* [PATCH v3] bpf: Fix smp_processor_id() call trace for preemptible kernels
From: Edward Adam Davis @ 2026-06-30 13:09 UTC (permalink / raw)
To: eadavis
Cc: jiayuan.chen, sashiko-bot, sashiko-reviews, andrii, ast, bpf,
daniel, eddyz87, emil, jolsa, linux-kernel, martin.lau, memxor,
netdev, song, syzkaller-bugs, yonghong.song
In-Reply-To: <tencent_B6259ABAF5BB63335B9E3C1BB74B071BD608@qq.com>
bpf_mem_cache_free_rcu() maybe called in preemptible context, this
will trigger the below warning message:
BUG: using smp_processor_id() in preemptible [00000000] code: syz.0.17/5820
caller is bpf_mem_cache_free_rcu+0x48/0xc0 kernel/bpf/memalloc.c:954
Call Trace:
check_preemption_disabled+0xd3/0xe0 lib/smp_processor_id.c:47
bpf_mem_cache_free_rcu+0x48/0xc0 kernel/bpf/memalloc.c:954
rhtab_delete_elem+0x185a/0x1b30 kernel/bpf/hashtab.c:2969
__rhtab_map_lookup_and_delete_batch+0x935/0xcb0 kernel/bpf/hashtab.c:3349
bpf_map_do_batch+0x445/0x630 kernel/bpf/syscall.c:-1
__sys_bpf+0x906/0xd90 kernel/bpf/syscall.c:-1
this_cpu_ptr() access needs to be guarded against preemption.
Fixes: 5af6807bdb10 ("bpf: Introduce bpf_mem_free_rcu() similar to kfree_rcu().")
Reported-by: syzbot+fd7e415d891073b83e1f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fd7e415d891073b83e1f
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
v1 -> v2: using guard against preemption
v2 -> v3: replace get/put_cpu() to bpf_disable/enable_instrumentation()
kernel/bpf/hashtab.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 9f394e1aa2e8..d3f2f8a379e8 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -3299,6 +3299,7 @@ static int __rhtab_map_lookup_and_delete_batch(struct bpf_map *map,
dst_val = values;
total = 0;
+ bpf_disable_instrumentation();
rcu_read_lock();
/*
@@ -3313,6 +3314,7 @@ static int __rhtab_map_lookup_and_delete_batch(struct bpf_map *map,
elem = rhtab_lookup_elem(map, cursor);
if (!elem) {
rcu_read_unlock();
+ bpf_enable_instrumentation();
ret = -EAGAIN;
goto free;
}
@@ -3350,6 +3352,7 @@ static int __rhtab_map_lookup_and_delete_batch(struct bpf_map *map,
}
rcu_read_unlock();
+ bpf_enable_instrumentation();
if (total == 0) {
ret = -ENOENT;
--
2.43.0
^ permalink raw reply related
* [PATCH net-next v2 0/3] Introduce HSR/PRP HW offload support for PRU-ICSSM Ethernet driver
From: Parvathi Pudi @ 2026-06-30 12:46 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, danishanwar,
parvathi, rogerq, pmohan, afd, basharath, arnd
Cc: linux-kernel, netdev, linux-arm-kernel, pratheesh, j-rameshbabu,
vigneshr, praneeth, srk, rogerq, m-malladi, krishna, mohan
Hi,
This series introduces HSR and PRP protocol HW offload support for ICSSM-Prueth driver.
HW offload support for HSR/PRP is implemented using dedicated HSR/PRP firmware running
on 2 PRU cores(PRU-ICSS) as a "DAN" available in AM57xx, AM437x and AM335x.
The following features are offloaded to HW in case of HSR and PRP:
1. L2 forwarding of a HSR frame via traditional store and forward or via cut-through (only for HSR)
2. Transmit frame duplication is offloaded to HW
3. Tag removal on the receive is offloaded to HW
4. Redundant duplicate packet discard on the receive is also offloaded to HW
In HW offload mode, redundant tag insertion in the transmit path will be still done by HSR driver
and firmware updates the LAN information available in the tag on the fly when PRU is transmitting
frame in that respective LAN.
HSR Test Setup:
--------------
___________ ______________ ___________
| | Link AB | | Link BC | |
__| AM57* |_________|AM57/AM43/AM33|_________| AM57* |___
| | Station A | | Station B | | Station C | |
| |___________| |______________| |___________| |
| |
|_________________________________________________________________|
Link CA
Steps to switch to HSR forward offload mode:
-------------------------------------------------
Example assuming eth1, eth2 ports of ICSSM on AM57x, AM437x and AM335x EVM's
1) Bring down both slave interfaces
ip link set eth1 down
ip link set eth2 down
2) Set matching MAC addresses on both slave interfaces
ip link set eth1 address <mac-addr>
ip link set eth2 address <mac-addr>
3) Enable HSR offload for both interfaces
ethtool -K eth1 hsr-fwd-offload on
ethtool -K eth1 hsr-dup-offload on
ethtool -K eth1 hsr-tag-rm-offload on
ethtool -K eth2 hsr-fwd-offload on
ethtool -K eth2 hsr-dup-offload on
ethtool -K eth2 hsr-tag-rm-offload on
4) Create HSR interface and add slave interfaces to it
ip link add name hsr0 type hsr slave1 eth1 slave2 eth2 \
supervision 45 version 1
5) Add IP address to the HSR interface
ip addr add <IP_ADDR>/24 dev hsr0
6) Bring up the HSR interface
ip link set hsr0 up
7) Bring up the both slave ports
ip link set eth1 up
ip link set eth2 up
Switching back to default mode:
--------------------------------
1) Bring down both slave interfaces
ip link set eth1 down
ip link set eth2 down
2) Delete HSR interface
ip link delete hsr0
3) Disable HSR port-to-port offloading mode, packet duplication
ethtool -K eth1 hsr-fwd-offload off
ethtool -K eth1 hsr-dup-offload off
ethtool -K eth1 hsr-tag-rm-offload off
ethtool -K eth2 hsr-fwd-offload off
ethtool -K eth2 hsr-dup-offload off
ethtool -K eth2 hsr-tag-rm-offload off
Testing the port-to-port frame forward offload feature:
-------------------------------------------------------
1) Connect the LAN cables as shown in the test setup.
2) Configure Station A and Station C in HSR non-offload mode.
3) Configure Station B is HSR offload mode.
4) Since HSR is a redundancy protocol, disconnect cable "Link CA",
to ensure frames from Station A reach Station C only through
Station B.
5) Run iperf3 Server on Station C and client on station A.
7) Check the CPU usage on Station B.
CPU usage report on Station B using mpstat when running UDP iperf3:
-------------------------------------------------------------------
AM57xx
------
1) Non-Offload case
-------------------
CPU %usr %nice %sys %iowait %irq %soft %steal %guest %idle
all 0.00 0.00 0.00 0.00 0.00 10.41 0.00 0.00 89.59
0 0.00 0.00 0.00 0.00 0.00 20.88 0.00 0.00 79.12
1 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 100.00
2) Offload case
---------------
CPU %usr %nice %sys %iowait %irq %soft %steal %guest %idle
all 0.00 0.00 0.10 0.00 0.00 0.73 0.00 0.00 99.17
0 0.00 0.00 0.20 0.00 0.00 1.46 0.00 0.00 98.34
1 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 100.00
AM437x
------
1) Non-Offload case
-------------------
CPU %usr %nice %sys %iowait %irq %soft %steal %guest %idle
all 0.30 0.00 0.80 0.00 0.00 35.19 0.00 0.00 63.72
0 0.30 0.00 0.80 0.00 0.00 35.19 0.00 0.00 63.72
2) Offload case
---------------
CPU %usr %nice %sys %iowait %irq %soft %steal %guest %idle
all 0.10 0.00 0.31 0.10 0.00 1.74 0.00 0.00 97.75
0 0.10 0.00 0.31 0.10 0.00 1.74 0.00 0.00 97.75
AM335x
------
1) Non Offload case
-------------------
CPU %usr %nice %sys %iowait %irq %soft %steal %guest %idle
all 0.30 0.00 1.10 0.00 0.00 90.32 0.00 0.00 8.28
0 0.30 0.00 1.10 0.00 0.00 90.32 0.00 0.00 8.28
2) Offload case
---------------
CPU %usr %nice %sys %iowait %irq %soft %steal %guest %idle
all 0.43 0.00 3.61 0.00 0.00 13.28 0.00 0.00 82.68
0 0.43 0.00 3.61 0.00 0.00 13.28 0.00 0.00 82.68
PRP Test Setup:
---------------
_________________ LAN-A __________________
| |eth1-----------eth1| |
| AM57/AM437/AM335| | AM57/AM437/AM335 |
| station A |eth2-----------eth2| station B |
|_________________| LAN-B |__________________|
Steps to switch to PRP offload mode:
------------------------------------
Example assuming eth1, eth2 ports of ICSSM on AM57x, AM437x and AM335x EVM's
1) Bring down both slave interfaces
ip link set eth1 down
ip link set eth2 down
2) Set matching MAC addresses on both slave interfaces
ip link set eth1 address <mac-addr>
ip link set eth2 address <mac-addr>
3) Enable PRP offload for both interfaces
ethtool -K eth1 hsr-dup-offload on
ethtool -K eth1 hsr-tag-rm-offload on
ethtool -K eth2 hsr-dup-offload on
ethtool -K eth2 hsr-tag-rm-offload on
4) Create PRP interface and add slave interfaces to it
ip link add name prp0 type hsr slave1 eth1 slave2 eth2 \
supervision 45 proto 1
5) Add IP address to the PRP interface
ip addr add <IP_ADDR>/24 dev prp0
6) Bring up the PRP interface
ip link set prp0 up
7) Bring up the both slave ports
ip link set eth1 up
ip link set eth2 up
Switching back to default mode:
--------------------------------
1) Bring down both slave interfaces
ip link set eth1 down
ip link set eth2 down
2) Delete PRP interface
ip link delete prp0
3) Disable PRP offloading mode
ethtool -K eth1 hsr-dup-offload off
ethtool -K eth1 hsr-tag-rm-offload off
ethtool -K eth2 hsr-dup-offload off
ethtool -K eth2 hsr-tag-rm-offload off
Testing the PRP offload feature:
--------------------------------
1) Connect eth1 of Station A to eth1 of Station B (LAN-A).
Connect eth2 of Station A to eth2 of Station B (LAN-B).
2) Configure Station A in PRP non-offload mode.
3) Configure Station B in PRP offload mode.
4) Run iperf3 Server on Station B and client on Station A.
5) Check the CPU usage on Station B.
6) Disconnect LAN-B cable to verify Station A frames still reach
Station B over LAN-A with no traffic interruption.
7) Reconnect LAN-B and disconnect LAN-A, verify the same.
CPU usage report on Station B using mpstat when running UDP iperf3:
-------------------------------------------------------------------
AM57x
-----
1) Non Offload case
-------------------
CPU %usr %nice %sys %iowait %irq %soft %steal %guest %idle
all 2.04 0.00 18.85 0.00 0.00 27.83 0.00 0.00 51.27
0 1.80 0.00 21.56 0.00 0.00 54.89 0.00 0.00 21.76
1 2.29 0.00 16.14 0.00 0.00 0.80 0.00 0.00 80.78
2) Offload case
---------------
CPU %usr %nice %sys %iowait %irq %soft %steal %guest %idle
all 2.79 0.00 18.36 0.00 0.00 18.16 0.00 0.00 60.68
0 3.89 0.00 22.16 0.00 0.00 36.13 0.00 0.00 37.82
1 1.69 0.00 14.56 0.00 0.00 0.20 0.00 0.00 83.55
AM437x
------
1) Non Offload case
-------------------
CPU %usr %nice %sys %iowait %irq %soft %steal %guest %idle
all 5.68 0.00 43.27 0.00 0.00 43.57 0.00 0.00 7.48
0 5.68 0.00 43.27 0.00 0.00 43.57 0.00 0.00 7.48
2) Offload case
---------------
CPU %usr %nice %sys %iowait %irq %soft %steal %guest %idle
all 6.39 0.00 42.86 0.00 0.00 32.57 0.00 0.00 18.18
0 6.39 0.00 42.86 0.00 0.00 32.57 0.00 0.00 18.18
AM335x
------
1) Non Offload case
-------------------
CPU %usr %nice %sys %iowait %irq %soft %steal %guest %idle
all 2.29 0.00 14.04 0.00 0.00 75.50 0.00 0.00 8.17
0 2.29 0.00 14.04 0.00 0.00 75.50 0.00 0.00 8.17
2) Offload case
---------------
CPU %usr %nice %sys %iowait %irq %soft %steal %guest %idle
all 5.70 0.00 48.50 0.00 0.00 29.00 0.00 0.00 16.80
0 5.70 0.00 48.50 0.00 0.00 29.00 0.00 0.00 16.80
Note:
hsr-tag-rm-offload and hsr-dup-offload are tightly coupled in the firmware implementation.
They both need to be enabled / disabled together and hsr-tag-ins-offload is unsupported.
This is the v2 of the patch series [v1]. This version of the patchset addresses the
comments made on [v1] of the series.
Changes from v1 to v2 :
*) Fixed all applicable issues, except for the false positives flagged by the AI review
on sashiko.dev.
*) Addressed Jakub Kicinski comments on patch 3 of the series.
*) Rebased the series on latest net-next.
[v1] https://lore.kernel.org/all/20260611123636.376577-1-parvathi@couthit.com/
Thanks and Regards,
Parvathi.
Roger Quadros (3):
net: ti: icssm-prueth: Add HSR and PRP HW offload mode support for
AM57xx, AM437x and AM335x
net: ti: icssm-prueth: Add priority based RX IRQ handlers
net: ti: icssm-prueth: Support duplicate HW offload feature for HSR
and PRP
drivers/net/ethernet/ti/Makefile | 2 +-
.../ethernet/ti/icssm/icssm_lre_firmware.h | 141 ++++
drivers/net/ethernet/ti/icssm/icssm_prueth.c | 728 ++++++++++++++++--
drivers/net/ethernet/ti/icssm/icssm_prueth.h | 73 +-
.../ethernet/ti/icssm/icssm_prueth_common.c | 283 +++++++
.../net/ethernet/ti/icssm/icssm_prueth_lre.c | 224 ++++++
.../net/ethernet/ti/icssm/icssm_prueth_lre.h | 19 +
.../ethernet/ti/icssm/icssm_prueth_switch.c | 310 +++++++-
.../ethernet/ti/icssm/icssm_prueth_switch.h | 1 +
drivers/net/ethernet/ti/icssm/icssm_switch.h | 35 +-
10 files changed, 1749 insertions(+), 67 deletions(-)
create mode 100644 drivers/net/ethernet/ti/icssm/icssm_lre_firmware.h
create mode 100644 drivers/net/ethernet/ti/icssm/icssm_prueth_common.c
create mode 100644 drivers/net/ethernet/ti/icssm/icssm_prueth_lre.c
create mode 100644 drivers/net/ethernet/ti/icssm/icssm_prueth_lre.h
--
2.43.0
^ permalink raw reply
* Re: [PATCH v2 02/19] driver core: platform: provide platform_device_set_of_node()
From: Bartosz Golaszewski @ 2026-06-30 13:22 UTC (permalink / raw)
To: Manuel Ebner
Cc: brgl, linux-kernel, netdev, linux-arm-msm, linux-sound,
driver-core, devicetree, linuxppc-dev, linux-i2c, iommu, linux-pm,
imx, linux-arm-kernel, intel-xe, dri-devel, linux-usb, linux-mips,
platform-driver-x86, Bartosz Golaszewski, Lee Jones,
Thierry Reding, Sebastian Hesselbarth, Andrew Lunn,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Srinivas Kandagatla, Greg Kroah-Hartman, Vinod Koul,
Rafael J. Wysocki, Danilo Krummrich, Rob Herring, Saravana Kannan,
Madhavan Srinivasan, Michael Ellerman, Nicholas Piggin,
Christophe Leroy (CS GROUP), Andi Shyti, Andy Shevchenko,
Joerg Roedel, Will Deacon, Robin Murphy, Doug Berger,
Florian Fainelli, Broadcom internal kernel review list,
Ulf Hansson, Frank Li, Sascha Hauer, Pengutronix Kernel Team,
Fabio Estevam, Matthew Brost, Thomas Hellström, Rodrigo Vivi,
David Airlie, Simona Vetter, Peter Chen, Paul Cercueil, Bin Liu,
Philipp Zabel, Maximilian Luz, Hans de Goede, Ilpo Järvinen,
Krzysztof Kozlowski, Benjamin Herrenschmidt
In-Reply-To: <263f58b418a27a2339fc2478f93234e0208b0ad9.camel@mailbox.org>
On Tue, 30 Jun 2026 13:37:54 +0200, Manuel Ebner <manuelebner@mailbox.org> said:
> On Mon, 2026-06-29 at 11:12 +0200, Bartosz Golaszewski wrote:
>> [...]
>>
>> +/**
>> + * platform_device_set_of_node - assign an OF node to device
>> + * @pdev: platform device to add the node for
>> + * @np: new device node
>> + *
>> + * Assign an OF node to this platform device. Internally keep track of the
>> + * reference count. Devices created with platform_device_alloc() must use this
>> + * function instead of assigning the node manually.
>
> Doesn't it make sense to add a remark to the kernel doc of platform_device_alloc()?
>
> Thanks
> Manuel
>
>> [...]
>
Sure, will do in the next iteration.
Bart
^ permalink raw reply
* Re: [PATCH net-next v11 1/7] dt-bindings: phy: document the serdes PHY on sa8255p
From: Krzysztof Kozlowski @ 2026-06-30 13:24 UTC (permalink / raw)
To: Vinod Koul, Geert Uytterhoeven
Cc: Bartosz Golaszewski, Bjorn Andersson, Konrad Dybcio, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Maxime Coquelin,
Alexandre Torgue, Giuseppe Cavallaro, Chen-Yu Tsai,
Jernej Skrabec, Neil Armstrong, Kevin Hilman, Jerome Brunet,
Shawn Guo, Fabio Estevam, Jan Petrous, s32, Mohd Ayaan Anwar,
Romain Gantois, Magnus Damm, Maxime Ripard, Christophe Roullier,
Radu Rendec, linux-arm-msm, devicetree, linux-kernel, netdev,
linux-stm32, linux-arm-kernel, Drew Fustini, linux-sunxi,
linux-amlogic, linux-mips, imx, linux-renesas-soc, linux-rockchip,
sophgo, linux-riscv, Bartosz Golaszewski, Bartosz Golaszewski
In-Reply-To: <akOZFIowVvprnAMf@vaman>
On 30/06/2026 12:23, Vinod Koul wrote:
> On 29-06-26, 16:51, Geert Uytterhoeven wrote:
>>> Russell King asked me to put the PHY logic for SCMI pm domains into the PHY
>>> driver instead of the MAC driver where it was previously. Instead of cramming
>>> both HLOS and firmware handling into the same driver, I figured it makes more
>>> sense to have a dedicated, cleaner driver as the two share very little code (if
>>> any).
>>
>> I think you are mixing up DT bindings and driver implementation?
>
> Should the bindings change if we have different driver and firmware
> implementations? Isn't binding supposed to be agnostic of
> implementations..?
I did not follow earlier discussions, so I do not know Russell
arguments, but in general it's true that driver choices should not
influence binding decisions. IOW, you need to figure out which real
device is part of power domain and add the power-domains to that device
node (that device).
Best regards,
Krzysztof
^ permalink raw reply
* [PATCH 0/3] arm64: dts/net: stmmac: Add Agilex5 SoCDK TSN Config2 board support
From: muhammad.nazim.amirul.nazle.asmade @ 2026-06-30 13:31 UTC (permalink / raw)
To: dinguyen, maxime.chevallier
Cc: rmk+kernel, krzk+dt, conor+dt, robh, davem, edumazet, kuba,
pabeni, andrew+netdev, devicetree, linux-arm-kernel, netdev,
linux-kernel
From: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
The Intel SoCFPGA Agilex5 SoCDK TSN Config2 board uses a dual-port
Ethernet setup where gmac1 (TSN port) operates with different MAC-side
and PHY-side interface modes: GMII internally in the MAC, and RGMII
towards the PHY.
Russell King's commit de696c63c1dc ("net: stmmac: socfpga: convert to
use phy_interface") replaced mac_interface with phy_interface in
socfpga_get_plat_phymode(), correctly noting that no upstream DTS files
set the "mac-mode" property at the time. However, the Agilex5 SoCDK
TSN Config2 board requires mac-mode and phy-mode to differ, causing
ping failures when the MAC is configured with RGMII instead of GMII.
This series fixes the issue in three steps:
Patch 1 (dt-bindings): Add the compatible string for the new board
variant to Documentation/devicetree/bindings/arm/altera.yaml.
Patch 2 (dts): Add the device tree source for the Agilex5 SoCDK
TSN Config2 board, enabling gmac1 with mac-mode = "gmii" alongside
the standard gmac2 port.
Patch 3 (driver): Restore mac_interface support in dwmac-socfpga by
reading the optional "mac-mode" DT property. When absent, it falls
back to phy_interface, preserving existing behaviour for all other
boards.
Note: Patches 1 and 2 target Dinh Nguyen's SoCFPGA tree
(git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux.git).
Patch 3 targets net-next.
Nazim Amirul (3):
dt-bindings: arm: altera: Add Agilex5 SoCDK TSN Config2 board
arm64: dts: socfpga: agilex5: Add SoCDK TSN Config2 board
net: stmmac: dwmac-socfpga: Add mac-mode DT property support
Documentation/devicetree/bindings/arm/altera.yaml | 1 +
arch/arm64/boot/dts/intel/Makefile | 9 +-
arch/arm64/boot/dts/intel/socfpga_agilex5_socdk_tsn_cfg2.dts | 133 ++++++++++++++++++
drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 23 ++-
4 files changed, 162 insertions(+), 4 deletions(-)
create mode 100644 arch/arm64/boot/dts/intel/socfpga_agilex5_socdk_tsn_cfg2.dts
--
2.43.7
^ permalink raw reply
* [PATCH 1/3] dt-bindings: arm: altera: Add Agilex5 SoCDK TSN Config2 board board
From: muhammad.nazim.amirul.nazle.asmade @ 2026-06-30 13:31 UTC (permalink / raw)
To: dinguyen, maxime.chevallier
Cc: rmk+kernel, krzk+dt, conor+dt, robh, davem, edumazet, kuba,
pabeni, andrew+netdev, devicetree, linux-arm-kernel, netdev,
linux-kernel
In-Reply-To: <20260630133108.27244-1-muhammad.nazim.amirul.nazle.asmade@altera.com>
From: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
Add compatible string for the Intel SoCFPGA Agilex5 SoCDK TSN Config2
board variant, which uses a dual-port TSN configuration where gmac1
operates with different MAC-side (GMII) and PHY-side (RGMII) interface
modes.
Signed-off-by: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
---
Documentation/devicetree/bindings/arm/altera.yaml | 1 +
1 file changed, 1 insertion(+)
diff --git a/Documentation/devicetree/bindings/arm/altera.yaml b/Documentation/devicetree/bindings/arm/altera.yaml
index 3030cf46fe74..e431469a7175 100644
--- a/Documentation/devicetree/bindings/arm/altera.yaml
+++ b/Documentation/devicetree/bindings/arm/altera.yaml
@@ -114,6 +114,7 @@ properties:
- intel,socfpga-agilex5-socdk-debug
- intel,socfpga-agilex5-socdk-modular
- intel,socfpga-agilex5-socdk-nand
+ - intel,socfpga-agilex5-socdk-tsn-cfg2
- const: intel,socfpga-agilex5
- description: Agilex72 boards
--
2.43.7
^ permalink raw reply related
* [PATCH 3/3] net: stmmac: dwmac-socfpga: Add mac-mode DT property support
From: muhammad.nazim.amirul.nazle.asmade @ 2026-06-30 13:31 UTC (permalink / raw)
To: dinguyen, maxime.chevallier
Cc: rmk+kernel, krzk+dt, conor+dt, robh, davem, edumazet, kuba,
pabeni, andrew+netdev, devicetree, linux-arm-kernel, netdev,
linux-kernel
In-Reply-To: <20260630133108.27244-1-muhammad.nazim.amirul.nazle.asmade@altera.com>
From: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
Russell King's commit de696c63c1dc ("net: stmmac: socfpga: convert to
use phy_interface") replaced mac_interface with phy_interface in
socfpga_get_plat_phymode(), noting that no upstream DTS files set the
"mac-mode" property, making the two values identical.
The Agilex5 SoCDK TSN Config2 board is an exception: its gmac1 TSN
port uses GMII internally in the MAC while the PHY-side interface is
RGMII, so mac-mode and phy-mode differ. Without restoring mac_interface
support, the MAC is configured with RGMII instead of GMII, causing
connectivity failures on this board.
Add socfpga_of_get_mac_mode() to read the optional "mac-mode" DT
property and store it in a new mac_interface field. When the property
is absent, mac_interface falls back to phy_interface, preserving
the existing behaviour for all other boards.
Fixes: de696c63c1dc ("net: stmmac: socfpga: convert to use phy_interface")
Signed-off-by: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
---
.../ethernet/stmicro/stmmac/dwmac-socfpga.c | 23 ++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
index 1d7f0a57d288..6a6837c4a414 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
@@ -69,12 +69,30 @@ struct socfpga_dwmac {
void __iomem *tse_pcs_base;
void __iomem *sgmii_adapter_base;
bool f2h_ptp_ref_clk;
+ phy_interface_t mac_interface;
const struct socfpga_dwmac_ops *ops;
};
+static int socfpga_of_get_mac_mode(struct device_node *np)
+{
+ const char *pm;
+ int err, i;
+
+ err = of_property_read_string(np, "mac-mode", &pm);
+ if (err < 0)
+ return err;
+
+ for (i = 0; i < PHY_INTERFACE_MODE_MAX; i++) {
+ if (!strcasecmp(pm, phy_modes(i)))
+ return i;
+ }
+
+ return -ENODEV;
+}
+
static phy_interface_t socfpga_get_plat_phymode(struct socfpga_dwmac *dwmac)
{
- return dwmac->plat_dat->phy_interface;
+ return dwmac->mac_interface;
}
static void socfpga_sgmii_config(struct socfpga_dwmac *dwmac, bool enable)
@@ -650,6 +668,9 @@ static int socfpga_dwmac_probe(struct platform_device *pdev)
plat_dat->pcs_exit = socfpga_dwmac_pcs_exit;
plat_dat->select_pcs = socfpga_dwmac_select_pcs;
+ ret = socfpga_of_get_mac_mode(pdev->dev.of_node);
+ dwmac->mac_interface = ret < 0 ? plat_dat->phy_interface : ret;
+
ops->setup_plat_dat(dwmac);
return devm_stmmac_pltfr_probe(pdev, plat_dat, &stmmac_res);
--
2.43.7
^ permalink raw reply related
* [PATCH 2/3] arm64: dts: socfpga: agilex5: Add SoCDK TSN Config2 board
From: muhammad.nazim.amirul.nazle.asmade @ 2026-06-30 13:31 UTC (permalink / raw)
To: dinguyen, maxime.chevallier
Cc: rmk+kernel, krzk+dt, conor+dt, robh, davem, edumazet, kuba,
pabeni, andrew+netdev, devicetree, linux-arm-kernel, netdev,
linux-kernel
In-Reply-To: <20260630133108.27244-1-muhammad.nazim.amirul.nazle.asmade@altera.com>
From: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
Add device tree for the Intel SoCFPGA Agilex5 SoCDK TSN Config2 board
variant. This configuration enables gmac1 as a TSN port alongside
the standard gmac2 Ethernet port.
The TSN port (gmac1) uses GMII internally in the MAC but connects to an
RGMII PHY. The mac-mode property is set to "gmii" to reflect the
MAC-side interface, while phy-mode is set to "rgmii" for the PHY-side
interface.
Signed-off-by: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
---
arch/arm64/boot/dts/intel/Makefile | 3 +-
.../intel/socfpga_agilex5_socdk_tsn_cfg2.dts | 133 ++++++++++++++++++
2 files changed, 135 insertions(+), 1 deletion(-)
create mode 100644 arch/arm64/boot/dts/intel/socfpga_agilex5_socdk_tsn_cfg2.dts
diff --git a/arch/arm64/boot/dts/intel/Makefile b/arch/arm64/boot/dts/intel/Makefile
index 270c70fdf084..fc7ba2c6384b 100644
--- a/arch/arm64/boot/dts/intel/Makefile
+++ b/arch/arm64/boot/dts/intel/Makefile
@@ -4,10 +4,11 @@ dtb-$(CONFIG_ARCH_INTEL_SOCFPGA) += socfpga_agilex_n6000.dtb \
socfpga_agilex_socdk_emmc.dtb \
socfpga_agilex_socdk_nand.dtb \
socfpga_agilex3_socdk.dtb \
- socfpga_agilex5_socdk.dtb \
+ socfpga_agilex5_socdk.dtb \
socfpga_agilex5_socdk_013b.dtb \
socfpga_agilex5_socdk_modular.dtb \
socfpga_agilex5_socdk_nand.dtb \
+ socfpga_agilex5_socdk_tsn_cfg2.dtb \
socfpga_agilex72_socdk.dtb \
socfpga_agilex7m_socdk.dtb \
socfpga_n5x_socdk.dtb
diff --git a/arch/arm64/boot/dts/intel/socfpga_agilex5_socdk_tsn_cfg2.dts b/arch/arm64/boot/dts/intel/socfpga_agilex5_socdk_tsn_cfg2.dts
new file mode 100644
index 000000000000..f84f41a647ae
--- /dev/null
+++ b/arch/arm64/boot/dts/intel/socfpga_agilex5_socdk_tsn_cfg2.dts
@@ -0,0 +1,133 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2026, Altera Corporation
+ */
+#include "socfpga_agilex5.dtsi"
+
+/ {
+ model = "SoCFPGA Agilex5 SoCDK TSN Config2";
+ compatible = "intel,socfpga-agilex5-socdk-tsn-cfg2", "intel,socfpga-agilex5";
+
+ aliases {
+ serial0 = &uart0;
+ ethernet1 = &gmac1;
+ ethernet2 = &gmac2;
+ };
+
+ chosen {
+ stdout-path = "serial0:115200n8";
+ };
+
+ leds {
+ compatible = "gpio-leds";
+
+ led-0 {
+ label = "hps_led0";
+ gpios = <&porta 11 GPIO_ACTIVE_HIGH>;
+ };
+
+ };
+
+ memory@80000000 {
+ device_type = "memory";
+ /* We expect the bootloader to fill in the reg */
+ reg = <0x0 0x80000000 0x0 0x0>;
+ };
+};
+
+&gpio0 {
+ status = "okay";
+};
+
+&gpio1 {
+ status = "okay";
+};
+
+/*
+ * gmac1 is the TSN port. The MAC operates in GMII mode internally
+ * while the PHY-side interface is RGMII, so mac-mode and phy-mode differ.
+ */
+&gmac1 {
+ status = "okay";
+ phy-mode = "rgmii"; /* TX/RX clock delays provided by Agilex5 I/O hardware */
+ mac-mode = "gmii";
+ phy-handle = <&emac1_phy0>;
+ max-frame-size = <9000>;
+
+ mdio0 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ compatible = "snps,dwmac-mdio";
+
+ emac1_phy0: ethernet-phy@0 {
+ reg = <0>;
+ };
+ };
+};
+
+&gmac2 {
+ status = "okay";
+ phy-mode = "rgmii"; /* TX/RX clock delays provided by Agilex5 I/O hardware */
+ phy-handle = <&emac2_phy0>;
+ max-frame-size = <9000>;
+
+ mdio0 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ compatible = "snps,dwmac-mdio";
+
+ emac2_phy0: ethernet-phy@0 {
+ reg = <0>;
+ };
+ };
+};
+
+&osc1 {
+ clock-frequency = <25000000>;
+};
+
+&qspi {
+ status = "okay";
+ flash@0 {
+ compatible = "micron,mt25qu02g", "jedec,spi-nor";
+ reg = <0>;
+ spi-max-frequency = <100000000>;
+ m25p,fast-read;
+ cdns,read-delay = <2>;
+ cdns,tshsl-ns = <50>;
+ cdns,tsd2d-ns = <50>;
+ cdns,tchsh-ns = <4>;
+ cdns,tslch-ns = <4>;
+ spi-tx-bus-width = <4>;
+ spi-rx-bus-width = <4>;
+
+ partitions {
+ compatible = "fixed-partitions";
+ #address-cells = <1>;
+ #size-cells = <1>;
+
+ qspi_boot: partition@0 {
+ label = "u-boot";
+ reg = <0x0 0x04200000>;
+ };
+
+ root: partition@4200000 {
+ label = "root";
+ reg = <0x04200000 0x0be00000>;
+ };
+ };
+ };
+};
+
+&uart0 {
+ status = "okay";
+};
+
+&usb0 {
+ status = "okay";
+ disable-over-current;
+};
+
+&watchdog0 {
+ status = "okay";
+};
--
2.43.7
^ permalink raw reply related
* Re: [PATCH] net: ipv4: fix TOCTOU race in __ip_do_redirect
From: Eric Dumazet @ 2026-06-30 13:31 UTC (permalink / raw)
To: Lei Huang
Cc: dsahern, idosch, davem, kuba, pabeni, horms, netdev, linux-kernel,
Lei Huang
In-Reply-To: <20260630122333.935406-1-huanglei814@163.com>
On Tue, Jun 30, 2026 at 5:24 AM Lei Huang <huanglei814@163.com> wrote:
>
> From: Lei Huang <huanglei@kylinos.cn>
>
> fib_lookup() internally acquires and releases rcu_read_lock and always uses
> FIB_LOOKUP_NOREF (no refcount on fib_info). After it returns, res (a local
> struct fib_result on the stack) has its nhc field pointing into the
> fib_info internal nexthop array, but RCU protection is already dropped.
> A concurrent route deletion can free the fib_info via kfree_rcu, making
> res.nhc a stale pointer. Subsequent FIB_RES_NHC(res) reads this stale value
> and update_or_create_fnhe() dereferences it, causing UAF.
>
> Fix by wrap the entire fib_lookup + FIB_RES_NHC + update_or_create_fnhe
> region in an explicit rcu_read_lock/unlock to keep the fib_info alive
> throughout the critical section.
>
> Signed-off-by: Lei Huang <huanglei@kylinos.cn>
You forgot to include a Fixes: tag.
Please read Documentation/process/maintainer-netdev.rst
Anyway, this patch isn't needed; all callers of this helper already
use rcu_read_lock().
I am guessing all of them are called from ip_protocol_deliver_rcu()
If you think about this, LOCKDEP would have fired a warning years ago
at line 769:
in_dev = __in_dev_get_rcu(dev);
pw-bot: cr
^ permalink raw reply
* Re: [PATCH v3 4/4] vhost/vsock: add VHOST_RESET_OWNER ioctl
From: Stefano Garzarella @ 2026-06-30 13:40 UTC (permalink / raw)
To: Andrey Drobyshev
Cc: linux-kernel, kvm, virtualization, netdev, mst, stefanha,
dongli.zhang, maciej.szmigiero, bchaney, mark.kanda, ptikhomirov,
den
In-Reply-To: <20260625155416.480669-5-andrey.drobyshev@virtuozzo.com>
On Thu, Jun 25, 2026 at 06:54:16PM +0300, Andrey Drobyshev wrote:
>From: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
>
>This ioctl is needed for QEMU's CPR (checkpoint-restore) migration of
>the guest with vhost-vsock device. For this to work, we need to reset
>the device ownership on the source side by calling RESET_OWNER, and then
>claim it on the dest side by calling SET_OWNER. We expect not to lose any
>AF_VSOCK connection while this happens.
>
>RESET_OWNER keeps the guest CID hashed, so that connections survive. That
>leaves the device reachable by a lockless send/cancel path while the worker
>is being torn down: a concurrent vhost_transport_send_pkt() or
>vhost_transport_cancel_pkt() can call vhost_vq_work_queue() as
>vhost_workers_free() frees the worker. That might cause a use-after-free
>of vq->worker. In addition, any work queued onto the dying worker leaves
>VHOST_WORK_QUEUED stuck, stalling send_pkt_queue after resume.
>
>Fence the send/cancel paths around the teardown: send_pkt()/cancel_pkt()
>only kick the worker while the backend is alive. And reset_owner() calls
>synchronize_rcu() after drop_backends() so in-flight send/cancel finish
>before the worker is freed.
>
>Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
>Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
>---
> drivers/vhost/vsock.c | 51 +++++++++++++++++++++++++++++++++++++++++--
> 1 file changed, 49 insertions(+), 2 deletions(-)
>
>diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
>index 81d4f7209719..f0a0aa7d3200 100644
>--- a/drivers/vhost/vsock.c
>+++ b/drivers/vhost/vsock.c
>@@ -318,7 +318,14 @@ vhost_transport_send_pkt(struct sk_buff *skb, struct net *net)
> atomic_inc(&vsock->queued_replies);
>
> virtio_vsock_skb_queue_tail(&vsock->send_pkt_queue, skb);
>- vhost_vq_work_queue(&vsock->vqs[VSOCK_VQ_RX], &vsock->send_pkt_work);
>+
>+ /* Skip the kick once the backend is gone (stop/RESET_OWNER); the skb
>+ * stays queued and vhost_vsock_start() drains it. Pairs with the
>+ * synchronize_rcu() in vhost_vsock_reset_owner().
>+ */
Please explain better (as done by commit bb26ed5f3a8b ("vhost/vsock:
Refuse the connection immediately when guest isn't ready") in the
comment removed by this seris) why we can use vhost_vq_get_backend()
without vq->mutex held.
>+ if (data_race(vhost_vq_get_backend(&vsock->vqs[VSOCK_VQ_RX])))
>+ vhost_vq_work_queue(&vsock->vqs[VSOCK_VQ_RX],
>+ &vsock->send_pkt_work);
BTW I'm now confused about what we are preventing here. A better
explanation should be added both in the commit and in the comment,
because it's hard to understand what we're preventing.
That said, if there is a problem, perhaps it should be fixed in vhost.c,
because it seems more like a generic issue.
vhost_vq_work_queue() has `worker = rcu_dereference(vq->worker);` so
should already prevent UAF, no?
Or maybe vhost_workers_free() is missing a synchronize_rcu()?
>
> rcu_read_unlock();
> return len;
>@@ -346,7 +353,15 @@ vhost_transport_cancel_pkt(struct vsock_sock *vsk)
> int new_cnt;
>
> new_cnt = atomic_sub_return(cnt, &vsock->queued_replies);
>- if (new_cnt + cnt >= tx_vq->num && new_cnt < tx_vq->num)
>+
>+ /* Skip the kick once the backend is gone (stop/RESET_OWNER):
>+ * vhost_poll_queue() would touch the worker which is being freed
>+ * by teardown, e.g. on RESET_OWNER. Pairs with the
>+ * synchronize_rcu() in vhost_vsock_reset_owner(). The TX VQ is
Ditto about the comment.
>+ * re-kicked by vhost_vsock_start().
>+ */
>+ if (data_race(vhost_vq_get_backend(tx_vq)) &&
>+ new_cnt + cnt >= tx_vq->num && new_cnt < tx_vq->num)
> vhost_poll_queue(&tx_vq->poll);
> }
>
>@@ -903,6 +918,36 @@ static int vhost_vsock_set_features(struct vhost_vsock *vsock, u64 features)
> return -EFAULT;
> }
>
>+static int vhost_vsock_reset_owner(struct vhost_vsock *vsock)
Why returning int?
We are defining err as long here, also the caller vhost_vsock_dev_ioctl()
returns long, so it is not clear to me why here we are not just
returning long.
>+{
>+ struct vhost_iotlb *umem;
>+ long err;
>+
>+ mutex_lock(&vsock->dev.mutex);
>+ err = vhost_dev_check_owner(&vsock->dev);
>+ if (err)
>+ goto done;
>+ umem = vhost_dev_reset_owner_prepare();
>+ if (!umem) {
>+ err = -ENOMEM;
>+ goto done;
>+ }
>+ vhost_vsock_drop_backends(vsock);
>+
>+ /* Let in-flight send_pkt() callers stop touching the worker before the
>+ * flush + free below. Pairs with the backend check in
>+ * vhost_transport_send_pkt().
This is also paired with vhost_transport_cancel_pkt(), so please update
this comment.
>+ */
>+ synchronize_rcu();
>+
>+ vhost_vsock_flush(vsock);
>+ vhost_dev_stop(&vsock->dev);
>+ vhost_dev_reset_owner(&vsock->dev, umem);
>+done:
>+ mutex_unlock(&vsock->dev.mutex);
>+ return err;
>+}
>+
> static long vhost_vsock_dev_ioctl(struct file *f, unsigned int ioctl,
> unsigned long arg)
> {
>@@ -946,6 +991,8 @@ static long vhost_vsock_dev_ioctl(struct file *f, unsigned int ioctl,
> return -EOPNOTSUPP;
> vhost_set_backend_features(&vsock->dev, features);
> return 0;
>+ case VHOST_RESET_OWNER:
>+ return vhost_vsock_reset_owner(vsock);
> default:
> mutex_lock(&vsock->dev.mutex);
> r = vhost_dev_ioctl(&vsock->dev, ioctl, argp);
>--
>2.47.1
>
^ permalink raw reply
* Re: [PATCH net-next v11 1/7] dt-bindings: phy: document the serdes PHY on sa8255p
From: Bartosz Golaszewski @ 2026-06-30 13:44 UTC (permalink / raw)
To: Vinod Koul
Cc: Geert Uytterhoeven, Bartosz Golaszewski, Bjorn Andersson,
Konrad Dybcio, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Maxime Coquelin, Alexandre Torgue,
Giuseppe Cavallaro, Chen-Yu Tsai, Jernej Skrabec, Neil Armstrong,
Kevin Hilman, Jerome Brunet, Shawn Guo, Fabio Estevam,
Jan Petrous, s32, Mohd Ayaan Anwar, Romain Gantois, Magnus Damm,
Maxime Ripard, Christophe Roullier, Radu Rendec, linux-arm-msm,
devicetree, linux-kernel, netdev, linux-stm32, linux-arm-kernel,
Drew Fustini, linux-sunxi, linux-amlogic, linux-mips, imx,
linux-renesas-soc, linux-rockchip, sophgo, linux-riscv,
Bartosz Golaszewski, Bartosz Golaszewski
In-Reply-To: <akOZFIowVvprnAMf@vaman>
On Tue, 30 Jun 2026 12:23:16 +0200, Vinod Koul <vkoul@kernel.org> said:
> On 29-06-26, 16:51, Geert Uytterhoeven wrote:
>> > Russell King asked me to put the PHY logic for SCMI pm domains into the PHY
>> > driver instead of the MAC driver where it was previously. Instead of cramming
>> > both HLOS and firmware handling into the same driver, I figured it makes more
>> > sense to have a dedicated, cleaner driver as the two share very little code (if
>> > any).
>>
>> I think you are mixing up DT bindings and driver implementation?
>
> Should the bindings change if we have different driver and firmware
> implementations? Isn't binding supposed to be agnostic of
> implementations..?
>
The way sa8255p implements SCMI is with SMC exclusively but - since even base
support is not yet upstream - maybe it would be possible to expose SCMI clocks
like some platforms do and reuse the same binding.
Would it make sense?
Bart
^ permalink raw reply
* [PATCH net 5/6] batman-adv: bla: reacquire gw address after skb realloc
From: Simon Wunderlich @ 2026-06-30 13:44 UTC (permalink / raw)
To: netdev
Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, b.a.t.m.a.n, Sven Eckelmann, stable,
Simon Wunderlich
In-Reply-To: <20260630134430.85786-1-sw@simonwunderlich.de>
From: Sven Eckelmann <sven@narfation.org>
The pskb_may_pull() called by batadv_bla_is_backbone_gw() could reallocate
the buffer behind the skb. Variables which were pointing to the old buffer
need to be reassigned to avoid an use-after-free.
Cc: stable@vger.kernel.org
Fixes: 9e794b6bf4a2 ("batman-adv: drop unicast packets from other backbone gw")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/routing.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 2cc2307a41702..bbd40fe3a8e59 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -1029,6 +1029,7 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
hdr_size);
batadv_orig_node_put(orig_node_gw);
if (is_gw) {
+ orig_addr_gw = eth_hdr(skb)->h_source;
batadv_dbg(BATADV_DBG_BLA, bat_priv,
"%s(): Dropped unicast pkt received from another backbone gw %pM.\n",
__func__, orig_addr_gw);
--
2.47.3
^ permalink raw reply related
* [PATCH net 6/6] batman-adv: dat: ensure accessible eth_hdr proto field
From: Simon Wunderlich @ 2026-06-30 13:44 UTC (permalink / raw)
To: netdev
Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, b.a.t.m.a.n, Sven Eckelmann, stable, Sashiko,
Simon Wunderlich
In-Reply-To: <20260630134430.85786-1-sw@simonwunderlich.de>
From: Sven Eckelmann <sven@narfation.org>
When batadv_get_vid() accesses the proto field of the ethernet header, it
is not checking if the data itself is accessible. The caller is responsible
for it. But in contrast to other call sites, batadv_dat_get_vid() and its
caller didn't make sure this is true. This could have caused an
out-of-bounds access.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: be1db4f6615b ("batman-adv: make the Distributed ARP Table vlan aware")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/distributed-arp-table.c | 23 +++++++++++++++++++++++
net/batman-adv/main.c | 3 +++
2 files changed, 26 insertions(+)
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index ead02c9e08484..c40c9e02391be 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -1066,6 +1066,9 @@ static u16 batadv_arp_get_type(struct batadv_priv *bat_priv,
* @skb: the buffer containing the packet to extract the VID from
* @hdr_size: the size of the batman-adv header encapsulating the packet
*
+ * The caller must ensure that at least @hdr_size + ETH_HLEN bytes are
+ * accessible after skb->data.
+ *
* Return: If the packet embedded in the skb is vlan tagged this function
* returns the VID with the BATADV_VLAN_HAS_TAG flag. Otherwise BATADV_NO_FLAGS
* is returned.
@@ -1148,6 +1151,10 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,
if (!READ_ONCE(bat_priv->distributed_arp_table))
goto out;
+ /* first, find out the vid. */
+ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
+ goto out;
+
vid = batadv_dat_get_vid(skb, &hdr_size);
type = batadv_arp_get_type(bat_priv, skb, hdr_size);
@@ -1243,6 +1250,10 @@ bool batadv_dat_snoop_incoming_arp_request(struct batadv_priv *bat_priv,
if (!READ_ONCE(bat_priv->distributed_arp_table))
goto out;
+ /* first, find out the vid. */
+ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
+ goto out;
+
vid = batadv_dat_get_vid(skb, &hdr_size);
type = batadv_arp_get_type(bat_priv, skb, hdr_size);
@@ -1305,6 +1316,10 @@ void batadv_dat_snoop_outgoing_arp_reply(struct batadv_priv *bat_priv,
if (!READ_ONCE(bat_priv->distributed_arp_table))
return;
+ /* first, find out the vid. */
+ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
+ return;
+
vid = batadv_dat_get_vid(skb, &hdr_size);
type = batadv_arp_get_type(bat_priv, skb, hdr_size);
@@ -1353,6 +1368,10 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
if (!READ_ONCE(bat_priv->distributed_arp_table))
goto out;
+ /* first, find out the vid. */
+ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
+ goto out;
+
vid = batadv_dat_get_vid(skb, &hdr_size);
type = batadv_arp_get_type(bat_priv, skb, hdr_size);
@@ -1807,6 +1826,10 @@ bool batadv_dat_drop_broadcast_packet(struct batadv_priv *bat_priv,
if (batadv_forw_packet_is_rebroadcast(forw_packet))
goto out;
+ /* first, find out the vid. */
+ if (!pskb_may_pull(forw_packet->skb, hdr_size + ETH_HLEN))
+ goto out;
+
vid = batadv_dat_get_vid(forw_packet->skb, &hdr_size);
type = batadv_arp_get_type(bat_priv, forw_packet->skb, hdr_size);
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 3c4572284b532..4d3807a645b78 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -580,6 +580,9 @@ void batadv_recv_handler_unregister(u8 packet_type)
* @skb: the buffer containing the packet
* @header_len: length of the batman header preceding the ethernet header
*
+ * The caller must ensure that at least @header_len + ETH_HLEN bytes are
+ * accessible after skb->data.
+ *
* Return: VID with the BATADV_VLAN_HAS_TAG flag when the packet embedded in the
* skb is vlan tagged. Otherwise BATADV_NO_FLAGS.
*/
--
2.47.3
^ permalink raw reply related
* Re: [PATCH v3] net/sched: act_nat: only rewrite IPv4 packets
From: Paolo Abeni @ 2026-06-30 13:44 UTC (permalink / raw)
To: Samuel Moelius, Jamal Hadi Salim
Cc: Jiri Pirko, David S. Miller, Eric Dumazet, Jakub Kicinski,
Simon Horman, Herbert Xu, open list:TC subsystem, open list
In-Reply-To: <20260628132029.2209612.f2aaf6467355.act-nat-non-ipv4@trailofbits.com>
On 6/28/26 3:20 PM, Samuel Moelius wrote:
> act_nat can process packets whose protocol is not IPv4 and then
> interpret the payload as an IPv4 header. Non-IPv4 packets may be
> modified based on unrelated bytes at the network header offset.
>
> The action is documented as IPv4 NAT and should leave other protocols
> alone.
>
> Check skb->protocol before parsing and rewriting the IPv4 header. This
> keeps accepting hardware-accelerated VLAN IPv4 packets whose network
> header already points at the IPv4 header, while still rejecting inline
> VLAN packets because act_nat does not adjust the network header offset
> before using ip_hdr(skb).
>
> Fixes: b4219952356b ("[PKT_SCHED]: Add stateless NAT")
> Assisted-by: Codex:gpt-5.5-cyber-preview
> Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
> ---
> Changes in v3:
> - Check skb->protocol
> Changes in v2:
> - Check skb_protocol(skb, false)
>
> net/sched/act_nat.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
> index abb332dee836..1bf4a5853617 100644
> --- a/net/sched/act_nat.c
> +++ b/net/sched/act_nat.c
> @@ -142,6 +142,9 @@ TC_INDIRECT_SCOPE int tcf_nat_act(struct sk_buff *skb,
> egress = parms->flags & TCA_NAT_FLAG_EGRESS;
>
> noff = skb_network_offset(skb);
> + if (skb->protocol != htons(ETH_P_IP))
AFAICS, in the xmit path, for actions applied at the H/W NIC level,
without vlan H/W offload, the above test check will fail, even if the
current code would work just fine (skb->network_header points to the
actual IPv4 header).
My take is implementing a robust and safe check here would be overkill.
Users should attach the action to the correct filter.
/P
> + goto out;
> +
> if (!pskb_may_pull(skb, sizeof(*iph) + noff))
> goto drop;
>
^ permalink raw reply
* Re: [PATCH net-next v4] net: usb: rtl8150: handle link status read failures
From: Andrew Lunn @ 2026-06-30 13:48 UTC (permalink / raw)
To: Yousef Alhouseen
Cc: Petko Manolov, Andrew Lunn, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, linux-usb, netdev, linux-kernel,
syzbot+9db6c624635564ad813c
In-Reply-To: <20260630101216.10365-1-alhouseenyousef@gmail.com>
On Tue, Jun 30, 2026 at 12:12:16PM +0200, Yousef Alhouseen wrote:
> set_carrier() ignores the result of the USB control transfer and tests
> the stack variable supplied as its receive buffer. If the device rejects
> or aborts the request, that variable remains uninitialized and the driver
> chooses an arbitrary carrier state.
>
> Leave the existing carrier state unchanged when the link status cannot be
> read. A transient USB error should not be treated as link loss.
>
> Reported-by: syzbot+9db6c624635564ad813c@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=9db6c624635564ad813c
> Suggested-by: Petko Manolov <petkan@nucleusys.com>
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Andrew
^ permalink raw reply
* [PATCH net 1/6] batman-adv: retrieve ethhdr after potential skb realloc on RX
From: Simon Wunderlich @ 2026-06-30 13:44 UTC (permalink / raw)
To: netdev
Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, b.a.t.m.a.n, Sven Eckelmann, stable, Sashiko,
Simon Wunderlich
In-Reply-To: <20260630134430.85786-1-sw@simonwunderlich.de>
From: Sven Eckelmann <sven@narfation.org>
pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind
the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
This was done correctly for the VLAN header but missed for the ethernet
header which is later used for the TT and AP isolation handling.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Fixes: c78296665c3d ("batman-adv: Check skb size before using encapsulated ETH+VLAN header")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/mesh-interface.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/batman-adv/mesh-interface.c b/net/batman-adv/mesh-interface.c
index 44026810b99ce..511f70e0706a7 100644
--- a/net/batman-adv/mesh-interface.c
+++ b/net/batman-adv/mesh-interface.c
@@ -434,6 +434,7 @@ void batadv_interface_rx(struct net_device *mesh_iface,
if (!pskb_may_pull(skb, VLAN_ETH_HLEN))
goto dropped;
+ ethhdr = eth_hdr(skb);
vhdr = skb_vlan_eth_hdr(skb);
/* drop batman-in-batman packets to prevent loops */
--
2.47.3
^ permalink raw reply related
* [PATCH net 0/6] pull request: batman-adv 2026-06-30
From: Simon Wunderlich @ 2026-06-30 13:44 UTC (permalink / raw)
To: netdev
Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, b.a.t.m.a.n, Simon Wunderlich
Dear net maintainers,
here are a couple of bugfixes for batman-adv which we would like to have integrated into net.
Please pull or let me know of any problem!
Thank you,
Simon
The following changes since commit 805185b7c7a1069e407b6f7b3bc98e44d415f484:
Merge tag 'net-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-06-25 12:25:36 -0700)
are available in the Git repository at:
https://git.open-mesh.org/batadv.git tags/batadv-net-pullrequest-20260630
for you to fetch changes up to 26560c4a03dc4d607331600c187f59ab2df5f341:
batman-adv: dat: ensure accessible eth_hdr proto field (2026-06-28 11:49:04 +0200)
----------------------------------------------------------------
Here are some batman-adv bugfix, all by Sven Eckelmann:
- fix pointers after potential skb reallocs (5 patches)
- dat: ensure accessible eth_hdr proto field
----------------------------------------------------------------
Sven Eckelmann (6):
batman-adv: retrieve ethhdr after potential skb realloc on RX
batman-adv: access unicast_ttvn skb->data only after skb realloc
batman-adv: gw: acquire ethernet header only after skb realloc
batman-adv: dat: acquire ARP hw source only after skb realloc
batman-adv: bla: reacquire gw address after skb realloc
batman-adv: dat: ensure accessible eth_hdr proto field
net/batman-adv/distributed-arp-table.c | 28 +++++++++++++++++++++++++++-
net/batman-adv/gateway_client.c | 3 ++-
net/batman-adv/main.c | 3 +++
net/batman-adv/mesh-interface.c | 1 +
net/batman-adv/routing.c | 3 ++-
5 files changed, 35 insertions(+), 3 deletions(-)
^ permalink raw reply
* [PATCH net 3/6] batman-adv: gw: acquire ethernet header only after skb realloc
From: Simon Wunderlich @ 2026-06-30 13:44 UTC (permalink / raw)
To: netdev
Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, b.a.t.m.a.n, Sven Eckelmann, stable,
Simon Wunderlich
In-Reply-To: <20260630134430.85786-1-sw@simonwunderlich.de>
From: Sven Eckelmann <sven@narfation.org>
The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
Cc: stable@vger.kernel.org
Fixes: 6c413b1c22a2 ("batman-adv: send every DHCP packet as bat-unicast")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/gateway_client.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index 305488a74a256..a5ac82eabd250 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -684,12 +684,13 @@ bool batadv_gw_out_of_range(struct batadv_priv *bat_priv,
struct batadv_gw_node *gw_node = NULL;
struct batadv_gw_node *curr_gw = NULL;
struct batadv_neigh_ifinfo *curr_ifinfo, *old_ifinfo;
- struct ethhdr *ethhdr = (struct ethhdr *)skb->data;
+ struct ethhdr *ethhdr;
bool out_of_range = false;
u8 curr_tq_avg;
unsigned short vid;
vid = batadv_get_vid(skb, 0);
+ ethhdr = (struct ethhdr *)skb->data;
if (is_multicast_ether_addr(ethhdr->h_dest))
goto out;
--
2.47.3
^ permalink raw reply related
* [PATCH net 2/6] batman-adv: access unicast_ttvn skb->data only after skb realloc
From: Simon Wunderlich @ 2026-06-30 13:44 UTC (permalink / raw)
To: netdev
Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, b.a.t.m.a.n, Sven Eckelmann, stable, Sashiko,
Simon Wunderlich
In-Reply-To: <20260630134430.85786-1-sw@simonwunderlich.de>
From: Sven Eckelmann <sven@narfation.org>
The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
This was done correctly for the ethernet header but missed for the
unicast_packet pointer.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: c018ad3de61a ("batman-adv: add the VLAN ID attribute to the TT entry")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/routing.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index c05fcc9241add..2cc2307a41702 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -855,8 +855,8 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
if (skb_cow(skb, sizeof(*unicast_packet)) < 0)
return false;
- unicast_packet = (struct batadv_unicast_packet *)skb->data;
vid = batadv_get_vid(skb, hdr_len);
+ unicast_packet = (struct batadv_unicast_packet *)skb->data;
ethhdr = (struct ethhdr *)(skb->data + hdr_len);
/* do not reroute multicast frames in a unicast header */
--
2.47.3
^ permalink raw reply related
* [PATCH net 4/6] batman-adv: dat: acquire ARP hw source only after skb realloc
From: Simon Wunderlich @ 2026-06-30 13:44 UTC (permalink / raw)
To: netdev
Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, b.a.t.m.a.n, Sven Eckelmann, stable,
Simon Wunderlich
In-Reply-To: <20260630134430.85786-1-sw@simonwunderlich.de>
From: Sven Eckelmann <sven@narfation.org>
The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
Cc: stable@vger.kernel.org
Fixes: b61ec31c8575 ("batman-adv: Snoop DHCPACKs for DAT")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/distributed-arp-table.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index ae39ceaa2e29a..ead02c9e08484 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -1747,6 +1747,7 @@ void batadv_dat_snoop_incoming_dhcp_ack(struct batadv_priv *bat_priv,
struct ethhdr *ethhdr;
__be32 ip_src, yiaddr;
unsigned short vid;
+ int hdr_size_tmp;
__be16 proto;
u8 *hw_src;
@@ -1763,8 +1764,10 @@ void batadv_dat_snoop_incoming_dhcp_ack(struct batadv_priv *bat_priv,
if (!batadv_dat_check_dhcp_ack(skb, proto, &ip_src, chaddr, &yiaddr))
return;
+ hdr_size_tmp = hdr_size;
+ vid = batadv_dat_get_vid(skb, &hdr_size_tmp);
+ ethhdr = (struct ethhdr *)(skb->data + hdr_size);
hw_src = ethhdr->h_source;
- vid = batadv_dat_get_vid(skb, &hdr_size);
batadv_dat_entry_add(bat_priv, yiaddr, chaddr, vid);
batadv_dat_entry_add(bat_priv, ip_src, hw_src, vid);
--
2.47.3
^ permalink raw reply related
* Re: [PATCH net-next v4 06/13] dpaa2-switch: add dpaa2_switch_port_to_bridge_port() helper
From: Ioana Ciornei @ 2026-06-30 13:51 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, netdev; +Cc: linux-kernel
In-Reply-To: <20260629112309.154328-7-ioana.ciornei@nxp.com>
On Mon, Jun 29, 2026 at 02:23:02PM +0300, Ioana Ciornei wrote:
> In preparation for adding offloading support for upper bond devices we
> have to let the switchdev framework know if a specific bridge port is
> offloaded or not, even if that brport is an upper device.
>
> For this to happen, create the dpaa2_switch_port_to_bridge_port function
> which will determine the bridge port corresponding to a particular DPAA2
> switch interface and use it in the switchdev_bridge_port_offload call.
>
> Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
> ---
> Changes in v4:
> - Split the patch so that the first part only adds the base function and
> its call sites and the logic aroung lag is added later in the patch
> which actually adds the support for LAG.
> - Moved the patch so that it's a preparatory patch
>
> Changes in v3:
> - Access lag field through rtnl_dereference() so that we adapt to the
> __rcu change.
> - Check that the brport is non-NULL before calling
> switchdev_bridge_port_unoffload() on it.
>
> Changes in v2:
> - none
> ---
> .../ethernet/freescale/dpaa2/dpaa2-switch.c | 23 ++++++++++++++++---
> 1 file changed, 20 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
> index d4975d08fa44..88d199befbd9 100644
> --- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
> +++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
> @@ -2017,6 +2017,15 @@ static int dpaa2_switch_port_attr_set_event(struct net_device *netdev,
> return notifier_from_errno(err);
> }
>
> +static struct net_device *
> +dpaa2_switch_port_to_bridge_port(struct ethsw_port_priv *port_priv)
> +{
> + if (!port_priv->fdb->bridge_dev)
> + return NULL;
> +
> + return port_priv->netdev;
> +}
> +
> static int dpaa2_switch_port_bridge_join(struct net_device *netdev,
> struct net_device *upper_dev,
> struct netlink_ext_ack *extack)
> @@ -2024,6 +2033,7 @@ static int dpaa2_switch_port_bridge_join(struct net_device *netdev,
> struct ethsw_port_priv *port_priv = netdev_priv(netdev);
> struct dpaa2_switch_fdb *old_fdb = port_priv->fdb;
> struct ethsw_core *ethsw = port_priv->ethsw_data;
> + struct net_device *brport_dev;
> bool learn_ena;
> int err;
>
> @@ -2035,7 +2045,8 @@ static int dpaa2_switch_port_bridge_join(struct net_device *netdev,
> dpaa2_switch_port_set_fdb(port_priv, upper_dev, true);
sashiko.dev notes:
Does the removal of rtnl_lock() earlier in this patch series
expose port_priv->fdb to a concurrent data race here?
dpaa2_switch_event_work() reads port_priv->fdb without taking
rtnl_lock or using READ_ONCE(), which can race with bridge
join/leave operations that modify it via
dpaa2_switch_port_set_fdb().
No, that is not correct and how was this avoided is explained in the
commit message from patch 2/13:
To avoid this kind of concurency without a rtnl_lock, flush the
event workqueue as the last step from the pre_bridge_leave so
that any in-flight operations targeting the current FDB are
finalized before the bridge layout (and the per port FDB
assignment) changes.
Ioana
^ permalink raw reply
* Re: [PATCH 0/3] arm64: dts/net: stmmac: Add Agilex5 SoCDK TSN Config2 board support
From: Maxime Chevallier @ 2026-06-30 13:53 UTC (permalink / raw)
To: muhammad.nazim.amirul.nazle.asmade, dinguyen
Cc: rmk+kernel, krzk+dt, conor+dt, robh, davem, edumazet, kuba,
pabeni, andrew+netdev, devicetree, linux-arm-kernel, netdev,
linux-kernel
In-Reply-To: <20260630133108.27244-1-muhammad.nazim.amirul.nazle.asmade@altera.com>
Hi,
On 6/30/26 15:31, muhammad.nazim.amirul.nazle.asmade@altera.com wrote:
> From: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
>
> The Intel SoCFPGA Agilex5 SoCDK TSN Config2 board uses a dual-port
> Ethernet setup where gmac1 (TSN port) operates with different MAC-side
> and PHY-side interface modes: GMII internally in the MAC, and RGMII
> towards the PHY.
There's the same behaviour on Gen5, e.g. CycloneV where we have the
"EMAC splitter". Based on wether or not we have that splitter in DT,
we override the INTF_SEL bits to set GMII as the MAC output, the splitter
converting that to RGMII/SGMII.
Is there something similar on this AgileX5 version by any chance, for
which we could reuse the logic ?
I know that on CycloneV you also need to adjust that GMII -> RGMII/SGMII
splitter whenever the speed changes, is that different on agileX5 ? have
you tested 10/100Mbps ?
Thanks,
Maxime
^ permalink raw reply
* [PATCH RESEND net-next] net: hns3: add support to query/set TX pfc_prevention_tout for ethtool with RX prevention disabled
From: Jijie Shao @ 2026-06-30 13:40 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, andrew+netdev, horms
Cc: shenjian15, liuyonglong, chenhao418, yangshuaisong, netdev,
linux-kernel, shaojijie
From: Hao Chen <chenhao418@huawei.com>
Add ethtool support to query and configure the PFC (Priority Flow Control)
storm prevention timeout. When TX continuously sends PFC frames, the peer
end is suppressed from sending packets. If this persists, a PFC frame storm
may occur.
This feature allows configuring a timeout to prevent such storms.
Signed-off-by: Hao Chen <chenhao418@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
---
drivers/net/ethernet/hisilicon/hns3/hnae3.h | 14 ++
.../hns3/hns3_common/hclge_comm_cmd.h | 3 +
.../ethernet/hisilicon/hns3/hns3_ethtool.c | 12 ++
.../hisilicon/hns3/hns3pf/hclge_cmd.h | 9 +
.../hisilicon/hns3/hns3pf/hclge_main.c | 172 ++++++++++++++++++
.../hisilicon/hns3/hns3pf/hclge_main.h | 7 +
6 files changed, 217 insertions(+)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
index a8798eecd9fb..4286af9239b0 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
@@ -602,6 +602,10 @@ typedef int (*read_func)(struct seq_file *s, void *data);
* Config wake on lan
* dbg_get_read_func
* Return the read func for debugfs seq file
+ * set_pfc_prevention_tout
+ * Set PFC storm prevention timeout
+ * get_pfc_prevention_tout
+ * Get PFC storm prevention timeout
*/
struct hnae3_ae_ops {
int (*init_ae_dev)(struct hnae3_ae_dev *ae_dev);
@@ -810,6 +814,8 @@ struct hnae3_ae_ops {
int (*hwtstamp_set)(struct hnae3_handle *handle,
struct kernel_hwtstamp_config *config,
struct netlink_ext_ack *extack);
+ int (*set_pfc_prevention_tout)(struct hnae3_handle *handle, u16 times);
+ int (*get_pfc_prevention_tout)(struct hnae3_handle *handle, u16 *times);
};
struct hnae3_dcb_ops {
@@ -891,6 +897,14 @@ struct hnae3_roce_private_info {
unsigned long state;
};
+struct hnae3_pfc_storm_para {
+ u32 dir;
+ u32 enable;
+ u32 period_ms;
+ u32 times;
+ u32 recovery_period_ms;
+};
+
#define HNAE3_SUPPORT_APP_LOOPBACK BIT(0)
#define HNAE3_SUPPORT_PHY_LOOPBACK BIT(1)
#define HNAE3_SUPPORT_SERDES_SERIAL_LOOPBACK BIT(2)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.h
index 2c2a2f1e0d7a..6dde07dde1e8 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.h
@@ -314,6 +314,9 @@ enum hclge_opcode_type {
/* Query link diagnosis info command */
HCLGE_OPC_QUERY_LINK_DIAGNOSIS = 0x702A,
+
+ /* Config pause storm param command */
+ HCLGE_OPC_CFG_PAUSE_STORM_PARA = 0x7019,
};
enum hclge_comm_cmd_return_status {
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
index 442f15476af3..e7318f236315 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
@@ -1895,6 +1895,12 @@ static int hns3_get_tunable(struct net_device *netdev,
case ETHTOOL_TX_COPYBREAK_BUF_SIZE:
*(u32 *)data = h->kinfo.tx_spare_buf_size;
break;
+ case ETHTOOL_PFC_PREVENTION_TOUT:
+ if (!h->ae_algo->ops->get_pfc_prevention_tout)
+ return -EOPNOTSUPP;
+
+ ret = h->ae_algo->ops->get_pfc_prevention_tout(h, (u16 *)data);
+ break;
default:
ret = -EOPNOTSUPP;
break;
@@ -2020,6 +2026,12 @@ static int hns3_set_tunable(struct net_device *netdev,
netdev_info(netdev, "the active tx spare buf size is %u, due to page order\n",
priv->ring->tx_spare->len);
+ break;
+ case ETHTOOL_PFC_PREVENTION_TOUT:
+ if (!h->ae_algo->ops->set_pfc_prevention_tout)
+ return -EOPNOTSUPP;
+
+ ret = h->ae_algo->ops->set_pfc_prevention_tout(h, *(u16 *)data);
break;
default:
ret = -EOPNOTSUPP;
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
index 4ce92ddefcde..1c029dc32ab8 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
@@ -890,6 +890,15 @@ struct hclge_query_wol_supported_cmd {
u8 rsv[20];
};
+struct hclge_pfc_storm_para_cmd {
+ __le32 dir;
+ __le32 enable;
+ __le32 period_ms;
+ __le32 times;
+ __le32 recovery_period_ms;
+ __le32 rsv;
+};
+
struct hclge_hw;
int hclge_cmd_send(struct hclge_hw *hw, struct hclge_desc *desc, int num);
#endif
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index fc8587c80813..a08d8a35aef9 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -3524,6 +3524,122 @@ static int hclge_set_vf_link_state(struct hnae3_handle *handle, int vf,
return ret;
}
+static int hclge_set_pfc_storm_para(struct hclge_dev *hdev,
+ struct hnae3_pfc_storm_para *para)
+{
+ struct hclge_pfc_storm_para_cmd *para_cmd;
+ struct hclge_desc desc;
+ int ret;
+
+ if (hdev->ae_dev->dev_version < HNAE3_DEVICE_VERSION_V3)
+ return -EOPNOTSUPP;
+
+ hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_CFG_PAUSE_STORM_PARA,
+ false);
+ para_cmd = (struct hclge_pfc_storm_para_cmd *)desc.data;
+ para_cmd->dir = cpu_to_le32(para->dir);
+ para_cmd->enable = cpu_to_le32(para->enable);
+ para_cmd->period_ms = cpu_to_le32(para->period_ms);
+ para_cmd->times = cpu_to_le32(para->times);
+ para_cmd->recovery_period_ms = cpu_to_le32(para->recovery_period_ms);
+
+ ret = hclge_cmd_send(&hdev->hw, &desc, 1);
+ if (ret)
+ dev_err(&hdev->pdev->dev,
+ "failed to set pfc storm para, ret = %d\n", ret);
+ return ret;
+}
+
+static int hclge_get_pfc_storm_para(struct hclge_dev *hdev,
+ struct hnae3_pfc_storm_para *para)
+{
+ struct hclge_pfc_storm_para_cmd *para_cmd;
+ struct hclge_desc desc;
+ int ret;
+
+ if (hdev->ae_dev->dev_version < HNAE3_DEVICE_VERSION_V3)
+ return -EOPNOTSUPP;
+
+ hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_CFG_PAUSE_STORM_PARA, true);
+ para_cmd = (struct hclge_pfc_storm_para_cmd *)desc.data;
+ para_cmd->dir = cpu_to_le32(para->dir);
+ ret = hclge_cmd_send(&hdev->hw, &desc, 1);
+ if (ret) {
+ dev_err(&hdev->pdev->dev,
+ "failed to get pfc storm para, ret = %d\n", ret);
+ return ret;
+ }
+
+ para->enable = le32_to_cpu(para_cmd->enable);
+ para->period_ms = le32_to_cpu(para_cmd->period_ms);
+ para->times = le32_to_cpu(para_cmd->times);
+ para->recovery_period_ms = le32_to_cpu(para_cmd->recovery_period_ms);
+
+ return 0;
+}
+
+static int hclge_enable_pfc_storm_prevent(struct hclge_dev *hdev,
+ int dir, bool enable)
+{
+ struct hnae3_pfc_storm_para para = {0};
+ int ret;
+
+ para.dir = dir;
+ ret = hclge_get_pfc_storm_para(hdev, ¶);
+ if (ret)
+ return ret;
+
+ para.enable = enable;
+ return hclge_set_pfc_storm_para(hdev, ¶);
+}
+
+static int hclge_set_pfc_prevention_tout(struct hnae3_handle *h, u16 times)
+{
+ struct hclge_vport *vport = hclge_get_vport(h);
+ struct hclge_dev *hdev = vport->back;
+ struct hnae3_pfc_storm_para para;
+ int ret;
+
+ if (times > HCLGE_MAX_PFC_PREVENTION_TOUT) {
+ dev_err(&hdev->pdev->dev,
+ "times %u should be no more than %u!\n",
+ times, HCLGE_MAX_PFC_PREVENTION_TOUT);
+ return -EINVAL;
+ }
+
+ para.dir = HCLGE_DIR_TX;
+ ret = hclge_get_pfc_storm_para(hdev, ¶);
+ if (ret)
+ return ret;
+
+ para.enable = times ? 1 : 0;
+ para.times = (u32)times;
+ ret = hclge_set_pfc_storm_para(hdev, ¶);
+ if (ret)
+ return ret;
+
+ hdev->pfc_prevention_tout = times;
+
+ return 0;
+}
+
+static int hclge_get_pfc_prevention_tout(struct hnae3_handle *h, u16 *times)
+{
+ struct hclge_vport *vport = hclge_get_vport(h);
+ struct hclge_dev *hdev = vport->back;
+ struct hnae3_pfc_storm_para para;
+ int ret;
+
+ para.dir = HCLGE_DIR_TX;
+ ret = hclge_get_pfc_storm_para(hdev, ¶);
+ if (ret)
+ return ret;
+
+ *times = para.enable ? (u16)para.times : 0;
+
+ return 0;
+}
+
static void hclge_set_reset_pending(struct hclge_dev *hdev,
enum hnae3_reset_type reset_type)
{
@@ -4317,6 +4433,26 @@ static int hclge_reset_prepare(struct hclge_dev *hdev)
return hclge_reset_prepare_wait(hdev);
}
+static void hclge_restore_pfc_storm_prevention_tout(struct hclge_dev *hdev)
+{
+ struct hnae3_handle *handle = &hdev->vport[0].nic;
+ int ret;
+
+ ret = hclge_enable_pfc_storm_prevent(hdev, HCLGE_DIR_RX, false);
+ if (ret == -EOPNOTSUPP)
+ return;
+ else if (ret)
+ dev_warn(&hdev->pdev->dev,
+ "failed to disable rx pfc storm prevent, ret = %d\n",
+ ret);
+
+ ret = hclge_set_pfc_prevention_tout(handle, hdev->pfc_prevention_tout);
+ if (ret)
+ dev_warn(&hdev->pdev->dev,
+ "failed to set tx pfc storm prevent, ret = %d\n",
+ ret);
+}
+
static int hclge_reset_rebuild(struct hclge_dev *hdev)
{
int ret;
@@ -9278,6 +9414,32 @@ static int hclge_init_wol(struct hclge_dev *hdev)
return hclge_update_wol(hdev);
}
+static void hclge_init_pfc_prevention_tout(struct hclge_dev *hdev)
+{
+ struct hnae3_handle *handle = &hdev->vport[0].nic;
+ u16 times;
+ int ret;
+
+ ret = hclge_enable_pfc_storm_prevent(hdev, HCLGE_DIR_RX, false);
+ if (ret == -EOPNOTSUPP)
+ return;
+ else if (ret)
+ dev_warn(&hdev->pdev->dev,
+ "failed to disable rx pfc storm prevent, ret = %d\n",
+ ret);
+
+ ret = hclge_get_pfc_prevention_tout(handle, ×);
+ if (ret) {
+ dev_warn(&hdev->pdev->dev,
+ "failed to get tx pfc prevention timeout, ret = %d\n",
+ ret);
+ times = HCLGE_DEFAULT_PFC_PREVENTION_TOUT;
+ }
+
+ hdev->pfc_prevention_tout = times;
+ hdev->pfc_prevention_tout_default = times;
+}
+
static void hclge_get_wol(struct hnae3_handle *handle,
struct ethtool_wolinfo *wol)
{
@@ -9547,6 +9709,8 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
dev_warn(&pdev->dev,
"failed to wake on lan init, ret = %d\n", ret);
+ hclge_init_pfc_prevention_tout(hdev);
+
ret = hclge_devlink_init(hdev);
if (ret)
goto err_ptp_uninit;
@@ -9946,6 +10110,8 @@ static int hclge_reset_ae_dev(struct hnae3_ae_dev *ae_dev)
dev_warn(&pdev->dev,
"failed to update wol config, ret = %d\n", ret);
+ hclge_restore_pfc_storm_prevention_tout(hdev);
+
dev_info(&pdev->dev, "Reset done, %s driver initialization finished.\n",
HCLGE_DRIVER_NAME);
@@ -9977,6 +10143,10 @@ static void hclge_uninit_ae_dev(struct hnae3_ae_dev *ae_dev)
hclge_config_nic_hw_error(hdev, false);
hclge_config_rocee_ras_interrupt(hdev, false);
+ /* Restore hw default values for the next initialization */
+ hclge_set_pfc_prevention_tout(&hdev->vport->nic,
+ hdev->pfc_prevention_tout_default);
+
hclge_comm_cmd_uninit(hdev->ae_dev, &hdev->hw.hw);
hclge_misc_irq_uninit(hdev);
hclge_devlink_uninit(hdev);
@@ -10539,6 +10709,8 @@ static const struct hnae3_ae_ops hclge_ops = {
.set_wol = hclge_set_wol,
.hwtstamp_get = hclge_ptp_get_cfg,
.hwtstamp_set = hclge_ptp_set_cfg,
+ .set_pfc_prevention_tout = hclge_set_pfc_prevention_tout,
+ .get_pfc_prevention_tout = hclge_get_pfc_prevention_tout,
};
static struct hnae3_ae_algo ae_algo = {
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
index 7419481422c3..0cee8947f6b4 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
@@ -346,6 +346,11 @@ enum hclge_link_fail_code {
#define HCLGE_LINK_STATUS_DOWN 0
#define HCLGE_LINK_STATUS_UP 1
+#define HCLGE_DIR_RX 0
+#define HCLGE_DIR_TX 1
+#define HCLGE_MAX_PFC_PREVENTION_TOUT 2000
+#define HCLGE_DEFAULT_PFC_PREVENTION_TOUT 1000
+
#define HCLGE_PG_NUM 4
#define HCLGE_SCH_MODE_SP 0
#define HCLGE_SCH_MODE_DWRR 1
@@ -898,6 +903,8 @@ struct hclge_dev {
u16 vf_rss_size_max; /* HW defined VF max RSS task queue */
u16 pf_rss_size_max; /* HW defined PF max RSS task queue */
u32 tx_spare_buf_size; /* HW defined TX spare buffer size */
+ u16 pfc_prevention_tout; /* User config, restored after reset */
+ u16 pfc_prevention_tout_default; /* HW default, to avoid stale state */
u16 fdir_pf_filter_count; /* Num of guaranteed filters for this PF */
u16 num_alloc_vport; /* Num vports this driver supports */
base-commit: cef9d6804030793cf8b8796fd6936197d065dd3e
--
2.33.0
^ permalink raw reply related
* Re: [PATCH 2/3] arm64: dts: socfpga: agilex5: Add SoCDK TSN Config2 board
From: Andrew Lunn @ 2026-06-30 13:58 UTC (permalink / raw)
To: muhammad.nazim.amirul.nazle.asmade
Cc: dinguyen, maxime.chevallier, rmk+kernel, krzk+dt, conor+dt, robh,
davem, edumazet, kuba, pabeni, andrew+netdev, devicetree,
linux-arm-kernel, netdev, linux-kernel
In-Reply-To: <20260630133108.27244-3-muhammad.nazim.amirul.nazle.asmade@altera.com>
> + * gmac1 is the TSN port. The MAC operates in GMII mode internally
> + * while the PHY-side interface is RGMII, so mac-mode and phy-mode differ.
> + */
> +&gmac1 {
> + status = "okay";
> + phy-mode = "rgmii"; /* TX/RX clock delays provided by Agilex5 I/O hardware */
Could you provide more details about this. I want to understand the
big picture.
Normally we talk about the PCB providing the delays. This sounds like
it is the FPGA? So i need convincing this is correct.
https://elixir.bootlin.com/linux/v6.15/source/Documentation/devicetree/bindings/net/ethernet-controller.yaml#L287
Andrew
^ permalink raw reply
* [PATCH net-next v2 0/4] net: convert UDP getsockopt to sockopt_t
From: Breno Leitao @ 2026-06-30 14:01 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Willem de Bruijn, Shuah Khan, sdf.kernel
Cc: netdev, linux-kernel, linux-kselftest, Breno Leitao, kernel-team
The leaf proto_ops getsockopt callbacks have been moving to the new
getsockopt_iter()/sockopt_t interface.
I was trying to get SMC into getsockop and retire .getsockopt, but,
I found the best approach is to keep converting other protocols.
This series starts the same conversion one layer down, at the struct proto
getsockopt path, beginning with UDP.
Example of the current code.
static int udp_getsockopt(struct sock *sk, int level, int optname,
char __user *optval, int __user *optlen)
{
if (level == SOL_UDP)
return udp_lib_getsockopt(sk, level, optname, optval, optlen);
return ip_getsockopt(sk, level, optname, optval, optlen);
}
We want udp_getsockopt to go to .getsockopt_iter, and there are two
approaches in this case:
1) Create a patchset that moves both of them to getsockopt_iter, which
is will be a huge change (ip_getsockopt() is used in many places)
2) Break this down, and transform from bottoms up. First
udp_lib_getsockopt() up to the point we can easily convert
others, such as ip_getsockopt().
I am taking the approach 2), so, the intermediate code will be something
like:
static int udp_getsockopt(struct sock *sk, int level, int optname,
char __user *optval, int __user *optlen)
{
sockopt_t opt;
int err;
if (level != SOL_UDP)
return ip_getsockopt(sk, level, optname, optval, optlen);
// Convert optlen/optval in sockopt // (first patch)
err = udp_lib_getsockopt(sk, level, optname, &opt);
}
The work is bottom-up and mergeable in small steps: a protocol's inner
getsockopt helper is switched to sockopt_t behind its existing thin
__user wrapper, one patch at a time.
Once every inner helper speaks sockopt_t, a later series flips the shared
struct proto.getsockopt and inet_connection_sock_af_ops.getsockopt signatures
and drops the transitional wrappers.
Signed-off-by: Breno Leitao <leitao@debian.org>
---
Changes in v2:
- Check for invalid `len` at call site (Stanlislav)
- Do not rewrite `optlen` on error path (Sashiko)
- Converted ipv4 raw
- Expanded the selftest to test this new helper.
- Link to v1: https://lore.kernel.org/r/20260612-getsockopt_phase2-v1-0-7b01f1f5d106@debian.org
---
Breno Leitao (4):
net: add sockopt_init_user() for getsockopt conversion
udp: convert udp_lib_getsockopt to sockopt_t
ipv4: raw: convert do_raw_getsockopt to sockopt_t
selftests: net: getsockopt_iter: add raw ICMP_FILTER coverage
include/linux/net.h | 23 +++++++
include/net/udp.h | 2 +-
net/ipv4/raw.c | 41 ++++++-----
net/ipv4/udp.c | 39 ++++++++---
net/ipv6/udp.c | 19 +++++-
tools/testing/selftests/net/getsockopt_iter.c | 97 +++++++++++++++++++++++++++
6 files changed, 191 insertions(+), 30 deletions(-)
---
base-commit: c8459ee2fef502d6ef6c063751c33d9ac7943eab
change-id: 20260611-getsockopt_phase2-cd495a0115ca
Best regards,
--
Breno Leitao <leitao@debian.org>
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox