* [PATCH v5 2/4] dmaengine: xilinx_dma: Move descriptors to done list based on completion bit
From: Srinivas Neeli @ 2026-07-17 9:08 UTC (permalink / raw)
To: Vinod Koul, Radhey Shyam Pandey
Cc: Frank Li, Michal Simek, Andrew Lunn, David S . Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Suraj Gupta,
Marek Vasut, Tomi Valkeinen, Alex Bereza, Folker Schwesinger,
dmaengine, netdev, linux-arm-kernel, linux-kernel, git
In-Reply-To: <20260717090824.2364230-1-srinivas.neeli@amd.com>
In AXI MCDMA, xilinx_dma_complete_descriptor() walks the channel's
active_list and unconditionally moves every entry to the done_list. The
MCDMA IOC interrupt handler invokes this function on every
interrupt-on-completion, but with interrupt coalescing (IRQThreshold > 1)
an IOC interrupt may fire after only a subset of the queued descriptors
have actually been processed by the hardware. As a result, descriptors
whose completion bit is not yet set in the BD status were being reported
as completed to client drivers.
Add a check for the descriptor completion bit before moving entries from
the active list to the done list, using the appropriate direction-
specific status field (s2mm_status for DMA_DEV_TO_MEM, mm2s_status for
DMA_MEM_TO_DEV).
This mirrors the AXIDMA fix in commit 7bcdaa658102 ("dmaengine:
xilinx_dma: Freeup active list based on descriptor completion bit").
Fixes: 6ccd692bfb7f ("dmaengine: xilinx_dma: Add Xilinx AXI MCDMA Engine driver support")
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Signed-off-by: Srinivas Neeli <srinivas.neeli@amd.com>
---
Changes in V5:
- No change.
Changes in V4:
- Reworded commit message to reference the AXIDMA fix it mirrors
(commit 7bcdaa658102).
- Added Reviewed-by: Radhey Shyam Pandey.
Changes in V3:
- Added Fixes tag.
- Expanded commit message to explain the interrupt coalescing scenario
and why the has_sg guard is omitted for MCDMA.
- Changed local variable from 'bool completed' to 'u32 status' for
cleaner status field access.
- Simplified completion check logic.
Changes in V2:
- No change.
---
drivers/dma/xilinx/xilinx_dma.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
index ff5b29a808e9..1b5b00f08c5f 100644
--- a/drivers/dma/xilinx/xilinx_dma.c
+++ b/drivers/dma/xilinx/xilinx_dma.c
@@ -1784,6 +1784,17 @@ static void xilinx_dma_complete_descriptor(struct xilinx_dma_chan *chan)
struct xilinx_axidma_tx_segment, node);
if (!(seg->hw.status & XILINX_DMA_BD_COMP_MASK) && chan->has_sg)
break;
+ } else if (chan->xdev->dma_config->dmatype == XDMA_TYPE_AXIMCDMA) {
+ struct xilinx_aximcdma_tx_segment *seg;
+ u32 status;
+
+ seg = list_last_entry(&desc->segments,
+ struct xilinx_aximcdma_tx_segment,
+ node);
+ status = (chan->direction == DMA_DEV_TO_MEM) ?
+ seg->hw.s2mm_status : seg->hw.mm2s_status;
+ if (!(status & XILINX_DMA_BD_COMP_MASK))
+ break;
}
if (chan->has_sg && chan->xdev->dma_config->dmatype !=
XDMA_TYPE_VDMA)
--
2.43.0
^ permalink raw reply related
* [PATCH v5 3/4] net: xilinx: axienet: Derive RX frame length from residue in dmaengine path
From: Srinivas Neeli @ 2026-07-17 9:08 UTC (permalink / raw)
To: Vinod Koul, Radhey Shyam Pandey
Cc: Frank Li, Michal Simek, Andrew Lunn, David S . Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Suraj Gupta,
Marek Vasut, Tomi Valkeinen, Alex Bereza, Folker Schwesinger,
dmaengine, netdev, linux-arm-kernel, linux-kernel, git
In-Reply-To: <20260717090824.2364230-1-srinivas.neeli@amd.com>
The dmaengine RX path derived the received frame length from the descriptor
APP metadata. That only works when the optional AXI4-Stream status/control
interface is present, because the hardware populates the APP fields solely
when that interface is enabled. On designs without it the length read back
is invalid.
The AXI DMA engine already reports how many bytes it wrote into the buffer
through the standard dmaengine residue mechanism. Compute the RX frame
length as the posted buffer length minus result->residue, which is
independent of the status/control interface and correct across all designs,
including multi-descriptor frames where the residue is summed over the
chain.
Drop the descriptor metadata lookup, which was only used for this purpose.
Detect a failed transfer from dmaengine_result.result instead of the
metadata pointer return value, and remove the now unused LEN_APP macro.
The transmit path is unaffected. It still passes APP metadata for checksum
offload and derives its length from the skb.
Signed-off-by: Srinivas Neeli <srinivas.neeli@amd.com>
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
---
Changes in V5:
- No change.
Changes in V4:
- Renamed subject to "Derive RX frame length from residue in dmaengine
path".
- Condensed the commit message.
- Dropped the Fixes tag.
Changes in V3:
- New patch in this series.
- This patch enables axienet to work on designs where the AXI4-Stream
status/control interface is not present. By using the standard
dmaengine residue mechanism, the driver no longer depends on APP
fields being populated by hardware.
- This approach replaces the V2 xferred_bytes mechanism (V2 patch 5/5),
making the dt-bindings patch (V2 patch 4/5) for xlnx,include-stscntrl-strm
also unnecessary. Both V2 patches are dropped in this series.
---
drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 14 +++++---------
1 file changed, 5 insertions(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index fcf517069d16..67d1b8e91d68 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -53,7 +53,6 @@
#define TX_BD_NUM_MAX 4096
#define RX_BD_NUM_MAX 4096
#define DMA_NUM_APP_WORDS 5
-#define LEN_APP 4
#define RX_BUF_NUM_DEFAULT 128
/* Must be shorter than length of ethtool_drvinfo.driver field to fit */
@@ -1159,29 +1158,26 @@ axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
static void axienet_dma_rx_cb(void *data, const struct dmaengine_result *result)
{
struct skbuf_dma_descriptor *skbuf_dma;
- size_t meta_len, meta_max_len, rx_len;
struct axienet_local *lp = data;
struct sk_buff *skb;
- u32 *app_metadata;
+ size_t rx_len;
int i;
skbuf_dma = axienet_get_rx_desc(lp, lp->rx_ring_tail++);
skb = skbuf_dma->skb;
- app_metadata = dmaengine_desc_get_metadata_ptr(skbuf_dma->desc, &meta_len,
- &meta_max_len);
dma_unmap_single(lp->dev, skbuf_dma->dma_address, lp->max_frm_size,
DMA_FROM_DEVICE);
- if (IS_ERR(app_metadata)) {
+ if (result->result != DMA_TRANS_NOERROR) {
if (net_ratelimit())
- netdev_err(lp->ndev, "Failed to get RX metadata pointer\n");
+ netdev_err(lp->ndev, "RX DMA transfer failed\n");
dev_kfree_skb_any(skb);
lp->ndev->stats.rx_dropped++;
goto rx_submit;
}
- /* TODO: Derive app word index programmatically */
- rx_len = (app_metadata[LEN_APP] & 0xFFFF);
+ /* Actual length = posted buffer length - residue. */
+ rx_len = lp->max_frm_size - result->residue;
skb_put(skb, rx_len);
skb->protocol = eth_type_trans(skb, lp->ndev);
skb->ip_summed = CHECKSUM_NONE;
--
2.43.0
^ permalink raw reply related
* [PATCH v5 4/4] dmaengine: xilinx_dma: Extend metadata handling for AXI DMA and MCDMA
From: Srinivas Neeli @ 2026-07-17 9:08 UTC (permalink / raw)
To: Vinod Koul, Radhey Shyam Pandey
Cc: Frank Li, Michal Simek, Andrew Lunn, David S . Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Suraj Gupta,
Marek Vasut, Tomi Valkeinen, Alex Bereza, Folker Schwesinger,
dmaengine, netdev, linux-arm-kernel, linux-kernel, git
In-Reply-To: <20260717090824.2364230-1-srinivas.neeli@amd.com>
From: Suraj Gupta <suraj.gupta2@amd.com>
xilinx_dma_get_metadata_ptr() returns the AXI DMA APP words from the SOP
descriptor in both directions. This is wrong for RX, where the hardware
writes the APP words into the EOF descriptor. It also leaves AXI MCDMA
without metadata support.
Return the metadata from the SOP descriptor for TX and from the EOF
descriptor for RX, matching where the hardware reads and writes the
fields. For AXI DMA, expose the APP words (20 bytes). For AXI MCDMA,
expose the control sideband, status, and APP fields (28 bytes). On TX
the control sideband holds TID and TUSER configuration for the outgoing
stream. On RX the sideband status holds the received TID, TDEST and TUSER
from the incoming stream. The field layout differs between MM2S and S2MM,
and the wider payload lets a consumer distinguish the two controllers.
No in-tree consumer is affected.
Read xlnx,axistream-connected for AXI MCDMA. Attach metadata_ops in
xilinx_mcdma_prep_slave_sg() when an AXI4-Stream interface is present,
so MCDMA clients use the metadata API the same way as AXI DMA clients.
Signed-off-by: Suraj Gupta <suraj.gupta2@amd.com>
Co-developed-by: Srinivas Neeli <srinivas.neeli@amd.com>
Signed-off-by: Srinivas Neeli <srinivas.neeli@amd.com>
---
Changes in V5:
- Take the metadata pointer from the SOP descriptor for TX and the EOF
descriptor for RX, matching where the hardware reads and writes the
fields (TX previously used the EOF descriptor).
- AXI DMA now exposes only the APP words (20 bytes) in both directions,
instead of the status word followed by APP (24 bytes).
- AXI MCDMA exposes the control sideband, status and APP fields
(28 bytes), with the sideband position differing between MM2S and S2MM.
- Reworked the kernel-doc index table and commit message accordingly.
Changes in V4:
- Restructured xilinx_dma_get_metadata_ptr(): AXIDMA is now the
fall-through path instead of a separate branch guarded by
WARN_ON_ONCE()/ERR_PTR().
- Rewrote the kernel-doc as an index table covering AXI DMA, MCDMA S2MM
and MCDMA MM2S, and documented that the pointer and payload length are
the same for both MCDMA directions.
- Added an inline comment explaining the union aliasing.
- Condensed the commit message.
Changes in V3:
- Renamed subject to include "AXI DMA and MCDMA" (was "AXI MCDMA" only).
- Complete rewrite of commit message and implementation.
- Metadata pointer now returns status field at index 0 instead of APP
fields, exposing status and sideband information to clients.
- Changed from list_first_entry to list_last_entry to return the EOF
descriptor where hardware writes status and APP fields.
- Added explicit handling for both AXIDMA and MCDMA types with proper
payload length calculation.
- Added WARN_ON_ONCE for unsupported DMA types.
- Removed the 'chan' field from struct xilinx_dma_tx_descriptor (was
added in V2) as it's no longer needed; channel is obtained from
tx->chan instead.
- Dropped V2 patches 4/5 (dt-bindings xlnx,include-stscntrl-strm) and
5/5 (xferred_bytes support) as the approach changed to use residue.
Changes in V2:
- Added support for MCDMA metadata handling alongside AXIDMA.
- Added 'chan' field to struct xilinx_dma_tx_descriptor.
---
drivers/dma/xilinx/xilinx_dma.c | 48 +++++++++++++++++++++++++++++----
1 file changed, 43 insertions(+), 5 deletions(-)
diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
index 1b5b00f08c5f..6bf509d33e7c 100644
--- a/drivers/dma/xilinx/xilinx_dma.c
+++ b/drivers/dma/xilinx/xilinx_dma.c
@@ -651,17 +651,51 @@ static inline void xilinx_aximcdma_buf(struct xilinx_dma_chan *chan,
* @tx: async transaction descriptor
* @payload_len: metadata payload length
* @max_len: metadata max length
- * Return: The app field pointer.
+ *
+ * The metadata lives in the SOP descriptor for TX and the EOF descriptor for RX.
+ * Field order depends on dmatype and direction:
+ *
+ * AXI DMA: [0..] app
+ * AXI MCDMA (TX): [0] ctrl_sideband, [1] status, [2..] app
+ * AXI MCDMA (RX): [0] status, [1] sideband, [2..] app
+ *
+ * Return: Pointer to the first metadata word.
*/
static void *xilinx_dma_get_metadata_ptr(struct dma_async_tx_descriptor *tx,
size_t *payload_len, size_t *max_len)
{
struct xilinx_dma_tx_descriptor *desc = to_dma_tx_descriptor(tx);
+ struct xilinx_dma_chan *chan = to_xilinx_chan(tx->chan);
+
+ if (chan->xdev->dma_config->dmatype == XDMA_TYPE_AXIMCDMA) {
+ struct xilinx_aximcdma_tx_segment *seg;
+
+ if (chan->direction == DMA_DEV_TO_MEM) {
+ seg = list_last_entry(&desc->segments,
+ struct xilinx_aximcdma_tx_segment, node);
+ *max_len = *payload_len = sizeof(seg->hw.s2mm_status) +
+ sizeof(seg->hw.s2mm_sideband_status) +
+ sizeof(seg->hw.app);
+ return &seg->hw.s2mm_status;
+ }
+ seg = list_first_entry(&desc->segments,
+ struct xilinx_aximcdma_tx_segment, node);
+ *max_len = *payload_len = sizeof(seg->hw.mm2s_ctrl_sideband) +
+ sizeof(seg->hw.mm2s_status) +
+ sizeof(seg->hw.app);
+ return &seg->hw.mm2s_ctrl_sideband;
+ }
+
struct xilinx_axidma_tx_segment *seg;
- *max_len = *payload_len = sizeof(u32) * XILINX_DMA_NUM_APP_WORDS;
- seg = list_first_entry(&desc->segments,
- struct xilinx_axidma_tx_segment, node);
+ if (chan->direction == DMA_DEV_TO_MEM)
+ seg = list_last_entry(&desc->segments,
+ struct xilinx_axidma_tx_segment, node);
+ else
+ seg = list_first_entry(&desc->segments,
+ struct xilinx_axidma_tx_segment, node);
+
+ *max_len = *payload_len = sizeof(seg->hw.app);
return seg->hw.app;
}
@@ -2639,6 +2673,9 @@ xilinx_mcdma_prep_slave_sg(struct dma_chan *dchan, struct scatterlist *sgl,
segment->hw.control |= XILINX_MCDMA_BD_EOP;
}
+ if (chan->xdev->has_axistream_connected)
+ desc->async_tx.metadata_ops = &xilinx_dma_metadata_ops;
+
return &desc->async_tx;
error:
@@ -3287,7 +3324,8 @@ static int xilinx_dma_probe(struct platform_device *pdev)
dma_set_max_seg_size(xdev->dev, xdev->max_buffer_len);
- if (xdev->dma_config->dmatype == XDMA_TYPE_AXIDMA) {
+ if (xdev->dma_config->dmatype == XDMA_TYPE_AXIDMA ||
+ xdev->dma_config->dmatype == XDMA_TYPE_AXIMCDMA) {
xdev->has_axistream_connected =
of_property_read_bool(node, "xlnx,axistream-connected");
}
--
2.43.0
^ permalink raw reply related
* Re: [PATCH] usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
From: Stanislaw Gruszka @ 2026-07-17 9:10 UTC (permalink / raw)
To: Diego Fernando Mancera Gomez
Cc: Matthieu CASTET, Chas Williams, Greg Kroah-Hartman,
Mauricio Faria de Oliveira, linux-usb, netdev, linux-atm-general,
linux-kernel, syzbot+e62a973f8322b3bbe3ac
In-Reply-To: <20260717080704.1264-1-diegomancera.dev@gmail.com>
On Fri, Jul 17, 2026 at 02:07:04AM -0600, Diego Fernando Mancera Gomez wrote:
> uea_probe() distinguishes a pre-firmware device from a post-firmware one
> using the USB id (UEA_IS_PREFIRM()), and stores a different object as the
> interface data in each case: a 'struct completion' for a pre-firmware
> device (to be waited on in .disconnect()), or a 'struct usbatm_data' for a
> post-firmware one.
>
> uea_disconnect() instead tells the two apart by the number of interfaces
> of the active configuration (a pre-firmware device exposes a single
> interface, ADI930 has 2 and eagle has 3), and casts the interface data
> accordingly.
>
> Because the two handlers use different criteria, a crafted device that
> advertises a pre-firmware id together with a multi-interface descriptor
> (or a post-firmware id with a single interface) makes them disagree: the
> small 'struct completion' stored by uea_probe() is then passed to
> usbatm_usb_disconnect(), which casts it to 'struct usbatm_data' and takes
> instance->serialize, reading past the end of the allocation:
>
> BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80
> Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982
> ...
> __mutex_lock+0x152a/0x1b80
> usbatm_usb_disconnect+0x70/0x820
> uea_disconnect+0x133/0x2c0
> usb_unbind_interface+0x1dd/0x9e0
> ...
> which belongs to the cache kmalloc-96 of size 96
> The buggy address is located 0 bytes to the right of
> allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60)
>
> Reject such inconsistent descriptors in uea_probe() so that both handlers
> always make the same pre/post-firmware decision.
>
> Reported-by: syzbot+e62a973f8322b3bbe3ac@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=e62a973f8322b3bbe3ac
> Fixes: e2674dfbed8a ("usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()")
> Signed-off-by: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
Thanks
Stanislaw
> ---
> drivers/usb/atm/ueagle-atm.c | 17 +++++++++++++++++
> 1 file changed, 17 insertions(+)
>
> diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c
> index 4e71ed679a76..4266a0cb7e3b 100644
> --- a/drivers/usb/atm/ueagle-atm.c
> +++ b/drivers/usb/atm/ueagle-atm.c
> @@ -2549,6 +2549,7 @@ static struct usbatm_driver uea_usbatm_driver = {
> static int uea_probe(struct usb_interface *intf, const struct usb_device_id *id)
> {
> struct usb_device *usb = interface_to_usbdev(intf);
> + bool single_iface = usb->config->desc.bNumInterfaces == 1;
> int ret;
>
> uea_dbg(usb, "ADSL device found with vid (%#X) pid (%#X) Rev (%#X): %s\n",
> @@ -2557,6 +2558,22 @@ static int uea_probe(struct usb_interface *intf, const struct usb_device_id *id)
> le16_to_cpu(usb->descriptor.bcdDevice),
> chip_name[UEA_CHIP_VERSION(id)]);
>
> + /*
> + * uea_probe() decides between the pre-firmware and post-firmware case
> + * from the USB id and stores a different object as interface data in
> + * each case: a struct completion for a pre-firmware device, a struct
> + * usbatm_data for a post-firmware one. uea_disconnect() instead tells
> + * the two apart by the number of interfaces (a pre-firmware device
> + * exposes a single interface, ADI930 has 2 and eagle has 3). A crafted
> + * device advertising a pre-firmware id together with a multi-interface
> + * descriptor (or the other way around) makes the two disagree, so that
> + * usbatm_usb_disconnect() treats the small completion object as a
> + * struct usbatm_data and reads out of bounds. Reject such inconsistent
> + * descriptors so both paths make the same decision.
> + */
> + if (UEA_IS_PREFIRM(id) != single_iface)
> + return -ENODEV;
> +
> usb_reset_device(usb);
>
> if (UEA_IS_PREFIRM(id)) {
> --
> 2.43.0
>
^ permalink raw reply
* RE: [PATCH net v6] tipc: serialize udp bearer replicast list updates
From: Tung Quang Nguyen @ 2026-07-17 9:13 UTC (permalink / raw)
To: Weiming Shi
Cc: netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org, xmei5@asu.edu, Jon Maloy,
David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman
In-Reply-To: <20260716025203.9332-2-bestswngs@gmail.com>
>Subject: [PATCH net v6] tipc: serialize udp bearer replicast list updates
>
>tipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with
>list_add_rcu() / list_del_rcu(), but nothing serializes them. The add runs from
>the encap receive softirq (via tipc_udp_rcast_disc()) without rtnl_lock(), so it
>can race the cleanup delete and corrupt the list:
>
> list_del corruption. prev->next should be ffff8880298d7ab8,
> but was ffff88802449ad38. (prev=ffff888027e3ec98)
> kernel BUG at lib/list_debug.c:62!
> RIP: __list_del_entry_valid_or_report+0x17a/0x200
> Workqueue: events cleanup_bearer
> Call Trace:
> cleanup_bearer (net/tipc/udp_media.c:811)
> process_one_work (kernel/workqueue.c:3302)
> worker_thread (kernel/workqueue.c:3466)
>
>The bearer can be enabled from an unprivileged user namespace, as the
>TIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM.
>
>Add a spinlock to struct udp_bearer and take it around the list_add_rcu() in
>tipc_udp_rcast_add() and the list_del_rcu() loop in cleanup_bearer() so the
>two writers can no longer corrupt the list.
>
>Reject a duplicate peer under the same lock before allocating, and remove
>tipc_udp_is_known_peer(). The old lockless pre-check in
>tipc_udp_rcast_disc() was racy: two softirqs discovering the same peer could
>both find it absent and add it twice.
>
>cleanup_bearer() runs from a workqueue after tipc_udp_disable() clears the
>bearer's up bit, so an encap softirq can still reach tipc_udp_rcast_add() and
>add a peer after cleanup_bearer() has already emptied the list, leaking that
>entry when the bearer is freed. Mark the bearer disabled under rcast_lock
>once the list is emptied and refuse further additions.
>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
^ permalink raw reply
* [PATCH net] net: sxgbe: fix null pointer dereference in probe error path
From: Chenguang Zhao @ 2026-07-17 9:14 UTC (permalink / raw)
To: bh74.an, andrew+netdev, davem, edumazet, kuba, pabeni
Cc: netdev, chenguang.zhao, Chenguang Zhao
From: Chenguang Zhao <zhaochenguang@kylinos.cn>
The platform drvdata is not set until all IRQs have been mapped, so the
local net_device pointer is NULL when IRQ mapping fails. Remove the device
allocated by sxgbe_drv_probe() through priv instead.
Fixes: 1edb9ca69e8a ("net: sxgbe: add basic framework for Samsung 10Gb ethernet driver")
Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
---
drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c
index 2eccc7617507..e4701b29e1a0 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c
@@ -82,7 +82,6 @@ static int sxgbe_platform_probe(struct platform_device *pdev)
void __iomem *addr;
struct sxgbe_priv_data *priv = NULL;
struct sxgbe_plat_data *plat_dat = NULL;
- struct net_device *ndev = platform_get_drvdata(pdev);
struct device_node *node = dev->of_node;
/* Get memory resource */
@@ -158,7 +157,7 @@ static int sxgbe_platform_probe(struct platform_device *pdev)
irq_dispose_mapping(priv->txq[i]->irq_no);
irq_dispose_mapping(priv->irq);
err_drv_remove:
- sxgbe_drv_remove(ndev);
+ sxgbe_drv_remove(priv->dev);
err_out:
return -ENODEV;
}
--
2.25.1
^ permalink raw reply related
* [PATCH net V3] net: phy: motorcomm: read EEE abilities in yt8521_get_features()
From: xiaoning.wang @ 2026-07-17 9:16 UTC (permalink / raw)
To: Frank.Sae, andrew, leitao, hkallweit1, linux, davem, edumazet,
kuba, pabeni
Cc: netdev, linux-kernel, imx, Clark Wang
From: Clark Wang <xiaoning.wang@nxp.com>
In phy_probe(), genphy_c45_read_eee_abilities() is only called when a
driver uses phydrv->features. Drivers that implement .get_features are
responsible for reading the EEE abilities themselves.
yt8521_get_features() does not do this, so phydev->supported_eee stays
empty for YT8521/YT8531S and "ethtool --show-eee" reports "EEE status:
not supported", even though the PHY has the standard EEE capability
registers.
Call genphy_c45_read_eee_abilities() at the end of yt8521_get_features()
to populate supported_eee.
Fixes: 70479a40954c ("net: phy: Add driver for Motorcomm yt8521 gigabit ethernet phy")
Reviewed-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
---
V3 changes:
- Replace the uncommon "ret ? : ..." expression with the usual
check, and move the check right after the first yt8521_get_features_paged()
call, which was the only path missing it.
- Collect Reviewed tag from Breno.
V2 changes:
- Return the value from genphy_c45_read_eee_abilities.
---
drivers/net/phy/motorcomm.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/phy/motorcomm.c b/drivers/net/phy/motorcomm.c
index 5071605a1a11..6b710c02264e 100644
--- a/drivers/net/phy/motorcomm.c
+++ b/drivers/net/phy/motorcomm.c
@@ -2481,6 +2481,8 @@ static int yt8521_get_features(struct phy_device *phydev)
if (priv->reg_page != YT8521_RSSR_TO_BE_ARBITRATED) {
ret = yt8521_get_features_paged(phydev, priv->reg_page);
+ if (ret < 0)
+ return ret;
} else {
ret = yt8521_get_features_paged(phydev,
YT8521_RSSR_UTP_SPACE);
@@ -2490,7 +2492,8 @@ static int yt8521_get_features(struct phy_device *phydev)
/* add fiber's features to phydev->supported */
yt8521_prepare_fiber_features(phydev, phydev->supported);
}
- return ret;
+
+ return genphy_c45_read_eee_abilities(phydev);
}
/**
--
2.43.0
^ permalink raw reply related
* Re: [PATCH net 8/9] ipvs: fix more places with wrong ipv6 transport offsets
From: Paolo Abeni @ 2026-07-17 9:17 UTC (permalink / raw)
To: Florian Westphal, netdev
Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, netfilter-devel,
pablo
In-Reply-To: <20260710143733.29741-9-fw@strlen.de>
Hi,
On 7/10/26 4:37 PM, Florian Westphal wrote:
> From: Julian Anastasov <ja@ssi.bg>
>
> Sashiko reports for more incorrect IPv6 transport offsets.
>
> The app code for TCP was assuming IPv4 network header
> even after the ipvsh argument was provided. This can
> cause problems with apps over IPv6. As for the only
> official app in the kernel tree (FTP) this problem is
> harmless because we use Netfilter to mangle the FTP
> ports and we do not adjust the TCP seq numbers.
>
> Also, provide correct offset of the ICMPV6 header in
> ip_vs_out_icmp_v6() for correct checksum checks when
> the IPv6 packet has extension headers.
>
> Fixes: d12e12299a69 ("ipvs: add ipv6 support to ftp")
> Fixes: 2a3b791e6e11 ("IPVS: Add/adjust Netfilter hook functions and helpers for v6")
> Cc: stable@vger.kernel.org
> Link: https://sashiko.dev/#/patchset/20260706101624.69471-1-zhaoyz24%40mails.tsinghua.edu.cn
> Signed-off-by: Julian Anastasov <ja@ssi.bg>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
> net/netfilter/ipvs/ip_vs_app.c | 10 ++++------
> net/netfilter/ipvs/ip_vs_core.c | 3 +--
> 2 files changed, 5 insertions(+), 8 deletions(-)
>
> diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
> index d54d7da58334..b0e00be85cb1 100644
> --- a/net/netfilter/ipvs/ip_vs_app.c
> +++ b/net/netfilter/ipvs/ip_vs_app.c
> @@ -361,14 +361,13 @@ static inline int app_tcp_pkt_out(struct ip_vs_conn *cp, struct sk_buff *skb,
> struct ip_vs_iphdr *ipvsh)
> {
> int diff;
> - const unsigned int tcp_offset = ip_hdrlen(skb);
> struct tcphdr *th;
> __u32 seq;
>
> - if (skb_ensure_writable(skb, tcp_offset + sizeof(*th)))
> + if (skb_ensure_writable(skb, ipvsh->len + sizeof(*th)))
> return 0;
>
> - th = (struct tcphdr *)(skb_network_header(skb) + tcp_offset);
> + th = (struct tcphdr *)(skb_network_header(skb) + ipvsh->len);
Beyond the usual set of pre-existing issues, sashiko-gemini noted this
patch may need a follow-up:
https://sashiko.dev/#/patchset/20260710143733.29741-2-fw%40strlen.de
/P
^ permalink raw reply
* Re: [PATCH net-next v2 1/2] dt-bindings: net: Add Maxio MAE0621A PHY
From: Liu Changjie @ 2026-07-17 9:26 UTC (permalink / raw)
To: Krzysztof Kozlowski
Cc: Andrew Lunn, Heiner Kallweit, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, netdev, Russell King, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Luo Jie, Wolfram Sang,
devicetree, linux-kernel
In-Reply-To: <20260717-immortal-moth-of-will-6ab571@quoll>
Hi Krzysztof,
> How did you address previous feedback?
>
> If you ignore feedback, shall we ignore the patch?
You are right. I should have documented the disposition of Andrew's
comment in this patch's changelog below the --- separator, rather than
only in the cover letter. Sorry about that.
Andrew suggested allowing a value of 0 to disable CLKOUT and noted that
this could also be added later. I intentionally did not add 0 in v2. The
only setting I have tested on this PHY is 125 MHz, and public documentation
for page 0xa43, register 0x19 is not available, so I cannot yet verify the
register programming and reset requirements for disabling CLKOUT.
Andrew's comment:
https://lore.kernel.org/r/1a02ef89-2608-44c4-847f-239d9b86c7ab@lunn.ch
The deferral is recorded in the cover letter's Changes in v2 section:
https://lore.kernel.org/r/MN0PR19MB609154F210DF84DCB29D3696ACC62@MN0PR19MB6091.namprd19.prod.outlook.com
I did not intend to ignore the feedback; I deferred that optional extension
until it can be documented and tested properly. I will state this explicitly
in the per-patch changelog in any future revision.
Best regards,
Liu Changjie
^ permalink raw reply
* Re: [PATCH net 1/9] netfilter: xt_nat: reject unsupported target families
From: patchwork-bot+netdevbpf @ 2026-07-17 9:30 UTC (permalink / raw)
To: Florian Westphal
Cc: netdev, pabeni, davem, edumazet, kuba, netfilter-devel, pablo
In-Reply-To: <20260710143733.29741-2-fw@strlen.de>
Hello:
This series was applied to netdev/net.git (main)
by Florian Westphal <fw@strlen.de>:
On Fri, 10 Jul 2026 16:37:25 +0200 you wrote:
> From: Wyatt Feng <bronzed_45_vested@icloud.com>
>
> xt_nat SNAT and DNAT target handlers assume IP-family conntrack state
> is present and can dereference a NULL pointer when instantiated from an
> unsupported family through nft_compat. A bridge-family compat rule can
> therefore trigger a NULL-dereference in nf_nat_setup_info().
>
> [...]
Here is the summary with links:
- [net,1/9] netfilter: xt_nat: reject unsupported target families
https://git.kernel.org/netdev/net/c/5d1a2240935e
- [net,2/9] netfilter: ecache: fix inverted time_after() check
https://git.kernel.org/netdev/net/c/b06163ce52ec
- [net,3/9] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
https://git.kernel.org/netdev/net/c/86f3ce81dd2b
- [net,4/9] netfilter: nf_conncount: fix zone comparison in tuple dedup
https://git.kernel.org/netdev/net/c/f62c41b4910e
- [net,5/9] selftests: netfilter: add bridge tunnel flowtable regression
https://git.kernel.org/netdev/net/c/bd0bdfae1cf0
- [net,6/9] netfilter: flowtable: use correct direction to set up tunnel route
https://git.kernel.org/netdev/net/c/90941d9c925d
- [net,7/9] ipvs: reload ip header after head reallocation
https://git.kernel.org/netdev/net/c/a2f57827bf7c
- [net,8/9] ipvs: fix more places with wrong ipv6 transport offsets
https://git.kernel.org/netdev/net/c/b3fe4cbd5838
- [net,9/9] netfilter: xt_physdev: masks are not c-strings
https://git.kernel.org/netdev/net/c/f468c48d488d
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net v2] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
From: patchwork-bot+netdevbpf @ 2026-07-17 9:30 UTC (permalink / raw)
To: Xiang Mei
Cc: fw, pablo, phil, davem, edumazet, kuba, pabeni, horms,
netfilter-devel, coreteam, netdev, linux-kernel,
AutonomousCodeSecurity, tgopinath, kys, stable
In-Reply-To: <20260708181150.3944015-1-xmei5@asu.edu>
Hello:
This patch was applied to netdev/net.git (main)
by Florian Westphal <fw@strlen.de>:
On Wed, 8 Jul 2026 18:11:50 +0000 you wrote:
> br_ip6_fragment() gets prevhdr, a pointer into the skb head, from
> ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb
> skb_checksum_help() reallocates the head via pskb_expand_head(), leaving
> prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a
> use-after-free write.
>
> Save prevhdr's offset before skb_checksum_help() and recompute it after,
> like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6
> fragment").
>
> [...]
Here is the summary with links:
- [net,v2] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
https://git.kernel.org/netdev/net/c/86f3ce81dd2b
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next v8 1/4] dt-bindings: net: pse-pd: add bindings for Realtek PSE MCU
From: Kory Maincent @ 2026-07-17 9:39 UTC (permalink / raw)
To: Jonas Jelonek
Cc: Oleksij Rempel, Andrew Lunn, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, netdev, devicetree, linux-kernel, Daniel Golle,
Bjørn Mork, Conor Dooley
In-Reply-To: <20260715075530.2491534-2-jelonek.jonas@gmail.com>
On Wed, 15 Jul 2026 07:55:25 +0000
Jonas Jelonek <jelonek.jonas@gmail.com> wrote:
> Add a binding for the microcontroller (MCU) that fronts the PSE silicon
> on a range of managed Realtek-based switches. The host talks only to the
> MCU, over I2C/SMBus or UART, using a fixed message-based protocol; the
> PSE chips behind it never appear on the bus.
>
> The device is the MCU together with its Realtek firmware: the firmware
> and its host protocol are what the binding describes, not the
> general-purpose microcontroller they run on. The PSE silicon behind the
> MCU (Realtek or Broadcom) is reported by the MCU and detected at runtime,
> so it is not described here - hence the 'realtek' vendor prefix.
>
> Two protocol generations exist, both Realtek's, selected by the
> compatible: gen1 on older boards (fronting Broadcom PSE silicon) and gen2,
> the altered protocol used with Realtek's own PSE silicon. On an I2C
> attachment the framing the MCU firmware expects is part of the compatible
> as well - '-smbus' or raw '-i2c'; a UART attachment carries no framing
> suffix, as the transport is given by the parent serial node.
>
> Each board additionally carries a device-specific compatible that falls
> back to one of the protocol compatibles above. Drivers bind on the
> protocol compatible; the device-specific string identifies the board and
> reserves a place for a future per-board quirk without having to retrofit
> device trees already in the field.
>
> Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
> Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
> Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Thank you!
--
Köry Maincent, Bootlin
Embedded Linux and kernel engineering
https://bootlin.com
^ permalink raw reply
* Re: [GIT PULL] bluetooth 2026-07-13
From: patchwork-bot+netdevbpf @ 2026-07-17 9:40 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: davem, kuba, linux-bluetooth, netdev
In-Reply-To: <20260713141940.954317-1-luiz.dentz@gmail.com>
Hello:
This pull request was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Mon, 13 Jul 2026 10:19:40 -0400 you wrote:
> The following changes since commit 3f1f755366687d051174739fb99f7d560202f60b:
>
> net: openvswitch: reject oversized nested action attrs (2026-07-11 13:09:11 +0200)
>
> are available in the Git repository at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-07-13
>
> [...]
Here is the summary with links:
- [GIT,PULL] bluetooth 2026-07-13
https://git.kernel.org/netdev/net/c/78d24e77ffd3
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v2 00/11] rust: driver: use pointers instead of indices for ID info
From: Greg Kroah-Hartman @ 2026-07-17 9:40 UTC (permalink / raw)
To: Danilo Krummrich
Cc: Gary Guo, Rafael J. Wysocki, Viresh Kumar, Uwe Kleine-König,
Michal Wilczynski, Igor Korotin, Rob Herring, Miguel Ojeda,
Boqun Feng, Björn Roy Baron, Benno Lossin, Andreas Hindborg,
Alice Ryhl, Trevor Gross, Daniel Almeida, Tamir Duberstein,
Alexandre Courbot, Onur Özkan, FUJITA Tomonori, David Airlie,
Simona Vetter, Bjorn Helgaas, Krzysztof Wilczyński,
Abdiel Janulgue, Robin Murphy, Dave Ertman, Ira Weiny,
Leon Romanovsky, Len Brown, Saravana Kannan, Drew Fustini,
Guo Ren, Fu Wei, driver-core, rust-for-linux, linux-kernel,
netdev, nova-gpu, dri-devel, linux-pci, linux-acpi, devicetree,
linux-pm, linux-pwm, linux-usb
In-Reply-To: <DK08KE2A3M7K.3OQDFZB94SMFC@kernel.org>
On Thu, Jul 16, 2026 at 09:18:05PM +0200, Danilo Krummrich wrote:
> On Mon Jun 29, 2026 at 2:39 PM CEST, Gary Guo wrote:
> > MAINTAINERS | 1 -
> > drivers/acpi/bus.c | 6 +-
> > drivers/cpufreq/rcpufreq_dt.rs | 1 -
> > drivers/gpu/drm/nova/driver.rs | 1 -
> > drivers/gpu/drm/tyr/driver.rs | 1 -
> > drivers/gpu/nova-core/driver.rs | 3 +-
> > drivers/pwm/pwm_th1520.rs | 1 -
> > include/acpi/acpi_bus.h | 11 --
> > rust/helpers/acpi.c | 16 ---
> > rust/helpers/helpers.c | 1 -
> > rust/kernel/acpi.rs | 14 +--
> > rust/kernel/auxiliary.rs | 18 +--
> > rust/kernel/device_id.rs | 207 +++++++++++++++++++---------------
> > rust/kernel/driver.rs | 137 ++--------------------
> > rust/kernel/i2c.rs | 26 ++---
> > rust/kernel/net/phy.rs | 66 +----------
> > rust/kernel/of.rs | 14 +--
> > rust/kernel/pci.rs | 25 ++--
> > rust/kernel/platform.rs | 5 +-
> > rust/kernel/usb.rs | 24 ++--
> > samples/rust/rust_debugfs.rs | 1 -
> > samples/rust/rust_dma.rs | 3 +-
> > samples/rust/rust_driver_auxiliary.rs | 4 +-
> > samples/rust/rust_driver_i2c.rs | 3 -
> > samples/rust/rust_driver_pci.rs | 11 +-
> > samples/rust/rust_driver_platform.rs | 2 -
> > samples/rust/rust_driver_usb.rs | 3 +-
> > samples/rust/rust_i2c_client.rs | 2 -
> > samples/rust/rust_soc.rs | 2 -
> > 29 files changed, 178 insertions(+), 431 deletions(-)
>
> I plan to pick this up soon. Please let me know in case there are any concerns
> from the acpi, i2c, of, net or usb side of things.
No objection from me fo rthe USB stuff:
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
^ permalink raw reply
* Re: [PATCH net-next v8 2/4] net: pse-pd: add Realtek PSE MCU core
From: Kory Maincent @ 2026-07-17 9:41 UTC (permalink / raw)
To: Jonas Jelonek
Cc: Oleksij Rempel, Andrew Lunn, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, netdev, devicetree, linux-kernel, Daniel Golle,
Bjørn Mork
In-Reply-To: <20260715075530.2491534-3-jelonek.jonas@gmail.com>
On Wed, 15 Jul 2026 07:55:26 +0000
Jonas Jelonek <jelonek.jonas@gmail.com> wrote:
> A range of managed Realtek-based PoE switches use a small microcontroller
> on the PCB to front the actual PSE silicon. The host CPU talks to that
> MCU over I2C/SMBus or UART using a fixed 12-byte request/response
> protocol with a trailing checksum; the PSE chips are managed by the MCU
> and are not accessed directly. Two generations of the protocol exist -
> both Realtek's - diverging in opcode numbering and a few response
> layouts; the driver handles this with a per-dialect opcode table and
> parser hooks for the responses that differ, selected by the compatible.
> The specific PSE chip behind the MCU is detected at runtime and only
> influences per-chip constants (power scaling and the per-port cap).
>
> This core module implements the protocol, message framing, the dialect
> machinery and the pse_controller_ops glue, and exports a registration
> helper for transport modules. The I2C and UART transports that drive it
> follow in the next patches; the core (PSE_REALTEK_MCU) is selected
> automatically by those transports and is not user-selectable on its own.
>
> The realtek-pse-mcu-* files and PSE_REALTEK_MCU* symbols match the
> realtek,pse-mcu-* compatibles (see the binding for the naming rationale).
> The two protocol generations - gen1 on older Broadcom-PSE boards, gen2 on
> Realtek's own PSE silicon - are both Realtek's, handled by the same shared
> core, each selecting its dialect via the compatible.
>
> Power budgeting is left to the MCU firmware; the driver advertises
> PSE_BUDGET_EVAL_STRAT_DYNAMIC (controller-managed budget) accordingly.
>
> Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
> Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Thank you!
--
Köry Maincent, Bootlin
Embedded Linux and kernel engineering
https://bootlin.com
^ permalink raw reply
* Re: [PATCH net-next v8 3/4] net: pse-pd: realtek-pse-mcu: add I2C transport
From: Kory Maincent @ 2026-07-17 9:45 UTC (permalink / raw)
To: Jonas Jelonek
Cc: Oleksij Rempel, Andrew Lunn, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, netdev, devicetree, linux-kernel, Daniel Golle,
Bjørn Mork
In-Reply-To: <20260715075530.2491534-4-jelonek.jonas@gmail.com>
On Wed, 15 Jul 2026 07:55:27 +0000
Jonas Jelonek <jelonek.jonas@gmail.com> wrote:
> Add the I2C/SMBus transport for the Realtek PSE MCU core. It registers
> the MCU on an I2C bus and provides the send/recv callbacks the core
> uses to exchange the 12-byte frames.
>
> The MCU firmware expects one of two framings on the I2C bus, and which one
> is part of the compatible: '-smbus' (reads carry a leading command byte
> and a repeated start) or raw '-i2c' (bare block writes and reads). The
> match data flags the raw-I2C case; SMBus is the default because that's
> what the majority of devices uses.
>
> Because i2c_master_send()/i2c_master_recv() may DMA, the raw-I2C path
> bounces each frame through a heap buffer rather than the core's stack
> buffers; the SMBus path is unaffected.
>
> Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
> Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Thank you!
--
Köry Maincent, Bootlin
Embedded Linux and kernel engineering
https://bootlin.com
^ permalink raw reply
* Re: [PATCH net-next v8 4/4] net: pse-pd: realtek-pse-mcu: add UART transport
From: Kory Maincent @ 2026-07-17 9:46 UTC (permalink / raw)
To: Jonas Jelonek
Cc: Oleksij Rempel, Andrew Lunn, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, netdev, devicetree, linux-kernel, Daniel Golle,
Bjørn Mork
In-Reply-To: <20260715075530.2491534-5-jelonek.jonas@gmail.com>
On Wed, 15 Jul 2026 07:55:28 +0000
Jonas Jelonek <jelonek.jonas@gmail.com> wrote:
> Add the serdev (UART) transport for the Realtek PSE MCU core. It registers
> the MCU as a serdev device and provides the send/recv callbacks the core
> uses to exchange the 12-byte frames, receiving asynchronously via the
> serdev receive_buf callback.
>
> The baud rate defaults to 19200 and can be overridden per board with the
> "current-speed" property.
>
> Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
> Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Thank you!
--
Köry Maincent, Bootlin
Embedded Linux and kernel engineering
https://bootlin.com
^ permalink raw reply
* Re: [PATCH net-next v2 2/2] net: stmmac: dwmac-rk: enable the reference clock for output mode
From: Maxime Chevallier @ 2026-07-17 9:47 UTC (permalink / raw)
To: Jiaxing Hu, andrew+netdev, davem, edumazet, kuba, pabeni, heiko,
mcoquelin.stm32, alexandre.torgue
Cc: netdev, linux-rockchip, linux-arm-kernel, linux-stm32,
linux-kernel
In-Reply-To: <20260717065933.2629501-3-gahing@gahingwoo.com>
Hi,
On 7/17/26 08:59, Jiaxing Hu wrote:
> rk_gmac_clk_init() only requests the refout clock group for RMII. The
> ArmSoM CM5 has an on-module YT8531 RGMII PHY with no crystal that needs
> the SoC 25 MHz reference (clk_mac_refout), so in RGMII the clock was
> never enabled and the PHY did not respond on MDIO.
>
> Request the group whenever the SoC drives the clock (clock_in_out =
> "output"), not just for RMII. The clocks are optional, so other boards
> are unaffected.
You've taken my review into account (thanks :) ), but you're failing to
address Andrew's comment.
The PHY should be the one requesting the MAC to output the refclk, in
that case the MAC will act as a clock provider, something like this :
https://elixir.bootlin.com/linux/v7.1.3/source/drivers/net/phy/air_en8811h.c#L1156
The PHY then requests the clock (probably an optional clock).
Maxime
^ permalink raw reply
* Re: [PATCH net v2] net/mlx5: free mlx5_st_idx_data on final dealloc
From: Paolo Abeni @ 2026-07-17 9:47 UTC (permalink / raw)
To: Leon Romanovsky
Cc: Zhiping Zhang, Jason Gunthorpe, Saeed Mahameed Michael,
Tariq Toukan, Mark Bloch, Michael Guralnik, netdev, linux-rdma,
linux-kernel, stable
In-Reply-To: <20260713080816.GA327832@unreal>
On 7/13/26 10:08 AM, Leon Romanovsky wrote:
> On Fri, Jul 10, 2026 at 01:25:45PM +0200, Paolo Abeni wrote:
>> On 7/3/26 12:24 AM, Zhiping Zhang wrote:
>>> Workloads that repeatedly allocate and release mkeys carrying TPH
>>> steering-tag hints (e.g. churning RDMA MRs) leak one
>>> struct mlx5_st_idx_data per cycle; kmemleak flags it as unreferenced
>>> and the kmalloc slab grows over time.
>>>
>>> When the last reference to an ST table entry is dropped,
>>> mlx5_st_dealloc_index() removed the entry from idx_xa but the backing
>>> mlx5_st_idx_data allocation was never freed.
>>>
>>> Free idx_data after the xa_erase() so the lifetime of the bookkeeping
>>> struct matches the lifetime of the ST entry it tracks.
>>>
>>> Cc: stable@vger.kernel.org
>>> Fixes: 888a7776f4fb ("net/mlx5: Add support for device steering tag")
>>> Reviewed-by: Michael Gur <michaelgur@nvidia.com>
>>> Signed-off-by: Zhiping Zhang <zhipingz@meta.com>
>> @Leon, @Saeed, @Tariq: just in case this fell under the radar, it's
>> waiting for your ack.
>
> Tariq and I completed this on Jul 5 and Jul 6.
>
> https://lore.kernel.org/linux-rdma/20260705141920.GI15188@unreal/
> https://lore.kernel.org/linux-rdma/0bb37f75-c94a-4a10-b115-186b71daf14f@nvidia.com/
Thank you for pointing out and for the review. PW lost track of it,
likely because there are multiple copies of the same patch/revision and
only one of them landed on the netdev ML.
Applying right now.
/P
^ permalink raw reply
* RE: [PATCH net v4 2/2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list
From: Tung Quang Nguyen @ 2026-07-17 9:48 UTC (permalink / raw)
To: Weiming Shi
Cc: netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org, xmei5@asu.edu, Jon Maloy,
David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman
In-Reply-To: <20260716190204.100895-4-bestswngs@gmail.com>
>Subject: [PATCH net v4 2/2] tipc: fix NULL deref in tipc_named_node_up() on
>empty publication list
>
>named_distribute() ends by stamping the last_bulk flag on the tail skb via
>buf_msg(skb_peek_tail(list)). When the publication list is empty no skb is
>enqueued, skb_peek_tail() returns NULL, and buf_msg(NULL) is dereferenced.
>
>tipc_named_node_up() runs this on &nt->cluster_scope. With a node-id
>configuration cluster_scope is populated only later by tipc_net_finalize(), so a
>peer link that comes up first reaches named_distribute() with an empty list. It
>is reachable by an unprivileged user (TIPC genl ops use
>GENL_UNS_ADMIN_PERM) over a UDP bearer in a user+net namespace:
>
> KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df]
> RIP: 0010:tipc_named_node_up (net/tipc/name_distr.c:196)
> tipc_named_node_up (net/tipc/name_distr.c:196 net/tipc/name_distr.c:221)
> tipc_node_write_unlock (net/tipc/node.c:428)
> tipc_rcv (net/tipc/node.c:2185)
> tipc_udp_recv (net/tipc/udp_media.c:392) Kernel panic - not syncing: Fatal
>exception in interrupt
>
>The peer holds back this node's later name updates until it sees a bulk with the
>last_bulk flag, so simply skipping the send would stall it. Emit an item-less bulk
>when the publication list is empty, so the peer still receives the last_bulk flag
>and opens.
>
>Fixes: cad2929dc432 ("tipc: update a binding service via broadcast")
>Reported-by: Xiang Mei <xmei5@asu.edu>
>Assisted-by: Claude:claude-opus-4-8
>Signed-off-by: Weiming Shi <bestswngs@gmail.com>
>---
> net/tipc/name_distr.c | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)
>
>diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c index
>ba4f4906e13b..a8bb7bd101ea 100644
>--- a/net/tipc/name_distr.c
>+++ b/net/tipc/name_distr.c
>@@ -192,6 +192,20 @@ static void named_distribute(struct net *net, struct
>sk_buff_head *list,
> skb_trim(skb, INT_H_SIZE + (msg_dsz - msg_rem));
> __skb_queue_tail(list, skb);
> }
>+
>+ if (skb_queue_empty(list)) {
>+ skb = named_prepare_buf(net, PUBLICATION, 0, dnode);
>+ if (!skb) {
>+ pr_warn("Bulk publication failure\n");
>+ return;
>+ }
>+ hdr = buf_msg(skb);
>+ msg_set_bc_ack_invalid(hdr, true);
>+ msg_set_bulk(hdr);
>+ msg_set_non_legacy(hdr);
>+ __skb_queue_tail(list, skb);
>+ }
As I explained before, this approach is wrong because
1. It does not handle memory allocation failure.
2. It breaks receiving peer by sending non-data message to that peer in case skb is not NULL.
Could you please test below patch to see if it fixes the NULL dereference issue you reported ?
---
net/tipc/core.c | 1 +
net/tipc/core.h | 2 ++
net/tipc/name_distr.c | 48 +++++++++++++++++++++++++++++++++++++++----
net/tipc/name_distr.h | 3 ++-
net/tipc/net.c | 2 ++
net/tipc/node.c | 34 ++++++++++++++++++++++++++++--
6 files changed, 83 insertions(+), 7 deletions(-)
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 315975c3be81..9e81be4f01cf 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -61,6 +61,7 @@ static int __net_init tipc_init_net(struct net *net)
tn->trial_addr = 0;
tn->addr_trial_end = 0;
tn->capabilities = TIPC_NODE_CAPABILITIES;
+ atomic_set(&tn->finalized, 0);
INIT_WORK(&tn->work, tipc_net_finalize_work);
memset(tn->node_id, 0, sizeof(tn->node_id));
memset(tn->node_id_string, 0, sizeof(tn->node_id_string));
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 9ce5f9ff6cc0..76768844c808 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -145,6 +145,8 @@ struct tipc_net {
struct work_struct work;
/* The numbers of work queues in schedule */
atomic_t wq_count;
+ /* flag to indicate work has finished */
+ atomic_t finalized;
};
static inline struct tipc_net *tipc_net(struct net *net)
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index ba5f4906e13b..8a1692dbd243 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -147,7 +147,7 @@ struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *p)
* @pls: linked list of publication items to be packed into buffer chain
* @seqno: sequence number for this message
*/
-static void named_distribute(struct net *net, struct sk_buff_head *list,
+static int named_distribute(struct net *net, struct sk_buff_head *list,
u32 dnode, struct list_head *pls, u16 seqno)
{
struct publication *publ;
@@ -164,8 +164,9 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
skb = named_prepare_buf(net, PUBLICATION, msg_rem,
dnode);
if (!skb) {
+ __skb_queue_purge(list);
pr_warn("Bulk publication failure\n");
- return;
+ return 1;
}
hdr = buf_msg(skb);
msg_set_bc_ack_invalid(hdr, true);
@@ -195,6 +196,8 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
hdr = buf_msg(skb_peek_tail(list));
msg_set_last_bulk(hdr);
msg_set_named_seqno(hdr, seqno);
+
+ return 0;
}
/**
@@ -203,7 +206,7 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
* @dnode: destination node
* @capabilities: peer node's capabilities
*/
-void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
+int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
{
struct name_table *nt = tipc_name_table(net);
struct tipc_net *tn = tipc_net(net);
@@ -218,9 +221,46 @@ void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
spin_unlock_bh(&tn->nametbl_lock);
read_lock_bh(&nt->cluster_scope_lock);
- named_distribute(net, &head, dnode, &nt->cluster_scope, seqno);
+ /* tipc_net_finalize_work() has not finished inserting self address to
+ * name table yet.
+ */
+ if (unlikely(list_empty(&nt->cluster_scope))) {
+ read_unlock_bh(&nt->cluster_scope_lock);
+ return 1;
+ }
+
+ if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) {
+ read_unlock_bh(&nt->cluster_scope_lock);
+ return -ENOBUFS;
+ }
+
tipc_node_xmit(net, &head, dnode, 0);
read_unlock_bh(&nt->cluster_scope_lock);
+ return 0;
+}
+
+int tipc_named_dist_cluster_scope(struct net *net, u32 dnode)
+{
+ struct name_table *nt = tipc_name_table(net);
+ struct tipc_net *tn = tipc_net(net);
+ struct sk_buff_head head;
+ u16 seqno;
+
+ __skb_queue_head_init(&head);
+ wait_var_event(&tn->finalized, atomic_read(&tn->finalized));
+ spin_lock_bh(&tn->nametbl_lock);
+ seqno = nt->snd_nxt;
+ spin_unlock_bh(&tn->nametbl_lock);
+
+ read_lock_bh(&nt->cluster_scope_lock);
+ if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) {
+ read_unlock_bh(&nt->cluster_scope_lock);
+ return -ENOBUFS;
+ }
+ tipc_node_xmit(net, &head, dnode, 0);
+ read_unlock_bh(&nt->cluster_scope_lock);
+
+ return 0;
}
/**
diff --git a/net/tipc/name_distr.h b/net/tipc/name_distr.h
index c677f6f082df..cadf4e8c3e66 100644
--- a/net/tipc/name_distr.h
+++ b/net/tipc/name_distr.h
@@ -69,7 +69,8 @@ struct distr_item {
struct sk_buff *tipc_named_publish(struct net *net, struct publication *publ);
struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *publ);
-void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities);
+int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities);
+int tipc_named_dist_cluster_scope(struct net *net, u32 dnode);
void tipc_named_rcv(struct net *net, struct sk_buff_head *namedq,
u16 *rcv_nxt, bool *open);
void tipc_named_reinit(struct net *net);
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 7e65d0b0c4a8..4c144e720ac1 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -139,6 +139,8 @@ static void tipc_net_finalize(struct net *net, u32 addr)
tipc_sk_reinit(net);
tipc_mon_reinit_self(net);
tipc_nametbl_publish(net, &ua, &sk, addr);
+ atomic_inc(&tn->finalized);
+ wake_up_var(&tn->finalized);
}
void tipc_net_finalize_work(struct work_struct *work)
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 8e4ef2630ae4..c5b0a98324c3 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -145,6 +145,8 @@ struct tipc_node {
#ifdef CONFIG_TIPC_CRYPTO
struct tipc_crypto *crypto_rx;
#endif
+ /* Work item for bulk distribution of cluster scope publications */
+ struct work_struct work;
};
/* Node FSM states and events:
@@ -303,6 +305,7 @@ static void tipc_node_free(struct rcu_head *rp)
#ifdef CONFIG_TIPC_CRYPTO
tipc_crypto_stop(&n->crypto_rx);
#endif
+ cancel_work_sync(&n->work);
kfree(n);
}
@@ -393,6 +396,19 @@ static void tipc_node_write_unlock_fast(struct tipc_node *n)
write_unlock_bh(&n->lock);
}
+static void tipc_node_dist_bulk(struct work_struct *work)
+{
+ struct tipc_node *node = container_of(work, struct tipc_node, work);
+
+ if (tipc_named_dist_cluster_scope(node->net, node->addr) < 0) {
+ u32 bearer_id = node->link_id & 0xffff;
+
+ tipc_node_link_down(node, bearer_id, false);
+ }
+
+ tipc_node_put(node);
+}
+
static void tipc_node_write_unlock(struct tipc_node *n)
__releases(n->lock)
{
@@ -424,8 +440,21 @@ static void tipc_node_write_unlock(struct tipc_node *n)
if (flags & TIPC_NOTIFY_NODE_DOWN)
tipc_publ_notify(net, publ_list, node, n->capabilities);
- if (flags & TIPC_NOTIFY_NODE_UP)
- tipc_named_node_up(net, node, n->capabilities);
+ if (flags & TIPC_NOTIFY_NODE_UP) {
+ int rc = 0;
+
+ rc = tipc_named_node_up(net, node, n->capabilities);
+ /* Defer bulk distribution to work queue */
+ if (rc > 0) {
+ tipc_node_get(n);
+ schedule_work(&n->work);
+ } else if (rc < 0) {
+ /* Bring the link down to start over bulk distribution
+ * when the link is up again.
+ */
+ tipc_node_link_down(n, bearer_id, false);
+ }
+ }
if (flags & TIPC_NOTIFY_LINK_UP) {
tipc_mon_peer_up(net, node, bearer_id);
@@ -564,6 +593,7 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u8 *peer_id,
INIT_LIST_HEAD(&n->list);
INIT_LIST_HEAD(&n->publ_list);
INIT_LIST_HEAD(&n->conn_sks);
+ INIT_WORK(&n->work, tipc_node_dist_bulk);
skb_queue_head_init(&n->bc_entry.namedq);
skb_queue_head_init(&n->bc_entry.inputq1);
__skb_queue_head_init(&n->bc_entry.arrvq);
^ permalink raw reply related
* Re: [PATCH net 01/19] can: vxcan: Kconfig: fix description stating no local echo provided
From: patchwork-bot+netdevbpf @ 2026-07-17 9:50 UTC (permalink / raw)
To: Marc Kleine-Budde
Cc: netdev, davem, kuba, linux-can, kernel, alexander.hoelzl,
socketcan
In-Reply-To: <20260716155528.809908-2-mkl@pengutronix.de>
Hello:
This series was applied to netdev/net.git (main)
by Marc Kleine-Budde <mkl@pengutronix.de>:
On Thu, 16 Jul 2026 17:47:26 +0200 you wrote:
> From: Alexander Hölzl <alexander.hoelzl@gmx.net>
>
> The Kconfig description of the vxcan kernel module erroneously states the
> the vxcan interface does not provide a local echo of sent can frames.
> However this behavior changed in commit 259bdba27e32 ("vxcan: enable local
> echo for sent CAN frames") and vxcan interfaces now provide a local echo.
>
> [...]
Here is the summary with links:
- [net,01/19] can: vxcan: Kconfig: fix description stating no local echo provided
https://git.kernel.org/netdev/net/c/79adf48fb091
- [net,02/19] can: esd_usb: kill anchored URBs before freeing netdevs
https://git.kernel.org/netdev/net/c/c43122fef328
- [net,03/19] can: raw: add locking for raw flags bitfield
https://git.kernel.org/netdev/net/c/1e5185c09058
- [net,04/19] can: j1939: fix lockless local-destination check
https://git.kernel.org/netdev/net/c/e4e8af62adab
- [net,05/19] can: peak: Modification of references to email accounts being deleted
https://git.kernel.org/netdev/net/c/d83762005c13
- [net,06/19] can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
https://git.kernel.org/netdev/net/c/68973f9db761
- [net,07/19] can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
https://git.kernel.org/netdev/net/c/d9b091d9d22f
- [net,08/19] can: bcm: add locking when updating filter and timer values
https://git.kernel.org/netdev/net/c/749179c2e25b
- [net,09/19] can: bcm: fix CAN frame rx/tx statistics
https://git.kernel.org/netdev/net/c/e6c24ba95fc3
- [net,10/19] can: bcm: add missing rcu list annotations and operations
https://git.kernel.org/netdev/net/c/7b2c3eabc4da
- [net,11/19] can: bcm: extend bcm_tx_lock usage for data and timer updates
https://git.kernel.org/netdev/net/c/12ce799f7ab1
- [net,12/19] can: bcm: validate frame length in bcm_rx_setup() for RTR replies
https://git.kernel.org/netdev/net/c/62ec41f36464
- [net,13/19] can: bcm: add missing device refcount for CAN filter removal
https://git.kernel.org/netdev/net/c/d59948293ea3
- [net,14/19] can: bcm: fix stale rx/tx ops after device removal
https://git.kernel.org/netdev/net/c/3b762c0d9503
- [net,15/19] can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
https://git.kernel.org/netdev/net/c/58fd6cbc8541
- [net,16/19] can: bcm: track a single source interface for ANYDEV timeout/throttle ops
https://git.kernel.org/netdev/net/c/2f5976f54a04
- [net,17/19] can: isotp: use unconditional synchronize_rcu() in isotp_release()
https://git.kernel.org/netdev/net/c/9b1a02e0d980
- [net,18/19] can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
https://git.kernel.org/netdev/net/c/20bab8b88baa
- [net,19/19] can: isotp: serialize TX state transitions under so->rx_lock
https://git.kernel.org/netdev/net/c/cf070fe33bfb
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net v2] can: esd_usb: kill anchored URBs before freeing netdevs
From: patchwork-bot+netdevbpf @ 2026-07-17 9:50 UTC (permalink / raw)
To: Fan Wu
Cc: linux-can, frank.jungclaus, socketcan, mkl, mailhol,
jedrzej.jagielski, netdev, linux-kernel, stable
In-Reply-To: <20260709164159.497640-1-fanwu01@zju.edu.cn>
Hello:
This patch was applied to netdev/net.git (main)
by Marc Kleine-Budde <mkl@pengutronix.de>:
On Thu, 9 Jul 2026 16:41:59 +0000 you wrote:
> esd_usb_disconnect() frees each CAN netdev with free_candev() inside
> its per-netdev loop and only calls unlink_all_urbs(dev) afterwards.
> The per-netdev private data (struct esd_usb_net_priv) is embedded in
> the net_device allocation returned by alloc_candev(), so once
> free_candev() has run, dev->nets[i] points to freed memory.
> unlink_all_urbs() then dereferences the freed dev->nets[i] to kill the
> per-netdev TX anchor (usb_kill_anchored_urbs(&priv->tx_submitted)),
> clear active_tx_jobs, and reset priv->tx_contexts[].
>
> [...]
Here is the summary with links:
- [net,v2] can: esd_usb: kill anchored URBs before freeing netdevs
https://git.kernel.org/netdev/net/c/c43122fef328
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [PATCH] igc: fix netdev not re-attached after resume if interface is down
From: Philipp David @ 2026-07-17 9:22 UTC (permalink / raw)
To: intel-wired-lan, netdev
Cc: Tony Nguyen, Przemek Kitszel, Andrew Lunn, David S . Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Philipp David, stable
__igc_resume() calls netif_device_attach() only inside the
netif_running() branch, so an interface that was down during suspend
is never re-attached on resume. It then stays in the not-present state
that __igc_shutdown() set via netif_device_detach(): ethtool reports
ENODEV and every attempt to bring the interface up fails the
netif_device_present() check in __dev_open() with -ENODEV, silently,
since __igc_resume() returns 0. Only reloading the driver recovers the
device.
This is easy to hit in practice because NetworkManager brings managed
interfaces down before sleep unless Wake-on-LAN is configured, making
the adapter unusable after every suspend/resume cycle with WoL
disabled.
Re-attach the netdev on every successful resume, as igb and e1000e do.
Fixes: 6f31d6b643a3 ("igc: Refactor runtime power management flow")
Cc: stable@vger.kernel.org
Signed-off-by: Philipp David <pd-lkml@3b.pm>
---
drivers/net/ethernet/intel/igc/igc_main.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
index 2c9e2dfd8499..e777c2df0b73 100644
--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
@@ -7586,11 +7586,13 @@ static int __igc_resume(struct device *dev, bool rpm)
err = __igc_open(netdev, true);
if (!rpm)
rtnl_unlock();
- if (!err)
- netif_device_attach(netdev);
+ if (err)
+ return err;
}
- return err;
+ netif_device_attach(netdev);
+
+ return 0;
}
static int igc_resume(struct device *dev)
--
2.54.0
^ permalink raw reply related
* [PATCH net-next 0/6] tc: introduce FRER action (IEEE 802.1CB)
From: Xiaoliang Yang @ 2026-07-17 9:55 UTC (permalink / raw)
To: netdev, linux-kernel, linux-kselftest
Cc: davem, edumazet, kuba, pabeni, jhs, jiri, horms, shuah,
vladimir.oltean, vinicius.gomes, fejes, xiaoliang.yang_1
This series introduces a new TC action implementing
Frame Replication and Elimination for Reliability (FRER)
as defined in IEEE 802.1CB.
The FRER action enables:
- Frame replication (push)
- Sequence numbering via R-TAG
- Frame elimination based on sequence recovery
Patch overview:
1. Add ETH_P_RTAG definition
2. Introduce TCA_ID_FRER
3. Add tc_frer uAPI
4. Implement act_frer kernel module
5. Add tc-testing selftest JSON coverage
6. Add kselftest integration test
The implementation currently focuses on software datapath. Hardware
offload is exposed through the flow offload API (FLOW_ACTION_FRER);
driver-side support for specific hardware will be submitted separately.
Usage scenarios:
=== Scenario 1a: Talker End - single port (no replication) ===
The simplest case: a single egress path. The frer push action
inserts an R-TAG on the egress of the physical interface. No
mirror or virtual interface is needed.
CPU
|
eth0 egress clsact:
action frer push index 1 <- insert R-TAG seq=N
|
eth0
[R-TAG seq=N | payload]
Path A --> network
Configuration:
tc qdisc add dev eth0 clsact
tc filter add dev eth0 egress protocol ip flower skip_hw \
action frer push index 1
=== Scenario 1b: Talker End - dual port replication via bond + cross-mirror ===
A bond interface (balance-rr) aggregates both physical ports. The
frer push action is placed on each slave's egress; each slave also
mirrors every outgoing frame to the other slave. This cross-mirror
ensures that every frame transmitted by the bond (regardless of which
slave the round-robin selects) carries an R-TAG and reaches both
physical links. If one link goes down, the bond continues on the
remaining slave without any traffic interruption.
CPU (socket on bond0)
|
bond0 (balance-rr)
/ \
eth0 eth1
egress clsact: egress clsact:
action frer push index 1 action frer push index 1
action mirred egress action mirred egress
mirror dev eth1 mirror dev eth0
| |
eth0 eth1
[R-TAG seq=N | payload] [R-TAG seq=N | payload]
Path A --> network Path B --> network
Configuration:
ip link add bond0 type bond mode balance-rr miimon 100
ip link set eth0 master bond0
ip link set eth1 master bond0
ip link set eth0 up
ip link set eth1 up
ip link set bond0 up
ip addr add 192.0.2.1/24 dev bond0
tc qdisc add dev eth0 clsact
tc filter add dev eth0 egress protocol ip flower skip_hw \
action frer push index 1 \
action mirred egress mirror dev eth1
tc qdisc add dev eth1 clsact
tc filter add dev eth1 egress protocol ip flower skip_hw \
action frer push index 1 \
action mirred egress mirror dev eth0
=== Scenario 2: Listener End - shared sequence recovery via bond ===
Both physical ports are bonded (balance-rr). Each port's ingress
references the same recover action by index. The first copy of each
sequence number passes (R-TAG stripped by tag-pop) and is delivered
directly to the bond's IP stack; the duplicate is discarded. No
separate convergence interface is needed because the bond already
provides a single IP address over both slaves.
eth0 (Path A in) eth1 (Path B in)
[R-TAG seq=N | payload] [R-TAG seq=N | payload]
| |
ingress clsact ingress clsact
flower: match stream flower: match stream
action frer recover <--> action frer recover
index 10 (shared, index 10 (shared,
tag-pop, spinlock same action object)
protected)
| |
+-----------+---------------+
|
bond0 (IP_DST) ----> IP stack / CPU
[payload, R-TAG removed by tag-pop]
Configuration:
ip link add bond0 type bond mode balance-rr miimon 100
ip link set eth0 master bond0
ip link set eth1 master bond0
ip link set eth0 up
ip link set eth1 up
ip link set bond0 up
ip addr add 192.0.2.2/24 dev bond0
tc qdisc add dev eth0 clsact
tc filter add dev eth0 ingress protocol all flower skip_hw \
action frer recover alg vector history-length 16 \
reset-time 2000 tag-pop index 10
tc qdisc add dev eth1 clsact
tc filter add dev eth1 ingress protocol all flower skip_hw \
action frer recover index 10
=== Scenario 3a: Relay System - ingress sequence recovery ===
A relay node receives redundant streams on two ingress ports and
eliminates duplicates before forwarding. The two ingress ports
share the same recover action by index. The surviving frame is
redirected to an egress port and forwarded to the next segment.
upstream
Path A --> swp0 (ingress) Path B --> swp1 (ingress)
| |
ingress clsact ingress clsact
flower: match stream flower: match stream
action frer recover action frer recover
index 10 index 10 (shared)
action mirred action mirred
redirect redirect
dev swp2 dev swp2
| |
+----------+----------+
|
swp2 --> downstream
Configuration:
tc qdisc add dev swp0 clsact
tc filter add dev swp0 ingress protocol all flower skip_hw \
action frer recover alg vector history-length 16 \
reset-time 2000 tag-pop index 10 \
action mirred egress redirect dev swp2
tc qdisc add dev swp1 clsact
tc filter add dev swp1 ingress protocol all flower skip_hw \
action frer recover index 10 \
action mirred egress redirect dev swp2
=== Scenario 3b: Relay System - ingress frame replication (push) ===
A relay node receives frames from a talker on swp0 ingress, inserts
an R-TAG, and replicates them onto two egress ports towards the next
network segment. FDB learning and flooding are disabled on all relay
ports; MAC forwarding entries are configured statically to prevent
duplicate frames from looping through the bridge.
upstream
|
swp0 ingress clsact:
action frer push index 1 <- insert new R-TAG seq=M
action mirred egress mirror dev swp2 <- copy to Path B'
action mirred egress redirect dev swp1 <- to Path A'
| |
swp1 swp2
[R-TAG seq=M | payload] [R-TAG seq=M | payload]
Path A' --> downstream Path B' --> downstream
Configuration:
tc qdisc add dev swp0 clsact
tc filter add dev swp0 ingress protocol ip flower skip_hw \
action frer push index 1 \
action mirred egress mirror dev swp2 \
action mirred egress redirect dev swp1
# Disable FDB learning and flooding on all relay ports to prevent
# duplicate frames from looping back through the bridge.
bridge link set dev swp0 learning off flood off
bridge link set dev swp1 learning off flood off
bridge link set dev swp2 learning off flood off
bridge fdb add DST_MAC dev swp1 master static
bridge fdb add DST_MAC dev swp2 master static
Known limitations:
1. Only R-TAG (EtherType 0xF1C1, IEEE 802.1CB Section 7.8) is
currently supported as the redundancy tag type. HSR
(IEC 62439-3) and PRP (IEC 62439-3) tag formats are defined in
the UAPI (TCA_FRER_TAG_HSR, TCA_FRER_TAG_PRP) but not yet
implemented; attempts to use them are rejected with -EOPNOTSUPP.
Support for HSR and PRP tags will be added in a follow-up series.
Changes since RFC (https://lkml.org/lkml/2021/9/28/535):
1. The frer action can now be attached to either ingress or egress
clsact. For talker-end frame replication the action is placed on
the egress of the outgoing interface. For relay-system replication
the action is placed on the ingress of the receiving interface,
followed by mirred redirect to the egress ports.
2. Reset timer reworked following Vinicius Costa Gomes' review.
3. Vector recovery algorithm corrected following Ferenc Fejes' review.
4. A bond is used on the end system to aggregate two device interfaces.
addressing Vladimir’s comment that TC-FRER is not applicable to end
systems. See Scenario 1b(talker end) and Scenario 2(listener end).
The kselftest script (frer_test.sh) test this on TEST 2.
5. Added detailed usage scenario descriptions with ASCII topology
diagrams. Added tc-testing JSON test cases (32 cases) and a
TAP-format kselftest script (frer_test.sh) with five end-to-end
functional tests and one relay bridge topology test.
Xiaoliang Yang (6):
uapi: if_ether: add ETH_P_RTAG for IEEE 802.1CB R-TAG
uapi: pkt_cls: add TCA_ID_FRER action identifier
uapi: tc_act: add tc_frer UAPI header
net: sched: act_frer: add FRER tc action
selftest: add tc-testing JSON test cases for act_frer
selftests: net: add kselftest for IEEE 802.1CB FRER tc action
include/net/flow_offload.h | 11 +
include/net/tc_act/tc_frer.h | 71 ++
include/uapi/linux/if_ether.h | 1 +
include/uapi/linux/pkt_cls.h | 1 +
include/uapi/linux/tc_act/tc_frer.h | 89 ++
net/sched/Kconfig | 16 +
net/sched/Makefile | 1 +
net/sched/act_frer.c | 835 ++++++++++++++
tools/testing/selftests/net/Makefile | 1 +
tools/testing/selftests/net/frer_test.sh | 1013 +++++++++++++++++
.../tc-testing/tc-tests/actions/frer.json | 785 +++++++++++++
11 files changed, 2824 insertions(+)
create mode 100644 include/net/tc_act/tc_frer.h
create mode 100644 include/uapi/linux/tc_act/tc_frer.h
create mode 100644 net/sched/act_frer.c
create mode 100755 tools/testing/selftests/net/frer_test.sh
create mode 100644 tools/testing/selftests/tc-testing/tc-tests/actions/frer.json
--
2.17.1
^ permalink raw reply
* [PATCH net-next 1/6] uapi: if_ether: add ETH_P_RTAG for IEEE 802.1CB R-TAG
From: Xiaoliang Yang @ 2026-07-17 9:55 UTC (permalink / raw)
To: netdev, linux-kernel, linux-kselftest
Cc: davem, edumazet, kuba, pabeni, jhs, jiri, horms, shuah,
vladimir.oltean, vinicius.gomes, fejes, xiaoliang.yang_1
In-Reply-To: <20260717095549.10565-1-xiaoliang.yang_1@nxp.com>
The IEEE 802.1CB-2017 standard defines the Redundancy Tag (R-TAG) with
EtherType 0xF1C1. Add ETH_P_RTAG to the kernel's EtherType definitions
so that it can be used by tc classifiers (e.g. cls_flower) and the FRER
tc action for stream identification on the ingress path.
Signed-off-by: Xiaoliang Yang <xiaoliang.yang_1@nxp.com>
---
include/uapi/linux/if_ether.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/uapi/linux/if_ether.h b/include/uapi/linux/if_ether.h
index fb5efc8e06cc..2d909078cde1 100644
--- a/include/uapi/linux/if_ether.h
+++ b/include/uapi/linux/if_ether.h
@@ -122,6 +122,7 @@
#define ETH_P_DSA_8021Q 0xDADB /* Fake VLAN Header for DSA [ NOT AN OFFICIALLY REGISTERED ID ] */
#define ETH_P_DSA_A5PSW 0xE001 /* A5PSW Tag Value [ NOT AN OFFICIALLY REGISTERED ID ] */
#define ETH_P_IFE 0xED3E /* ForCES inter-FE LFB type */
+#define ETH_P_RTAG 0xF1C1 /* Redundancy Tag (IEEE 802.1CB) */
#define ETH_P_AF_IUCV 0xFBFB /* IBM af_iucv [ NOT AN OFFICIALLY REGISTERED ID ] */
#define ETH_P_NXP_NETC 0xFD3A /* NXP NETC DSA [ NOT AN OFFICIALLY REGISTERED ID ] */
--
2.17.1
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox