk:FAIL
After:
#427 sockopt_sk:OK
While at it, missing free() is fixed up.
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
---
.../selftests/bpf/prog_tests/sockopt_sk.c | 17 ++++++++++++++++-
tools/testing/selftests/bpf/progs/sockopt_sk.c | 16 ++++++++++++++++
2 files changed, 32 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c b/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c
index 53637431ec5d..87e771c8991f 100644
--- a/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c
+++ b/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c
@@ -190,7 +190,7 @@ static int getsetsockopt(void)
fd = socket(AF_NETLINK, SOCK_RAW, 0);
if (fd < 0) {
log_err("Failed to create AF_NETLINK socket");
- return -1;
+ goto err;
}
buf.u32 = 1;
@@ -211,6 +211,21 @@ static int getsetsockopt(void)
}
ASSERT_EQ(optlen, 8, "Unexpected NETLINK_LIST_MEMBERSHIPS value");
+ /* Trick bpf_tcp_sock() with IPPROTO_TCP */
+ close(fd);
+ fd = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
+ if (fd < 0) {
+ log_err("Failed to create RAW socket");
+ goto err;
+ }
+
+ optlen = 60;
+ err = setsockopt(fd, SOL_TCP, TCP_SAVED_SYN, &buf, optlen);
+ if (err) {
+ log_err("Unexpected setsockopt(TCP_SAVED_SYN)");
+ goto err;
+ }
+
free(big_buf);
close(fd);
return 0;
diff --git a/tools/testing/selftests/bpf/progs/sockopt_sk.c b/tools/testing/selftests/bpf/progs/sockopt_sk.c
index cb990a7d3d45..5e0b27e7855c 100644
--- a/tools/testing/selftests/bpf/progs/sockopt_sk.c
+++ b/tools/testing/selftests/bpf/progs/sockopt_sk.c
@@ -149,6 +149,20 @@ int _setsockopt(struct bpf_sockopt *ctx)
if (sk && sk->family == AF_NETLINK)
goto out;
+ if (sk && sk->family == AF_INET && sk->type == SOCK_RAW) {
+ struct bpf_tcp_sock *tp = bpf_tcp_sock(sk);
+
+ if (tp) {
+ char saved_syn[60];
+
+ bpf_getsockopt(sk, SOL_TCP, TCP_SAVED_SYN,
+ &saved_syn, sizeof(saved_syn));
+ goto consumed;
+ }
+
+ goto out;
+ }
+
/* Make sure bpf_get_netns_cookie is callable.
*/
if (bpf_get_netns_cookie(NULL) == 0)
@@ -224,6 +238,8 @@ int _setsockopt(struct bpf_sockopt *ctx)
return 0; /* couldn't get sk storage */
storage->val = optval[0];
+
+consumed:
ctx->optlen = -1; /* BPF has consumed this option, don't call kernel
* setsockopt handler.
*/
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH v1 bpf 1/2] bpf: tcp: Fix type confusion in bpf_tcp_sock().
From: Kuniyuki Iwashima @ 2026-04-30 18:43 UTC (permalink / raw)
To: Martin KaFai Lau, Daniel Borkmann, Alexei Starovoitov,
Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi
Cc: John Fastabend, Stanislav Fomichev, Song Liu, Yonghong Song,
Jiri Olsa, Eric Dumazet, Kuniyuki Iwashima, Kuniyuki Iwashima,
bpf, netdev, Damiano Melotti
In-Reply-To: <20260430184405.1227386-1-kuniyu@google.com>
bpf_tcp_sock() only check if sk->sk_protocol is IPPROTO_TCP,
but RAW socket can bypass it:
socket(AF_INET, SOCK_RAW, IPPROTO_TCP)
Calling bpf_setsockopt() in SOCKOPT prog triggers out-of-bounds
access to another slab object. [0]
Let's use sk_is_tcp().
[0]:
BUG: KASAN: slab-out-of-bounds in sol_tcp_sockopt (net/core/filter.c:5519)
Read of size 8 at addr ffff88801083d760 by task test_progs/1259
CPU: 1 UID: 0 PID: 1259 Comm: test_progs Tainted: G OE 7.0.0-11175-gb5c111f4967b #1 PREEMPT(full)
Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
sol_tcp_sockopt (net/core/filter.c:5519)
__bpf_getsockopt (net/core/filter.c:5633)
bpf_sk_getsockopt (net/core/filter.c:5654)
bpf_prog_629ba00a1601e9f2__setsockopt+0x86/0x22c
__cgroup_bpf_run_filter_setsockopt (./include/linux/bpf.h:1402 ./include/linux/filter.h:722 ./include/linux/filter.h:729 kernel/bpf/cgroup.c:81 kernel/bpf/cgroup.c:2026)
do_sock_setsockopt (net/socket.c:2363)
__x64_sys_setsockopt (net/socket.c:2406)
do_syscall_64 (arch/x86/entry/syscall_64.c:63)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
RIP: 0033:0x7f85f82fe7de
Code: 55 48 63 c9 48 63 ff 45 89 c9 48 89 e5 48 83 ec 08 6a 2c e8 34 69 f7 ff c9 c3 66 90 f3 0f 1e fa 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 e1
RSP: 002b:00007ffe59dcecd8 EFLAGS: 00000202 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f85f82fe7de
RDX: 000000000000001c RSI: 0000000000000006 RDI: 000000000000000d
RBP: 00007ffe59dcef20 R08: 000000000000003c R09: 0000000000000000
R10: 00007ffe59dcef00 R11: 0000000000000202 R12: 00007ffe59dcf268
R13: 0000000000000003 R14: 00007f85f9da5000 R15: 000055b2f3201400
</TASK>
The buggy address belongs to the object at ffff88801083d280
which belongs to the cache RAW of size 1792
The buggy address is located 1248 bytes inside of
allocated 1792-byte region [ffff88801083d280, ffff88801083d980)
Fixes: 655a51e536c0 ("bpf: Add struct bpf_tcp_sock and BPF_FUNC_tcp_sock")
Reported-by: Damiano Melotti <melotti@google.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
---
net/core/filter.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index bc96c18df4e0..cd88633f8dc1 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -7475,7 +7475,7 @@ u32 bpf_tcp_sock_convert_ctx_access(enum bpf_access_type type,
BPF_CALL_1(bpf_tcp_sock, struct sock *, sk)
{
- if (sk_fullsock(sk) && sk->sk_protocol == IPPROTO_TCP)
+ if (sk_fullsock(sk) && sk_is_tcp(sk))
return (unsigned long)sk;
return (unsigned long)NULL;
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH v1 bpf 0/2] bpf: tcp: Fix type confusion in bpf_tcp_sock().
From: Kuniyuki Iwashima @ 2026-04-30 18:43 UTC (permalink / raw)
To: Martin KaFai Lau, Daniel Borkmann, Alexei Starovoitov,
Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi
Cc: John Fastabend, Stanislav Fomichev, Song Liu, Yonghong Song,
Jiri Olsa, Eric Dumazet, Kuniyuki Iwashima, Kuniyuki Iwashima,
bpf, netdev
bpf_tcp_sock() only check if sk->sk_protocol is IPPROTO_TCP,
but RAW socket can bypass it:
socket(AF_INET, SOCK_RAW, IPPROTO_TCP)
Patch 1 fixes it and Patch 2 adds a test.
Kuniyuki Iwashima (2):
bpf: tcp: Fix type confusion in bpf_tcp_sock().
selftest: bpf: Add test for bpf_tcp_sock() and RAW socket.
net/core/filter.c | 2 +-
.../selftests/bpf/prog_tests/sockopt_sk.c | 17 ++++++++++++++++-
tools/testing/selftests/bpf/progs/sockopt_sk.c | 16 ++++++++++++++++
3 files changed, 33 insertions(+), 2 deletions(-)
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply
* [PATCH net-next v2 2/3] netfilter: nf_conntrack_irc: use nf_ct_helper_parse_port()
From: HACKE-RC @ 2026-04-30 18:25 UTC (permalink / raw)
To: Pablo Neira Ayuso, Florian Westphal
Cc: Phil Sutter, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, netfilter-devel, coreteam, netdev,
linux-kernel, HACKE-RC
In-Reply-To: <20260430182543.3931718-1-rc@rexion.ai>
Replace the bare simple_strtoul() call for port parsing with the
shared nf_ct_helper_parse_port(). This avoids reliance on the
nul-terminated string guarantee (currently provided by the newline
scan earlier in parse_dcc) and validates the port fits in u16.
The simple_strtoul() for the IP address field is left as-is since
it returns unsigned long for a __be32 conversion, which is a
separate concern.
Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port")
Signed-off-by: HACKE-RC <rc@rexion.ai>
---
net/netfilter/nf_conntrack_irc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 522183b9a..1b51f5a6a 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -93,7 +93,9 @@ static int parse_dcc(char *data, const char *data_end, __be32 *ip,
data++;
}
- *port = simple_strtoul(data, &data, 10);
+ if (nf_ct_helper_parse_port(data, data_end - data, port, &data))
+ return -1;
+
*ad_end_p = data;
return 0;
--
2.54.0
^ permalink raw reply related
* [PATCH net-next v2 0/3] netfilter: conntrack: add shared port parser and use it in IRC and Amanda helpers
From: HACKE-RC @ 2026-04-30 18:25 UTC (permalink / raw)
To: Pablo Neira Ayuso, Florian Westphal
Cc: Phil Sutter, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, netfilter-devel, coreteam, netdev,
linux-kernel, HACKE-RC
Both nf_conntrack_irc and nf_conntrack_amanda parse port numbers
from application-layer protocol data using simple_strtoul(), which
relies on nul-terminated strings and returns unsigned long without
range checking. Port values above 65535 silently truncate when
stored in u16.
This v2 adds a shared nf_ct_helper_parse_port() function to the
conntrack helper core, modeled after the approach in 8cf6809cddcb
("netfilter: nf_conntrack_sip: don't use simple_strtoul"), then
converts both helpers to use it.
Changes since v1:
- Added shared nf_ct_helper_parse_port() in the helper core
instead of open-coding range checks in each helper (Pablo)
- Parser does not rely on nul-terminated strings
- Dropped simple_strtoul usage entirely for port parsing
HACKE-RC (3):
netfilter: conntrack: add shared port parser for helpers
netfilter: nf_conntrack_irc: use nf_ct_helper_parse_port()
netfilter: nf_conntrack_amanda: use nf_ct_helper_parse_port()
include/net/netfilter/nf_conntrack_helper.h | 3 +++
net/netfilter/nf_conntrack_amanda.c | 11 ++++----
net/netfilter/nf_conntrack_helper.c | 28 +++++++++++++++++++++
net/netfilter/nf_conntrack_irc.c | 4 ++-
4 files changed, 40 insertions(+), 6 deletions(-)
--
2.54.0
^ permalink raw reply
* [PATCH net-next v2 3/3] netfilter: nf_conntrack_amanda: use nf_ct_helper_parse_port()
From: HACKE-RC @ 2026-04-30 18:25 UTC (permalink / raw)
To: Pablo Neira Ayuso, Florian Westphal
Cc: Phil Sutter, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, netfilter-devel, coreteam, netdev,
linux-kernel, HACKE-RC
In-Reply-To: <20260430182543.3931718-1-rc@rexion.ai>
Replace the bare simple_strtoul() call with the shared
nf_ct_helper_parse_port(). This removes reliance on the
nul-terminated pbuf string for parsing and validates the port
range in a single call.
The len > 5 guard and port == 0 check are now handled by the
shared parser, which rejects zero and values above 65535.
Reorder local variable declarations to reverse christmas tree.
Fixes: 16958900578b ("[NETFILTER]: nf_conntrack/nf_nat: add amanda helper port")
Signed-off-by: HACKE-RC <rc@rexion.ai>
---
net/netfilter/nf_conntrack_amanda.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index d2c09e8dd..30b5c4b84 100644
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -88,11 +88,12 @@ static int amanda_help(struct sk_buff *skb,
struct nf_conntrack_expect *exp;
struct nf_conntrack_tuple *tuple;
unsigned int dataoff, start, stop, off, i;
+ nf_nat_amanda_hook_fn *nf_nat_amanda;
char pbuf[sizeof("65535")], *tmp;
+ int ret = NF_ACCEPT;
u_int16_t len;
+ u16 parsed_port;
__be16 port;
- int ret = NF_ACCEPT;
- nf_nat_amanda_hook_fn *nf_nat_amanda;
/* Only look at packets from the Amanda server */
if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL)
@@ -132,10 +133,10 @@ static int amanda_help(struct sk_buff *skb,
break;
pbuf[len] = '\0';
- port = htons(simple_strtoul(pbuf, &tmp, 10));
- len = tmp - pbuf;
- if (port == 0 || len > 5)
+ if (nf_ct_helper_parse_port(pbuf, len, &parsed_port, &tmp))
break;
+ port = htons(parsed_port);
+ len = tmp - pbuf;
exp = nf_ct_expect_alloc(ct);
if (exp == NULL) {
--
2.54.0
^ permalink raw reply related
* [PATCH net-next v2 1/3] netfilter: conntrack: add shared port parser for helpers
From: HACKE-RC @ 2026-04-30 18:25 UTC (permalink / raw)
To: Pablo Neira Ayuso, Florian Westphal
Cc: Phil Sutter, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, netfilter-devel, coreteam, netdev,
linux-kernel, HACKE-RC
In-Reply-To: <20260430182543.3931718-1-rc@rexion.ai>
Add nf_ct_helper_parse_port() to the conntrack helper core. This
provides a port parser that does not rely on nul-terminated strings,
taking an explicit length parameter and validating the result fits
in the 1-65535 range.
Modeled after the approach in 8cf6809cddcb ("netfilter:
nf_conntrack_sip: don't use simple_strtoul") but as a shared
function so IRC, Amanda, and other helpers can use it instead of
open-coding simple_strtoul calls with ad-hoc range checks.
Signed-off-by: HACKE-RC <rc@rexion.ai>
---
include/net/netfilter/nf_conntrack_helper.h | 3 +++
net/netfilter/nf_conntrack_helper.c | 28 +++++++++++++++++++++
2 files changed, 31 insertions(+)
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index de2f956ab..db19fe25f 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -160,6 +160,9 @@ nf_ct_helper_expectfn_find_by_name(const char *name);
struct nf_ct_helper_expectfn *
nf_ct_helper_expectfn_find_by_symbol(const void *symbol);
+int nf_ct_helper_parse_port(const char *cp, unsigned int len,
+ u16 *port, char **endp);
+
extern struct hlist_head *nf_ct_helper_hash;
extern unsigned int nf_ct_helper_hsize;
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index a715304a5..12f51670d 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -499,6 +499,34 @@ void nf_nat_helper_unregister(struct nf_conntrack_nat_helper *nat)
}
EXPORT_SYMBOL_GPL(nf_nat_helper_unregister);
+int nf_ct_helper_parse_port(const char *cp, unsigned int len,
+ u16 *port, char **endp)
+{
+ unsigned long result = 0;
+ const char *start = cp;
+
+ while (len > 0 && *cp >= '0' && *cp <= '9') {
+ result = result * 10 + (*cp - '0');
+ if (result > 65535)
+ return -1;
+ cp++;
+ len--;
+ }
+
+ if (cp == start)
+ return -1;
+
+ if (result == 0)
+ return -1;
+
+ *port = result;
+ if (endp)
+ *endp = (char *)cp;
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(nf_ct_helper_parse_port);
+
int nf_conntrack_helper_init(void)
{
nf_ct_helper_hsize = 1; /* gets rounded up to use one page */
--
2.54.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox