* RE: [PATCH iwl-net v1] idpf: fix lan_regs leak on core init failure
From: Jagielski, Jedrzej @ 2026-07-06 9:12 UTC (permalink / raw)
To: xuanqiang.luo@linux.dev, intel-wired-lan@lists.osuosl.org
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
Nguyen, Anthony L, Kitszel, Przemyslaw, Andrew Lunn,
Hay, Joshua A, Nikolova, Tatyana E, Xuanqiang Luo
In-Reply-To: <20260703104132.47419-1-xuanqiang.luo@linux.dev>
From: xuanqiang.luo@linux.dev <xuanqiang.luo@linux.dev>
Sent: Friday, July 3, 2026 12:42 PM
>From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
>
>idpf_vc_core_init() gets the LAN memory region layout before mapping the
>regions and allocating vport resources. Both layout paths allocate
>hw->lan_regs, but later error paths return without freeing it.
>
>idpf_vc_core_deinit() does not cover these paths because it returns unless
>IDPF_VC_CORE_INIT is set, and that bit is set only after core init
>succeeds.
>
>Free hw->lan_regs on the post-allocation error paths and clear the
>pointer and region count.
>
>Fixes: 6aa53e861c1a ("idpf: implement get LAN MMIO memory regions")
>Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Looks fine, thanks for the patch!
Reviewed-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
^ permalink raw reply
* Re: [PATCH 07/13] ASoC: replace linux/gpio.h inclusions
From: Charles Keepax @ 2026-07-06 9:01 UTC (permalink / raw)
To: Arnd Bergmann
Cc: linux-gpio, Arnd Bergmann, Bartosz Golaszewski, Andrew Lunn,
Sebastian Hesselbarth, Gregory Clement, Frank Li, Robert Jarzmik,
Krzysztof Kozlowski, Greg Ungerer, Thomas Bogendoerfer,
Hauke Mehrtens, Rafał Miłecki, Yoshinori Sato,
John Paul Adrian Glaubitz, Linus Walleij, Dmitry Torokhov,
Jakub Kicinski, Paolo Abeni, Dominik Brodowski, linux-kernel,
linux-arm-kernel, linux-samsung-soc, patches, linux-m68k,
linux-mips, linux-sh, linux-input, linux-media, netdev,
linux-sunxi, linux-phy, linux-rockchip, linux-sound
In-Reply-To: <20260629132633.1300009-8-arnd@kernel.org>
On Mon, Jun 29, 2026 at 03:26:27PM +0200, Arnd Bergmann wrote:
> From: Arnd Bergmann <arnd@arndb.de>
>
> linux/gpio.h is going away,s o use linux/gpio/consumer.h instead.
>
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
> sound/soc/codecs/cs42l84.c | 2 +-
> sound/soc/codecs/cx2072x.c | 2 +-
For the Cirrus bits:
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Thanks,
Charles
^ permalink raw reply
* [PATCH net v3] ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
From: Norbert Szetei @ 2026-07-06 9:01 UTC (permalink / raw)
To: netdev
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Qingfang Deng, Yue Haibing, Guillaume Nault,
Kees Cook, Taegu Ha, linux-ppp, netdev, linux-kernel, gnault
pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:
l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv()
-> ppp_input(&po->chan)
It runs under rcu_read_lock() holding only an l2tp_session reference and
takes NO reference on the internal PPP channel (struct channel,
chan->ppp) that ppp_input() dereferences.
The pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel
are RCU-safe. But the internal struct channel is a separate allocation
that ppp_release_channel() frees with a plain kfree():
close(data socket) -> pppol2tp_release() -> pppox_unbind_sock()
-> ppp_unregister_channel() -> ppp_release_channel() -> kfree(pch)
For a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit
(no PPPIOCCONNECT, pch->ppp == NULL) and not bridged, teardown skips
both ppp_disconnect_channel()'s synchronize_net() and
ppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace
period. rcu_read_lock() in pppol2tp_recv() does not protect against a
plain kfree(), so an in-flight ppp_input() on one CPU can dereference
the channel just freed by close() on another CPU.
The bug is reachable by an unprivileged user.
Defer the channel free to an RCU callback via call_rcu() so the grace
period fences any in-flight ppp_input(). The disconnect and unbridge
teardown paths already fence with synchronize_net()/synchronize_rcu();
call_rcu() does the same here without stalling the close() path.
Fixes: ee40fb2e1eb5 ("l2tp: protect sock pointer of struct pppol2tp_session with RCU")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
---
v3:
- Added rcu_barrier() at the end of ppp_cleanup() to ensure all
ppp_release_channel_free() callbacks complete before the module's
text segment is unloaded (Documentation/RCU/rcubarrier.rst).
v2: https://lore.kernel.org/linux-ppp/D9C0245B-608B-4884-8A09-F55BA4A9F948@doyensec.com/
- Moved skb_queue_purge() to a dedicated RCU callback to prevent leaking
skbs added by an in-flight ppp_input() during the grace period (Sebastian).
- Retained call_rcu() to avoid introducing synchronous multi-millisecond
latency into the teardown path.
v1: https://lore.kernel.org/netdev/C954A7EA-AA98-4E3C-80B5-42C34B3183A3@doyensec.com/
drivers/net/ppp/ppp_generic.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 57c68efa5ff8..717c1d3aa953 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -184,6 +184,7 @@ struct channel {
struct list_head clist; /* link in list of channels per unit */
spinlock_t upl; /* protects `ppp' and 'bridge' */
struct channel __rcu *bridge; /* "bridged" ppp channel */
+ struct rcu_head rcu; /* for RCU-deferred free of the channel */
#ifdef CONFIG_PPP_MULTILINK
u8 avail; /* flag used in multilink stuff */
u8 had_frag; /* >= 1 fragments have been sent */
@@ -3562,6 +3563,18 @@ ppp_disconnect_channel(struct channel *pch)
return err;
}
+/* Purge after the grace period: a late ppp_input() may still queue an
+ * skb on pch->file.rq before the last RCU reader drains.
+ */
+static void ppp_release_channel_free(struct rcu_head *rcu)
+{
+ struct channel *pch = container_of(rcu, struct channel, rcu);
+
+ skb_queue_purge(&pch->file.xq);
+ skb_queue_purge(&pch->file.rq);
+ kfree(pch);
+}
+
/*
* Drop a reference to a ppp channel and free its memory if the refcount reaches
* zero.
@@ -3581,9 +3594,7 @@ static void ppp_release_channel(struct channel *pch)
pr_err("ppp: destroying undead channel %p !\n", pch);
return;
}
- skb_queue_purge(&pch->file.xq);
- skb_queue_purge(&pch->file.rq);
- kfree(pch);
+ call_rcu(&pch->rcu, ppp_release_channel_free);
}
static void __exit ppp_cleanup(void)
@@ -3596,6 +3607,7 @@ static void __exit ppp_cleanup(void)
device_destroy(&ppp_class, MKDEV(PPP_MAJOR, 0));
class_unregister(&ppp_class);
unregister_pernet_device(&ppp_net_ops);
+ rcu_barrier(); /* wait for RCU callbacks before module unload */
}
/*
--
2.55.0
^ permalink raw reply related
* Re: [PATCH net 2/3] net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
From: Paolo Abeni @ 2026-07-06 9:01 UTC (permalink / raw)
To: Daniel Borkmann, kuba
Cc: jhs, bigeasy, andrii, memxor, bpf, netdev, Victor Nogueira
In-Reply-To: <20260630123331.186840-3-daniel@iogearbox.net>
On 6/30/26 2:33 PM, Daniel Borkmann wrote:
> From: Jamal Hadi Salim <jhs@mojatatu.com>
>
> When a TC filter attached to a qdisc filter chain returns
> TC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an
> act_bpf action), the redirect was silently lost i.e no qdisc classify
> function handled TC_ACT_REDIRECT, so the packet fell through the
> switch and was enqueued normally instead of being redirected.
>
> This has been broken since bpf_redirect() was introduced for TC in
> commit 27b29f63058d ("bpf: add bpf_redirect() helper"). We got lucky
> for a long time because bpf_net_context was a per-CPU variable that
> was always available.
>
> commit 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct
> on PREEMPT_RT.") turned bpf_net_context into a task_struct member that
> is only set up by explicit callers. Without a caller setting it up,
> bpf_redirect() itself crashes with a NULL pointer dereference in
> bpf_net_ctx_get_ri(). However, even with bpf_net_context available,
> TC_ACT_REDIRECT from qdisc filter chains cannot be honored without
> adding skb_do_redirect() calls to every qdisc classify function, which
> would require changes across net/sched/. Isolate it to ebpf core where
> it belongs.
>
> Instead, add a tcf_classify_qdisc() inline helper in pkt_cls.h, as a
> wrapper around tcf_classify() for use by qdisc classify functions and
> tcf_qevent_handle(). When the classify verdict is TC_ACT_REDIRECT,
> the wrapper converts it to TC_ACT_SHOT, dropping the packet rather
> than letting it continue silently. Dropping is preferred over
> letting the packet through because the user immediately sees packet
> loss. Silently passing the packet through would hide the problem and
> leave the user wondering why their redirect is not working.
>
> The clsact fast path, tc_run() continues to call tcf_classify() directly
> and is unaffected: TC_ACT_REDIRECT is returned as-is and handled by
> sch_handle_egress/ingress() calling skb_do_redirect() as before.
>
> Fixes: 27b29f63058d ("bpf: add bpf_redirect() helper")
> Fixes: 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.")
> Tested-by: Victor Nogueira <victor@mojatatu.com>
> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
I'm sorry, this does not apply cleanly anymore.
Could you please rebase and repost?
Thanks!
Paolo
^ permalink raw reply
* Re: [PATCH 05/13] mfd: replace linux/gpio.h inclusions
From: Charles Keepax @ 2026-07-06 8:59 UTC (permalink / raw)
To: Arnd Bergmann
Cc: linux-gpio, Arnd Bergmann, Bartosz Golaszewski, Andrew Lunn,
Sebastian Hesselbarth, Gregory Clement, Frank Li, Robert Jarzmik,
Krzysztof Kozlowski, Greg Ungerer, Thomas Bogendoerfer,
Hauke Mehrtens, Rafał Miłecki, Yoshinori Sato,
John Paul Adrian Glaubitz, Linus Walleij, Dmitry Torokhov,
Jakub Kicinski, Paolo Abeni, Dominik Brodowski, linux-kernel,
linux-arm-kernel, linux-samsung-soc, patches, linux-m68k,
linux-mips, linux-sh, linux-input, linux-media, netdev,
linux-sunxi, linux-phy, linux-rockchip, linux-sound
In-Reply-To: <20260629132633.1300009-6-arnd@kernel.org>
On Mon, Jun 29, 2026 at 03:26:25PM +0200, Arnd Bergmann wrote:
> From: Arnd Bergmann <arnd@arndb.de>
>
> linux/gpio.h should no longer be used, convert these instead to
> either linux/gpio/consumer.h or linux/gpio/legacy.h as needed.
>
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
> drivers/mfd/arizona-irq.c | 2 +-
> drivers/mfd/wm8994-irq.c | 2 +-
For the wolfson bits:
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Thanks,
Charles
^ permalink raw reply
* Re: [PATCH rdma-next v9] RDMA: Change capability fields in ib_device_attr from int to u32
From: Leon Romanovsky @ 2026-07-06 8:49 UTC (permalink / raw)
To: Erni Sri Satya Vennela
Cc: Jason Gunthorpe, mkalderon, zyjzyj2000, sagi, mgurtovoy,
haris.iqbal, jinpu.wang, bvanassche, kbusch, Jens Axboe,
Christoph Hellwig, kch, smfrench, linkinjeon, metze, tom, cel,
jlayton, neil, okorniev, Dai.Ngo, trondmy, anna, achender, davem,
edumazet, kuba, pabeni, horms, kees, andriy.shevchenko, clm,
ebadger, linux-rdma, linux-kernel, target-devel, linux-nvme,
linux-cifs, samba-technical, linux-nfs, netdev, rds-devel,
Jason Gunthorpe
In-Reply-To: <20260703060329.896125-1-ernis@linux.microsoft.com>
On Thu, Jul 02, 2026 at 11:02:57PM -0700, Erni Sri Satya Vennela wrote:
> The capability counter fields in struct ib_device_attr are declared
> as signed int, but these values are inherently non-negative. Drivers
> maintain their cached caps as u32 and assign them directly into these
> int fields; if a cap exceeds INT_MAX the implicit narrowing yields a
> negative value visible to the IB core.
>
> Change the signed int capability fields to u32 to match the
> underlying nature of the data. Also update consumers across the IB
> core, ULPs, NVMe-oF target, RDS, and NFS/RDMA so the new u32 values
> are not forced back through signed int or u8 via min()/min_t() or
> narrowing local variables.
>
> Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
> Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com>
> Acked-by: Stefan Metzmacher <metze@samba.org> # smbdirect
> ---
> Changes in v9:
> * Switch the srq_size module parameter accessors to param_get_uint and
> kstrtouint()/param_set_uint() so they match the now-unsigned
> nvmet_rdma_srq_size variable.
> Changes in v8:
> * Convert the remaining non-negative counter fields max_ee_rd_atom,
> max_ee_init_rd_atom, max_ee, max_rdd, max_raw_ipv6_qp and max_srq_wr
> to u32; keep max_srq as int (its consumer compares it against
> ib_device.num_comp_vectors, still int).
> * Drop all remaining min_t() where plain min() now works.
> * Make the srq_size module parameters unsigned int so the srq_size min()
> stays a plain min().
> * Replace the ternary-inside-min() with the simpler "if (x) x--;".
> * Reorder the send_queue_depth min() to min(value, CONST) to match the
> sibling site.
> * Restore reverse xmas-tree declaration order.
> * Collapse the min()/min3() assignments that now fit onto a single line
> within 100 columns.
> * Print the now-u32 fields with %u instead of %d.
> Changes in v7:
> * Drop min_t() in all sites where a plain min() (or min3()) works
> cleanly
> * Guard nvme/host/rdma.c num_inline_segments computation against a
> device reporting max_send_sge == 0, so the u32 subtract
> cannot wrap to UINT_MAX.
> * Use %u when printing the newly-u32 capability fields
> in diagnostic messages.
> Changes in v6:
> * Fix subject prefix: net-next -> rdma-next.
> Changes in v5:
> * Add U8_MAX clamps in iser_verbs, nvme/host, nvme/target, isert,
> * rds/ib_cm, smbdirect/connect and smbdirect/accept where u32 capability
> fields were directly narrowed into u8 rdma_conn_param fields without
> clamping.
> * Guard the inline_sge_count calculation in nvmet_rdma_find_get_device()
> to prevent u32 underflow when both max_sge_rd and max_recv_sge are
> zero.
> * Expand type migration to 9 additional fields (max_mw, max_raw_ethy_qp,
> max_mcast_grp, max_mcast_qp_attach, max_total_mcast_qp_attach, max_ah,
> max_srq, max_srq_wr, max_srq_sge)
> * Fix min_t(int,...) in svc_rdma_transport; min_t(u32,...) in ipoib,
> srpt, nvme/target, rds/ib, rtrs-clt, rtrs-srv, xprtrdma/verbsdd.
> * Fix frwr_ops.c u32 underflow guard (reorder check before subtraction)
> * Change sc_max_send_sges to unsigned int, inline_sge_count to u32
> * Fix %d -> %u in rxe_qp, rxe_srq, ipoib_cm, ib_isert,
> * svc_rdma_transport
> * Update commit message.
> Changes in v4:
> * Drop clamping the values in mana_ib_query_device, instead update
> the props values from int to u32.
> Changes in v3:
> * Drop clamping from mana_ib_gd_query_adapter_caps(). The internal u32
> caps cache does not need to be clamped.
> * Move all clamping exclusively to mana_ib_query_device(), which is the
> only place the cached u32 values are narrowed into the signed int
> fields of struct ib_device_attr.
> * Reframe commit message: this is a u32-to-int type boundary fix, not a
> CVM/untrusted-hardware hardening patch.
> Changes in v2:
> * Update patch title.
> ---
> drivers/infiniband/core/cq.c | 3 +-
> drivers/infiniband/hw/qedr/verbs.c | 2 +-
> drivers/infiniband/sw/rxe/rxe_qp.c | 22 +++++-----
> drivers/infiniband/sw/rxe/rxe_srq.c | 16 +++----
> drivers/infiniband/ulp/ipoib/ipoib_cm.c | 10 ++---
> drivers/infiniband/ulp/ipoib/ipoib_verbs.c | 3 +-
> drivers/infiniband/ulp/iser/iser_verbs.c | 5 +--
> drivers/infiniband/ulp/isert/ib_isert.c | 7 ++-
> drivers/infiniband/ulp/rtrs/rtrs-clt.c | 11 ++---
> drivers/infiniband/ulp/rtrs/rtrs-srv.c | 11 ++---
> drivers/infiniband/ulp/srp/ib_srp.c | 2 +-
> drivers/infiniband/ulp/srpt/ib_srpt.c | 21 +++++----
> drivers/nvme/host/rdma.c | 8 ++--
> drivers/nvme/target/rdma.c | 22 ++++++----
> fs/smb/smbdirect/accept.c | 5 ++-
> fs/smb/smbdirect/connect.c | 5 ++-
> fs/smb/smbdirect/connection.c | 8 ++--
> include/linux/sunrpc/svc_rdma.h | 4 +-
> include/rdma/ib_verbs.h | 50 +++++++++++-----------
> net/rds/ib.c | 10 ++---
> net/rds/ib_cm.c | 10 ++---
> net/sunrpc/xprtrdma/frwr_ops.c | 7 +--
> net/sunrpc/xprtrdma/svc_rdma_transport.c | 5 +--
> net/sunrpc/xprtrdma/verbs.c | 2 +-
> 24 files changed, 122 insertions(+), 127 deletions(-)
The following code is still missing. Also, what about mxa_srq?
Why wasn't it converted as well?
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index f599c24b34e8..aae4f3f6bcba 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -454,7 +454,8 @@ static int fill_res_info(struct sk_buff *msg, struct ib_device *device,
};
struct nlattr *table_attr;
- int ret, i, curr, max;
+ u64 curr, max;
+ int ret, i;
if (fill_nldev_handle(msg, device))
return -EMSGSIZE;
diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/restrack.c
index cfee2071586c..1b2f9df49e28 100644
--- a/drivers/infiniband/core/restrack.c
+++ b/drivers/infiniband/core/restrack.c
@@ -61,7 +61,7 @@ void rdma_restrack_clean(struct ib_device *dev)
* @type: actual type of object to operate
* @show_details: count driver specific objects
*/
-int rdma_restrack_count(struct ib_device *dev, enum rdma_restrack_type type,
+u32 rdma_restrack_count(struct ib_device *dev, enum rdma_restrack_type type,
bool show_details)
{
struct rdma_restrack_root *rt = &dev->res[type];
diff --git a/include/rdma/restrack.h b/include/rdma/restrack.h
index 451f99e3717d..c081384740ce 100644
--- a/include/rdma/restrack.h
+++ b/include/rdma/restrack.h
@@ -123,7 +123,7 @@ struct rdma_restrack_entry {
u32 id;
};
-int rdma_restrack_count(struct ib_device *dev, enum rdma_restrack_type type,
+u32 rdma_restrack_count(struct ib_device *dev, enum rdma_restrack_type type,
bool show_details);
/**
* rdma_is_kernel_res() - check the owner of resource
^ permalink raw reply related
* [PATCH] bonding: fix devconf_all NULL dereference when IPv6 is disabled
From: zhangzl2013 @ 2026-07-06 8:45 UTC (permalink / raw)
To: Zhaolong Zhang, Jay Vosburgh
Cc: Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Hangbin Liu, netdev, linux-kernel, Qianheng Peng,
Zhaolong Zhang
From: Zhaolong Zhang <zhangzl68@chinatelecom.cn>
When booting with the 'ipv6.disable=1' parameter, the devconf_all is
never initialized because inet6_init() exits before addrconf_init() is
called which initializes it. bond_send_validate(), however, will still
call bond_ns_send_all() even ipv6 is indeed disabled. It will lead to
NULL derefence of net->ipv6.devconf_all in ip6_pol_route().
BUG: kernel NULL pointer dereference, address: 000000000000000c
[...]
Workqueue: bond0 bond_arp_monitor [bonding]
RIP: 0010:ip6_pol_route+0x69/0x480
[...]
Call Trace:
<TASK>
? srso_return_thunk+0x5/0x5f
? __pfx_ip6_pol_route_output+0x10/0x10
fib6_rule_lookup+0xfe/0x260
? wakeup_preempt+0x8a/0x90
? srso_return_thunk+0x5/0x5f
? srso_return_thunk+0x5/0x5f
? sched_balance_rq+0x369/0x810
ip6_route_output_flags+0xd7/0x170
bond_ns_send_all+0xde/0x280 [bonding]
bond_ab_arp_probe+0x296/0x320 [bonding]
? srso_return_thunk+0x5/0x5f
bond_activebackup_arp_mon+0xb4/0x2c0 [bonding]
process_one_work+0x196/0x370
worker_thread+0x1af/0x320
? srso_return_thunk+0x5/0x5f
? __pfx_worker_thread+0x10/0x10
kthread+0xe3/0x120
? __pfx_kthread+0x10/0x10
ret_from_fork+0x199/0x260
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Fix this by adding ipv6_mod_enabled() condition check in the caller.
Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets")
Signed-off-by: Qianheng Peng <pengqh1@chinatelecom.cn>
Signed-off-by: Zhaolong Zhang <zhangzl68@chinatelecom.cn>
---
drivers/net/bonding/bond_main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index e044fc733b8c..522eab060f9e 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3455,7 +3455,8 @@ static void bond_send_validate(struct bonding *bond, struct slave *slave)
{
bond_arp_send_all(bond, slave);
#if IS_ENABLED(CONFIG_IPV6)
- bond_ns_send_all(bond, slave);
+ if (likely(ipv6_mod_enabled()))
+ bond_ns_send_all(bond, slave);
#endif
}
--
2.52.0
^ permalink raw reply related
* Re: [PATCH] timekeeping: Document monotonic raw timestamps in snapshots correctly
From: Thomas Weißschuh @ 2026-07-06 8:42 UTC (permalink / raw)
To: Thomas Gleixner
Cc: LKML, David Woodhouse, Miroslav Lichvar, John Stultz,
Stephen Boyd, Anna-Maria Behnsen, Frederic Weisbecker,
Arthur Kiyanovski, Rodolfo Giometti, Vincent Donnefort,
Marc Zyngier, Oliver Upton, kvmarm, Oliver Upton, Richard Cochran,
netdev, Takashi Iwai, Miri Korenblit, Johannes Berg, Jacob Keller,
Tony Nguyen, Saeed Mahameed, Peter Hilber, Michael S. Tsirkin,
virtualization, linux-wireless, linux-sound
In-Reply-To: <87wlv9k3wz.ffs@fw13>
On Sun, Jul 05, 2026 at 02:38:04PM +0200, Thomas Gleixner wrote:
> The comments related to raw monotonic timestamps for the various
> snapshot mechanisms in code and struct documentation are ambiguous. They
> reference them as CLOCK_MONOTONIC_RAW timestamps, but with the arrival
> of AUX clocks that's not longer correct.
>
> The raw monotonic timestamps only represent CLOCK_MONOTONIC_RAW for the
> system time clock IDs, i.e. REALTIME, MONOTONIC, BOOTTIME, TAI.
>
> For AUX clocks they refer to the monotonic raw clock which is related to
> the individual AUX clocks. These monotonic raw timestamps have the same
> conversion factor as CLOCK_MONOTONIC_RAW, but differ from that by an
> offset:
>
> MONORAW(AUX$N) = MONORAW(SYSTEM) + OFFSET(AUX$N)
>
> The offset is established when a AUX clock is enabled and stays constant
> for the lifetime of the AUX clock.
>
> Update the comments so they reflect reality.
>
> Signed-off-by: Thomas Gleixner <tglx@kernel.org>
> Reported-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Thanks!
Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
(...)
^ permalink raw reply
* Re: [PATCH net-next] net: dpaa_eth: convert to napi_gro_receive
From: Vladimir Oltean @ 2026-07-06 8:39 UTC (permalink / raw)
To: Rosen Penev
Cc: netdev, Madalin Bucur, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, open list
In-Reply-To: <20260706030632.1826810-1-rosenp@gmail.com>
Hi Rosen,
On Sun, Jul 05, 2026 at 08:06:32PM -0700, Rosen Penev wrote:
> Replace netif_receive_skb() with napi_gro_receive() to improve receive
> performance for this driver. It has rx checksum support so routing speed
> shouldn't suffer.
>
> Tested on a WatchGuard Firebox M300.
>
> iperf3 bidir speed test:
>
> [ ID][Role] Interval Transfer Bitrate Retr
> [ 5][TX-C] 0.00-60.01 sec 5.35 GBytes 766 Mbits/sec 184 sender
> [ 5][TX-C] 0.00-60.02 sec 5.35 GBytes 766 Mbits/sec receiver
> [ 7][RX-C] 0.00-60.01 sec 5.50 GBytes 787 Mbits/sec 124 sender
> [ 7][RX-C] 0.00-60.02 sec 5.49 GBytes 786 Mbits/sec receiver
>
> After:
>
> [ ID][Role] Interval Transfer Bitrate Retr
> [ 5][TX-C] 0.00-60.01 sec 6.49 GBytes 929 Mbits/sec 0 sender
> [ 5][TX-C] 0.00-60.02 sec 6.49 GBytes 928 Mbits/sec receiver
> [ 7][RX-C] 0.00-60.01 sec 6.55 GBytes 938 Mbits/sec 0 sender
> [ 7][RX-C] 0.00-60.02 sec 6.55 GBytes 937 Mbits/sec receiver
>
> Assisted-by: Opencode:big-pickle
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---
> drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 5 +----
> 1 file changed, 1 insertion(+), 4 deletions(-)
>
> diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
> index ad2d8256eb8d..83191f636ec7 100644
> --- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
> +++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
> @@ -2824,10 +2824,7 @@ static enum qman_cb_dqrr_result rx_default_dqrr(struct qman_portal *portal,
>
> skb_len = skb->len;
>
> - if (unlikely(netif_receive_skb(skb) == NET_RX_DROP)) {
> - percpu_stats->rx_dropped++;
> - return qman_cb_dqrr_consume;
> - }
> + napi_gro_receive(&np->napi, skb);
>
> percpu_stats->rx_packets++;
> percpu_stats->rx_bytes += skb_len;
> --
> 2.55.0
>
>
(thanks to Madalin for pointing out this change to me)
I do not have time this week to test this patch, but in premise, you are
creating exactly the conditions for this bug to occur:
https://github.com/nxp-qoriq/linux/commit/d0ebec2092d6c5fe327513cb66e02d8c2c1a8f87
In sdk_dpaa we already do GRO for TCP flows and it has the problems
pointed out in the above commit. With your change to use GRO for all
capable flows, I currently have no reason to believe that without
similar countermeasures as those taken by sdk_dpaa (napi_gro_receive()
global to the entire QMan portal) the outcome would be different.
Have you tested traffic in mixed scenarios, where flows from multiple
interfaces land on the same CPU?
Until further evidence comes in:
pw-bot: cr
^ permalink raw reply
* Re: [PATCH net] net: stmmac: intel: don't reconfigure SerDes on unchanged mode
From: Maxime Chevallier @ 2026-07-06 8:29 UTC (permalink / raw)
To: Markus Breitenberger, netdev
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Choong Yong Liang, stable, Markus Breitenberger
In-Reply-To: <20260706061954.94842-1-bre@breiti.cc>
Hi Markus,
On 7/6/26 08:19, Markus Breitenberger wrote:
> From: Markus Breitenberger <bre@keba.com>
>
> intel_mac_finish() is registered as the phylink mac_finish() callback
> for the Elkhart Lake SGMII ports. phylink calls mac_finish() at the end
> of every major link reconfiguration, including the initial one during
> probe, before any interface mode has actually changed.
>
> The callback reprograms the shared ModPHY LCPLL through the PMC IPC and
> then power-cycles the SerDes. On Elkhart Lake that ModPHY is also used
> by the on-die AHCI SATA PHY. Running the reconfiguration during the
> initial boot-time link-up disturbs the shared analog block while it is
> still driving SATA, so the SATA link fails to train:
>
> ata1: SATA link down (SStatus 1 SControl 300)
>
> The disk carrying the root filesystem is never detected and the system
> hangs at rootwait. Ethernet itself comes up normally, which makes the
> failure look unrelated to the network driver.
>
> Firmware already programs the ModPHY for the configured interface, so
> the reconfiguration is redundant unless the interface mode really
> changes. Return early when the requested mode equals the current one.
> This avoids touching the shared ModPHY (and the SATA PHY) during boot
> while preserving runtime SGMII to 2500BASE-X switching, which still
> sees a genuine mode change and reconfigures as before.
One thing is that now we 'blindly' rely on the bootloader / fw having
correctly configured the initial interface.
From what I see the only configuration that's done is regarding the serdes
rate. Maybe instead the serdes interaction logic can be reworked so that you
query the serdes rate, see if you need to adjust it based on the selected
interface, and if so you re-configure it ?
Maxime
^ permalink raw reply
* Re: [PATCH net 0/9] netfilter: updates for net
From: Florian Westphal @ 2026-07-06 8:26 UTC (permalink / raw)
To: netdev
Cc: Paolo Abeni, David S. Miller, Eric Dumazet, Jakub Kicinski,
netfilter-devel, pablo
In-Reply-To: <20260703125709.16493-1-fw@strlen.de>
Florian Westphal <fw@strlen.de> wrote:
> The following patchset contains Netfilter fixes for *net*, all
> for ancient problems. Patch 7 raised drive-by sashiko findings,
> but those are not related to the change itself.
There more unrelated findings, those will be addressed in a future PR.
^ permalink raw reply
* Re: [PATCH nf] ipvs: skip IPv6 extension headers in SCTP state lookup
From: Yizhou Zhao @ 2026-07-06 8:22 UTC (permalink / raw)
To: Julian Anastasov
Cc: netdev, Simon Horman, Pablo Neira Ayuso, Florian Westphal,
Phil Sutter, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, lvs-devel, netfilter-devel, coreteam, linux-kernel,
Yuxiang Yang, Ao Wang, Xuewei Feng, Qi Li, Ke Xu, stable
In-Reply-To: <92783c87-7e6a-e90a-b2fc-e5d1332139e0@ssi.bg>
Hi Julian,
Thanks for your review.
> On Jul 6, 2026, at 01:35, Julian Anastasov <ja@ssi.bg> wrote:
>
> May be it is better starting from ip_vs_set_state()
> to provide new arg 'int iph_len/offset' (set to iph.len), down to
> state_transition(), sctp_state_transition() and set_sctp_state().
> Same for all protos. It should cost less stack and ipv6_find_hdr()
> calls and what matters most, correct iph context in case we
> have IP+ICMP+TCP (with just two ports or even with TCP flags)
> and are scheduling ICMP, i.e. not IP+TCP as usually.
I agree that the already parsed transport-header offset should be
passed from ip_vs_set_state() down to the protocol state_transition()
callbacks, instead of reparsing the skb in set_sctp_state(). We will
send a v2 that does this for SCTP, TCP and the other IPVS protocols
in one combined fix.
> But what I see is that ip_vs_in_icmp*() are missing
> the ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd) call just
> after ip_vs_in_stats() and before ip_vs_icmp_xmit() where
> we should provide ciph.len. That is why we don't reach the
> set_tcp_state() calls to set correct cp->state and timeout
> when scheduling related ICMP. So, this should be fixed too.
For the ICMP path, I agree that the missing ip_vs_set_state() call is
worth looking at, but using ICMP errors to drive the upper L4 state
needs some care, because spoofed ICMP packets can match an
existing embedded tuple before the endpoint TCP/SCTP stack
performs its own validation. Maybe this change needs further
discussion?
Thanks,
Yizhou
^ permalink raw reply
* [PATCH net] ptp: netc: explicitly clear TMR_OFF during initialization
From: wei.fang @ 2026-07-06 8:12 UTC (permalink / raw)
To: richardcochran, xiaoning.wang, andrew+netdev, davem, edumazet,
kuba, pabeni, Frank.Li
Cc: netdev, imx, wei.fang
From: Clark Wang <xiaoning.wang@nxp.com>
The NETC timer does not support function level reset, so TMR_OFF_L/H
registers are not cleared by pcie_flr(). If TMR_OFF was set to a
non-zero value in a previous binding, it will persist across driver
rebind and cause inaccurate PTP time.
There is also a hardware issue: after a warm reset or soft reset,
TMR_OFF_L/H registers appear to be cleared to zero, but the timer clock
domain internally retains the stale value. When the timer is re-enabled,
TMR_CUR_TIME continues to track the old offset until TMR_OFF is written
explicitly. This can cause incorrect PTP timestamps and even PTP clock
synchronization failures.
Per the recommendation from the IP team, explicitly write 0 to TMR_OFF
in netc_timer_init() to flush the internally cached value and ensure
TMR_CUR_TIME follows the freshly initialized counter.
Fixes: 87a201d59963 ("ptp: netc: add NETC V4 Timer PTP driver support")
Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
Signed-off-by: Wei Fang <wei.fang@nxp.com>
---
drivers/ptp/ptp_netc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/ptp/ptp_netc.c b/drivers/ptp/ptp_netc.c
index 94e952ee6990..5e381c354d74 100644
--- a/drivers/ptp/ptp_netc.c
+++ b/drivers/ptp/ptp_netc.c
@@ -779,6 +779,7 @@ static void netc_timer_init(struct netc_timer *priv)
netc_timer_wr(priv, NETC_TMR_FIPER_CTRL, fiper_ctrl);
netc_timer_wr(priv, NETC_TMR_ECTRL, NETC_TMR_DEFAULT_ETTF_THR);
+ netc_timer_offset_write(priv, 0);
ktime_get_real_ts64(&now);
ns = timespec64_to_ns(&now);
netc_timer_cnt_write(priv, ns);
--
2.34.1
^ permalink raw reply related
* Re: [PATCH v4 2/5] drm/ras: Introduce error threshold
From: Raag Jadav @ 2026-07-06 8:03 UTC (permalink / raw)
To: intel-xe, dri-devel, netdev
Cc: simona.vetter, airlied, kuba, lijo.lazar, Hawking.Zhang, davem,
pabeni, edumazet, dev, zachary.mckevitt, rodrigo.vivi,
riana.tauro, michal.wajdeczko, matthew.d.roper, mallesh.koujalagi
In-Reply-To: <20260623101043.255897-3-raag.jadav@intel.com>
Hi Jakub,
On Tue, Jun 23, 2026 at 03:39:56PM +0530, Raag Jadav wrote:
> Add get-error-threshold and set-error-threshold command support which
> allows querying/setting error threshold of the counter. Threshold in RAS
> context means the number of errors the hardware is expected to accumulate
> before it raises them to software. This is to have a fine grained control
> over error notifications that are raised by the hardware.
Anything I can do to move this forward?
> Signed-off-by: Raag Jadav <raag.jadav@intel.com>
> ---
> v2: Document threshold definition (Riana)
> Return -EOPNOTSUPP on threshold callbacks absence (Riana)
> Cancel and free genlmsg on failure (Riana)
> Document threshold bounds checking responsibility (Riana)
> v3: Move documentation from yaml to rst file (Riana)
> s/value/threshold (Riana)
> Use goto for error handling (Riana)
> v4: Clarify 0 threshold expectations (Riana)
> Drop redundant wrapping (Riana)
> ---
> Documentation/gpu/drm-ras.rst | 18 +++
> Documentation/netlink/specs/drm_ras.yaml | 32 +++++
> drivers/gpu/drm/drm_ras.c | 161 +++++++++++++++++++++++
> drivers/gpu/drm/drm_ras_nl.c | 27 ++++
> drivers/gpu/drm/drm_ras_nl.h | 4 +
> include/drm/drm_ras.h | 28 ++++
> include/uapi/drm/drm_ras.h | 3 +
> 7 files changed, 273 insertions(+)
>
> diff --git a/Documentation/gpu/drm-ras.rst b/Documentation/gpu/drm-ras.rst
> index 83c21853b74b..2718f8aee09d 100644
> --- a/Documentation/gpu/drm-ras.rst
> +++ b/Documentation/gpu/drm-ras.rst
> @@ -56,6 +56,10 @@ User space tools can:
> ``node-id`` and ``error-id`` as parameters.
> * Clear specific error counters with the ``clear-error-counter`` command, using both
> ``node-id`` and ``error-id`` as parameters.
> +* Query specific error counter threshold with the ``get-error-threshold`` command, using both
> + ``node-id`` and ``error-id`` as parameters.
> +* Set specific error counter threshold with the ``set-error-threshold`` command, using
> + ``node-id``, ``error-id`` and ``error-threshold`` as parameters.
>
> YAML-based Interface
> --------------------
> @@ -111,3 +115,17 @@ Example: Clear an error counter for a given node
>
> sudo ynl --family drm_ras --do clear-error-counter --json '{"node-id":0, "error-id":1}'
> None
> +
> +Example: Query error threshold of a given counter
> +
> +.. code-block:: bash
> +
> + sudo ynl --family drm_ras --do get-error-threshold --json '{"node-id":0, "error-id":1}'
> + {'error-id': 1, 'error-name': 'error_name1', 'error-threshold': 16}
> +
> +Example: Set error threshold of a given counter
> +
> +.. code-block:: bash
> +
> + sudo ynl --family drm_ras --do set-error-threshold --json '{"node-id":0, "error-id":1, "error-threshold":8}'
> + None
> diff --git a/Documentation/netlink/specs/drm_ras.yaml b/Documentation/netlink/specs/drm_ras.yaml
> index e113056f8c01..9cf7f9cde242 100644
> --- a/Documentation/netlink/specs/drm_ras.yaml
> +++ b/Documentation/netlink/specs/drm_ras.yaml
> @@ -69,6 +69,10 @@ attribute-sets:
> name: error-value
> type: u32
> doc: Current value of the requested error counter.
> + -
> + name: error-threshold
> + type: u32
> + doc: Error threshold of the counter.
>
> operations:
> list:
> @@ -124,3 +128,31 @@ operations:
> do:
> request:
> attributes: *id-attrs
> + -
> + name: get-error-threshold
> + doc: >-
> + Retrieve error threshold of a given counter.
> + The response includes the id, the name, and current threshold
> + of the counter.
> + attribute-set: error-counter-attrs
> + flags: [admin-perm]
> + do:
> + request:
> + attributes: *id-attrs
> + reply:
> + attributes:
> + - error-id
> + - error-name
> + - error-threshold
> + -
> + name: set-error-threshold
> + doc: >-
> + Set error threshold of a given counter.
> + attribute-set: error-counter-attrs
> + flags: [admin-perm]
> + do:
> + request:
> + attributes:
> + - node-id
> + - error-id
> + - error-threshold
> diff --git a/drivers/gpu/drm/drm_ras.c b/drivers/gpu/drm/drm_ras.c
> index 467a169026fc..d60c40ac5427 100644
> --- a/drivers/gpu/drm/drm_ras.c
> +++ b/drivers/gpu/drm/drm_ras.c
> @@ -41,6 +41,13 @@
> * Userspace must provide Node ID, Error ID.
> * Clears specific error counter of a node if supported.
> *
> + * 4. GET_ERROR_THRESHOLD: Query error threshold of a given counter.
> + * Userspace must provide Node ID and Error ID.
> + * Returns the error threshold of a specific counter.
> + *
> + * 5. SET_ERROR_THRESHOLD: Set error threshold of a given counter.
> + * Userspace must provide Node ID, Error ID and threshold to be set.
> + *
> * Node registration:
> *
> * - drm_ras_node_register(): Registers a new node and assigns
> @@ -61,6 +68,16 @@
> * + The error counters in the driver doesn't need to be contiguous, but the
> * driver must return -ENOENT to the query_error_counter as an indication
> * that the ID should be skipped and not listed in the netlink API.
> + * + The driver can optionally implement query_error_threshold() and
> + * set_error_threshold() callbacks to facilitate getting/setting error
> + * threshold of the counter. Threshold in RAS context means the number of
> + * errors the hardware is expected to accumulate before it raises them to
> + * software. This is to have a fine grained control over error notifications
> + * that are raised by the hardware.
> + * + The driver is responsible for error threshold bounds checking.
> + * + Threshold of 0 can mean invalid threshold or act as a disable notifications
> + * toggle for that counter depending on usecase and the driver is responsible
> + * for handling it as needed.
> *
> * Netlink handlers:
> *
> @@ -72,6 +89,10 @@
> * operation, fetching a counter value from a specific node.
> * - drm_ras_nl_clear_error_counter_doit(): Implements the CLEAR_ERROR_COUNTER doit
> * operation, clearing a counter value from a specific node.
> + * - drm_ras_nl_get_error_threshold_doit(): Implements the GET_ERROR_THRESHOLD doit
> + * operation, fetching the error threshold of a specific counter.
> + * - drm_ras_nl_set_error_threshold_doit(): Implements the SET_ERROR_THRESHOLD doit
> + * operation, setting the error threshold of a specific counter.
> */
>
> static DEFINE_XARRAY_ALLOC(drm_ras_xa);
> @@ -168,6 +189,40 @@ static int get_node_error_counter(u32 node_id, u32 error_id,
> return node->query_error_counter(node, error_id, name, value);
> }
>
> +static int get_node_error_threshold(u32 node_id, u32 error_id, const char **name, u32 *threshold)
> +{
> + struct drm_ras_node *node;
> +
> + node = xa_load(&drm_ras_xa, node_id);
> + if (!node)
> + return -ENOENT;
> +
> + if (!node->query_error_threshold)
> + return -EOPNOTSUPP;
> +
> + if (error_id < node->error_counter_range.first || error_id > node->error_counter_range.last)
> + return -EINVAL;
> +
> + return node->query_error_threshold(node, error_id, name, threshold);
> +}
> +
> +static int set_node_error_threshold(u32 node_id, u32 error_id, u32 threshold)
> +{
> + struct drm_ras_node *node;
> +
> + node = xa_load(&drm_ras_xa, node_id);
> + if (!node)
> + return -ENOENT;
> +
> + if (!node->set_error_threshold)
> + return -EOPNOTSUPP;
> +
> + if (error_id < node->error_counter_range.first || error_id > node->error_counter_range.last)
> + return -EINVAL;
> +
> + return node->set_error_threshold(node, error_id, threshold);
> +}
> +
> static int msg_reply_value(struct sk_buff *msg, u32 error_id,
> const char *error_name, u32 value)
> {
> @@ -186,6 +241,22 @@ static int msg_reply_value(struct sk_buff *msg, u32 error_id,
> value);
> }
>
> +static int msg_reply_threshold(struct sk_buff *msg, u32 error_id, const char *error_name,
> + u32 threshold)
> +{
> + int ret;
> +
> + ret = nla_put_u32(msg, DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID, error_id);
> + if (ret)
> + return ret;
> +
> + ret = nla_put_string(msg, DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_NAME, error_name);
> + if (ret)
> + return ret;
> +
> + return nla_put_u32(msg, DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_THRESHOLD, threshold);
> +}
> +
> static int doit_reply_value(struct genl_info *info, u32 node_id,
> u32 error_id)
> {
> @@ -225,6 +296,43 @@ static int doit_reply_value(struct genl_info *info, u32 node_id,
> return ret;
> }
>
> +static int doit_reply_threshold(struct genl_info *info, u32 node_id, u32 error_id)
> +{
> + const char *error_name;
> + struct sk_buff *msg;
> + struct nlattr *hdr;
> + u32 threshold;
> + int ret;
> +
> + msg = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
> + if (!msg)
> + return -ENOMEM;
> +
> + hdr = genlmsg_iput(msg, info);
> + if (!hdr) {
> + ret = -EMSGSIZE;
> + goto free_msg;
> + }
> +
> + ret = get_node_error_threshold(node_id, error_id, &error_name, &threshold);
> + if (ret)
> + goto cancel_msg;
> +
> + ret = msg_reply_threshold(msg, error_id, error_name, threshold);
> + if (ret)
> + goto cancel_msg;
> +
> + genlmsg_end(msg, hdr);
> +
> + return genlmsg_reply(msg, info);
> +
> +cancel_msg:
> + genlmsg_cancel(msg, hdr);
> +free_msg:
> + nlmsg_free(msg);
> + return ret;
> +}
> +
> /**
> * drm_ras_nl_get_error_counter_dumpit() - Dump all Error Counters
> * @skb: Netlink message buffer
> @@ -358,6 +466,59 @@ int drm_ras_nl_clear_error_counter_doit(struct sk_buff *skb,
> return node->clear_error_counter(node, error_id);
> }
>
> +/**
> + * drm_ras_nl_get_error_threshold_doit() - Query error threshold of a counter
> + * @skb: Netlink message buffer
> + * @info: Generic Netlink info containing attributes of the request
> + *
> + * Extracts the Node ID and Error ID from the netlink attributes and retrieves
> + * the error threshold of the corresponding counter. Sends the result back to
> + * the requesting user via the standard Genl reply.
> + *
> + * Return: 0 on success, or negative errno on failure.
> + */
> +int drm_ras_nl_get_error_threshold_doit(struct sk_buff *skb, struct genl_info *info)
> +{
> + u32 node_id, error_id;
> +
> + if (!info->attrs ||
> + GENL_REQ_ATTR_CHECK(info, DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID) ||
> + GENL_REQ_ATTR_CHECK(info, DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID))
> + return -EINVAL;
> +
> + node_id = nla_get_u32(info->attrs[DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID]);
> + error_id = nla_get_u32(info->attrs[DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID]);
> +
> + return doit_reply_threshold(info, node_id, error_id);
> +}
> +
> +/**
> + * drm_ras_nl_set_error_threshold_doit() - Set error threshold of a counter
> + * @skb: Netlink message buffer
> + * @info: Generic Netlink info containing attributes of the request
> + *
> + * Extracts the Node ID, Error ID and threshold from the netlink attributes and
> + * sets the error threshold of the corresponding counter.
> + *
> + * Return: 0 on success, or negative errno on failure.
> + */
> +int drm_ras_nl_set_error_threshold_doit(struct sk_buff *skb, struct genl_info *info)
> +{
> + u32 node_id, error_id, threshold;
> +
> + if (!info->attrs ||
> + GENL_REQ_ATTR_CHECK(info, DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID) ||
> + GENL_REQ_ATTR_CHECK(info, DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID) ||
> + GENL_REQ_ATTR_CHECK(info, DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_THRESHOLD))
> + return -EINVAL;
> +
> + node_id = nla_get_u32(info->attrs[DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID]);
> + error_id = nla_get_u32(info->attrs[DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID]);
> + threshold = nla_get_u32(info->attrs[DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_THRESHOLD]);
> +
> + return set_node_error_threshold(node_id, error_id, threshold);
> +}
> +
> /**
> * drm_ras_node_register() - Register a new RAS node
> * @node: Node structure to register
> diff --git a/drivers/gpu/drm/drm_ras_nl.c b/drivers/gpu/drm/drm_ras_nl.c
> index dea1c1b2494e..02e8e5054d05 100644
> --- a/drivers/gpu/drm/drm_ras_nl.c
> +++ b/drivers/gpu/drm/drm_ras_nl.c
> @@ -28,6 +28,19 @@ static const struct nla_policy drm_ras_clear_error_counter_nl_policy[DRM_RAS_A_E
> [DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID] = { .type = NLA_U32, },
> };
>
> +/* DRM_RAS_CMD_GET_ERROR_THRESHOLD - do */
> +static const struct nla_policy drm_ras_get_error_threshold_nl_policy[DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID + 1] = {
> + [DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID] = { .type = NLA_U32, },
> + [DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID] = { .type = NLA_U32, },
> +};
> +
> +/* DRM_RAS_CMD_SET_ERROR_THRESHOLD - do */
> +static const struct nla_policy drm_ras_set_error_threshold_nl_policy[DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_THRESHOLD + 1] = {
> + [DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID] = { .type = NLA_U32, },
> + [DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID] = { .type = NLA_U32, },
> + [DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_THRESHOLD] = { .type = NLA_U32, },
> +};
> +
> /* Ops table for drm_ras */
> static const struct genl_split_ops drm_ras_nl_ops[] = {
> {
> @@ -56,6 +69,20 @@ static const struct genl_split_ops drm_ras_nl_ops[] = {
> .maxattr = DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID,
> .flags = GENL_ADMIN_PERM | GENL_CMD_CAP_DO,
> },
> + {
> + .cmd = DRM_RAS_CMD_GET_ERROR_THRESHOLD,
> + .doit = drm_ras_nl_get_error_threshold_doit,
> + .policy = drm_ras_get_error_threshold_nl_policy,
> + .maxattr = DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID,
> + .flags = GENL_ADMIN_PERM | GENL_CMD_CAP_DO,
> + },
> + {
> + .cmd = DRM_RAS_CMD_SET_ERROR_THRESHOLD,
> + .doit = drm_ras_nl_set_error_threshold_doit,
> + .policy = drm_ras_set_error_threshold_nl_policy,
> + .maxattr = DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_THRESHOLD,
> + .flags = GENL_ADMIN_PERM | GENL_CMD_CAP_DO,
> + },
> };
>
> struct genl_family drm_ras_nl_family __ro_after_init = {
> diff --git a/drivers/gpu/drm/drm_ras_nl.h b/drivers/gpu/drm/drm_ras_nl.h
> index a398643572a5..57b1e647d833 100644
> --- a/drivers/gpu/drm/drm_ras_nl.h
> +++ b/drivers/gpu/drm/drm_ras_nl.h
> @@ -20,6 +20,10 @@ int drm_ras_nl_get_error_counter_dumpit(struct sk_buff *skb,
> struct netlink_callback *cb);
> int drm_ras_nl_clear_error_counter_doit(struct sk_buff *skb,
> struct genl_info *info);
> +int drm_ras_nl_get_error_threshold_doit(struct sk_buff *skb,
> + struct genl_info *info);
> +int drm_ras_nl_set_error_threshold_doit(struct sk_buff *skb,
> + struct genl_info *info);
>
> extern struct genl_family drm_ras_nl_family;
>
> diff --git a/include/drm/drm_ras.h b/include/drm/drm_ras.h
> index f2a787bc4f64..683a3844f84f 100644
> --- a/include/drm/drm_ras.h
> +++ b/include/drm/drm_ras.h
> @@ -69,6 +69,34 @@ struct drm_ras_node {
> */
> int (*clear_error_counter)(struct drm_ras_node *node, u32 error_id);
>
> + /**
> + * @query_error_threshold:
> + *
> + * This callback is used by drm-ras to query error threshold of a
> + * specific counter.
> + *
> + * Driver should expect query_error_threshold() to be called with
> + * error_id from `error_counter_range.first` to
> + * `error_counter_range.last`.
> + *
> + * Returns: 0 on success, negative error code on failure.
> + */
> + int (*query_error_threshold)(struct drm_ras_node *node, u32 error_id, const char **name,
> + u32 *threshold);
> + /**
> + * @set_error_threshold:
> + *
> + * This callback is used by drm-ras to set error threshold of a specific
> + * counter.
> + *
> + * Driver should expect set_error_threshold() to be called with error_id
> + * from `error_counter_range.first` to `error_counter_range.last`.
> + * Driver is responsible for error threshold bounds checking.
> + *
> + * Returns: 0 on success, negative error code on failure.
> + */
> + int (*set_error_threshold)(struct drm_ras_node *node, u32 error_id, u32 threshold);
> +
> /** @priv: Driver private data */
> void *priv;
> };
> diff --git a/include/uapi/drm/drm_ras.h b/include/uapi/drm/drm_ras.h
> index 218a3ee86805..27c68956495f 100644
> --- a/include/uapi/drm/drm_ras.h
> +++ b/include/uapi/drm/drm_ras.h
> @@ -33,6 +33,7 @@ enum {
> DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID,
> DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_NAME,
> DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_VALUE,
> + DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_THRESHOLD,
>
> __DRM_RAS_A_ERROR_COUNTER_ATTRS_MAX,
> DRM_RAS_A_ERROR_COUNTER_ATTRS_MAX = (__DRM_RAS_A_ERROR_COUNTER_ATTRS_MAX - 1)
> @@ -42,6 +43,8 @@ enum {
> DRM_RAS_CMD_LIST_NODES = 1,
> DRM_RAS_CMD_GET_ERROR_COUNTER,
> DRM_RAS_CMD_CLEAR_ERROR_COUNTER,
> + DRM_RAS_CMD_GET_ERROR_THRESHOLD,
> + DRM_RAS_CMD_SET_ERROR_THRESHOLD,
>
> __DRM_RAS_CMD_MAX,
> DRM_RAS_CMD_MAX = (__DRM_RAS_CMD_MAX - 1)
> --
> 2.43.0
>
^ permalink raw reply
* Re: [PATCH net] net: airoha: fix HTB class modification offload
From: Lorenzo Bianconi @ 2026-07-06 8:02 UTC (permalink / raw)
To: Wayen Yan
Cc: netdev, horms, pabeni, kuba, edumazet, andrew+netdev,
angelogioacchino.delregno, matthias.bgg, linux-arm-kernel,
linux-mediatek
In-Reply-To: <178332096675.2250671.599544331813347302@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 3418 bytes --]
> HTB core does not populate parent_classid for TC_HTB_NODE_MODIFY.
> Airoha currently checks parent_classid against TC_HTB_CLASSID_ROOT
> in a helper shared by both TC_HTB_LEAF_ALLOC_QUEUE and
> TC_HTB_NODE_MODIFY. Since the modify path leaves parent_classid as
> zero, the check always fails and changing parameters of an already
> offloaded HTB class is rejected with -EINVAL.
>
> Move the root-parent check into the allocation path and validate
> modify requests using the per-netdev QoS channel bitmap, consistent
> with the delete and query paths.
>
> Fixes: ef1ca9271313 ("net: airoha: Add sched HTB offload support")
> Signed-off-by: Wayen Yan <win847@gmail.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
> ---
> drivers/net/ethernet/airoha/airoha_eth.c | 32 +++++++++++++++++-------
> 1 file changed, 23 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/net/ethernet/airoha/airoha_eth.c b/drivers/net/ethernet/airoha/airoha_eth.c
> index 59001fd4b6f7..8e4e79c1e4c2 100644
> --- a/drivers/net/ethernet/airoha/airoha_eth.c
> +++ b/drivers/net/ethernet/airoha/airoha_eth.c
> @@ -2766,18 +2766,13 @@ static int airoha_qdma_set_tx_rate_limit(struct net_device *netdev,
> return 0;
> }
>
> -static int airoha_tc_htb_modify_queue(struct net_device *dev,
> - struct tc_htb_qopt_offload *opt)
> +static int airoha_tc_htb_set_rate(struct net_device *dev,
> + struct tc_htb_qopt_offload *opt,
> + u32 channel)
> {
> - u32 channel = TC_H_MIN(opt->classid) % AIROHA_NUM_QOS_CHANNELS;
> u32 rate = div_u64(opt->rate, 1000) << 3; /* kbps */
> int err;
>
> - if (opt->parent_classid != TC_HTB_CLASSID_ROOT) {
> - NL_SET_ERR_MSG_MOD(opt->extack, "invalid parent classid");
> - return -EINVAL;
> - }
> -
> err = airoha_qdma_set_tx_rate_limit(dev, channel, rate, opt->quantum);
> if (err)
> NL_SET_ERR_MSG_MOD(opt->extack,
> @@ -2786,6 +2781,20 @@ static int airoha_tc_htb_modify_queue(struct net_device *dev,
> return err;
> }
>
> +static int airoha_tc_htb_modify_queue(struct net_device *netdev,
> + struct tc_htb_qopt_offload *opt)
> +{
> + u32 channel = TC_H_MIN(opt->classid) % AIROHA_NUM_QOS_CHANNELS;
> + struct airoha_gdm_dev *dev = netdev_priv(netdev);
> +
> + if (!test_bit(channel, dev->qos_sq_bmap)) {
> + NL_SET_ERR_MSG_MOD(opt->extack, "invalid queue id");
> + return -EINVAL;
> + }
> +
> + return airoha_tc_htb_set_rate(netdev, opt, channel);
> +}
> +
> static int airoha_tc_htb_alloc_leaf_queue(struct net_device *netdev,
> struct tc_htb_qopt_offload *opt)
> {
> @@ -2794,6 +2803,11 @@ static int airoha_tc_htb_alloc_leaf_queue(struct net_device *netdev,
> struct airoha_gdm_dev *dev = netdev_priv(netdev);
> struct airoha_qdma *qdma = dev->qdma;
>
> + if (opt->parent_classid != TC_HTB_CLASSID_ROOT) {
> + NL_SET_ERR_MSG_MOD(opt->extack, "invalid parent classid");
> + return -EINVAL;
> + }
> +
> /* Here we need to check the requested QDMA channel is not already
> * in use by another net_device running on the same QDMA block.
> */
> @@ -2803,7 +2817,7 @@ static int airoha_tc_htb_alloc_leaf_queue(struct net_device *netdev,
> return -EBUSY;
> }
>
> - err = airoha_tc_htb_modify_queue(netdev, opt);
> + err = airoha_tc_htb_set_rate(netdev, opt, channel);
> if (err)
> goto error;
>
> --
> 2.51.0
>
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply
* [PATCH net-next] net: Convert %pK back to %p
From: Sebastian Andrzej Siewior @ 2026-07-06 7:38 UTC (permalink / raw)
To: linux-atm-general, linux-can, linux-sctp, netdev
Cc: David S. Miller, Eric Dumazet, Herbert Xu, Jakub Kicinski,
Kuniyuki Iwashima, Marc Kleine-Budde, Marcelo Ricardo Leitner,
Neal Cardwell, Oliver Hartkopp, Paolo Abeni, Remi Denis-Courmont,
Simon Horman, Steffen Klassert, Willem de Bruijn, Xin Long,
Petr Mladek, Thomas Weißschuh, Kees Cook
This is a revert of commit 71338aa7d050c ("net: convert %p usage to
%pK") which is from 2011. Back then the default behaviour for %p was to
print the pointer. The %pK modifier was introduced to be able to control
the behaviour of specific pointer output without changing the behaviour
of %p for everyone. It was dedicated to avoid leaking pointers via
/proc.
There was also the idea to remove the check from formatting the string
and move to the open callback (of the /proc file) with some helpers but
this did not happen.
Things changed over time. The default behaviour for %p is now to print a
hash pointer which does not leak the address but allows to
correlate if two pointers are equal. The pointer to hash value mapping
is not stable across reboots so one can not precompute the values and
have a lookup table. There is also the `hash_pointers' boot argument
which allows to disable it and print real pointers if needed. The
default behaviour of %pK (kptr_restrict==0) is already %p (hashed
pointer).
The %pK modifier brings hardly and value over %p. Removing it allows to
remove the policy checks from pointer formatting.
Switch back to the %p modifier.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
---
My long term goal is remove the restricted_pointer() handling from
vsprintf. I don't see any benefit in having it and case kptr_restrict==1
caused problems in terms of locking. Instead of attempting to get the
debug/ warn infrastructure right I am for removing it.
net/atm/proc.c | 2 +-
net/can/bcm.c | 6 +++---
net/can/proc.c | 4 ++--
net/ipv4/ping.c | 2 +-
net/ipv4/raw.c | 2 +-
net/ipv4/tcp_ipv4.c | 6 +++---
net/ipv4/udp.c | 2 +-
net/ipv6/datagram.c | 2 +-
net/ipv6/tcp_ipv6.c | 6 +++---
net/key/af_key.c | 2 +-
net/netlink/af_netlink.c | 2 +-
net/packet/af_packet.c | 2 +-
net/phonet/socket.c | 2 +-
net/sctp/proc.c | 4 ++--
net/unix/af_unix.c | 2 +-
15 files changed, 23 insertions(+), 23 deletions(-)
diff --git a/net/atm/proc.c b/net/atm/proc.c
index 8f20b49b9c02a..2c39364edf929 100644
--- a/net/atm/proc.c
+++ b/net/atm/proc.c
@@ -159,7 +159,7 @@ static void vcc_info(struct seq_file *seq, struct atm_vcc *vcc)
{
struct sock *sk = sk_atm(vcc);
- seq_printf(seq, "%pK ", vcc);
+ seq_printf(seq, "%p ", vcc);
if (!vcc->dev)
seq_printf(seq, "Unassigned ");
else
diff --git a/net/can/bcm.c b/net/can/bcm.c
index a4bef2c48a559..ce3650932d5cd 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -213,9 +213,9 @@ static int bcm_proc_show(struct seq_file *m, void *v)
struct bcm_sock *bo = bcm_sk(sk);
struct bcm_op *op;
- seq_printf(m, ">>> socket %pK", sk->sk_socket);
- seq_printf(m, " / sk %pK", sk);
- seq_printf(m, " / bo %pK", bo);
+ seq_printf(m, ">>> socket %p", sk->sk_socket);
+ seq_printf(m, " / sk %p", sk);
+ seq_printf(m, " / bo %p", bo);
seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
seq_printf(m, " / bound %s", bcm_proc_getifname(net, ifname, bo->ifindex));
seq_printf(m, " <<<\n");
diff --git a/net/can/proc.c b/net/can/proc.c
index de4d05ae34597..1f2611b0ccfc1 100644
--- a/net/can/proc.c
+++ b/net/can/proc.c
@@ -192,8 +192,8 @@ static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list,
hlist_for_each_entry_rcu(r, rx_list, list) {
char *fmt = (r->can_id & CAN_EFF_FLAG)?
- " %-5s %08x %08x %pK %pK %8ld %s\n" :
- " %-5s %03x %08x %pK %pK %8ld %s\n";
+ " %-5s %08x %08x %p %p %8ld %s\n" :
+ " %-5s %03x %08x %p %p %8ld %s\n";
seq_printf(m, fmt, DNAME(dev), r->can_id, r->mask,
r->func, r->data, atomic_long_read(&r->matches),
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index d36f1e273fde4..d66811d825eba 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -1095,7 +1095,7 @@ static void ping_v4_format_sock(struct sock *sp, struct seq_file *f,
__u16 srcp = ntohs(inet->inet_sport);
seq_printf(f, "%5d: %08X:%04X %08X:%04X"
- " %02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d %pK %u",
+ " %02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d %p %u",
bucket, src, srcp, dest, destp, sp->sk_state,
sk_wmem_alloc_get(sp),
sk_rmem_alloc_get(sp),
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 2aebaf8297e04..c7ef95f8eb2c6 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -1045,7 +1045,7 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
srcp = inet->inet_num;
seq_printf(seq, "%4d: %08X:%04X %08X:%04X"
- " %02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d %pK %u\n",
+ " %02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d %p %u\n",
i, src, srcp, dest, destp, sp->sk_state,
sk_wmem_alloc_get(sp),
sk_rmem_alloc_get(sp),
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 209ef7522508f..aa31af06e5e3b 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2743,7 +2743,7 @@ static void get_openreq4(const struct request_sock *req,
long delta = req->rsk_timer.expires - jiffies;
seq_printf(f, "%4d: %08X:%04X %08X:%04X"
- " %02X %08X:%08X %02X:%08lX %08X %5u %8d %u %d %pK",
+ " %02X %08X:%08X %02X:%08lX %08X %5u %8d %u %d %p",
i,
ireq->ir_loc_addr,
ireq->ir_num,
@@ -2806,7 +2806,7 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i)
READ_ONCE(tp->copied_seq), 0);
seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
- "%08X %5u %8d %llu %d %pK %lu %lu %u %u %d",
+ "%08X %5u %8d %llu %d %p %lu %lu %u %u %d",
i, src, srcp, dest, destp, state,
READ_ONCE(tp->write_seq) - tp->snd_una,
rx_queue,
@@ -2839,7 +2839,7 @@ static void get_timewait4_sock(const struct inet_timewait_sock *tw,
srcp = ntohs(tw->tw_sport);
seq_printf(f, "%4d: %08X:%04X %08X:%04X"
- " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK",
+ " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p",
i, src, srcp, dest, destp, READ_ONCE(tw->tw_substate), 0, 0,
3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
refcount_read(&tw->tw_refcnt), tw);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 59248a59358ca..db3c90f9a56de 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -3280,7 +3280,7 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
__u16 srcp = ntohs(inet->inet_sport);
seq_printf(f, "%5d: %08X:%04X %08X:%04X"
- " %02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d %pK %u",
+ " %02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d %p %u",
bucket, src, srcp, dest, destp, sp->sk_state,
sk_wmem_alloc_get(sp),
udp_rqueue_get(sp),
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 38d7b48452817..7cfacc06a331c 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -1102,7 +1102,7 @@ void __ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp,
src = &sp->sk_v6_rcv_saddr;
seq_printf(seq,
"%5d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
- "%02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d %pK %u\n",
+ "%02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d %p %u\n",
bucket,
src->s6_addr32[0], src->s6_addr32[1],
src->s6_addr32[2], src->s6_addr32[3], srcp,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index ebe161d72fbd0..e370b47171ce8 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -2099,7 +2099,7 @@ static void get_openreq6(struct seq_file *seq,
seq_printf(seq,
"%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
- "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
+ "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %p\n",
i,
src->s6_addr32[0], src->s6_addr32[1],
src->s6_addr32[2], src->s6_addr32[3],
@@ -2167,7 +2167,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
seq_printf(seq,
"%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
- "%02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d %pK %lu %lu %u %u %d\n",
+ "%02X %08X:%08X %02X:%08lX %08X %5u %8d %llu %d %p %lu %lu %u %u %d\n",
i,
src->s6_addr32[0], src->s6_addr32[1],
src->s6_addr32[2], src->s6_addr32[3], srcp,
@@ -2207,7 +2207,7 @@ static void get_timewait6_sock(struct seq_file *seq,
seq_printf(seq,
"%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
- "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
+ "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
i,
src->s6_addr32[0], src->s6_addr32[1],
src->s6_addr32[2], src->s6_addr32[3], srcp,
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 1d8965d7f4f3c..4df706789280f 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3805,7 +3805,7 @@ static int pfkey_seq_show(struct seq_file *f, void *v)
if (v == SEQ_START_TOKEN)
seq_printf(f ,"sk RefCnt Rmem Wmem User Inode\n");
else
- seq_printf(f, "%pK %-6d %-6u %-6u %-6u %-6llu\n",
+ seq_printf(f, "%p %-6d %-6u %-6u %-6u %-6llu\n",
s,
refcount_read(&s->sk_refcnt),
sk_rmem_alloc_get(s),
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 5202fe0b08671..48a1996f897b9 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2706,7 +2706,7 @@ static int netlink_native_seq_show(struct seq_file *seq, void *v)
struct sock *s = v;
struct netlink_sock *nlk = nlk_sk(s);
- seq_printf(seq, "%pK %-3d %-10u %08x %-8d %-8d %-5d %-8d %-8u %-8llu\n",
+ seq_printf(seq, "%p %-3d %-10u %08x %-8d %-8d %-5d %-8d %-8u %-8llu\n",
s,
s->sk_protocol,
nlk->portid,
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 8e6f3a734ba0b..fd22ff5677ebc 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4726,7 +4726,7 @@ static int packet_seq_show(struct seq_file *seq, void *v)
const struct packet_sock *po = pkt_sk(s);
seq_printf(seq,
- "%pK %-6d %-4d %04x %-5d %1d %-6u %-6u %-6llu\n",
+ "%p %-6d %-4d %04x %-5d %1d %-6u %-6u %-6llu\n",
s,
refcount_read(&s->sk_refcnt),
s->sk_type,
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 631a99cdbd006..eefdb788be592 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -586,7 +586,7 @@ static int pn_sock_seq_show(struct seq_file *seq, void *v)
struct pn_sock *pn = pn_sk(sk);
seq_printf(seq, "%2d %04X:%04X:%02X %02X %08X:%08X %5d %llu "
- "%d %pK %u",
+ "%d %p %u",
sk->sk_protocol, pn->sobject, pn->dobject,
pn->resource, sk->sk_state,
sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 43433d7e2acd7..cd99d634fa6d6 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -174,7 +174,7 @@ static int sctp_eps_seq_show(struct seq_file *seq, void *v)
sk = ep->base.sk;
if (!net_eq(sock_net(sk), seq_file_net(seq)))
continue;
- seq_printf(seq, "%8pK %8pK %-3d %-3d %-4d %-5d %5u %5llu ", ep, sk,
+ seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5u %5llu ", ep, sk,
sctp_sk(sk)->type, sk->sk_state, hash,
ep->base.bind_addr.port,
from_kuid_munged(seq_user_ns(seq), sk_uid(sk)),
@@ -260,7 +260,7 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
sk = epb->sk;
seq_printf(seq,
- "%8pK %8pK %-3d %-3d %-2d %-4d "
+ "%8p %8p %-3d %-3d %-2d %-4d "
"%4d %8d %8d %7u %5llu %-5d %5d ",
assoc, sk, sctp_sk(sk)->type, sk->sk_state,
assoc->state, 0,
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index f7a9d55eee8a1..6a8174977c87a 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -3554,7 +3554,7 @@ static int unix_seq_show(struct seq_file *seq, void *v)
struct unix_sock *u = unix_sk(s);
unix_state_lock(s);
- seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5llu",
+ seq_printf(seq, "%p: %08X %08X %08X %04X %02X %5llu",
s,
refcount_read(&s->sk_refcnt),
0,
--
2.53.0
^ permalink raw reply related
* Re: [PATCH net v3] net: usb: lan78xx: disable VLAN filter in promiscuous mode
From: Nicolai Buchwitz @ 2026-07-06 7:37 UTC (permalink / raw)
To: enrico.pozzobon
Cc: Thangaraj Samynathan, Rengarajan Sundararajan, UNGLinuxDriver,
Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Woojung.Huh, netdev, linux-usb, linux-kernel
In-Reply-To: <20260701-lan78xx-vlan-promisc-v3-1-232266d32743@dissecto.com>
On 1.7.2026 16:47, Enrico Pozzobon via B4 Relay wrote:
> From: Enrico Pozzobon <enrico.pozzobon@dissecto.com>
>
> The hardware VLAN filter (RFE_CTL_VLAN_FILTER_) drops VLAN-tagged
> frames
> whose VID has not been registered via lan78xx_vlan_rx_add_vid(). It is
> left enabled in promiscuous mode, so packet capture (e.g. tcpdump or
> Wireshark) does not see tagged frames for unregistered VIDs.
>
> Clear the filter while the interface is promiscuous and restore it from
> NETIF_F_HW_VLAN_CTAG_FILTER otherwise. Enforce the same condition in
> lan78xx_set_features() so netdev_update_features() cannot re-enable the
> filter while promiscuous.
>
> Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000
> Ethernet device driver")
> Signed-off-by: Enrico Pozzobon <enrico.pozzobon@dissecto.com>
> ---
> Currently, on microchip lan7801, enabling promiscuous mode does not
> result in VLAN tagged packets being captured. This patch fixes this,
> forcing the RFE_CTL_VLAN_FILTER_ flag to be off when promiscuous mode
> is
> enabled.
> ---
> Changes in v3:
> - EDITME: describe what is new in this series revision.
> - EDITME: use bulletpoints and terse descriptions.
> - Link to v2:
> https://patch.msgid.link/20260701-lan78xx-vlan-promisc-v2-1-fe3b18066728@dissecto.com
>
> Changes in v2:
> - moved VLAN filter logic into lan78xx_update_vlan_filter()
> - Link to v1:
> https://patch.msgid.link/20260630-lan78xx-vlan-promisc-v1-1-fbf0f903bd8f@dissecto.com
>
> To: Thangaraj Samynathan <Thangaraj.S@microchip.com>
> To: Rengarajan Sundararajan <Rengarajan.S@microchip.com>
> To: UNGLinuxDriver@microchip.com
> To: Andrew Lunn <andrew+netdev@lunn.ch>
> To: "David S. Miller" <davem@davemloft.net>
> To: Eric Dumazet <edumazet@google.com>
> To: Jakub Kicinski <kuba@kernel.org>
> To: Paolo Abeni <pabeni@redhat.com>
> To: Woojung.Huh@microchip.com
> Cc: netdev@vger.kernel.org
> Cc: linux-usb@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> ---
> drivers/net/usb/lan78xx.c | 18 ++++++++++++++----
> 1 file changed, 14 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
> index c4cebacabcb5..cb782d81d84f 100644
> --- a/drivers/net/usb/lan78xx.c
> +++ b/drivers/net/usb/lan78xx.c
> @@ -1499,6 +1499,17 @@ static void
> lan78xx_deferred_multicast_write(struct work_struct *param)
> return;
> }
>
> +static void lan78xx_update_vlan_filter(struct lan78xx_priv *pdata,
> + struct net_device *netdev,
> + netdev_features_t features)
> +{
> + if ((features & NETIF_F_HW_VLAN_CTAG_FILTER) &&
> + !(netdev->flags & IFF_PROMISC))
> + pdata->rfe_ctl |= RFE_CTL_VLAN_FILTER_;
> + else
> + pdata->rfe_ctl &= ~RFE_CTL_VLAN_FILTER_;
> +}
> +
> static void lan78xx_set_multicast(struct net_device *netdev)
> {
> struct lan78xx_net *dev = netdev_priv(netdev);
> @@ -1533,6 +1544,8 @@ static void lan78xx_set_multicast(struct
> net_device *netdev)
> }
> }
>
> + lan78xx_update_vlan_filter(pdata, dev->net, dev->net->features);
> +
> if (netdev_mc_count(dev->net)) {
> struct netdev_hw_addr *ha;
> int i;
> @@ -3074,10 +3087,7 @@ static int lan78xx_set_features(struct
> net_device *netdev,
> else
> pdata->rfe_ctl &= ~RFE_CTL_VLAN_STRIP_;
>
> - if (features & NETIF_F_HW_VLAN_CTAG_FILTER)
> - pdata->rfe_ctl |= RFE_CTL_VLAN_FILTER_;
> - else
> - pdata->rfe_ctl &= ~RFE_CTL_VLAN_FILTER_;
> + lan78xx_update_vlan_filter(pdata, netdev, features);
>
> spin_unlock_irqrestore(&pdata->rfe_ctl_lock, flags);
>
>
> ---
> base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
> change-id: 20260623-lan78xx-vlan-promisc-83af8a48a7ec
>
> Best regards,
> --
> Enrico Pozzobon <enrico.pozzobon@dissecto.com>
v2 is marked superseded in patchwork, so FWIW
Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>
Thanks
Nicolai
^ permalink raw reply
* Re: [PATCH net-next 2/2] net: sfp: add quirks for OEM XGSPONST2001 and FS XGS-SFP-ONT-MACI
From: Maxime Chevallier @ 2026-07-06 7:29 UTC (permalink / raw)
To: Martino Dell'Ambrogio, netdev
Cc: Russell King, Andrew Lunn, Heiner Kallweit, David S . Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, linux-kernel
In-Reply-To: <20260705185440.136496-3-tillo@tillo.ch>
Hi
On 7/5/26 20:54, Martino Dell'Ambrogio wrote:
> Cheap XGS-PON ONT sticks identifying as vendor "OEM", PN "XGSPONST2001"
> have broken TX_FAULT and LOS indicators (driven by the ONU serial
> passthrough wires) and need a longer T_START_UP than the SFF-8472
> default. The Fiberstore XGS-SFP-ONT-MACI MAC-mode ONT stick has the
> same ONT-class TX_FAULT/LOS wiring and startup behaviour. Apply the
> existing sfp_fixup_potron handler to both, which masks both signals
> and bumps T_START_UP to T_START_UP_BAD_GPON.
>
> Both modules fail to space-pad the EEPROM vendor PN field past the
> legitimate string as SFF-8472 mandates (the XGSPONST2001 fills it with
> non-printable garbage), which defeats exact-length matching:
> sfp_strlen() cannot trim the field, so a plain SFP_QUIRK_F entry would
> silently never apply and the kernel would honor the spurious TX_FAULT
> and eventually disable the module. Match both entries as prefixes
> using SFP_QUIRK_F_PREFIX.
>
> Signed-off-by: Martino Dell'Ambrogio <tillo@tillo.ch>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Maxime
^ permalink raw reply
* Re: [PATCH net-next 1/2] net: sfp: allow prefix matching in quirk lookup
From: Maxime Chevallier @ 2026-07-06 7:28 UTC (permalink / raw)
To: Martino Dell'Ambrogio, netdev
Cc: Russell King, Andrew Lunn, Heiner Kallweit, David S . Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, linux-kernel
In-Reply-To: <20260705185440.136496-2-tillo@tillo.ch>
Hi,
On 7/5/26 20:54, Martino Dell'Ambrogio wrote:
> Some clone SFP modules (notably XGS-PON ONT sticks) ship malformed
> EEPROMs where the vendor PN field is filled with non-printable garbage
> past the trailing legitimate characters instead of SFF-8472 mandated
> space padding.
:(
> The current sfp_match() requires an exact full-field
> length match: sfp_strlen() returns 16 (no trailing spaces or NULs to
> strip), but strlen() of the quirk string is shorter, so the length
> comparison rejects the entry before strncmp() is even called and the
> quirk silently never applies. The kernel then honors the module's
> spurious TX_FAULT signal and the SFP state machine eventually disables
> the module.
>
> Add a prefix_match flag to struct sfp_quirk and a SFP_QUIRK_F_PREFIX
> macro. When set, sfp_match() compares only strlen() leading bytes of
> the quirk string, ignoring trailing field bytes. Existing exact-match
> quirks are unaffected (prefix_match defaults to false via zero-init in
> the existing SFP_QUIRK macros).
>
> Signed-off-by: Martino Dell'Ambrogio <tillo@tillo.ch>
> ---
> drivers/net/phy/sfp.c | 22 +++++++++++++++++-----
> drivers/net/phy/sfp.h | 1 +
> 2 files changed, 18 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
> index f520206..e7ba642 100644
> --- a/drivers/net/phy/sfp.c
> +++ b/drivers/net/phy/sfp.c
> @@ -516,6 +516,13 @@ static void sfp_quirk_ubnt_uf_instant(const struct sfp_eeprom_id *id,
> { .vendor = _v, .part = _p, .support = _s, .fixup = _f, }
> #define SFP_QUIRK_S(_v, _p, _s) SFP_QUIRK(_v, _p, _s, NULL)
> #define SFP_QUIRK_F(_v, _p, _f) SFP_QUIRK(_v, _p, NULL, _f)
> +/* Like SFP_QUIRK_F, but matches as a prefix. Use for clone modules
> + * that fill EEPROM trailing bytes with garbage instead of the
> + * SFF-8472-mandated space padding, so sfp_strlen can't trim the
> + * field down to the legitimate length.
> + */
> +#define SFP_QUIRK_F_PREFIX(_v, _p, _f) \
> + { .vendor = _v, .part = _p, .support = NULL, .fixup = _f, .prefix_match = true }
>
> static const struct sfp_quirk sfp_quirks[] = {
> // Alcatel Lucent G-010S-P can operate at 2500base-X, but incorrectly
> @@ -626,13 +633,16 @@ static size_t sfp_strlen(const char *str, size_t maxlen)
> return size;
> }
>
> -static bool sfp_match(const char *qs, const char *str, size_t len)
> +static bool sfp_match(const char *qs, const char *str, size_t len, bool prefix)
> {
> + size_t qs_len;
> +
> if (!qs)
> return true;
> - if (strlen(qs) != len)
> + qs_len = strlen(qs);
> + if (prefix ? qs_len > len : qs_len != len)
> return false;
> - return !strncmp(qs, str, len);
> + return !strncmp(qs, str, qs_len);
> }
The variable naming qs_len and the "if(<ternary operator>)" aren't very easy
to process. It's correct but could use a few comments to explain that for
prefix match, we only compare up to the PN/Vendor string length.
But there's already a good comment on the macro definition, I'm personally
OK with this.
>
> static const struct sfp_quirk *sfp_lookup_quirk(const struct sfp_eeprom_id *id)
> @@ -645,8 +655,10 @@ static const struct sfp_quirk *sfp_lookup_quirk(const struct sfp_eeprom_id *id)
> ps = sfp_strlen(id->base.vendor_pn, ARRAY_SIZE(id->base.vendor_pn));
>
> for (i = 0, q = sfp_quirks; i < ARRAY_SIZE(sfp_quirks); i++, q++)
> - if (sfp_match(q->vendor, id->base.vendor_name, vs) &&
> - sfp_match(q->part, id->base.vendor_pn, ps))
> + if (sfp_match(q->vendor, id->base.vendor_name, vs,
> + q->prefix_match) &&
> + sfp_match(q->part, id->base.vendor_pn, ps,
> + q->prefix_match))
> return q;
>
> return NULL;
> diff --git a/drivers/net/phy/sfp.h b/drivers/net/phy/sfp.h
> index 879dff7..867e45e 100644
> --- a/drivers/net/phy/sfp.h
> +++ b/drivers/net/phy/sfp.h
> @@ -12,6 +12,7 @@ struct sfp_quirk {
> void (*support)(const struct sfp_eeprom_id *id,
> struct sfp_module_caps *caps);
> void (*fixup)(struct sfp *sfp);
> + bool prefix_match;
> };
>
> struct sfp_socket_ops {
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Maxime
^ permalink raw reply
* Re: [PATCH net v2] ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
From: Norbert Szetei @ 2026-07-06 7:22 UTC (permalink / raw)
To: Qingfang Deng
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Sebastian Andrzej Siewior, Breno Leitao, Taegu Ha,
Kees Cook, linux-ppp, linux-kernel, Guillaume Nault, netdev
In-Reply-To: <de2616b3-6edf-4255-ba77-0674e225ab27@linux.dev>
Hi,
> On Jul 3, 2026, at 09:27, Qingfang Deng <qingfang.deng@linux.dev> wrote:
>
> Hi,
>
> On 2026/7/2 2:12, Norbert Szetei wrote:
>> +/* Purge after the grace period: a late ppp_input() may still queue an
>> + * skb on pch->file.rq before the last RCU reader drains.
>> + */
>> +static void ppp_release_channel_free(struct rcu_head *rcu)
>> +{
>> + struct channel *pch = container_of(rcu, struct channel, rcu);
>> +
>> + skb_queue_purge(&pch->file.xq);
>> + skb_queue_purge(&pch->file.rq);
>> + kfree(pch);
>> +}
>> +
>> /*
>> * Drop a reference to a ppp channel and free its memory if the refcount reaches
>> * zero.
>> @@ -3581,9 +3594,7 @@ static void ppp_release_channel(struct channel *pch)
>> pr_err("ppp: destroying undead channel %p !\n", pch);
>> return;
>> }
>> - skb_queue_purge(&pch->file.xq);
>> - skb_queue_purge(&pch->file.rq);
>> - kfree(pch);
>> + call_rcu(&pch->rcu, ppp_release_channel_free);
>> }
>> static void __exit ppp_cleanup(void)
>
> AI-review found an issue: https://sashiko.dev/#/patchset/D9C0245B-608B-4884-8A09-F55BA4A9F948%40doyensec.com
>
> An rcu_barrier() call is needed at the end of ppp_cleanup().
Thanks for reviewing. I'll add it and send out a v3.
N.
>
> Regards,
>
> Qingfang
>
^ permalink raw reply
* RE: [PATCH net-next 11/17] net: dsa: mv88e6xxx: Move available stats into info structure
From: Jagielski, Jedrzej @ 2026-07-06 7:17 UTC (permalink / raw)
To: Luke Howard, Andrew Lunn, Vladimir Oltean, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Russell King, Richard Cochran, Florian Fainelli
Cc: Cedric Jehasse, Max Holtmann, Max Hunter, Tyrrell, Kieran,
Ryan Wilkins, Mattias Forsblad, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
In-Reply-To: <20260703-net-next-mv88e6xxx-rmu-v1-11-991a27d78bca@padl.com>
From: Luke Howard <lukeh@padl.com>
Sent: Friday, July 3, 2026 9:47 AM
>From: Andrew Lunn <andrew@lunn.ch>
>
>Different families of switches have different statistics available.
>This information is current hard coded into functions, however this
>information will also soon be needed when getting statistics from the
>RMU. Move it into the info structure.
>
>Signed-off-by: Andrew Lunn <andrew@lunn.ch>
>---
> drivers/net/dsa/mv88e6xxx/chip.c | 12 ++++++++++++
> 1 file changed, 12 insertions(+)
>
>diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
>index 6431d25f3cfa2..5c0a1e2b0507d 100644
>--- a/drivers/net/dsa/mv88e6xxx/chip.c
>+++ b/drivers/net/dsa/mv88e6xxx/chip.c
>@@ -1303,6 +1303,9 @@ static size_t mv88e6095_stats_get_stat(struct mv88e6xxx_chip *chip, int port,
> const struct mv88e6xxx_hw_stat *stat,
> uint64_t *data)
> {
>+ if (!(stat->type & chip->info->stats_type))
>+ return 0;
>+
Is everything fine with this patch?
There's nothing beside adding checks to some of the functions
(which is reverted in the upcoming patch) what does not
seem to be corresponding to the commit msg
> *data = _mv88e6xxx_get_ethtool_stat(chip, stat, port, 0,
> MV88E6XXX_G1_STATS_OP_HIST_RX);
> return 1;
>@@ -1312,6 +1315,9 @@ static size_t mv88e6250_stats_get_stat(struct mv88e6xxx_chip *chip, int port,
> const struct mv88e6xxx_hw_stat *stat,
> uint64_t *data)
> {
>+ if (!(stat->type & chip->info->stats_type))
>+ return 0;
>+
> *data = _mv88e6xxx_get_ethtool_stat(chip, stat, port, 0,
> MV88E6XXX_G1_STATS_OP_HIST_RX);
> return 1;
>@@ -1321,6 +1327,9 @@ static size_t mv88e6320_stats_get_stat(struct mv88e6xxx_chip *chip, int port,
> const struct mv88e6xxx_hw_stat *stat,
> uint64_t *data)
> {
>+ if (!(stat->type & chip->info->stats_type))
>+ return 0;
>+
> *data = _mv88e6xxx_get_ethtool_stat(chip, stat, port,
> MV88E6XXX_G1_STATS_OP_BANK_1_BIT_9,
> MV88E6XXX_G1_STATS_OP_HIST_RX);
>@@ -1331,6 +1340,9 @@ static size_t mv88e6390_stats_get_stat(struct mv88e6xxx_chip *chip, int port,
> const struct mv88e6xxx_hw_stat *stat,
> uint64_t *data)
> {
>+ if (!(stat->type & chip->info->stats_type))
>+ return 0;
>+
> *data = _mv88e6xxx_get_ethtool_stat(chip, stat, port,
> MV88E6XXX_G1_STATS_OP_BANK_1_BIT_10,
> 0);
>
>--
>2.43.0
^ permalink raw reply
* [PATCH v2 net-next] net: neigh: avoid calling neigh_forced_gc on every alloc when table is full
From: Vimal Agrawal @ 2026-07-06 6:58 UTC (permalink / raw)
To: netdev; +Cc: kuba, kuniyu, edumazet, vimal.agrawal, avimalin
In-Reply-To: <20260625084213.4e0b70c4@kernel.org>
Once the neighbour table exceeds gc_thresh3, neigh_forced_gc() is called
on every allocation attempt with no rate limiting. In workloads with mostly
active/reachable entries, the GC walk traverses a large portion of the
neighbour table without reclaiming entries, holding tbl->lock for an
extended period. This causes severe lock contention and allocation
latencies exceeding 16ms under sustained neighbour creation.
Add a pre-lock check in neigh_forced_gc() to skip the GC run if one was
performed within the last 50 ms, avoiding repeated full table scans and
lock acquisitions on the hot allocation path.
Profiling of neigh_create() shows ~3 orders of magnitude latency
improvement with this change.
Link: https://lore.kernel.org/netdev/CALkUMdSCpx_ywYCx_ePLdm6yioO1nQWx7sSM=AEgsq0kywHxTw@mail.gmail.com/
Signed-off-by: Vimal Agrawal <vimal.agrawal@sophos.com>
---
v2: Changed threshold from 1s (HZ) to 50ms (msecs_to_jiffies(50))
based on profiling data showing 44% -> 2.56% CPU reduction
net/core/neighbour.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 1349c0eedb64..a83535d32da3 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -260,6 +260,9 @@ static int neigh_forced_gc(struct neigh_table *tbl)
int shrunk = 0;
int loop = 0;
+ if (!time_after(jiffies, READ_ONCE(tbl->last_flush) + msecs_to_jiffies(50)))
+ return 0;
+
NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
spin_lock_bh(&tbl->lock);
--
2.17.1
^ permalink raw reply related
* [PATCH net] net: airoha: fix HTB class modification offload
From: Wayen Yan @ 2026-07-06 6:18 UTC (permalink / raw)
To: netdev
Cc: lorenzo, horms, pabeni, kuba, edumazet, andrew+netdev,
angelogioacchino.delregno, matthias.bgg, linux-arm-kernel,
linux-mediatek
HTB core does not populate parent_classid for TC_HTB_NODE_MODIFY.
Airoha currently checks parent_classid against TC_HTB_CLASSID_ROOT
in a helper shared by both TC_HTB_LEAF_ALLOC_QUEUE and
TC_HTB_NODE_MODIFY. Since the modify path leaves parent_classid as
zero, the check always fails and changing parameters of an already
offloaded HTB class is rejected with -EINVAL.
Move the root-parent check into the allocation path and validate
modify requests using the per-netdev QoS channel bitmap, consistent
with the delete and query paths.
Fixes: ef1ca9271313 ("net: airoha: Add sched HTB offload support")
Signed-off-by: Wayen Yan <win847@gmail.com>
---
drivers/net/ethernet/airoha/airoha_eth.c | 32 +++++++++++++++++-------
1 file changed, 23 insertions(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/airoha/airoha_eth.c b/drivers/net/ethernet/airoha/airoha_eth.c
index 59001fd4b6f7..8e4e79c1e4c2 100644
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
@@ -2766,18 +2766,13 @@ static int airoha_qdma_set_tx_rate_limit(struct net_device *netdev,
return 0;
}
-static int airoha_tc_htb_modify_queue(struct net_device *dev,
- struct tc_htb_qopt_offload *opt)
+static int airoha_tc_htb_set_rate(struct net_device *dev,
+ struct tc_htb_qopt_offload *opt,
+ u32 channel)
{
- u32 channel = TC_H_MIN(opt->classid) % AIROHA_NUM_QOS_CHANNELS;
u32 rate = div_u64(opt->rate, 1000) << 3; /* kbps */
int err;
- if (opt->parent_classid != TC_HTB_CLASSID_ROOT) {
- NL_SET_ERR_MSG_MOD(opt->extack, "invalid parent classid");
- return -EINVAL;
- }
-
err = airoha_qdma_set_tx_rate_limit(dev, channel, rate, opt->quantum);
if (err)
NL_SET_ERR_MSG_MOD(opt->extack,
@@ -2786,6 +2781,20 @@ static int airoha_tc_htb_modify_queue(struct net_device *dev,
return err;
}
+static int airoha_tc_htb_modify_queue(struct net_device *netdev,
+ struct tc_htb_qopt_offload *opt)
+{
+ u32 channel = TC_H_MIN(opt->classid) % AIROHA_NUM_QOS_CHANNELS;
+ struct airoha_gdm_dev *dev = netdev_priv(netdev);
+
+ if (!test_bit(channel, dev->qos_sq_bmap)) {
+ NL_SET_ERR_MSG_MOD(opt->extack, "invalid queue id");
+ return -EINVAL;
+ }
+
+ return airoha_tc_htb_set_rate(netdev, opt, channel);
+}
+
static int airoha_tc_htb_alloc_leaf_queue(struct net_device *netdev,
struct tc_htb_qopt_offload *opt)
{
@@ -2794,6 +2803,11 @@ static int airoha_tc_htb_alloc_leaf_queue(struct net_device *netdev,
struct airoha_gdm_dev *dev = netdev_priv(netdev);
struct airoha_qdma *qdma = dev->qdma;
+ if (opt->parent_classid != TC_HTB_CLASSID_ROOT) {
+ NL_SET_ERR_MSG_MOD(opt->extack, "invalid parent classid");
+ return -EINVAL;
+ }
+
/* Here we need to check the requested QDMA channel is not already
* in use by another net_device running on the same QDMA block.
*/
@@ -2803,7 +2817,7 @@ static int airoha_tc_htb_alloc_leaf_queue(struct net_device *netdev,
return -EBUSY;
}
- err = airoha_tc_htb_modify_queue(netdev, opt);
+ err = airoha_tc_htb_set_rate(netdev, opt, channel);
if (err)
goto error;
--
2.51.0
^ permalink raw reply related
* Re: [PATCH net] selftests: netfilter: conntrack_resize.sh: fix skip exit code
From: Florian Westphal @ 2026-07-06 6:53 UTC (permalink / raw)
To: Dharmik Parmar; +Cc: netdev
In-Reply-To: <20260705204252.630729-1-dharmikparmar2004@yahoo.com>
Dharmik Parmar <dharmikparmar2004@yahoo.com> wrote:
> When conntrack sysctls are unavailable, the test prints SKIP but exits
> with $KSFT_SKIP. lib.sh defines ksft_skip instead, so the kselftest
> runner did not see a proper skip.
Acked-by: Florian Westphal <fw@strlen.de>
^ permalink raw reply
* Re: [PATCH net] tun/tap & vhost-net: make qdisc backpressure opt-in via IFF_BACKPRESSURE
From: Simon Schippers @ 2026-07-06 6:46 UTC (permalink / raw)
To: Willem de Bruijn, Jason Wang, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Michael S . Tsirkin, netdev
Cc: Simon Horman, Jonathan Corbet, Shuah Khan, Andrew Lunn,
Tim Gebauer, Brett Sheffield, linux-doc, linux-kernel
In-Reply-To: <20260704112058.95421-1-simon.schippers@tu-dortmund.de>
On 7/4/26 13:20, Simon Schippers wrote:
> @@ -2893,8 +2899,19 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
> /* Make sure persistent devices do not get stuck in
> * xoff state.
> */
> - if (netif_running(tun->dev))
> - netif_tx_wake_all_queues(tun->dev);
> + if (netif_running(tun->dev)) {
> + for (int i = 0; i < tun->numqueues; i++) {
> + struct tun_file *i_tfile;
> +
> + i_tfile = rtnl_dereference(tun->tfiles[i]);
> + spin_lock_bh(&i_tfile->tx_ring.consumer_lock);
> + spin_lock(&i_tfile->tx_ring.producer_lock);
> + netif_wake_subqueue(tun->dev, i_tfile->queue_index);
> + i_tfile->cons_cnt = 0;
> + spin_unlock(&i_tfile->tx_ring.producer_lock);
> + spin_unlock_bh(&i_tfile->tx_ring.consumer_lock);
> + }
> + }
I think Sashiko [1] is right. I forgot to wake the disabled queues.
I will post a v2.
[1] Link: https://sashiko.dev/#/patchset/20260704112058.95421-1-simon.schippers%40tu-dortmund.de
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox