* [PATCH net 2/2] net: macb: mask TXUBR during TX NAPI poll to prevent IRQ storms
From: Christian Taedcke via B4 Relay @ 2026-07-06 14:02 UTC (permalink / raw)
To: christian.taedcke-oss, Théo Lebrun, Conor Dooley,
Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Kevin Hao, Simon Horman, Sebastian Andrzej Siewior,
Clark Williams, Steven Rostedt, Robert Hancock
Cc: netdev, linux-kernel, linux-rt-devel, Christian Taedcke, stable
In-Reply-To: <20260706-upstreaming-macb-irq-storm-v1-0-ab3115b5a13a@weidmueller.com>
From: Christian Taedcke <christian.taedcke@weidmueller.com>
macb_interrupt() defers TX completion handling to NAPI, but when it
schedules the poll it only masks TCOMP, even though TXUBR is enabled
alongside it (both are part of MACB_TX_INT_FLAGS). macb_tx_poll() is
asymmetric in the same way and only re-enables TCOMP. TXUBR is thus
left unmasked while responsibility for handling it has been deferred
to NAPI.
Unlike an edge event, TXUBR is a persistent condition: the controller
keeps it asserted for as long as the transmitter reads a buffer
descriptor whose used bit is set. Leaving a level-triggered source
enabled while NAPI owns its processing means the interrupt refires
immediately after the handler returns, before the poll has had a
chance to clear the underlying condition. This turns into a hard
interrupt storm that pegs a CPU in the (threaded) MAC IRQ handler and,
on PREEMPT_RT, triggers RT throttling ("sched: RT throttling
activated"), taking the network interface down.
Several situations can keep the used-bit read asserted across a poll -
for example unreaped completed descriptors still sitting at tx_tail,
or a transmit restart racing with macb_start_xmit(). The specific
trigger does not matter: as long as the source stays unmasked, any
persistent assertion is enough to storm, so the interrupt handling
itself must be made self-limiting.
Mask TXUBR together with TCOMP in the IDR write when scheduling the TX
NAPI, and re-enable both from the napi_complete path in
macb_tx_poll(), making the TX interrupt mask/unmask symmetric and
consistent with how the driver already treats every other
NAPI-serviced source. The pending TXUBR is still recorded in
queue->txubr_pending before masking and acted on by macb_tx_restart(),
so no event is lost. A persistent TXUBR now degrades to NAPI-paced
polling instead of a CPU-pegging hard interrupt storm.
Fixes: 138badbc21a0 ("net: macb: use NAPI for TX completion path")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Christian Taedcke <christian.taedcke@weidmueller.com>
---
drivers/net/ethernet/cadence/macb_main.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index b11cb8f068b7..f75cf2ffdf6f 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -1971,7 +1971,7 @@ static int macb_tx_poll(struct napi_struct *napi, int budget)
(unsigned int)(queue - bp->queues), work_done, budget);
if (work_done < budget && napi_complete_done(napi, work_done)) {
- queue_writel(queue, IER, MACB_BIT(TCOMP));
+ queue_writel(queue, IER, MACB_BIT(TCOMP) | MACB_BIT(TXUBR));
/* Packet completions only seem to propagate to raise
* interrupts when interrupts are enabled at the time, so if
@@ -2161,7 +2161,8 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
if (status & (MACB_BIT(TCOMP) |
MACB_BIT(TXUBR))) {
- queue_writel(queue, IDR, MACB_BIT(TCOMP));
+ queue_writel(queue, IDR, MACB_BIT(TCOMP) |
+ MACB_BIT(TXUBR));
macb_queue_isr_clear(bp, queue, MACB_BIT(TCOMP) |
MACB_BIT(TXUBR));
if (status & MACB_BIT(TXUBR)) {
--
2.54.0
^ permalink raw reply related
* [PATCH net 1/2] net: macb: reprogram TBQP after shuffling the TX ring on link-up
From: Christian Taedcke via B4 Relay @ 2026-07-06 14:02 UTC (permalink / raw)
To: christian.taedcke-oss, Théo Lebrun, Conor Dooley,
Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Kevin Hao, Simon Horman, Sebastian Andrzej Siewior,
Clark Williams, Steven Rostedt, Robert Hancock
Cc: netdev, linux-kernel, linux-rt-devel, Christian Taedcke, stable
In-Reply-To: <20260706-upstreaming-macb-irq-storm-v1-0-ab3115b5a13a@weidmueller.com>
From: Christian Taedcke <christian.taedcke@weidmueller.com>
gem_shuffle_tx_one_ring() rotates the software TX ring so that the
tail sits at index 0 and resets queue->tx_tail to 0, but it never
reprograms the hardware transmit buffer queue pointer (TBQP). Other
paths that reset tx_tail to the ring base (macb_init_buffers() and
macb_tx_error_task()) also reprogram TBQP to queue->tx_ring_dma; this
path does not, leaving TBQP pointing at a stale descriptor.
gem_shuffle_tx_rings() runs on every link-up from
macb_mac_link_up(). After a few link up/down flaps that leave
un-completed descriptors in the ring, the stale TBQP keeps pointing at
a descriptor whose used bit is set. When TX is re-enabled on link-up,
the GEM reads that used descriptor and raises TXUBR. macb_interrupt()
schedules the TX NAPI, macb_tx_poll() makes no progress (work_done ==
0) and macb_tx_restart() re-issues TSTART, which makes the controller
read the same used descriptor again and re-assert TXUBR. As the MAC
interrupt is level-triggered, it never deasserts and one CPU is pegged
at 100% in the threaded handler, eventually triggering "sched: RT
throttling activated" and a dead network interface.
Fix it by reprogramming TBQP to the ring base on every path of
gem_shuffle_tx_one_ring() that resets tx_tail to 0, mirroring
macb_tx_error_task(). The early return for an already-aligned tail is
left untouched as TBQP is already consistent there. This is safe
because the shuffle runs from macb_mac_link_up() while TE is still
disabled, so the transmitter is halted.
Fixes: 881a0263d502 ("net: macb: Shuffle the tx ring before enabling tx")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Christian Taedcke <christian.taedcke@weidmueller.com>
---
drivers/net/ethernet/cadence/macb_main.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index fd282a1700fb..b11cb8f068b7 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -820,7 +820,7 @@ static void gem_shuffle_tx_one_ring(struct macb_queue *queue)
if (!count) {
queue->tx_head = 0;
queue->tx_tail = 0;
- goto unlock;
+ goto reset_hw_ptr;
}
shift = tail % ring_size;
@@ -869,6 +869,13 @@ static void gem_shuffle_tx_one_ring(struct macb_queue *queue)
/* Make descriptor updates visible to hardware */
wmb();
+reset_hw_ptr:
+ /* tx_tail was reset to the ring base, so TBQP must be reprogrammed
+ * to match; otherwise it keeps pointing at a stale descriptor. Safe
+ * to write directly here as TX is still disabled (called from
+ * macb_mac_link_up() before TE is set).
+ */
+ queue_writel(queue, TBQP, lower_32_bits(queue->tx_ring_dma));
unlock:
spin_unlock_irqrestore(&queue->tx_ptr_lock, flags);
}
--
2.54.0
^ permalink raw reply related
* [PATCH net 0/2] net: macb: fix TXUBR interrupt storm on link flapping
From: Christian Taedcke via B4 Relay @ 2026-07-06 14:02 UTC (permalink / raw)
To: christian.taedcke-oss, Théo Lebrun, Conor Dooley,
Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Kevin Hao, Simon Horman, Sebastian Andrzej Siewior,
Clark Williams, Steven Rostedt, Robert Hancock
Cc: netdev, linux-kernel, linux-rt-devel, Christian Taedcke, stable
We observed a hard interrupt storm in the Cadence GEM (macb) driver on
a Xilinx ZynqMP based platform running a PREEMPT_RT kernel (6.6.142).
After several Ethernet link up/down transitions, the CPU that the MAC
IRQ is pinned to is pegged at 100% in the threaded MAC interrupt
handler and the kernel reports "sched: RT throttling activated",
killing the network interface. The MAC ISR keeps refiring with the
level-triggered TXUBR (TX used bit read) set, because the transmitter
is left pointing at a descriptor whose used bit is set. See the
individual commit messages for the full analysis.
Patch 1 fixes the root cause: gem_shuffle_tx_one_ring() resets tx_tail to
the ring base on link-up but never reprograms the hardware TBQP pointer.
Patch 2 fixes a second, independent bug: macb_interrupt() masks only
TCOMP (not TXUBR) when scheduling the TX NAPI, and macb_tx_poll()
re-enables only TCOMP. Because TXUBR is level-triggered, a persistent
used-descriptor condition keeps it asserted and re-fires immediately,
storming the MAC interrupt.
Both patches are required: on the affected platform the interrupt storm
still reproduces with patch 1 applied alone, so patch 2 is needed as
well to stop it.
The relevant code is essentially identical in mainline, so the bug is not
RT-specific. PREEMPT_RT merely turns the storm into a fatal failure via
RT throttling.
Tested on ZynqMP with PREEMPT_RT by repeatedly flapping the Ethernet
link. The interrupt storm and RT throttling no longer occur.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Christian Taedcke <christian.taedcke@weidmueller.com>
---
Christian Taedcke (2):
net: macb: reprogram TBQP after shuffling the TX ring on link-up
net: macb: mask TXUBR during TX NAPI poll to prevent IRQ storms
drivers/net/ethernet/cadence/macb_main.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
---
base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
change-id: 20260703-upstreaming-macb-irq-storm-ebd290b1e832
Best regards,
--
Christian Taedcke <christian.taedcke@weidmueller.com>
^ permalink raw reply
* Re: [PATCH] ixgbe: validate E610 PFA TLV bounds
From: Przemek Kitszel @ 2026-07-06 14:01 UTC (permalink / raw)
To: Pengpeng Hou
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Tony Nguyen,
Jakub Kicinski, Paolo Abeni, intel-wired-lan, netdev,
linux-kernel
In-Reply-To: <20260706092500.79044-1-pengpeng@iscas.ac.cn>
For the future please tag your intel ethernet submissions as
iwl-net (fixes) or iwl-next (refactors/features).
(Applies to v2 of this series).
On 7/6/26 11:25, Pengpeng Hou wrote:
> ixgbe_get_pfa_module_tlv() walks E610 PFA TLV records stored in
> EEPROM.
>
> Stop parsing malformed TLVs whose header or declared value length would
> exceed the PFA boundary.
this is a "beware of malicious NVM" type of change...
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
> index 4d8ae5b56145..03e88bdf5a43 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
> @@ -3895,6 +3895,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw, u16 *module_tlv,
> while (next_tlv < pfa_end_ptr) {
> u16 tlv_sub_module_type, tlv_len;
>
> + if (pfa_end_ptr - next_tlv < 2)
instead of wrap-around arithmetics it would be better to use
size_add/size_sub
> + break;
> +
> /* Read TLV type */
> err = ixgbe_read_ee_aci_e610(hw, next_tlv,
> &tlv_sub_module_type);
> @@ -3917,6 +3920,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw, u16 *module_tlv,
> /* Check next TLV, i.e. current TLV pointer + length + 2 words
> * (for current TLV's type and length).
> */
> + if (tlv_len > pfa_end_ptr - next_tlv - 2)
> + break;
> +
> next_tlv = next_tlv + tlv_len + 2;
> }
> /* Module does not exist */
^ permalink raw reply
* Re: [PATCH net-next 2/2] net: phy: qt2025: Use vertical import style
From: Andrew Lunn @ 2026-07-06 13:58 UTC (permalink / raw)
To: Guru Das Srinagesh
Cc: FUJITA Tomonori, Trevor Gross, Heiner Kallweit, Russell King,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
netdev, rust-for-linux, linux-kernel
In-Reply-To: <20260705-net-vert-imp-v1-2-95a35ddff411@gurudas.dev>
On Sun, Jul 05, 2026 at 10:38:41PM -0700, Guru Das Srinagesh wrote:
> Convert `use` imports to vertical layout for better readability and
> maintainability.
>
> Signed-off-by: Guru Das Srinagesh <linux@gurudas.dev>
> ---
> drivers/net/phy/qt2025.rs | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/phy/qt2025.rs b/drivers/net/phy/qt2025.rs
> index 470d89a0ac00..efde3f909367 100644
> --- a/drivers/net/phy/qt2025.rs
> +++ b/drivers/net/phy/qt2025.rs
> @@ -14,11 +14,17 @@
> use kernel::io::poll::read_poll_timeout;
> use kernel::net::phy::{
> self,
> - reg::{Mmd, C45},
> + reg::{
> + Mmd,
> + C45, //
> + },
Given the comment this should be sorted in 'ASCIIbetical order',
isn't this wrong, C comes before M?
Andrew
^ permalink raw reply
* Re: [PATCH net-next] net: skbuff: use net_zcopy_get() instead of refcount_inc()
From: Willem de Bruijn @ 2026-07-06 13:55 UTC (permalink / raw)
To: Yun Lu, davem, edumazet, kuba, pabeni, horms, kerneljasonxing,
kuniyu
Cc: mhal, bjorn, jiayuan.chen, netdev, minhnguyen.080505
In-Reply-To: <20260706100229.13812-1-luyun_611@163.com>
Yun Lu wrote:
> From: Yun Lu <luyun@kylinos.cn>
>
> The net_zcopy_get() increments the uarg->refcnt, which is called both
> in pskb_carve_inside_header() and pskb_carve_inside_nonlinear().
> Also use net_zcopy_get() in pskb_expand_head for code consistency.
>
> No functional change intended.
>
> Signed-off-by: Yun Lu <luyun@kylinos.cn>
> ---
> net/core/skbuff.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index 18dabb4e9cfa..bcf3b2c65fb9 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -2326,7 +2326,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
> if (skb_orphan_frags(skb, gfp_mask))
> goto nofrags;
> if (skb_zcopy(skb))
> - refcount_inc(&skb_uarg(skb)->refcnt);
> + net_zcopy_get(skb_zcopy(skb));
This adds some unnecessary instructions in skb_zcopy.
It's not terrible and I see the consistency argument. But would make
more sense to update the recently added pskb_carve_.. variants instead.
^ permalink raw reply
* Re: [PATCH net-next 1/2] net: phy: ax88796b: Use vertical import style
From: Andrew Lunn @ 2026-07-06 13:53 UTC (permalink / raw)
To: Gary Guo
Cc: Guru Das Srinagesh, FUJITA Tomonori, Trevor Gross,
Heiner Kallweit, Russell King, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, netdev, rust-for-linux, linux-kernel
In-Reply-To: <DJRJ4N9UQUR8.1GSF8WWG5WO2Q@garyguo.net>
> This is sorted list, albeit in ASCIIbetical order instead of alphabetical.
Ah, O.K. To avoid merge conflicts, the actual sorting scheme does not
matter, it just needs to be sorted, so inserts are more likely to be
spread across the list rather than appended at the end.
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Andrew
^ permalink raw reply
* Re: [PATCH ipsec] xfrm: espintcp: fix UAF during close
From: Sabrina Dubroca @ 2026-07-06 13:52 UTC (permalink / raw)
To: Breno Leitao
Cc: netdev, Steffen Klassert, Herbert Xu, stable, zdi-disclosures
In-Reply-To: <akfkd_1yI_G4cVoc@gmail.com>
2026-07-03, 09:36:42 -0700, Breno Leitao wrote:
> Hello Sabrina,
>
> On Fri, Jul 03, 2026 at 04:21:12PM +0200, Sabrina Dubroca wrote:
> > diff --git a/net/xfrm/espintcp.c b/net/xfrm/espintcp.c
> > index 374e1b964438..f09b5dd85db8 100644
> > --- a/net/xfrm/espintcp.c
> > +++ b/net/xfrm/espintcp.c
> > @@ -517,6 +517,8 @@ static void espintcp_close(struct sock *sk, long timeout)
> > sk->sk_prot = &tcp_prot;
> > barrier();
> >
> > + synchronize_rcu();
>
> I've got the impression netdev usually prefers synchronize_net() instead
> of synchornize_rcu(). Is there any reason for synchronize_net() not
> being used here?
I don't think it makes sense here. We're not holding RTNL (those are
just basic userspace TCP sockets), and we're not on the netns exit
path.
> Also, given you have a explicit synchronize_rcu() here, should the
> barrier() above be dropped?
Ok, I can clean that up in v2.
--
Sabrina
^ permalink raw reply
* linux-next: manual merge of the net-next tree with the net tree
From: Mark Brown @ 2026-07-06 13:48 UTC (permalink / raw)
To: David Miller, Jakub Kicinski, Paolo Abeni, Networking
Cc: Linux Kernel Mailing List, Linux Next Mailing List, Nirmoy Das
[-- Attachment #1: Type: text/plain, Size: 1176 bytes --]
Hi all,
Today's linux-next merge of the net-next tree got a conflict in:
tools/testing/selftests/net/lib.sh
between commit:
dd6a23bac306b ("selftests: net: make busywait timeout clock portable")
from the net tree and commit:
895bad9cc4cec ("selftests: net: make busywait timeout clock portable")
from the net-next tree.
I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging. You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.
diff --cc tools/testing/selftests/net/lib.sh
index d46d2cec89e45,d389a965d8f19..0000000000000
--- a/tools/testing/selftests/net/lib.sh
+++ b/tools/testing/selftests/net/lib.sh
@@@ -93,10 -89,8 +89,9 @@@ loopy_wait(
{
local sleep_cmd=$1; shift
local timeout_ms=$1; shift
- local start_time
+ local current_time
- start_time=$(timestamp_ms) || return
+ local start_time=$(timestamp_ms)
while true
do
local out
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply
* [PATCH net] tipc: serialize udp bearer replicast list updates
From: Weiming Shi @ 2026-07-06 13:47 UTC (permalink / raw)
To: netdev
Cc: Jon Maloy, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, tipc-discussion, Xiang Mei, Weiming Shi
tipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list
with list_add_rcu() / list_del_rcu(), but nothing serializes them. The
add runs from the encap receive softirq (via tipc_udp_rcast_disc())
without rtnl_lock(), so it can race the cleanup delete and corrupt the
list:
list_del corruption. prev->next should be ffff8880298d7ab8,
but was ffff88802449ad38. (prev=ffff888027e3ec98)
kernel BUG at lib/list_debug.c:62!
RIP: __list_del_entry_valid_or_report+0x17a/0x200
Workqueue: events cleanup_bearer
Call Trace:
cleanup_bearer (net/tipc/udp_media.c:811)
process_one_work (kernel/workqueue.c:3302)
worker_thread (kernel/workqueue.c:3466)
The bearer can be enabled from an unprivileged user namespace, as the
TIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM.
Add a spinlock and take it around both list updates. Re-check for the
peer under the lock in the add path so the check-then-add in
tipc_udp_rcast_disc() cannot insert a duplicate.
Fixes: ef20cd4dd163 ("tipc: introduce UDP replicast")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
net/tipc/udp_media.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index 62ae7f5b5840..601174297a16 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -94,6 +94,7 @@ struct udp_replicast {
* @ifindex: local address scope
* @work: used to schedule deferred work on a bearer
* @rcast: associated udp_replicast container
+ * @rcast_lock: serializes updates to @rcast.list
*/
struct udp_bearer {
struct tipc_bearer __rcu *bearer;
@@ -101,6 +102,7 @@ struct udp_bearer {
u32 ifindex;
struct work_struct work;
struct udp_replicast rcast;
+ spinlock_t rcast_lock; /* protects rcast.list */
};
static int tipc_udp_is_mcast_addr(struct udp_media_addr *addr)
@@ -301,7 +303,7 @@ static bool tipc_udp_is_known_peer(struct tipc_bearer *b,
static int tipc_udp_rcast_add(struct tipc_bearer *b,
struct udp_media_addr *addr)
{
- struct udp_replicast *rcast;
+ struct udp_replicast *rcast, *tmp;
struct udp_bearer *ub;
ub = rcu_dereference_rtnl(b->media_ptr);
@@ -319,6 +321,17 @@ static int tipc_udp_rcast_add(struct tipc_bearer *b,
memcpy(&rcast->addr, addr, sizeof(struct udp_media_addr));
+ /* tipc_udp_rcast_disc() adds from softirq without rtnl_lock(). */
+ spin_lock_bh(&ub->rcast_lock);
+ list_for_each_entry(tmp, &ub->rcast.list, list) {
+ if (!memcmp(&tmp->addr, addr, sizeof(struct udp_media_addr))) {
+ spin_unlock_bh(&ub->rcast_lock);
+ dst_cache_destroy(&rcast->dst_cache);
+ kfree(rcast);
+ return 0;
+ }
+ }
+
if (ntohs(addr->proto) == ETH_P_IP)
pr_info("New replicast peer: %pI4\n", &rcast->addr.ipv4);
#if IS_ENABLED(CONFIG_IPV6)
@@ -327,6 +340,7 @@ static int tipc_udp_rcast_add(struct tipc_bearer *b,
#endif
b->bcast_addr.broadcast = TIPC_REPLICAST_SUPPORT;
list_add_rcu(&rcast->list, &ub->rcast.list);
+ spin_unlock_bh(&ub->rcast_lock);
return 0;
}
@@ -679,6 +693,7 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b,
return -ENOMEM;
INIT_LIST_HEAD(&ub->rcast.list);
+ spin_lock_init(&ub->rcast_lock);
if (!attrs[TIPC_NLA_BEARER_UDP_OPTS])
goto err;
@@ -819,10 +834,12 @@ static void cleanup_bearer(struct work_struct *work)
struct udp_replicast *rcast, *tmp;
struct tipc_net *tn;
+ spin_lock_bh(&ub->rcast_lock);
list_for_each_entry_safe(rcast, tmp, &ub->rcast.list, list) {
list_del_rcu(&rcast->list);
call_rcu_hurry(&rcast->rcu, rcast_free_rcu);
}
+ spin_unlock_bh(&ub->rcast_lock);
tn = tipc_net(sock_net(ub->sk));
--
2.43.0
^ permalink raw reply related
* Re: [PATCH net] psp: fix NULL genl_sock deref race with concurrent netns teardown
From: Daniel Zahka @ 2026-07-06 13:46 UTC (permalink / raw)
To: Kiran Kella, kuba, willemdebruijn.kernel
Cc: davem, edumazet, pabeni, horms, weibunny, netdev, linux-kernel,
jayakrishnan.udayavarma, ajit.khaparde, akhilesh.samineni,
Vikas Gupta, Bhargava Marreddy
In-Reply-To: <20260703112431.2860506-1-kiran.kella@broadcom.com>
On 7/3/26 7:24 AM, Kiran Kella wrote:
> The race occurs between network namespace removal and PSP device
> unregistration. When a netns is deleted while a PSP device associated
> with that netns is concurrently being removed, psp_dev_unregister()
> triggers psp_nl_notify_dev() to send a device change notification.
> Concurrently, cleanup_net() running in the netns workqueue calls
> genl_pernet_exit(), which sets net->genl_sock to NULL. If
> genl_pernet_exit() wins the race, two sites in psp_nl_multicast_per_ns()
> then dereference the NULL socket and crash:
>
> CPU 0 (netns teardown) CPU 1 (PSP device unregister)
> ====================== =============================
> cleanup_net [workqueue]
> genl_pernet_exit() psp_dev_unregister()
> net->genl_sock = NULL psp_nl_notify_dev()
> psp_nl_multicast_per_ns()
> build_ntf()
> -> netlink_has_listeners(NULL)
> /* crash */
> genlmsg_multicast_netns()
> -> nlmsg_multicast_filtered(NULL)
> /* crash */
>
> Both the main_net path (derived from psd->main_netdev) and each
> assoc_net entry in psd->assoc_dev_list are affected.
>
> Fix by replacing the bare dev_net() calls with maybe_get_net().
> maybe_get_net() returns NULL if the namespace is already dying.
> Holding the reference ensures genl_sock remains valid across both the
> build_ntf() and genlmsg_multicast_netns() calls.
>
> Fixes: 00c94ca2b99e ("psp: base PSP device support")
> Fixes: 06c2dce2d0f6 ("psp: add new netlink cmd for dev-assoc and dev-disassoc")
> Signed-off-by: Kiran Kella <kiran.kella@broadcom.com>
> Reviewed-by: Ajit Khaparde <ajit.khaparde@broadcom.com>
> Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com>
> Reviewed-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com>
Thanks. I was able to repro myself by inserting a delay after the old:
main_net = dev_net(psd->main_netdev);
and then executing nsim_psp_rereg_write() in parallel with destroying
the netns that I placed a netdevsim dev into.
Tested-by: Daniel Zahka <daniel.zahka@gmail.com>
Reviewed-by: Daniel Zahka <daniel.zahka@gmail.com>
> ---
> net/psp/psp_nl.c | 33 +++++++++++++++++++++------------
> 1 file changed, 21 insertions(+), 12 deletions(-)
>
> diff --git a/net/psp/psp_nl.c b/net/psp/psp_nl.c
> index 9610d8c456ff..24ab626a9e8a 100644
> --- a/net/psp/psp_nl.c
> +++ b/net/psp/psp_nl.c
> @@ -62,36 +62,45 @@ psp_nl_multicast_per_ns(struct psp_dev *psd, unsigned int group,
> struct net *main_net;
> struct sk_buff *ntf;
>
> - main_net = dev_net(psd->main_netdev);
> + main_net = maybe_get_net(dev_net(psd->main_netdev));
> + if (!main_net)
> + return;
> +
> xa_init(&sent_nets);
>
> list_for_each_entry(entry, &psd->assoc_dev_list, dev_list) {
> struct net *assoc_net = dev_net(entry->assoc_dev);
> + struct net *net;
> int ret;
>
> if (net_eq(assoc_net, main_net))
> continue;
>
> - ret = xa_insert(&sent_nets, (unsigned long)assoc_net, assoc_net,
> - GFP_KERNEL);
> - if (ret == -EBUSY)
> + net = maybe_get_net(assoc_net);
> + if (!net)
> continue;
>
> - ntf = build_ntf(psd, assoc_net, ctx);
> - if (!ntf)
> + ret = xa_insert(&sent_nets, (unsigned long)assoc_net, assoc_net,
> + GFP_KERNEL);
> + if (ret == -EBUSY) {
> + put_net(net);
> continue;
> + }
>
> - genlmsg_multicast_netns(&psp_nl_family, assoc_net, ntf, 0,
> - group, GFP_KERNEL);
> + ntf = build_ntf(psd, net, ctx);
> + if (ntf)
> + genlmsg_multicast_netns(&psp_nl_family, net, ntf, 0,
> + group, GFP_KERNEL);
> + put_net(net);
> }
some optional nits if you wanted to respin:
You could eliminate the extra struct net *net, by just doing something
like if (!maybe_get_net(assoc_net)) directly.
You could get away with a single put_net(net); call site, if you reorder
the ops that could fail so that maybe_get_net(assoc_net) happens last
before the build_ntf(psd, net, ctx)
> xa_destroy(&sent_nets);
>
> /* Send to main device netns */
> ntf = build_ntf(psd, main_net, ctx);
> - if (!ntf)
> - return;
> - genlmsg_multicast_netns(&psp_nl_family, main_net, ntf, 0, group,
> - GFP_KERNEL);
> + if (ntf)
> + genlmsg_multicast_netns(&psp_nl_family, main_net, ntf, 0, group,
> + GFP_KERNEL);
> + put_net(main_net);
> }
>
> static struct sk_buff *psp_nl_clone_ntf(struct psp_dev *psd, struct net *net,
^ permalink raw reply
* Re: [PATCH net-next 1/2] net: phy: ax88796b: Use vertical import style
From: Alice Ryhl @ 2026-07-06 13:45 UTC (permalink / raw)
To: Andrew Lunn
Cc: Guru Das Srinagesh, FUJITA Tomonori, Trevor Gross,
Heiner Kallweit, Russell King, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, netdev, rust-for-linux, linux-kernel
In-Reply-To: <8376fc86-be9d-4e3a-a51e-4d9ecda1b648@lunn.ch>
On Mon, Jul 6, 2026 at 3:17 PM Andrew Lunn <andrew@lunn.ch> wrote:
>
> On Sun, Jul 05, 2026 at 10:38:40PM -0700, Guru Das Srinagesh wrote:
> > Convert `use` imports to vertical layout for better readability and
> > maintainability.
> >
> > Signed-off-by: Guru Das Srinagesh <linux@gurudas.dev>
> > ---
> > drivers/net/phy/ax88796b_rust.rs | 7 ++++++-
> > 1 file changed, 6 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/net/phy/ax88796b_rust.rs b/drivers/net/phy/ax88796b_rust.rs
> > index 2d24628a4e58..5a21fe09bd62 100644
> > --- a/drivers/net/phy/ax88796b_rust.rs
> > +++ b/drivers/net/phy/ax88796b_rust.rs
> > @@ -5,7 +5,12 @@
> > //!
> > //! C version of this driver: [`drivers/net/phy/ax88796b.c`](./ax88796b.c)
> > use kernel::{
> > - net::phy::{self, reg::C22, DeviceId, Driver},
> > + net::phy::{
> > + self,
> > + reg::C22,
> > + DeviceId,
> > + Driver, //
> > + },
>
> A question from somebody who does not know rust. Does the order of the
> elements in the list matter?
>
> Linux has a pattern of sorting multi line lists, because it reduces
> merge conflicts. Can this list be sorted?
No, the order does not matter. But rustfmt will complain if it's not
sorted. Note that rustfmt prefers ordering lower-case before
upper-case so it is currently sorted in the order preferred by the tool.
Alice
^ permalink raw reply
* net: airoha: PPE SRAM stale L2 entries survive TC flower destroy on station roam
From: Daniel Pawlik @ 2026-07-06 13:45 UTC (permalink / raw)
To: netdev; +Cc: lorenzo, upstream
Hi,
I spent the last few days debugging a WiFi throughput regression on an
Airoha AN7581 router (Quantum Fiber W1700K, OpenWrt, acting as a dumb AP
with bridger [1] doing TC flower-based L2 hardware offload). The symptom
is that when a WiFi station switches from one radio to another, throughput
drops to ~1 Mbit/s until something nudges the PPE out of its stale state.
I want to share what I found in case it helps identify a driver or firmware
issue, and ask a few questions for the Airoha folks.
The setup: bridger installs skip_sw TC flower filters on bridge member
interfaces to push L2 forwarding into the PPE. For a station on phy0.2-ap0:
phy0.2-ap0 ingress: src=STATION dst=GW -> redirect lan2
lan2 ingress: src=GW dst=STATION -> redirect phy0.2-ap0
When the station moves to phy0.1-ap0, bridger tears down the old filters
(RTM_DELTFILTER) and installs new ones (RTM_NEWTFILTER) for phy0.1-ap0.
The kernel and driver both report success. But the PPE keeps sending
downlink traffic to phy0.2-ap0, where the station is no longer associated,
so every frame is dropped. iw dev phy0.1-ap0 station get a few minutes
after the band switch:
tx retries: 3429
tx failed: 3435
rx bitrate: 6.0 MBit/s (link rate degraded by retransmission backoff)
Meanwhile tc filter show lan2 ingress correctly shows redirect to phy0.1-ap0.
The kernel's view of the world is right; the PPE's isn't.
Bridger improvements along the way
==================================
During the investigation I made several improvements to bridger - better
handling of port mismatches, FDB migration ordering, and the DELNEIGH/NEWNEIGH
race during band switch - all in main-bridger-v4 [2]. These helped narrow
down the problem but in the end were not enough to fully resolve the issue on
their own, which is what led us to the PPE SRAM behaviour described below.
Root issue - PPE SRAM consistency
=================================
Even after the bridger fixes, there's a residual window where the PPE SRAM
has the old redirect in place. The sequence from the kernel's side looks
correct:
RTM_DELTFILTER -> flow_offload_destroy() -> "flow_table entry
removed OK"
RTM_NEWTFILTER -> flow_offload_add() -> success
But the hardware continues forwarding on the old SRAM entry.
While adding debug logging to bridger's nl.c to trace every RTM_DELTFILTER
and its outcome (patch c1a5f49 in the same branch), I observed two things
that suggest the SRAM management is not entirely consistent.
First, RTM_DELTFILTER frequently returns ENOENT even for filters that were
successfully installed earlier:
flow offload del on ifindex 8 handle 0xf521a056: FAILED kernel error -2
The reason is that the PPE firmware proactively evicts idle flows from SRAM
on its own schedule, notifying the driver via flow_offload_destroy(), which
causes the kernel to remove the TC flower filter before bridger's idle timer
fires. So bridger's delete arrives late, after the filter is already gone.
In isolation this is harmless - ENOENT just means the hardware already did the
cleanup - but it does mean there's a window between the PPE evicting the entry
and bridger learning about it where the state is unclear.
Second, dmesg occasionally shows the same cookie receiving multiple DESTROY
notifications in rapid succession:
airoha_eth: PPE: TC DESTROY cookie ffffff8017ee1000: flow_table
entry removed OK (TC filter will be deleted)
airoha_eth: PPE: TC DESTROY cookie ffffff8017ee1000 NOT in
flow_table (already removed or never offloaded)
airoha_eth: PPE: TC DESTROY cookie ffffff8017ee1000 NOT in
flow_table (already removed or never offloaded)
Same cookie, three notifications within milliseconds. The first removes the
entry cleanly; the next two find nothing. This looks like the NPU firmware
can fire DESTROY more than once for the same SRAM slot, possibly because the
invalidation commit to the hardware is not atomic from the firmware's
perspective.
The practical consequence: when bridger installs a new TC flower for the same
MAC pair on a different port (RTM_NEWTFILTER for phy0.1-ap0 after
RTM_DELTFILTER for phy0.2-ap0), there is apparently a window where the old
SRAM entry is not yet fully invalidated. If the new flow_offload_add() runs
into that window, the new SRAM entry either doesn't land or coexists with the
old one in a way that lets the hardware continue using the old redirect.
Workaround
==========
I tried a kernel-side workaround [3]: register a switchdev notifier for
SWITCHDEV_FDB_ADD_TO_DEVICE / SWITCHDEV_FDB_DEL_TO_DEVICE and, on each
event, walk the driver's flow_table and l2_flows and flush all PPE entries
matching the affected MAC.
Two things that flush handles:
- Removing the flow_table entry makes airoha_ppe_flow_offload_destroy()
return -ENOENT on RTM_DELTFILTER, which causes the TC layer to remove
the software filter state cleanly.
- Removing the l2_flows entry prevents airoha_ppe_foe_insert_entry() from
re-learning the stale redirect direction after the BIND entry ages out.
Without this, even after the SRAM entry expires, the old l2_flows parent
is still around and the PPE re-establishes hardware offload in the wrong
direction the next time traffic flows.
This fixed the symptom completely. I held off upstreaming it because it
felt like compensating for something the driver or firmware should handle
correctly - if RTM_DELTFILTER reliably invalidated the SRAM entry and
l2_flows were tied to the lifetime of the station's bridge port association,
the switchdev flush wouldn't be needed.
Questions for Airoha
====================
Is the NPU firmware's SRAM invalidation atomic? When flow_offload_destroy()
returns, can the driver guarantee the hardware has stopped using that entry,
or is there a commit pipeline that takes additional time?
Is it expected that the firmware can send multiple DESTROY notifications for
the same slot? The double-NOT-in-flow_table pattern in dmesg suggests so.
When flow_offload_add() is called for a MAC pair that may still have a
partially-invalidated SRAM entry from a previous flow, does the NPU guarantee
the new entry takes precedence immediately? Or is there a recommended
sequence (e.g. explicit invalidate, barrier, then add)?
Is there a flush or barrier call in the NPU firmware interface that the driver
could expose, so a switchdev handler or similar could ensure SRAM consistency
without needing to walk the entire flow_table?
Happy to run more tests, capture more dmesg, or share the full debug log
from bridger if it would help.
Regards,
Dan
Some info:
Kernel: 6.18.37, arm64
Platform: Airoha AN7581 (tested on Quantum Fiber W1700K)
[1] https://github.com/nbd168/bridger
[2] https://github.com/danpawlik/bridger/commits/main-bridger-v4
[3] Local branch -
https://github.com/danpawlik/openwrt/tree/airoha-npu-kernel-mailinglist
commit: https://github.com/openwrt/openwrt/commit/7373faf11f4ad14a3cb16f33e51fbc4dccc85ca4
^ permalink raw reply
* [PATCH net-next v2 4/4] selftests: net: hsr: add PRP RedBox test
From: Xin Xie @ 2026-07-06 13:41 UTC (permalink / raw)
To: netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Shuah Khan, Sebastian Andrzej Siewior, Felix Maurer,
Luka Gejak, Fernando Fernandez Mancera, linux-kselftest,
linux-kernel, Xin Xie
In-Reply-To: <20260706134131.61659-1-xiexinet@gmail.com>
Add a kselftest that builds a PRP RedBox (interlink) with a SAN behind the
interlink and a peer DANP, and checks bidirectional unicast across the
interlink, preservation of the SAN source MAC on the PRP network, and that
the proxy-announce supervision frame carries the RedBox-MAC TLV (Type 30)
terminated by an EOT marker. It reuses the hsr_common.sh / lib.sh helpers
and skips cleanly on a kernel or iproute2 without PRP interlink support.
The background ping is killed by its exact PID: ip netns exec does not
isolate the PID namespace, so a pattern-based pkill could hit unrelated
processes on the host.
Signed-off-by: Xin Xie <xiexinet@gmail.com>
---
tools/testing/selftests/net/hsr/Makefile | 1 +
.../selftests/net/hsr/hsr_prp_redbox.sh | 99 +++++++++++++++++++
2 files changed, 100 insertions(+)
create mode 100755 tools/testing/selftests/net/hsr/hsr_prp_redbox.sh
diff --git a/tools/testing/selftests/net/hsr/Makefile b/tools/testing/selftests/net/hsr/Makefile
index 31fb9326c..2150e487a 100644
--- a/tools/testing/selftests/net/hsr/Makefile
+++ b/tools/testing/selftests/net/hsr/Makefile
@@ -4,6 +4,7 @@ top_srcdir = ../../../../..
TEST_PROGS := \
hsr_ping.sh \
+ hsr_prp_redbox.sh \
hsr_redbox.sh \
link_faults.sh \
prp_ping.sh \
diff --git a/tools/testing/selftests/net/hsr/hsr_prp_redbox.sh b/tools/testing/selftests/net/hsr/hsr_prp_redbox.sh
new file mode 100755
index 000000000..479c89222
--- /dev/null
+++ b/tools/testing/selftests/net/hsr/hsr_prp_redbox.sh
@@ -0,0 +1,99 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Test a PRP RedBox (PRP-SAN): a SAN that sits behind the interlink port must
+# reach, and be reached by, a peer DANP on the PRP network with its own MAC
+# preserved on the wire, and the RedBox must announce the SAN with a RedBox-MAC
+# TLV (terminated by an EOT marker) in its PRP supervision frames.
+#
+# RB PRP RedBox: prp0 over rb_a/rb_b (LAN A/B) + interlink rb_il
+# PEER peer DANP : prp0 over pe_a/pe_b, 100.64.0.2
+# SAN SAN : san_il, own MAC, 100.64.0.51 (behind the interlink)
+
+ipv6=false
+
+source ./hsr_common.sh
+
+check_prerequisites
+
+if ! command -v tcpdump >/dev/null 2>&1; then
+ echo "SKIP: This test requires tcpdump"
+ exit $ksft_skip
+fi
+
+if ! ip link help hsr 2>&1 | grep -q interlink; then
+ echo "SKIP: iproute2 too old (no hsr interlink support)"
+ exit $ksft_skip
+fi
+
+setup_ns RB PEER SAN
+trap 'cleanup_ns "$RB" "$PEER" "$SAN"' EXIT
+
+ip link add rb_a netns "$RB" type veth peer name pe_a netns "$PEER"
+ip link add rb_b netns "$RB" type veth peer name pe_b netns "$PEER"
+ip link add rb_il netns "$RB" type veth peer name san_il netns "$SAN"
+
+ip -n "$RB" link set rb_a up
+ip -n "$RB" link set rb_b up
+ip -n "$RB" link set rb_il up
+ip -n "$PEER" link set pe_a up
+ip -n "$PEER" link set pe_b up
+ip -n "$SAN" link set san_il up
+ip -n "$SAN" addr add 100.64.0.51/24 dev san_il
+
+# Feature gate: PRP interlink (RedBox) creation. A kernel without PRP RedBox
+# support rejects this with -EINVAL, so SKIP rather than FAIL.
+if ! ip -n "$RB" link add name prp0 type hsr slave1 rb_a slave2 rb_b \
+ interlink rb_il proto 1 2>/dev/null; then
+ echo "SKIP: kernel without PRP RedBox (interlink) support"
+ exit $ksft_skip
+fi
+ip -n "$RB" link set prp0 up
+ip -n "$PEER" link add name prp0 type hsr slave1 pe_a slave2 pe_b proto 1
+ip -n "$PEER" link set prp0 up
+ip -n "$PEER" addr add 100.64.0.2/24 dev prp0
+sleep 1
+
+san_mac=$(ip -n "$SAN" -br link show san_il | awk '{print $3}')
+rb_mac=$(ip -n "$RB" -br link show rb_il | awk '{print $3}')
+
+# Bidirectional unicast across the interlink.
+do_ping "$PEER" 100.64.0.51
+do_ping "$SAN" 100.64.0.2
+stop_if_error "PRP RedBox bidirectional unicast failed"
+
+# The SAN source MAC must be preserved on the PRP network, not laundered to the
+# RedBox MAC: the peer resolves the SAN IP to the SAN's own MAC.
+neigh=$(ip -n "$PEER" neigh show 100.64.0.51 | awk '{print $5}')
+if [ "$neigh" != "$san_mac" ]; then
+ echo "SAN MAC preservation [ FAIL ]: peer resolved 100.64.0.51 to" \
+ "'$neigh', expected $san_mac" 1>&2
+ ret=1
+fi
+stop_if_error "SAN MAC not preserved on the PRP network"
+
+# The proxy-announce supervision frame must carry, in order, the life-check TLV
+# (type 0x14, len 6) + MacAddressA == SAN MAC + the RedBox-MAC TLV (type 0x1e,
+# len 6) + MacAddressRedBox == RedBox MAC + the EOT marker (0x0000).
+ip netns exec "$SAN" ping -i 0.2 -q 100.64.0.2 >/dev/null 2>&1 &
+ping_pid=$!
+cap=$(ip netns exec "$PEER" timeout 5 tcpdump -i pe_a -nn -x \
+ "ether proto 0x88fb and ether src $rb_mac" 2>/dev/null || true)
+kill "$ping_pid" 2>/dev/null || true
+wait "$ping_pid" 2>/dev/null || true
+
+san_hex=$(echo "$san_mac" | tr -d ':')
+rb_hex=$(echo "$rb_mac" | tr -d ':')
+# Reassemble contiguous frame hex: drop the "0x0010:" offset labels and spaces.
+frame_hex=$(echo "$cap" | awk '/^[[:space:]]*0x[0-9a-f]+:/ {
+ sub(/^[[:space:]]*0x[0-9a-f]+:[[:space:]]*/, "");
+ gsub(/ /, ""); printf "%s", $0 }')
+if ! echo "$frame_hex" | grep -q "1406${san_hex}1e06${rb_hex}0000"; then
+ echo "supervision RedBox-MAC TLV [ FAIL ]: missing SAN MAC, Type-30" \
+ "payload, or EOT" 1>&2
+ ret=1
+fi
+stop_if_error "PRP RedBox supervision RedBox-MAC TLV/EOT check failed"
+
+echo "INFO: PRP RedBox (PRP-SAN) conformance checks passed"
+exit $ret
--
2.53.0
^ permalink raw reply related
* [PATCH net-next v2 3/4] net: hsr: allow PRP RedBox (interlink) creation
From: Xin Xie @ 2026-07-06 13:41 UTC (permalink / raw)
To: netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Shuah Khan, Sebastian Andrzej Siewior, Felix Maurer,
Luka Gejak, Fernando Fernandez Mancera, linux-kselftest,
linux-kernel, Xin Xie
In-Reply-To: <20260706134131.61659-1-xiexinet@gmail.com>
With the PRP interlink datapath, duplicate discard and supervision support
in place, a PRP device can act as a RedBox. Remove the rtnetlink rejection
of "type hsr ... interlink <dev> proto 1"; the feature is implemented
unconditionally by the preceding patches.
Signed-off-by: Xin Xie <xiexinet@gmail.com>
---
net/hsr/hsr_netlink.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/net/hsr/hsr_netlink.c b/net/hsr/hsr_netlink.c
index 8099f2069..88940e801 100644
--- a/net/hsr/hsr_netlink.c
+++ b/net/hsr/hsr_netlink.c
@@ -121,14 +121,8 @@ static int hsr_newlink(struct net_device *dev,
}
}
- if (proto == HSR_PROTOCOL_PRP) {
+ if (proto == HSR_PROTOCOL_PRP)
proto_version = PRP_V1;
- if (interlink) {
- NL_SET_ERR_MSG_MOD(extack,
- "Interlink only works with HSR");
- return -EINVAL;
- }
- }
return hsr_dev_finalize(dev, link, interlink, multicast_spec,
proto_version, extack);
--
2.53.0
^ permalink raw reply related
* [PATCH net-next v2 2/4] net: hsr: emit RedBox-MAC TLV in PRP RedBox supervision frames
From: Xin Xie @ 2026-07-06 13:41 UTC (permalink / raw)
To: netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Shuah Khan, Sebastian Andrzej Siewior, Felix Maurer,
Luka Gejak, Fernando Fernandez Mancera, linux-kselftest,
linux-kernel, Xin Xie
In-Reply-To: <20260706134131.61659-1-xiexinet@gmail.com>
A PRP RedBox must announce the SANs it proxies so peers populate their
proxy node tables. The proxy-announce machinery (hsr_proxy_announce(),
armed via hsr->redbox) already iterates proxy_node_db under RCU and calls
send_sv_frame() once per SAN, but the PRP sender emitted neither the
announced SAN MAC nor the RedBox-MAC TLV that IEC 62439-3 requires.
Extend send_prp_supervision_frame() so that, for a proxy-announce
(identified by the interlink port, an O(1) test), the frame carries the
proxied SAN MAC as MacAddressA followed by the RedBox-MAC TLV (Type 30)
and an explicit End-of-TLV marker before padding.
hsr_get_node() must also accept the reinjected proxy-announce: a PRP
supervision frame is an untagged ETH_P_PRP frame (mac_len == ETH_HLEN, the
RCT is appended only on egress) sourced from macaddress_redbox, which is
never learned from data. Exempt only PRP supervision frames from the
hsr_ethhdr length guard; HSR (ETH_P_HSR) supervision is front-tagged and
keeps the original guard, so HSR malformed-frame filtering is unchanged.
Also align macaddress_redbox so that ether_addr_copy() and
ether_addr_equal() on it are safe on architectures without efficient
unaligned access.
Signed-off-by: Xin Xie <xiexinet@gmail.com>
---
net/hsr/hsr_device.c | 33 ++++++++++++++++++++++++++++++---
net/hsr/hsr_framereg.c | 13 +++++++++++--
net/hsr/hsr_main.h | 2 +-
3 files changed, 42 insertions(+), 6 deletions(-)
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index 5af491ed2..0973f9a94 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -372,10 +372,21 @@ static void send_prp_supervision_frame(struct hsr_port *master,
{
struct hsr_priv *hsr = master->hsr;
struct hsr_sup_payload *hsr_sp;
+ struct hsr_sup_tlv *hsr_stlv;
struct hsr_sup_tag *hsr_stag;
struct sk_buff *skb;
+ bool redbox_proxy;
+ int extra = 0;
+
+ redbox_proxy = hsr->redbox && master->type == HSR_PT_INTERLINK;
+
+ /* A proxy-announce carries a RedBox-MAC TLV and an EOT marker. */
+ if (redbox_proxy)
+ extra = sizeof(struct hsr_sup_tlv) +
+ sizeof(struct hsr_sup_payload) +
+ sizeof(struct hsr_sup_tlv);
- skb = hsr_init_skb(master, 0);
+ skb = hsr_init_skb(master, extra);
if (!skb) {
netdev_warn_once(master->dev, "PRP: Could not send supervision frame\n");
return;
@@ -393,9 +404,25 @@ static void send_prp_supervision_frame(struct hsr_port *master,
hsr_stag->tlv.HSR_TLV_type = PRP_TLV_LIFE_CHECK_DD;
hsr_stag->tlv.HSR_TLV_length = sizeof(struct hsr_sup_payload);
- /* Payload: MacAddressA */
+ /* Payload: MacAddressA, the announced node. */
hsr_sp = skb_put(skb, sizeof(struct hsr_sup_payload));
- ether_addr_copy(hsr_sp->macaddress_A, master->dev->dev_addr);
+ ether_addr_copy(hsr_sp->macaddress_A, addr);
+
+ /* Proxy-announce: append the RedBox-MAC TLV (Type 30) and an explicit
+ * EOT to terminate the TLV chain before zero padding.
+ */
+ if (redbox_proxy) {
+ hsr_stlv = skb_put(skb, sizeof(struct hsr_sup_tlv));
+ hsr_stlv->HSR_TLV_type = PRP_TLV_REDBOX_MAC;
+ hsr_stlv->HSR_TLV_length = sizeof(struct hsr_sup_payload);
+
+ hsr_sp = skb_put(skb, sizeof(struct hsr_sup_payload));
+ ether_addr_copy(hsr_sp->macaddress_A, hsr->macaddress_redbox);
+
+ hsr_stlv = skb_put(skb, sizeof(struct hsr_sup_tlv));
+ hsr_stlv->HSR_TLV_type = HSR_TLV_EOT;
+ hsr_stlv->HSR_TLV_length = 0;
+ }
if (skb_put_padto(skb, ETH_ZLEN)) {
spin_unlock_bh(&hsr->seqnr_lock);
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index 8f708b6e6..b3b106be6 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -293,8 +293,17 @@ struct hsr_node *hsr_get_node(struct hsr_port *port, struct list_head *node_db,
*/
if (ethhdr->h_proto == htons(ETH_P_PRP) ||
ethhdr->h_proto == htons(ETH_P_HSR)) {
- /* Check if skb contains hsr_ethhdr */
- if (skb->mac_len < sizeof(struct hsr_ethhdr))
+ bool prp_sup;
+
+ /* A PRP supervision frame is an untagged ETH_P_PRP frame
+ * (mac_len == ETH_HLEN); its RCT is appended only on egress.
+ * HSR (ETH_P_HSR) supervision is front-tagged and still must
+ * contain a struct hsr_ethhdr.
+ */
+ prp_sup = hsr->prot_version == PRP_V1 &&
+ ethhdr->h_proto == htons(ETH_P_PRP) && is_sup;
+
+ if (!prp_sup && skb->mac_len < sizeof(struct hsr_ethhdr))
return NULL;
} else {
rct = skb_get_PRP_rct(skb);
diff --git a/net/hsr/hsr_main.h b/net/hsr/hsr_main.h
index 134e4f3ff..c27cfdd9c 100644
--- a/net/hsr/hsr_main.h
+++ b/net/hsr/hsr_main.h
@@ -211,7 +211,7 @@ struct hsr_priv {
*/
bool fwd_offloaded; /* Forwarding offloaded to HW */
bool redbox; /* Device supports HSR RedBox */
- unsigned char macaddress_redbox[ETH_ALEN];
+ unsigned char macaddress_redbox[ETH_ALEN] __aligned(sizeof(u16));
unsigned char sup_multicast_addr[ETH_ALEN] __aligned(sizeof(u16));
/* Align to u16 boundary to avoid unaligned access
* in ether_addr_equal
--
2.53.0
^ permalink raw reply related
* [PATCH net-next v2 1/4] net: hsr: add PRP interlink (RedBox) datapath and duplicate discard
From: Xin Xie @ 2026-07-06 13:41 UTC (permalink / raw)
To: netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Shuah Khan, Sebastian Andrzej Siewior, Felix Maurer,
Luka Gejak, Fernando Fernandez Mancera, linux-kselftest,
linux-kernel, Xin Xie
In-Reply-To: <20260706134131.61659-1-xiexinet@gmail.com>
A PRP RedBox proxies SANs that sit behind an interlink port: their frames
must reach the PRP network with the SAN source MAC preserved, and PRP
unicast must be steered between the LAN and the SAN segment correctly.
Add the PRP interlink forwarding rules to prp_drop_frame() and give RedBox
nodes a second duplicate-discard slot so the two LAN copies of a frame
destined to a SAN collapse to a single delivery out the interlink.
The destination classification (is the unicast DA a PRP-network node or a
proxied SAN) is resolved once per frame in fill_frame_info(), gated to PRP
RedBox devices, and cached in struct hsr_frame_info, so prp_drop_frame()
stays O(1) and does not walk the node tables for every candidate egress
port in the softIRQ path. HSR RedBox frame classification is untouched.
Factor the LAN A/B duplicate test into prp_is_lan_dup() so the new PRP
interlink rules do not change hsr_drop_frame() behaviour, including the
NETIF_F_HW_HSR_FWD path which keeps using the LAN-duplicate test only.
Publish the RedBox state before the first hsr_add_port(): the slave and
interlink rx handlers are live from hsr_add_port() on and rtnl does not
stop softirq processing, so a frame could otherwise be handled while
hsr->redbox is still false. hsr_add_node() sizes each node's per-port
sequence state from hsr->redbox; a node learned in that window would get
a single-port sequence block, breaking the interlink duplicate discard
(WARN_ON_ONCE plus duplicate delivery to the SAN) and letting the
supervision sequence-block merge read beyond the source node's allocated
sequence bitmap. Publishing the flag before any port exists makes the
per-node sizing uniform by construction. This is safe: the proxy
announce timer is only armed from hsr_check_announce() once the master
is running, the packet-path readers of hsr->redbox tolerate an empty
proxy node database and an absent interlink port, and the
prune_proxy_timer is still armed only after the interlink port has been
attached successfully.
Additionally bound the supervision sequence-block merge by the smaller
of the two nodes' seq_port_cnt as defense in depth against mismatched
node sizes.
Signed-off-by: Xin Xie <xiexinet@gmail.com>
---
net/hsr/hsr_device.c | 11 ++++++++--
net/hsr/hsr_forward.c | 49 ++++++++++++++++++++++++++++++++++++------
net/hsr/hsr_framereg.c | 14 ++++++++----
net/hsr/hsr_framereg.h | 2 ++
4 files changed, 64 insertions(+), 12 deletions(-)
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index 5555b71ab..5af491ed2 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -768,6 +768,15 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],
/* Make sure the 1st call to netif_carrier_on() gets through */
netif_carrier_off(hsr_dev);
+ /* Publish the RedBox state before any port is attached: the rx
+ * handlers are live from hsr_add_port() on, and hsr_add_node()
+ * sizes each node's per-port sequence state from hsr->redbox.
+ */
+ if (interlink) {
+ hsr->redbox = true;
+ ether_addr_copy(hsr->macaddress_redbox, interlink->dev_addr);
+ }
+
res = hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER, extack);
if (res)
goto err_add_master;
@@ -805,8 +814,6 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],
if (res)
goto err_unregister;
- hsr->redbox = true;
- ether_addr_copy(hsr->macaddress_redbox, interlink->dev_addr);
mod_timer(&hsr->prune_proxy_timer,
jiffies + msecs_to_jiffies(PRUNE_PROXY_PERIOD));
}
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index 0774981a6..efcd0acef 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -440,12 +440,37 @@ static int hsr_xmit(struct sk_buff *skb, struct hsr_port *port,
return dev_queue_xmit(skb);
}
+static bool prp_is_lan_dup(struct hsr_frame_info *frame,
+ struct hsr_port *port)
+{
+ enum hsr_port_type rx = frame->port_rcv->type;
+
+ return (rx == HSR_PT_SLAVE_A && port->type == HSR_PT_SLAVE_B) ||
+ (rx == HSR_PT_SLAVE_B && port->type == HSR_PT_SLAVE_A);
+}
+
bool prp_drop_frame(struct hsr_frame_info *frame, struct hsr_port *port)
{
- return ((frame->port_rcv->type == HSR_PT_SLAVE_A &&
- port->type == HSR_PT_SLAVE_B) ||
- (frame->port_rcv->type == HSR_PT_SLAVE_B &&
- port->type == HSR_PT_SLAVE_A));
+ enum hsr_port_type rx = frame->port_rcv->type;
+
+ /* Supervision frames are not delivered to a SAN on the interlink. */
+ if (frame->is_supervision && port->type == HSR_PT_INTERLINK)
+ return true;
+
+ if (prp_is_lan_dup(frame, port))
+ return true;
+
+ /* LAN to interlink: keep PRP-network unicast off the SAN segment. */
+ if ((rx == HSR_PT_SLAVE_A || rx == HSR_PT_SLAVE_B) &&
+ port->type == HSR_PT_INTERLINK)
+ return frame->dst_in_node_db;
+
+ /* Interlink to LAN: keep SAN-to-SAN unicast local. */
+ if ((port->type == HSR_PT_SLAVE_A || port->type == HSR_PT_SLAVE_B) &&
+ rx == HSR_PT_INTERLINK)
+ return frame->dst_in_proxy_node_db;
+
+ return false;
}
bool hsr_drop_frame(struct hsr_frame_info *frame, struct hsr_port *port)
@@ -453,7 +478,7 @@ bool hsr_drop_frame(struct hsr_frame_info *frame, struct hsr_port *port)
struct sk_buff *skb;
if (port->dev->features & NETIF_F_HW_HSR_FWD)
- return prp_drop_frame(frame, port);
+ return prp_is_lan_dup(frame, port);
/* RedBox specific frames dropping policies
*
@@ -466,7 +491,7 @@ bool hsr_drop_frame(struct hsr_frame_info *frame, struct hsr_port *port)
* are addressed to interlink port (and are in the ProxyNodeTable).
*/
skb = frame->skb_hsr;
- if (skb && prp_drop_frame(frame, port) &&
+ if (skb && prp_is_lan_dup(frame, port) &&
is_unicast_ether_addr(eth_hdr(skb)->h_dest) &&
hsr_is_node_in_db(&port->hsr->proxy_node_db,
eth_hdr(skb)->h_dest)) {
@@ -706,6 +731,18 @@ static int fill_frame_info(struct hsr_frame_info *frame,
frame->is_vlan = false;
proto = ethhdr->h_proto;
+ /* PRP RedBox only: classify the unicast destination once so the
+ * per-egress-port decision in prp_drop_frame() stays O(1). HSR RedBox
+ * does its own classification and must not pay these node-table walks.
+ */
+ if (hsr->prot_version == PRP_V1 && hsr->redbox &&
+ is_unicast_ether_addr(ethhdr->h_dest)) {
+ frame->dst_in_node_db =
+ hsr_is_node_in_db(&hsr->node_db, ethhdr->h_dest);
+ frame->dst_in_proxy_node_db =
+ hsr_is_node_in_db(&hsr->proxy_node_db, ethhdr->h_dest);
+ }
+
if (proto == htons(ETH_P_8021Q))
frame->is_vlan = true;
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index e44929871..8f708b6e6 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -199,7 +199,7 @@ static struct hsr_node *hsr_add_node(struct hsr_priv *hsr,
spin_lock_init(&new_node->seq_out_lock);
if (hsr->prot_version == PRP_V1)
- new_node->seq_port_cnt = 1;
+ new_node->seq_port_cnt = hsr->redbox ? 2 : 1;
else
new_node->seq_port_cnt = HSR_PT_PORTS - 1;
@@ -381,6 +381,7 @@ void hsr_handle_sup_frame(struct hsr_frame_info *frame)
struct ethhdr *ethhdr;
unsigned int total_pull_size = 0;
unsigned int pull_size = 0;
+ unsigned int seq_port_cnt;
unsigned long idx;
int i;
@@ -474,6 +475,7 @@ void hsr_handle_sup_frame(struct hsr_frame_info *frame)
}
}
+ seq_port_cnt = min(node_real->seq_port_cnt, node_curr->seq_port_cnt);
xa_for_each(&node_curr->seq_blocks, idx, src_blk) {
if (hsr_seq_block_is_old(src_blk))
continue;
@@ -482,7 +484,7 @@ void hsr_handle_sup_frame(struct hsr_frame_info *frame)
if (!merge_blk)
continue;
merge_blk->time = min(merge_blk->time, src_blk->time);
- for (i = 0; i < node_real->seq_port_cnt; i++) {
+ for (i = 0; i < seq_port_cnt; i++) {
bitmap_or(merge_blk->seq_nrs[i], merge_blk->seq_nrs[i],
src_blk->seq_nrs[i], HSR_SEQ_BLOCK_SIZE);
}
@@ -649,9 +651,13 @@ int prp_register_frame_out(struct hsr_port *port, struct hsr_frame_info *frame)
if (frame->port_rcv->type == HSR_PT_MASTER)
return 0;
- /* for PRP we should only forward frames from the slave ports
- * to the master port
+ /* RedBox: forward LAN frames out the interlink to a SAN, deduping the
+ * two LAN copies on a dedicated slot.
*/
+ if (port->type == HSR_PT_INTERLINK)
+ return hsr_check_duplicate(frame, 1);
+
+ /* For PRP only slave-to-master frames are forwarded. */
if (port->type != HSR_PT_MASTER)
return 1;
diff --git a/net/hsr/hsr_framereg.h b/net/hsr/hsr_framereg.h
index c65ecb925..127a3fb64 100644
--- a/net/hsr/hsr_framereg.h
+++ b/net/hsr/hsr_framereg.h
@@ -27,6 +27,8 @@ struct hsr_frame_info {
bool is_local_dest;
bool is_local_exclusive;
bool is_from_san;
+ bool dst_in_node_db;
+ bool dst_in_proxy_node_db;
};
void hsr_del_self_node(struct hsr_priv *hsr);
--
2.53.0
^ permalink raw reply related
* [PATCH net-next v2 0/4] net: hsr: PRP RedBox (PRP-SAN) support
From: Xin Xie @ 2026-07-06 13:41 UTC (permalink / raw)
To: netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Shuah Khan, Sebastian Andrzej Siewior, Felix Maurer,
Luka Gejak, Fernando Fernandez Mancera, linux-kselftest,
linux-kernel, Xin Xie
In-Reply-To: <20260704234704.4297-1-xiexinet@gmail.com>
This series adds PRP RedBox support to the hsr driver: a PRP node that
proxies one or more SANs sitting behind an interlink port (IEC 62439-3,
PRP-SAN). HSR-SAN has been supported since commit 5055cccfc2d1 ("net: hsr:
Provide RedBox support (HSR-SAN)"); this extends the equivalent capability
to PRP, reusing the existing protocol-neutral proxy machinery
(proxy_node_db, hsr_proxy_announce(), hsr_prune_proxy_nodes()).
A SAN behind the interlink does bidirectional unicast with peers on the PRP
network, its source MAC is preserved on the wire, the PRP RCT is correct,
and the RedBox announces each proxied SAN with the RedBox-MAC TLV (Type 30)
in its supervision frames.
The series is bisect-safe: the datapath, duplicate discard and supervision
support are added first; the rtnetlink rejection of "type hsr ... interlink
<dev> proto 1" is removed only in patch 3, once the feature is complete.
Design notes:
- prp_drop_frame() does not walk the node tables. The destination
classification (PRP-network node vs proxied SAN) is resolved once per
frame in fill_frame_info() and cached in struct hsr_frame_info, so the
per egress-port drop decision is O(1) in the softIRQ path. The
classification is gated on PRP RedBox devices (prot_version == PRP_V1 &&
hsr->redbox), so HSR RedBox traffic is not affected.
- The LAN A/B duplicate test is factored into prp_is_lan_dup() so the new
PRP interlink rules in prp_drop_frame() do not change hsr_drop_frame()
behaviour, including the NETIF_F_HW_HSR_FWD path. This is software PRP
RedBox only; it adds no new hardware-offload contract.
- The supervision emitter uses pre-reserved tailroom (hsr_init_skb() +
skb_put()) on the existing GFP_ATOMIC path; no skb_linearize() or
pskb_expand_head(). The RedBox-MAC TLV is followed by an explicit EOT
(Type 0, Length 0); padding via skb_put_padto(ETH_ZLEN) and the 6-byte
PRP RCT remain at the absolute tail of the egress frame.
- The hsr_get_node() hsr_ethhdr length guard is relaxed only for PRP
supervision frames (prot_version == PRP_V1 && ETH_P_PRP && is_sup), which
are untagged with mac_len == ETH_HLEN. HSR (ETH_P_HSR) supervision is
front-tagged and keeps the original length requirement, so HSR
malformed-frame filtering is unchanged.
Testing (on a net-next v7.2-rc1 kernel built from this base, x86-64):
- checkpatch.pl --strict: patches 1-3 clean; patch 4 reports only the
expected "added file(s), does MAINTAINERS need updating?" note, which is
ignorable here -- MAINTAINERS already lists
tools/testing/selftests/net/hsr/ under HSR NETWORK PROTOCOL.
- git diff --check clean; the series git-am's onto the base commit.
- tools/testing/selftests/net/hsr/hsr_prp_redbox.sh: PASS on the patched
kernel (bidirectional unicast, SAN MAC preservation, RedBox-MAC TLV +
EOT in the proxy-announce).
- HSR regression on the same kernel: hsr_redbox.sh (HSR-SAN/RedBox),
hsr_ping.sh and prp_ping.sh all PASS, confirming the PRP changes do not
regress the existing HSR/PRP paths.
- netns checks: peer<->SAN 0% loss with no duplicates and a valid PRP RCT
on the wire; a silent SAN is pruned from the announce; zero driver
WARN/BUG/Oops/RCU-stall during the run.
Beyond the in-tree selftest, this exact series (applied to this base and
running as the net-next kernel on x86-64 hardware) was also validated with an
out-of-tree IEC 62439-3 conformance harness (supervision TLV chain, duplicate
discard, cross-LAN rejection, seqnr rollover, VLAN/multicast/GOOSE frame types
with the RCT verified at the absolute frame tail), and interoperability-tested
against a commercial PRP RedBox (Siemens SCALANCE X204RNA) over 100 Mbit/s
Fast Ethernet with NIC hardware (PTP) timestamping: a mid-stream single-LAN
outage of ~2 s at 10 kpps was bridged with zero lost and zero duplicate frames
(seamless PRP failover), and the duplicate-discard window held zero lost /
zero duplicates under netem asymmetric delay up to 100 ms (~1000 sequence
numbers in flight), 25% reorder, and 5% single-LAN loss. The failover and
impairment matrix was additionally repeated on a KASAN + lockdep + kmemleak
instrumented build of this kernel, including a 72-carrier-event link
flap-storm with deliberate double-LAN cuts: zero KASAN, lockdep, or kmemleak
findings. This out-of-tree testing is supplementary and not required to
evaluate the series.
v1 -> v2:
- publish the RedBox state before lower RX handlers can learn nodes:
fixes an initialization-ordering race where a node learned during
device setup got a single-port sequence block, breaking interlink
duplicate discard and letting the supervision merge read beyond the
source node's allocated sequence bitmap (reported by the NIPA Sashiko
review)
- harden the supervision sequence-block merge against mismatched
seq_port_cnt
- align macaddress_redbox for ether_addr_copy() on strict-alignment
architectures
- selftest: kill the background ping by exact PID and wrap an overlong
line
Xin Xie (4):
net: hsr: add PRP interlink (RedBox) datapath and duplicate discard
net: hsr: emit RedBox-MAC TLV in PRP RedBox supervision frames
net: hsr: allow PRP RedBox (interlink) creation
selftests: net: hsr: add PRP RedBox test
net/hsr/hsr_device.c | 44 ++++++++-
net/hsr/hsr_forward.c | 49 +++++++--
net/hsr/hsr_framereg.c | 27 +++--
net/hsr/hsr_framereg.h | 2 +
net/hsr/hsr_main.h | 2 +-
net/hsr/hsr_netlink.c | 8 +-
tools/testing/selftests/net/hsr/Makefile | 1 +
.../selftests/net/hsr/hsr_prp_redbox.sh | 99 +++++++++++++++++++
8 files changed, 207 insertions(+), 25 deletions(-)
create mode 100755 tools/testing/selftests/net/hsr/hsr_prp_redbox.sh
base-commit: b73bc9ca3686b78b642fb35dcc1fdf874ecb74a1
--
2.53.0
^ permalink raw reply
* Re: [PATCH net-next 1/2] net: phy: ax88796b: Use vertical import style
From: Gary Guo @ 2026-07-06 13:40 UTC (permalink / raw)
To: Andrew Lunn, Guru Das Srinagesh
Cc: FUJITA Tomonori, Trevor Gross, Heiner Kallweit, Russell King,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
netdev, rust-for-linux, linux-kernel
In-Reply-To: <8376fc86-be9d-4e3a-a51e-4d9ecda1b648@lunn.ch>
On Mon Jul 6, 2026 at 2:05 PM BST, Andrew Lunn wrote:
> On Sun, Jul 05, 2026 at 10:38:40PM -0700, Guru Das Srinagesh wrote:
>> Convert `use` imports to vertical layout for better readability and
>> maintainability.
>>
>> Signed-off-by: Guru Das Srinagesh <linux@gurudas.dev>
>> ---
>> drivers/net/phy/ax88796b_rust.rs | 7 ++++++-
>> 1 file changed, 6 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/net/phy/ax88796b_rust.rs b/drivers/net/phy/ax88796b_rust.rs
>> index 2d24628a4e58..5a21fe09bd62 100644
>> --- a/drivers/net/phy/ax88796b_rust.rs
>> +++ b/drivers/net/phy/ax88796b_rust.rs
>> @@ -5,7 +5,12 @@
>> //!
>> //! C version of this driver: [`drivers/net/phy/ax88796b.c`](./ax88796b.c)
>> use kernel::{
>> - net::phy::{self, reg::C22, DeviceId, Driver},
>> + net::phy::{
>> + self,
>> + reg::C22,
>> + DeviceId,
>> + Driver, //
>> + },
>
> A question from somebody who does not know rust. Does the order of the
> elements in the list matter?
>
> Linux has a pattern of sorting multi line lists, because it reduces
> merge conflicts. Can this list be sorted?
>
> Andrew
This is sorted list, albeit in ASCIIbetical order instead of alphabetical. The
order is enforced by rustfmt. This is not optimal so in Rust style edition 2024
it is actually recommended to use alphabetical instead, however we haven't opted
into that style edition yet.
Best,
Gary
^ permalink raw reply
* [PATCH net-next v2 5/5] net: usb: r8152: Move long delayed work on system_dfl_long_wq
From: Marco Crivellari @ 2026-07-06 13:40 UTC (permalink / raw)
To: linux-kernel, netdev
Cc: Tejun Heo, Lai Jiangshan, Frederic Weisbecker,
Sebastian Andrzej Siewior, Marco Crivellari, Michal Hocko,
Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Ethan Nelson-Moore, linux-usb
In-Reply-To: <20260706134033.244295-1-marco.crivellari@suse.com>
Currently the code enqueue work items using {queue|mod}_delayed_work(),
using system_long_wq. This workqueue should be used when long works are
expected and it is a per-cpu workqueue.
The function(s) end up calling __queue_delayed_work(), which set a global
timer that could fire anywhere, enqueuing the work where the timer fired.
Unbound works could benefit from scheduler task placement, to optimize
performance and power consumption. Long work shouldn't stick to a single
CPU.
Recently, a new unbound workqueue specific for long running work has
been added:
c116737e972e ("workqueue: Add system_dfl_long_wq for long unbound works")
Since the workqueue work doesn't rely on per-cpu variables, there is no
obvious reason that justify the use of a per-cpu workqueue. So change
system_long_wq with system_dfl_long_wq so that the work may benefit from
scheduler task placement.
Cc: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Cc: linux-usb@vger.kernel.org
Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
---
drivers/net/usb/r8152.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index f61686433031..f6af66f294db 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -7072,7 +7072,8 @@ static void rtl_hw_phy_work_func_t(struct work_struct *work)
/* Delay execution in case request_firmware() is not ready yet.
*/
- queue_delayed_work(system_long_wq, &tp->hw_phy_work, HZ * 10);
+ queue_delayed_work(system_dfl_long_wq, &tp->hw_phy_work,
+ HZ * 10);
goto ignore_once;
}
@@ -8840,7 +8841,7 @@ static int rtl8152_reset_resume(struct usb_interface *intf)
clear_bit(SELECTIVE_SUSPEND, &tp->flags);
rtl_reset_ocp_base(tp);
tp->rtl_ops.init(tp);
- queue_delayed_work(system_long_wq, &tp->hw_phy_work, 0);
+ queue_delayed_work(system_dfl_long_wq, &tp->hw_phy_work, 0);
set_ethernet_addr(tp, true);
return rtl8152_resume(intf);
}
@@ -10295,7 +10296,7 @@ static int rtl8152_probe_once(struct usb_interface *intf,
/* Retry in case request_firmware() is not ready yet. */
tp->rtl_fw.retry = true;
#endif
- queue_delayed_work(system_long_wq, &tp->hw_phy_work, 0);
+ queue_delayed_work(system_dfl_long_wq, &tp->hw_phy_work, 0);
set_ethernet_addr(tp, false);
usb_set_intfdata(intf, tp);
--
2.54.0
^ permalink raw reply related
* [PATCH net-next v2 4/5] net: usb: pegasus: Move long delayed work on system_dfl_long_wq
From: Marco Crivellari @ 2026-07-06 13:40 UTC (permalink / raw)
To: linux-kernel, netdev
Cc: Tejun Heo, Lai Jiangshan, Frederic Weisbecker,
Sebastian Andrzej Siewior, Marco Crivellari, Michal Hocko,
Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Petko Manolov, linux-usb
In-Reply-To: <20260706134033.244295-1-marco.crivellari@suse.com>
Currently the code enqueue work items using {queue|mod}_delayed_work(),
using system_long_wq. This workqueue should be used when long works are
expected and it is a per-cpu workqueue.
The function(s) end up calling __queue_delayed_work(), which set a global
timer that could fire anywhere, enqueuing the work where the timer fired.
Unbound works could benefit from scheduler task placement, to optimize
performance and power consumption. Long work shouldn't stick to a single
CPU.
Recently, a new unbound workqueue specific for long running work has
been added:
c116737e972e ("workqueue: Add system_dfl_long_wq for long unbound works")
Since the workqueue work doesn't rely on per-cpu variables, there is no
obvious reason that justify the use of a per-cpu workqueue. So change
system_long_wq with system_dfl_long_wq so that the work may benefit from
scheduler task placement.
Cc: Petko Manolov <petkan@nucleusys.com>
Cc: linux-usb@vger.kernel.org
Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
---
drivers/net/usb/pegasus.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
index 8700eeb8e22d..c1798e14b224 100644
--- a/drivers/net/usb/pegasus.c
+++ b/drivers/net/usb/pegasus.c
@@ -1126,8 +1126,9 @@ static void check_carrier(struct work_struct *work)
pegasus_t *pegasus = container_of(work, pegasus_t, carrier_check.work);
set_carrier(pegasus->net);
if (!(pegasus->flags & PEGASUS_UNPLUG)) {
- queue_delayed_work(system_long_wq, &pegasus->carrier_check,
- CARRIER_CHECK_DELAY);
+ queue_delayed_work(system_dfl_long_wq,
+ &pegasus->carrier_check,
+ CARRIER_CHECK_DELAY);
}
}
@@ -1232,7 +1233,7 @@ static int pegasus_probe(struct usb_interface *intf,
res = register_netdev(net);
if (res)
goto out3;
- queue_delayed_work(system_long_wq, &pegasus->carrier_check,
+ queue_delayed_work(system_dfl_long_wq, &pegasus->carrier_check,
CARRIER_CHECK_DELAY);
dev_info(&intf->dev, "%s, %s, %pM\n", net->name,
usb_dev_id[dev_index].name, net->dev_addr);
@@ -1297,7 +1298,7 @@ static int pegasus_resume(struct usb_interface *intf)
pegasus->intr_urb->actual_length = 0;
intr_callback(pegasus->intr_urb);
}
- queue_delayed_work(system_long_wq, &pegasus->carrier_check,
+ queue_delayed_work(system_dfl_long_wq, &pegasus->carrier_check,
CARRIER_CHECK_DELAY);
return 0;
}
--
2.54.0
^ permalink raw reply related
* [PATCH net-next v2 3/5] net: thunderbolt: Move long delayed work on system_dfl_long_wq
From: Marco Crivellari @ 2026-07-06 13:40 UTC (permalink / raw)
To: linux-kernel, netdev
Cc: Tejun Heo, Lai Jiangshan, Frederic Weisbecker,
Sebastian Andrzej Siewior, Marco Crivellari, Michal Hocko,
Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Mika Westerberg, Yehezkel Bernat
In-Reply-To: <20260706134033.244295-1-marco.crivellari@suse.com>
Currently the code enqueue work items using {queue|mod}_delayed_work(),
using system_long_wq. This workqueue should be used when long works are
expected and it is a per-cpu workqueue.
The function(s) end up calling __queue_delayed_work(), which set a global
timer that could fire anywhere, enqueuing the work where the timer fired.
Unbound works could benefit from scheduler task placement, to optimize
performance and power consumption. Long work shouldn't stick to a single
CPU.
Recently, a new unbound workqueue specific for long running work has
been added:
c116737e972e ("workqueue: Add system_dfl_long_wq for long unbound works")
Since the workqueue work doesn't rely on per-cpu variables, there is no
obvious reason that justify the use of a per-cpu workqueue. So change
system_long_wq with system_dfl_long_wq so that the work may benefit from
scheduler task placement.
Cc: Mika Westerberg <westeri@kernel.org>
Cc: Yehezkel Bernat <YehezkelShB@gmail.com>
Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
Acked-by: Mika Westerberg <westeri@kernel.org>
---
drivers/net/thunderbolt/main.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/net/thunderbolt/main.c b/drivers/net/thunderbolt/main.c
index 02a91650561a..be27972bed18 100644
--- a/drivers/net/thunderbolt/main.c
+++ b/drivers/net/thunderbolt/main.c
@@ -316,7 +316,7 @@ static void start_login(struct tbnet *net)
net->login_received = false;
mutex_unlock(&net->connection_lock);
- queue_delayed_work(system_long_wq, &net->login_work,
+ queue_delayed_work(system_dfl_long_wq, &net->login_work,
msecs_to_jiffies(1000));
}
@@ -460,7 +460,7 @@ static int tbnet_handle_packet(const void *buf, size_t size, void *data)
if (net->login_retries >= TBNET_LOGIN_RETRIES ||
!net->login_sent) {
net->login_retries = 0;
- queue_delayed_work(system_long_wq,
+ queue_delayed_work(system_dfl_long_wq,
&net->login_work, 0);
}
mutex_unlock(&net->connection_lock);
@@ -700,7 +700,8 @@ static void tbnet_login_work(struct work_struct *work)
netdev_dbg(net->dev, "sending login request failed, ret=%d\n",
ret);
if (net->login_retries++ < TBNET_LOGIN_RETRIES) {
- queue_delayed_work(system_long_wq, &net->login_work,
+ queue_delayed_work(system_dfl_long_wq,
+ &net->login_work,
delay);
} else {
netdev_info(net->dev, "ThunderboltIP login timed out\n");
--
2.54.0
^ permalink raw reply related
* [PATCH net-next v2 2/5] net: ti: icssg-stats: Move long delayed work on system_dfl_long_wq
From: Marco Crivellari @ 2026-07-06 13:40 UTC (permalink / raw)
To: linux-kernel, netdev
Cc: Tejun Heo, Lai Jiangshan, Frederic Weisbecker,
Sebastian Andrzej Siewior, Marco Crivellari, Michal Hocko,
Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, MD Danish Anwar, Roger Quadros, linux-arm-kernel,
Richard Cheng
In-Reply-To: <20260706134033.244295-1-marco.crivellari@suse.com>
Currently the code enqueue work items using {queue|mod}_delayed_work(),
using system_long_wq. This workqueue should be used when long works are
expected and it is a per-cpu workqueue.
The function(s) end up calling __queue_delayed_work(), which set a global
timer that could fire anywhere, enqueuing the work where the timer fired.
Unbound works could benefit from scheduler task placement, to optimize
performance and power consumption. Long work shouldn't stick to a single
CPU.
Recently, a new unbound workqueue specific for long running work has
been added:
c116737e972e ("workqueue: Add system_dfl_long_wq for long unbound works")
Since the workqueue work doesn't rely on per-cpu variables, there is no
obvious reason that justify the use of a per-cpu workqueue. So change
system_long_wq with system_dfl_long_wq so that the work may benefit from
scheduler task placement.
Cc: MD Danish Anwar <danishanwar@ti.com>
Cc: Roger Quadros <rogerq@kernel.org>
Cc: linux-arm-kernel@lists.infradead.org
Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
Reviewed-by: Richard Cheng <icheng@nvidia.com>
---
drivers/net/ethernet/ti/icssg/icssg_stats.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/ti/icssg/icssg_stats.c b/drivers/net/ethernet/ti/icssg/icssg_stats.c
index 7159baa0155c..7d6d6692d819 100644
--- a/drivers/net/ethernet/ti/icssg/icssg_stats.c
+++ b/drivers/net/ethernet/ti/icssg/icssg_stats.c
@@ -69,7 +69,7 @@ void icssg_stats_work_handler(struct work_struct *work)
stats_work.work);
emac_update_hardware_stats(emac);
- queue_delayed_work(system_long_wq, &emac->stats_work,
+ queue_delayed_work(system_dfl_long_wq, &emac->stats_work,
msecs_to_jiffies((STATS_TIME_LIMIT_1G_MS * 1000) / emac->speed));
}
EXPORT_SYMBOL_GPL(icssg_stats_work_handler);
--
2.54.0
^ permalink raw reply related
* [PATCH v2 1/5] ibmvnic: Move long delayed work on system_dfl_long_wq
From: Marco Crivellari @ 2026-07-06 13:40 UTC (permalink / raw)
To: linux-kernel, netdev
Cc: Tejun Heo, Lai Jiangshan, Frederic Weisbecker,
Sebastian Andrzej Siewior, Marco Crivellari, Michal Hocko,
Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Haren Myneni, Rick Lindsley, Nick Child,
Madhavan Srinivasan, Michael Ellerman, Nicholas Piggin,
Christophe Leroy (CS GROUP), linuxppc-dev
In-Reply-To: <20260706134033.244295-1-marco.crivellari@suse.com>
Currently the code enqueue work items using {queue|mod}_delayed_work(),
using system_long_wq. This workqueue should be used when long works are
expected and it is a per-cpu workqueue.
The function(s) end up calling __queue_delayed_work(), which set a global
timer that could fire anywhere, enqueuing the work where the timer fired.
Unbound works could benefit from scheduler task placement, to optimize
performance and power consumption. Long work shouldn't stick to a single
CPU.
Recently, a new unbound workqueue specific for long running work has
been added:
c116737e972e ("workqueue: Add system_dfl_long_wq for long unbound works")
Since the workqueue work doesn't rely on per-cpu variables, there is no
obvious reason that justify the use of a per-cpu workqueue. So change
system_long_wq with system_dfl_long_wq so that the work may benefit from
scheduler task placement.
Cc: Haren Myneni <haren@linux.ibm.com>
Cc: Rick Lindsley <ricklind@linux.ibm.com>
Cc: Nick Child <nnac123@linux.ibm.com>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
---
drivers/net/ethernet/ibm/ibmvnic.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 5a510eed335e..a1c01c9820d2 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -3229,7 +3229,7 @@ static void __ibmvnic_reset(struct work_struct *work)
if (adapter->state == VNIC_PROBING &&
!wait_for_completion_timeout(&adapter->probe_done, timeout)) {
dev_err(dev, "Reset thread timed out on probe");
- queue_delayed_work(system_long_wq,
+ queue_delayed_work(system_dfl_long_wq,
&adapter->ibmvnic_delayed_reset,
IBMVNIC_RESET_DELAY);
return;
@@ -3267,7 +3267,7 @@ static void __ibmvnic_reset(struct work_struct *work)
spin_lock(&adapter->rwi_lock);
if (!list_empty(&adapter->rwi_list)) {
if (test_and_set_bit_lock(0, &adapter->resetting)) {
- queue_delayed_work(system_long_wq,
+ queue_delayed_work(system_dfl_long_wq,
&adapter->ibmvnic_delayed_reset,
IBMVNIC_RESET_DELAY);
} else {
--
2.54.0
^ permalink raw reply related
* [PATCH net-next v2 0/5] net: Move system_long_wq to system_dfl_long_wq
From: Marco Crivellari @ 2026-07-06 13:40 UTC (permalink / raw)
To: linux-kernel, netdev
Cc: Tejun Heo, Lai Jiangshan, Frederic Weisbecker,
Sebastian Andrzej Siewior, Marco Crivellari, Michal Hocko,
Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Christophe Leroy (CS GROUP), Ethan Nelson-Moore,
Haren Myneni, Madhavan Srinivasan, MD Danish Anwar,
Michael Ellerman, Mika Westerberg, Nicholas Piggin, Nick Child,
Petko Manolov, Richard Cheng, Rick Lindsley, Roger Quadros,
Yehezkel Bernat
Hello,
Currently the code uses the per-cpu workqueue system_long_wq to schedule
long running works.
Unbound works could benefit from scheduler task placement, to optimize
performance and power consumption. Another good reason to have this unbound,
is the "queue_delayed_work()" function, used to enqueue the work item.
More details on this will follow in the next section.
Recently, a new unbound workqueue specific for long running work has been
added:
c116737e972e ("workqueue: Add system_dfl_long_wq for long unbound works")
~~~ Details about queue_delayed_work ~~~
system_long_wq is a per-cpu workqueue and it is used as a parameter of
queue_delayed_work(). This function schedule an item that it will later
be enqueued (once the timer will fire). __queue_delayed_work() does the job
receiving as "cpu" WORK_CPU_UNBOUND:
if (housekeeping_enabled(HK_TYPE_TIMER)) {
// [....]
} else {
if (likely(cpu == WORK_CPU_UNBOUND))
add_timer_global(timer);
else
add_timer_on(timer, cpu);
}
The timer is global, so can fire everywhere, and the work item will be
enqueued where the timer fired.
Since the workqueue work doesn't rely on per-cpu variables, there is no
obvious reason that justify the use of a per-cpu workqueue. So change the
workqueue with the new system_dfl_long_wq, so that the used workqueue is
now unbound and can benefit from scheduler task placement.
Thanks!
---
Changes in v2:
- rebased on v7.2-rc2
- dropped the RFC prefix, kept Ack and review tags
Link to v1: https://lore.kernel.org/all/20260511092846.120141-1-marco.crivellari@suse.com/
Marco Crivellari (5):
ibmvnic: Move long delayed work on system_dfl_long_wq
net: ti: icssg-stats: Move long delayed work on system_dfl_long_wq
net: thunderbolt: Move long delayed work on system_dfl_long_wq
net: usb: pegasus: Move long delayed work on system_dfl_long_wq
net: usb: r8152: Move long delayed work on system_dfl_long_wq
drivers/net/ethernet/ibm/ibmvnic.c | 4 ++--
drivers/net/ethernet/ti/icssg/icssg_stats.c | 2 +-
drivers/net/thunderbolt/main.c | 7 ++++---
drivers/net/usb/pegasus.c | 9 +++++----
drivers/net/usb/r8152.c | 7 ++++---
5 files changed, 16 insertions(+), 13 deletions(-)
--
2.54.0
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox