* Re: [PATCH] wifi: mwifiex: validate HT/VHT element length before storing beacon IE pointers
From: Francesco Dolcini @ 2026-07-17 14:31 UTC (permalink / raw)
To: Christopher Kleiner
Cc: briannorris, linux-wireless, francesco, netdev, linux-kernel
In-Reply-To: <20260717000017.61415-1-chris@kleiner.pro>
On Thu, Jul 16, 2026 at 08:00:17PM -0400, Christopher Kleiner wrote:
> mwifiex_update_bss_desc_with_ie() stores raw pointers into the beacon
> buffer for the HT Capability, HT Operation, VHT Capability and VHT
> Operation elements without checking that the element is long enough to
> hold the corresponding fixed-size structure. The generic IE loop only
> guarantees that the declared element length fits inside the beacon
> buffer (bytes_left >= total_ie_len); it does not guarantee that
> element_len is large enough for the struct that later consumers copy.
>
> beacon_buf is a tight kmemdup() of the over-the-air IEs. When the
> association command is built, mwifiex_cmd_append_11n_tlv() /
> mwifiex_cmd_append_11ac_tlv() copy a fixed number of bytes from the
> stored pointers (sizeof(struct ieee80211_ht_cap) and friends). A
> malicious AP that emits a beacon or probe response ending in a
> truncated (e.g. zero-length) HT Capability element leaves bcn_ht_cap
> pointing near the end of the slab, and the subsequent copy reads out of
> bounds. The leaked bytes are placed into the association request
> transmitted back to the AP, disclosing adjacent slab memory; on
> CONFIG_KASAN / panic_on_oops kernels it is an out-of-bounds oops.
>
> Commit 685c9b7750bf ("mwifiex: Abort at too short BSS descriptor
> element") added such length checks for the FH/DS/CF/IBSS parameter sets
> and a few other elements, but did not cover the HT/VHT capability and
> operation elements. Validate element_len against the size of the
> structure that will be consumed, mirroring those existing checks.
>
> Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Christopher Kleiner <chris@kleiner.pro>
Duplicate? We already have this in review https://lore.kernel.org/all/20260709100800.7026-1-doruk@0sec.ai/
^ permalink raw reply
* [PATCH] vhost-scsi: Prevent OOM from invalid protection SGL count
From: Jia Jia @ 2026-07-17 14:22 UTC (permalink / raw)
To: mst, jasowang, michael.christie
Cc: pbonzini, stefanha, eperezma, virtualization, kvm, netdev,
linux-kernel, stable
The protection SGL path passes the result of vhost_scsi_calc_sgls()
directly to sg_alloc_table_chained(). The helper returns a negative
errno when the iterator is invalid or the request exceeds the segment
limit. The negative errno is then treated as a very large unsigned count
and sends the request into the SGL allocation path with an invalid size.
Repeated malformed T10-PI submissions from a host-side application caused
memory usage to rise sharply. MemAvailable fell to about 200 MB, and PSI
full avg10 reached about 1.46. The OOM killer terminated several userspace
processes before the endpoint cleanup completed. The kernel log included:
[17036.451028] Out of memory: Killed process 2345 (systemd)
[17036.493325] Out of memory: Killed process 2349 (sd-pam)
[17078.265127] Out of memory: Killed process 1793 (networkd-dispat)
Return the calculation error before setting up the protection SGL. This
keeps the protection path consistent with the data SGL path and prevents
the invalid count from entering the allocation path.
Fixes: bca939d5bcd0 ("vhost-scsi: Dynamically allocate scatterlists")
Cc: stable@vger.kernel.org
Signed-off-by: Jia Jia <physicalmtea@gmail.com>
---
drivers/vhost/scsi.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 9a1253b9d..8486652fd 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -972,6 +972,9 @@ vhost_scsi_mapal(struct vhost_scsi *vs, struct vhost_scsi_cmd *cmd,
if (prot_bytes) {
sgl_count = vhost_scsi_calc_sgls(prot_iter, prot_bytes,
VHOST_SCSI_PREALLOC_PROT_SGLS);
+ if (sgl_count < 0)
+ return sgl_count;
+
cmd->prot_table.sgl = cmd->prot_sgl;
ret = sg_alloc_table_chained(&cmd->prot_table, sgl_count,
cmd->prot_table.sgl,
--
2.43.0
^ permalink raw reply related
* Re: 回复: Re: [PATCH net v2] phonet: check register_netdevice_notifier() error in phonet_device_init()
From: Andrew Lunn @ 2026-07-17 13:56 UTC (permalink / raw)
To: 何敏红
Cc: courmisch, davem, edumazet, kuba, pabeni, horms,
remi.denis-courmont, netdev, linux-kernel
In-Reply-To: <3v5ygapsdjgl-3v61zwni6m6e@nsmail8.2--kylin--1>
On Fri, Jul 17, 2026 at 02:55:54PM +0800, 何敏红 wrote:
>
>
> Hi Andrew,
>
> Thanks for the review.
>
> > Think about what happens when phonet_netlink_register() fails.
>
> I checked that path. By the time phonet_netlink_register() runs,
> pernet, the proc entry and the netdevice notifier have all been
> registered successfully. On failure, rtnl_register_many() already
> unwinds any partially registered handlers, and phonet_device_exit()
> then tears down the notifier/pernet/proc that were set up. So this is
> not the same issue as calling unregister_netdevice_notifier() for a
> notifier that never got registered.
int __init phonet_device_init(void)
{
int err = register_pernet_subsys(&phonet_net_ops);
if (err)
return err;
proc_create_net("pnresource", 0, init_net.proc_net, &pn_res_seq_ops,
sizeof(struct seq_net_private));
register_netdevice_notifier(&phonet_device_notifier);
err = phonet_netlink_register();
if (err)
phonet_device_exit();
If we get here, phonet_netlink_register() failed.
What exactly does phonet_netlink_register() do:
int __init phonet_netlink_register(void)
{
return rtnl_register_many(phonet_rtnl_msg_handlers);
}
And what does phonet_device_exit() do?
void phonet_device_exit(void)
{
rtnl_unregister_all(PF_PHONET);
unregister_netdevice_notifier(&phonet_device_notifier);
unregister_pernet_subsys(&phonet_net_ops);
remove_proc_entry("pnresource", init_net.proc_net);
}
So it tries to unregister something which was not registered. That is
generally a bad idea.
The general pattern in the Linux kernel is that on error, you
carefully unwind everything which succeeded so far. Often you do that
at the end, with a series of goto statements and labels.
Calling the "mirror" function on error does not work, since that
function assumes everything went correctly in its peer.
Andrew
^ permalink raw reply
* Re: [PATCH v3 net 6/6] selftests/xsk: account invalid multi-buffer Tx descriptors
From: Jason Xing @ 2026-07-17 13:56 UTC (permalink / raw)
To: Maciej Fijalkowski
Cc: netdev, bpf, magnus.karlsson, stfomichev, kuba, pabeni, horms,
bjorn
In-Reply-To: <20260714140722.111645-7-maciej.fijalkowski@intel.com>
On Tue, Jul 14, 2026 at 4:08 PM Maciej Fijalkowski
<maciej.fijalkowski@intel.com> wrote:
>
> Invalid descriptors in the middle of a multi-buffer packet still belong
> to the packet being consumed from the Tx ring. The tests should therefore
> count the whole invalid packet as outstanding in verbatim mode, even
> though the packet must not be expected on the Rx side.
>
> Make fragment counting follow the packet boundary instead of stopping at
> the first invalid fragment. Update custom stream generation so invalid
> middle fragments terminate the generated Rx packet while Tx accounting
> still covers all descriptors consumed from the invalid multi-buffer
> packet.
>
> Also add explicit end fragments after invalid middle descriptors. This
> exercises the kernel drain logic and verifies that subsequent valid
> packets are not interpreted as continuations of the invalid packet.
>
> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>]
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
^ permalink raw reply
* Re: [PATCH v3 net 5/6] selftests/xsk: fix too-many-frags multi-buffer Tx test
From: Jason Xing @ 2026-07-17 13:56 UTC (permalink / raw)
To: Maciej Fijalkowski
Cc: netdev, bpf, magnus.karlsson, stfomichev, kuba, pabeni, horms,
bjorn
In-Reply-To: <20260714140722.111645-6-maciej.fijalkowski@intel.com>
On Tue, Jul 14, 2026 at 4:08 PM Maciej Fijalkowski
<maciej.fijalkowski@intel.com> wrote:
>
> The too-many-frags test describes a packet that is valid from the Tx
> ring ownership point of view, but invalid for transmission because it
> exceeds the supported number of fragments.
>
> Keep the generated Tx descriptors valid so that __send_pkts() accounts
> them as outstanding descriptors that must be reclaimed through the CQ.
> Then mark the corresponding Rx packet invalid so the test still does
> not expect the oversized packet to appear on the receive side.
>
> Add a valid synchronization packet after the oversized packet so the
> test can verify that the Tx path drains the bad packet and resumes at
> the next packet boundary.
>
> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
^ permalink raw reply
* Re: [PATCH] net: use sync wakeups for socket error reports
From: Matthew Wilcox @ 2026-07-17 13:47 UTC (permalink / raw)
To: Eric Dumazet
Cc: Usama Arif, Breno Leitao, davem, horms, kuba, kuniyu,
linux-kernel, netdev, pabeni, willemb, shakeel.butt, hannes, riel,
kernel-team
In-Reply-To: <CANn89iLc1Bv_wmKvr_9mtGRM3gL7kgoy2Prr2SgtHY4C=ZgfBg@mail.gmail.com>
On Wed, Jul 08, 2026 at 06:32:02PM +0200, Eric Dumazet wrote:
> On Wed, Jul 8, 2026 at 6:09 PM Usama Arif <usama.arif@linux.dev> wrote:
> > So the workload has SO_TIMESTAMPING enabled on its TCP sockets, and every
> > packet completion and every ACK triggers a timestamp delivery through the
> > error-queue path, which is why sock_def_error_report fires.
>
> It seems we can not please everyone.
>
> https://lore.kernel.org/netdev/20260526063650.952-1-xuewen.yan@unisoc.com/
>
> Perhaps this SYNC heuristic should be a per-socket choice so that
> applications can decide what is best for them.
Instead of adding a new socket option, perhaps use SO_TIMESTAMPING to
decide whether to use sync or not? There could be other socket options
which also report a high rate of "errors", but until those show up I
think just testing on this one socket option should be fine.
^ permalink raw reply
* Re: [PATCH net-next v4] net: mana: Add handler for sriov configure
From: patchwork-bot+netdevbpf @ 2026-07-17 13:40 UTC (permalink / raw)
To: Haiyang Zhang
Cc: linux-hyperv, netdev, kys, haiyangz, wei.liu, decui, longli,
andrew+netdev, davem, edumazet, kuba, pabeni, horms, ernis,
dipayanroy, gargaditya, shradhagupta, linux-kernel, paulros
In-Reply-To: <20260710192735.2921300-1-haiyangz@linux.microsoft.com>
Hello:
This patch was applied to netdev/net-next.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Fri, 10 Jul 2026 12:27:29 -0700 you wrote:
> From: Haiyang Zhang <haiyangz@microsoft.com>
>
> Add callback function for the pci_driver / sriov_configure.
>
> It asks the NIC to provide certain number of VFs, or disable
> VFs if the request is zero.
>
> [...]
Here is the summary with links:
- [net-next,v4] net: mana: Add handler for sriov configure
https://git.kernel.org/netdev/net-next/c/ce6b4d3216b6
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v1 net 2/2] net: Call net_enable_timestamp() before failure in sk_clone().
From: Jason Xing @ 2026-07-17 13:30 UTC (permalink / raw)
To: Kuniyuki Iwashima
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Willem de Bruijn, Simon Horman, Octavian Purdila, Daniel Borkmann,
Alexei Starovoitov, Martin KaFai Lau, Kuniyuki Iwashima, netdev,
Sashiko
In-Reply-To: <20260709183315.965751-3-kuniyu@google.com>
On Thu, Jul 9, 2026 at 8:34 PM Kuniyuki Iwashima <kuniyu@google.com> wrote:
>
> When sk_clone() fails, sk_destruct() is called for the new socket.
>
> If the parent socket has SK_FLAGS_TIMESTAMP in sk->sk_flags,
> net_disable_timestamp() is called for the child socket even though
> net_enable_timestamp() is not called for it.
>
> Let's call net_enable_timestamp() before any failure path in
> sk_clone().
>
> Fixes: 704da560c0a0 ("tcp: update the netstamp_needed counter when cloning sockets")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/all/20260709032007.9E4D61F000E9@smtp.kernel.org/
> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
> ---
> net/core/sock.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/net/core/sock.c b/net/core/sock.c
> index fc3ff0552d68..504d82a3aacd 100644
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -2546,6 +2546,9 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority,
>
> RCU_INIT_POINTER(newsk->sk_reuseport_cb, NULL);
>
> + if (sock_needs_netstamp(sk) && newsk->sk_flags & SK_FLAGS_TIMESTAMP)
> + net_enable_timestamp();
> +
> rcu_read_lock();
> filter = rcu_dereference(sk->sk_filter);
> if (filter != NULL)
> @@ -2595,9 +2598,6 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority,
>
> if (newsk->sk_prot->sockets_allocated)
> sk_sockets_allocated_inc(newsk);
> -
> - if (sock_needs_netstamp(sk) && newsk->sk_flags & SK_FLAGS_TIMESTAMP)
> - net_enable_timestamp();
> out:
> return newsk;
> free:
> --
> 2.55.0.795.g602f6c329a-goog
>
>
^ permalink raw reply
* Re: [PATCH v1 net 1/2] soreuseport: Clear sk_reuseport_cb before failure in sk_clone().
From: Jason Xing @ 2026-07-17 13:30 UTC (permalink / raw)
To: Kuniyuki Iwashima
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Willem de Bruijn, Simon Horman, Octavian Purdila, Daniel Borkmann,
Alexei Starovoitov, Martin KaFai Lau, Kuniyuki Iwashima, netdev,
Sashiko
In-Reply-To: <20260709183315.965751-2-kuniyu@google.com>
On Thu, Jul 9, 2026 at 8:33 PM Kuniyuki Iwashima <kuniyu@google.com> wrote:
>
> When sk_clone() fails, sk_destruct() is called for the new socket.
>
> If the parent socket has sk->sk_reuseport_cb, the child will call
> reuseport_detach_sock() for the reuseport group.
>
> Let's clear sk->sk_reuseport_cb before any failure path in sk_clone().
>
> Note that this was not a problem before the cited commit because
> reuseport_detach_sock() did nothing if the socket was not found in
> the reuseport array.
>
> Fixes: 5dc4c4b7d4e8 ("bpf: Introduce BPF_MAP_TYPE_REUSEPORT_SOCKARRAY")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/all/20260709032007.9E4D61F000E9@smtp.kernel.org/
> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
> ---
> net/core/sock.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/core/sock.c b/net/core/sock.c
> index 8a59bfaa8096..fc3ff0552d68 100644
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -2544,6 +2544,8 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority,
>
> cgroup_sk_clone(&newsk->sk_cgrp_data);
>
> + RCU_INIT_POINTER(newsk->sk_reuseport_cb, NULL);
> +
> rcu_read_lock();
> filter = rcu_dereference(sk->sk_filter);
> if (filter != NULL)
> @@ -2566,8 +2568,6 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority,
> goto free;
> }
>
> - RCU_INIT_POINTER(newsk->sk_reuseport_cb, NULL);
> -
> if (bpf_sk_storage_clone(sk, newsk))
> goto free;
>
> --
> 2.55.0.795.g602f6c329a-goog
>
>
^ permalink raw reply
* [GIT PULL] Networking for v7.2-rc4
From: Paolo Abeni @ 2026-07-17 13:26 UTC (permalink / raw)
To: torvalds; +Cc: kuba, davem, netdev, linux-kernel
Hi Linus!
This is one day later than usual, due to concurrent conferences. For
the same reason it's also dominated by subsystem PRs. Still for the
same reason, the next week's PR is expected to be larger than usual.
The following changes since commit 2c7c88a412aa6d09cd04b414211b4ef8553b5309:
Merge tag 'net-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-07-09 08:26:51 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git net-7.2-rc4
for you to fetch changes up to 56d96fededd61192cd7cc8d2b0f36adfd59036c3:
mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (2026-07-17 13:20:38 +0200)
----------------------------------------------------------------
Including fixes from Wireless, IPsec, Netfilter and Bluetooth.
Current release - new code bugs:
- netfilter: flowtable: use correct direction to set up tunnel route
Previous releases - regressions:
- wifi:
- mac80211:
- free AP_VLAN bc_buf SKBs outside IRQ lock
- defer link RX stats percpu free to RCU
- fix double free on alloc failure
- cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
- ipv4: free fib_alias with kfree_rcu() on insert error path
- sched: act_tunnel_key: Defer dst_release to RCU callback
- xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
- bluetooth: fix locking in unpair_device/disconnect_sync
- can: add locking for raw flags bitfield
- openvswitch: reject oversized nested action attrs
- eth: bnxt_en: handle partially initialized auxiliary devices
- eth: ppp: defer channel free to an RCU grace period to fix UAF
Previous releases - always broken:
- netfilter: xt_nat: reject unsupported target families
- wifi:
- brcmfmac: fix heap overflow on a short auth frame
- cfg80211: add missing FTM API validation
- xfrm:
- reject optional IPTFS templates in outbound policies
- policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
- bluetooth: revalidate LOAD_CONN_PARAM queued update
- can: fix lockless bound/ifindex race and silent RX_SETUP failure
- eth: mlx5: free mlx5_st_idx_data on final dealloc
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
----------------------------------------------------------------
Abdun Nihaal (1):
wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
Alexander Hölzl (1):
can: vxcan: Kconfig: fix description stating no local echo provided
Andre Carvalho (1):
selftests: netconsole: only restore MAC when it changed on resume
Antony Antony (1):
xfrm: reject optional IPTFS templates in outbound policies
Arnd Bergmann (1):
wifi: mac80211: allocate backup ieee80211_nan_sched_cfg off stack
Asim Viladi Oglu Manizada (1):
net: openvswitch: reject oversized nested action attrs
Bryam Vargas (2):
wifi: mac80211_hwsim: clamp virtio RX length before skb_put
net/iucv: take a reference on the socket found in afiucv_hs_rcv()
Cen Zhang (6):
xfrm: cache the offload ifindex for netlink dumps
xfrm: clear mode callbacks after failed mode setup
wifi: cfg80211: cancel sched scan results work on unregister
wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
wifi: cfg80211: use wiphy work for socket owner autodisconnect
Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update
Chen YanJun (1):
xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
Christophe JAILLET (1):
wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
Corentin Labbe (1):
wifi: ralink: RT2X00: init EEPROM properly
Dawei Feng (2):
wifi: libertas: fix memory leak in helper_firmware_cb()
wifi: mac80211: fix memory leak in ieee80211_register_hw()
Eric Dumazet (1):
tcp: fix TIME_WAIT socket reference leak on PSP policy failure
Fan Wu (1):
can: esd_usb: kill anchored URBs before freeing netdevs
Florian Westphal (2):
ipvs: reload ip header after head reallocation
netfilter: xt_physdev: masks are not c-strings
HE WEI (ギカク) (1):
wifi: cfg80211: bound element ID read when checking non-inheritance
Haofeng Li (1):
wifi: cfg80211: validate EHT MLE before MLD ID read
Ivan Vecera (1):
dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
Jamal Hadi Salim (1):
net/sched: act_tunnel_key: Defer dst_release to RCU callback
James Raphael Tiovalen (1):
macsec: fix promiscuity refcount leak in macsec_dev_open()
Julian Anastasov (1):
ipvs: fix more places with wrong ipv6 transport offsets
Laxman Acharya Padhya (1):
Bluetooth: btrtl: validate firmware patch bounds
Lee Jones (1):
can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
Maoyi Xie (3):
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
wifi: mac80211: defer link RX stats percpu free to RCU
wifi: brcmfmac: cyw: fix heap overflow on a short auth frame
Marc Kleine-Budde (2):
Merge patch series "can: bcm: collected fixes"
Merge patch series "net: can: isotp-fixes"
Mikhail Gavrilov (1):
Bluetooth: mgmt: Translate HCI reason in Device Disconnected event
Norbert Szetei (1):
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
Oliver Hartkopp (14):
can: raw: add locking for raw flags bitfield
can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
can: bcm: add locking when updating filter and timer values
can: bcm: fix CAN frame rx/tx statistics
can: bcm: add missing rcu list annotations and operations
can: bcm: extend bcm_tx_lock usage for data and timer updates
can: bcm: validate frame length in bcm_rx_setup() for RTR replies
can: bcm: add missing device refcount for CAN filter removal
can: bcm: fix stale rx/tx ops after device removal
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
can: bcm: track a single source interface for ANYDEV timeout/throttle ops
can: isotp: use unconditional synchronize_rcu() in isotp_release()
can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
can: isotp: serialize TX state transitions under so->rx_lock
Pablo Neira Ayuso (1):
netfilter: flowtable: use correct direction to set up tunnel route
Pagadala Yesu Anjaneyulu (1):
wifi: mac80211: ibss: wait for in-flight TX on disconnect
Paolo Abeni (5):
Merge tag 'wireless-2026-07-09' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless
Merge tag 'ipsec-2026-07-10' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec
Merge tag 'nf-26-07-10' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Merge tag 'for-net-2026-07-13' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Merge tag 'linux-can-fixes-for-7.2-20260716' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
Pauli Virtanen (4):
Bluetooth: hci_sync: extend conn_hash lookup critical sections
Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups
Peddolla Harshavardhan Reddy (1):
wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
Pengpeng Hou (5):
wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
wifi: libertas: reject short monitor TX frames
wifi: rsi: bound background scan probe request copy
wifi: libipw: fix key index receive bound checks
wifi: rsi: validate beacon length before fixed buffer copy
Petr Wozniak (2):
xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()
xfrm: fix stale skb->prev after async crypto steals a GSO segment
Qianyu Luo (1):
xfrm: nat_keepalive: avoid double free on send error
Rafael Beims (2):
wifi: mwifiex: fix roaming to different channel in host_mlme mode
wifi: mwifiex: fix permanently busy scans after multiple roam iterations
Runyu Xiao (2):
wifi: rt2x00: avoid full teardown before work setup in probe
wifi: brcmfmac: initialize SDIO data work before cleanup
Ruoyu Wang (2):
Bluetooth: hci_qca: Clear memdump state on invalid dump size
bnxt_en: Handle partially initialized auxiliary devices
Shahar Tzarfati (1):
wifi: mac80211: recalculate rx_nss on IBSS peer capability update
Shuhao Fu (1):
can: j1939: fix lockless local-destination check
Stéphane Grosjean (1):
can: peak: Modification of references to email accounts being deleted
Weiming Shi (3):
ipv4: fib: free fib_alias with kfree_rcu() on insert error path
sctp: validate STALE_COOKIE cause length before reading staleness
mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
Wyatt Feng (1):
netfilter: xt_nat: reject unsupported target families
Xiang Mei (4):
wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
wifi: mac80211: fix fils_discovery double free on alloc failure
wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
Bluetooth: qca: fix NVM tag length underflow in TLV parser
Xiang Mei (Microsoft) (4):
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
Xin Long (1):
sctp: fix auth_hmacs array size in struct sctp_cookie
Xuanqiang Luo (1):
llc: fix SAP refcount leak when creating incoming sockets
Yizhou Zhao (2):
netfilter: ecache: fix inverted time_after() check
netfilter: nf_conncount: fix zone comparison in tuple dedup
Yousef Alhouseen (1):
wifi: mac80211_hwsim: avoid treating MCS as legacy rate index
Zhao Li (14):
wifi: nl80211: free RNR data on MBSSID mismatch
wifi: mac80211: validate extension-frame layout before RX
wifi: cfg80211: derive S1G beacon TSF from S1G fields
wifi: ieee80211: validate MLE common info length
wifi: nl80211: validate nested MBSSID IE blobs
wifi: nl80211: constrain MBSSID TX link ID range
wifi: cfg80211: validate PMSR measurement type data
wifi: cfg80211: validate PMSR FTM preamble range
wifi: cfg80211: reject unsupported PMSR FTM location requests
wifi: cfg80211: reject empty PMSR peer lists
wifi: mac80211: avoid non-S1G AID fallback for S1G assoc
wifi: mac80211: validate deauth frame length before reason access
wifi: cfg80211: validate rx/tx MLME callback frame lengths before access
wifi: cfg80211: validate assoc response length before status and IE access
Zhengyang Chen (1):
selftests: netfilter: add bridge tunnel flowtable regression
Zhiling Zou (1):
wifi: mac80211: free ack status frame on TX header build failure
Zhiping Zhang (1):
net/mlx5: free mlx5_st_idx_data on final dealloc
.mailmap | 4 +-
drivers/bluetooth/btqca.c | 2 +-
drivers/bluetooth/btrtl.c | 5 +-
drivers/bluetooth/hci_qca.c | 4 +
drivers/dpll/dpll_netlink.c | 3 +
drivers/net/can/Kconfig | 7 +-
drivers/net/can/peak_canfd/peak_canfd.c | 2 +-
drivers/net/can/peak_canfd/peak_canfd_user.h | 2 +-
drivers/net/can/peak_canfd/peak_pciefd_main.c | 4 +-
drivers/net/can/sja1000/peak_pci.c | 4 +-
drivers/net/can/sja1000/peak_pcmcia.c | 4 +-
drivers/net/can/usb/esd_usb.c | 5 +-
drivers/net/can/usb/peak_usb/pcan_usb.c | 2 +-
drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 +-
drivers/net/can/usb/peak_usb/pcan_usb_core.h | 2 +-
drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 2 +-
drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 2 +-
drivers/net/can/usb/peak_usb/pcan_usb_pro.h | 2 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 39 +-
drivers/net/ethernet/mellanox/mlx5/core/lib/st.c | 1 +
drivers/net/macsec.c | 7 +-
drivers/net/ppp/ppp_generic.c | 18 +-
.../broadcom/brcm80211/brcmfmac/cyw/core.c | 6 +
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 +-
drivers/net/wireless/intel/ipw2x00/libipw_rx.c | 4 +-
drivers/net/wireless/intersil/p54/txrx.c | 8 +
drivers/net/wireless/marvell/libertas/firmware.c | 1 +
drivers/net/wireless/marvell/libertas/tx.c | 7 +
drivers/net/wireless/marvell/libertas_tf/main.c | 2 +-
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 +-
drivers/net/wireless/marvell/mwifiex/join.c | 1 -
drivers/net/wireless/ralink/rt2x00/rt2400pci.c | 2 +-
drivers/net/wireless/ralink/rt2x00/rt2500pci.c | 2 +-
drivers/net/wireless/ralink/rt2x00/rt2800pci.c | 2 +-
drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 12 +-
drivers/net/wireless/ralink/rt2x00/rt61pci.c | 2 +-
drivers/net/wireless/rsi/rsi_91x_hal.c | 8 +
drivers/net/wireless/rsi/rsi_91x_mgmt.c | 12 +-
drivers/net/wireless/virtual/mac80211_hwsim_main.c | 16 +-
include/linux/can/dev/peak_canfd.h | 2 +-
include/linux/ieee80211-eht.h | 12 +-
include/net/bluetooth/hci_core.h | 1 +
include/net/cfg80211.h | 4 +-
include/net/sctp/structs.h | 3 +-
include/net/xfrm.h | 2 +
net/bluetooth/hci_event.c | 18 +-
net/bluetooth/hci_sync.c | 66 ++-
net/bluetooth/mgmt.c | 105 +++-
net/can/bcm.c | 646 ++++++++++++++++-----
net/can/isotp.c | 298 +++++++---
net/can/j1939/transport.c | 18 +-
net/can/raw.c | 66 +--
net/core/dev.c | 10 +-
net/ipv4/fib_trie.c | 2 +-
net/ipv4/tcp_ipv4.c | 6 +-
net/ipv6/netfilter.c | 4 +-
net/ipv6/tcp_ipv6.c | 6 +-
net/ipv6/xfrm6_policy.c | 1 +
net/iucv/af_iucv.c | 4 +
net/llc/llc_conn.c | 1 -
net/mac80211/cfg.c | 11 +-
net/mac80211/ibss.c | 13 +-
net/mac80211/iface.c | 8 +-
net/mac80211/main.c | 3 +-
net/mac80211/mlme.c | 12 +-
net/mac80211/nan.c | 35 +-
net/mac80211/rx.c | 34 +-
net/mac80211/sta_info.c | 15 +-
net/mac80211/tx.c | 17 +-
net/mac80211/util.c | 3 +
net/mpls/af_mpls.c | 3 +
net/netfilter/ipvs/ip_vs_app.c | 10 +-
net/netfilter/ipvs/ip_vs_core.c | 3 +-
net/netfilter/ipvs/ip_vs_xmit.c | 6 +-
net/netfilter/nf_conncount.c | 6 +-
net/netfilter/nf_conntrack_ecache.c | 2 +-
net/netfilter/nf_flow_table_core.c | 6 +-
net/netfilter/xt_nat.c | 9 +
net/netfilter/xt_physdev.c | 5 -
net/openvswitch/flow_netlink.c | 201 +++++--
net/sched/act_tunnel_key.c | 14 +-
net/sctp/sm_statefuns.c | 23 +-
net/wireless/core.c | 14 +-
net/wireless/core.h | 4 +-
net/wireless/mlme.c | 101 +++-
net/wireless/nl80211.c | 25 +-
net/wireless/pmsr.c | 34 +-
net/wireless/scan.c | 18 +-
net/wireless/sme.c | 6 +-
net/xfrm/xfrm_device.c | 13 +-
net/xfrm/xfrm_iptfs.c | 1 +
net/xfrm/xfrm_nat_keepalive.c | 15 +-
net/xfrm/xfrm_policy.c | 4 +-
net/xfrm/xfrm_state.c | 12 +-
net/xfrm/xfrm_user.c | 41 +-
.../drivers/net/netconsole/netcons_resume.sh | 3 +-
.../selftests/net/netfilter/nft_flowtable.sh | 55 ++
98 files changed, 1681 insertions(+), 601 deletions(-)
^ permalink raw reply
* [PATCH net v3] net: dpaa: fix mode setting
From: Michael Walle @ 2026-07-17 13:20 UTC (permalink / raw)
To: Madalin Bucur, Sean Anderson, Andrew Lunn, David S . Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni
Cc: netdev, linux-kernel, Michael Walle
Before converting to the phylink interface, the init function would have
set a non-reserved I/F mode in the maccfg2 register. After converting to
phylink, 0 is written as mode, which is a reserved value (although it's
the hardware default). Without a valid mode, a SGMII link is never
established between the MAC and the PHY and thus .link_up() is never
called which could set the correct mode according to the actual speed.
Fix it by setting the maximum speed of the phy_interface_t in use in
.mac_config() - just like the driver did before the phylink conversion.
Fixes: 5d93cfcf7360 ("net: dpaa: Convert to phylink")
Suggested-by: Sean Anderson <sean.anderson@linux.dev>
Signed-off-by: Michael Walle <mwalle@kernel.org>
---
I didn't grab Sean's Rb tag as this is somewhat different.
Changes in v3:
- keep the mode setting also in .adjust_link().
- reword the commit message, to be (hopefully) more precise
- Link to v2: https://lore.kernel.org/r/20260710143430.2276141-1-mwalle@kernel.org/
Changes in v2:
- the setting is/was based on the maximum speed, not the current
speed. thus, move the setting into mac_config().
- Link to v1: https://lore.kernel.org/r/20260706121011.1948906-1-mwalle@kernel.org/
.../net/ethernet/freescale/fman/fman_dtsec.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/freescale/fman/fman_dtsec.c b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
index fe35703c509e..b8d70c0ecb6c 100644
--- a/drivers/net/ethernet/freescale/fman/fman_dtsec.c
+++ b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
@@ -900,22 +900,28 @@ static void dtsec_mac_config(struct phylink_config *config, unsigned int mode,
{
struct mac_device *mac_dev = fman_config_to_mac(config);
struct dtsec_regs __iomem *regs = mac_dev->fman_mac->regs;
- u32 tmp;
+ u32 ecntrl, maccfg2;
+
+ maccfg2 = ioread32be(®s->maccfg2);
+ maccfg2 &= ~(MACCFG2_NIBBLE_MODE | MACCFG2_BYTE_MODE);
switch (state->interface) {
case PHY_INTERFACE_MODE_RMII:
- tmp = DTSEC_ECNTRL_RMM;
+ ecntrl = DTSEC_ECNTRL_RMM;
+ maccfg2 |= MACCFG2_NIBBLE_MODE;
break;
case PHY_INTERFACE_MODE_RGMII:
case PHY_INTERFACE_MODE_RGMII_ID:
case PHY_INTERFACE_MODE_RGMII_RXID:
case PHY_INTERFACE_MODE_RGMII_TXID:
- tmp = DTSEC_ECNTRL_GMIIM | DTSEC_ECNTRL_RPM;
+ ecntrl = DTSEC_ECNTRL_GMIIM | DTSEC_ECNTRL_RPM;
+ maccfg2 |= MACCFG2_BYTE_MODE;
break;
case PHY_INTERFACE_MODE_SGMII:
case PHY_INTERFACE_MODE_1000BASEX:
case PHY_INTERFACE_MODE_2500BASEX:
- tmp = DTSEC_ECNTRL_TBIM | DTSEC_ECNTRL_SGMIIM;
+ ecntrl = DTSEC_ECNTRL_TBIM | DTSEC_ECNTRL_SGMIIM;
+ maccfg2 |= MACCFG2_BYTE_MODE;
break;
default:
dev_warn(mac_dev->dev, "cannot configure dTSEC for %s\n",
@@ -923,7 +929,8 @@ static void dtsec_mac_config(struct phylink_config *config, unsigned int mode,
return;
}
- iowrite32be(tmp, ®s->ecntrl);
+ iowrite32be(ecntrl, ®s->ecntrl);
+ iowrite32be(maccfg2, ®s->maccfg2);
}
static void dtsec_link_up(struct phylink_config *config, struct phy_device *phy,
--
2.47.3
^ permalink raw reply related
* Re: [PATCH v8 06/10] rust: miscdevice: set fops.owner from driver module pointer
From: Greg Kroah-Hartman @ 2026-07-17 13:07 UTC (permalink / raw)
To: Alvin Sun
Cc: Miguel Ojeda, Boqun Feng, Gary Guo, Björn Roy Baron,
Benno Lossin, Andreas Hindborg, Alice Ryhl, Trevor Gross,
Danilo Krummrich, Luis Chamberlain, Petr Pavlu, Daniel Gomez,
Sami Tolvanen, Aaron Tomlin, Rafael J. Wysocki, David Airlie,
Simona Vetter, Daniel Almeida, Arnd Bergmann, Brendan Higgins,
David Gow, Rae Moar, Breno Leitao, Jens Axboe, Dave Ertman,
Leon Romanovsky, Igor Korotin, FUJITA Tomonori, Bjorn Helgaas,
Krzysztof Wilczyński, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Carlos Llamas, rust-for-linux, linux-modules,
driver-core, dri-devel, nova-gpu, linux-kselftest, kunit-dev,
linux-block, linux-kernel, netdev, linux-pci
In-Reply-To: <20260713-fix-fops-owner-v8-6-2495cfa82d47@linux.dev>
On Mon, Jul 13, 2026 at 02:45:27PM +0800, Alvin Sun wrote:
> Set the miscdevice fops owner field from the driver module pointer
> via the `this_module::<T::OwnerModule>()` helper, instead of
> defaulting to null.
>
> Assisted-by: opencode:glm-5.2
> Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org>
> Reviewed-by: Gary Guo <gary@garyguo.net>
> Acked-by: Danilo Krummrich <dakr@kernel.org>
> Signed-off-by: Alvin Sun <alvin.sun@linux.dev>
> ---
> rust/kernel/miscdevice.rs | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
^ permalink raw reply
* Re: [PATCH net-next 5/7] phonet: pep: convert getsockopt to sockopt_t
From: Breno Leitao @ 2026-07-17 13:02 UTC (permalink / raw)
To: David Laight
Cc: sdf, David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Alexander Aring, Stefan Schmidt, Miquel Raynal,
Remi Denis-Courmont, Rémi Denis-Courmont, John Fastabend,
Sabrina Dubroca, Shuah Khan, netdev, linux-kernel, linux-wpan,
linux-kselftest, kernel-team
In-Reply-To: <20260717092258.776e63db@pumpkin>
On Fri, Jul 17, 2026 at 09:22:58AM +0100, David Laight wrote:
> > - len = min_t(unsigned int, sizeof(int), len);
> > - if (put_user(len, optlen))
> > + len = min_t(unsigned int, sizeof(int), opt->optlen);
>
> I'm pretty sure that can be min().
Right. opt->optlen is a plain int and sizeof(int) is a non-negative
constant, so min() takes it fine.
I'll switch it to min() in v2, thanks for the review.
> More generally I'm not at all sure about negative lengths.
> Historically the user type would have been 'int', but it got replaced
> by socklen_t which is probably unsigned.
> (IIRC one of the 64bit Unix had started using a 64bit type but I think
> it was sun objected to making that change so socklen_t was born.)
That's now handled one level up, in sockopt_init_user():
if (get_user(len, optlen))
return -EFAULT;
if (len < 0)
return -EINVAL;
> Also truncating below 4 bytes makes no sense here on BE systems.
Sure, but this is pre-existing, isn't it?
> Some code will try to write the significant bytes out, but that
> would be better done in the wrapper.
This is the transitional shim. The ->getsockopt prototype is shared by
every proto:
int (*getsockopt)(struct sock *sk, int level, int optname,
char __user *optval, int __user *optlen);
So it can't take a sockopt_t until every leaf is converted.
Each converted leaf keeps the __user signature, builds the sockopt_t
itself and calls a do_*_getsockopt(sk, optname, sockopt_t *) helper.
Once all the getsockopt leaves are done, sockopt_init_user() moves into
the common caller, the prototype flips to sockopt_t *, and these
per-leaf wrappers are deleted. The full plan is in the phase-1 cover
letter:
https://lore.kernel.org/all/20260401-getsockopt-v2-0-611df6771aff@debian.org/
Thanks for the review,
--breno
^ permalink raw reply
* Re: [PATCH net v2] net: dpaa: fix mode setting
From: Michael Walle @ 2026-07-17 12:57 UTC (permalink / raw)
To: Paolo Abeni, Sean Anderson, Madalin Bucur, Andrew Lunn,
David S . Miller, Eric Dumazet, Jakub Kicinski, Russell King
Cc: netdev, linux-kernel
In-Reply-To: <382033a5-77a6-4505-ac50-58120308507b@redhat.com>
[-- Attachment #1: Type: text/plain, Size: 2116 bytes --]
On Fri Jul 17, 2026 at 2:44 PM CEST, Paolo Abeni wrote:
> On 7/17/26 2:05 PM, Sean Anderson wrote:
>> On 7/17/26 07:11, Paolo Abeni wrote:
>>> On 7/17/26 12:13 PM, Michael Walle wrote:
>>>> I've seen that, but.. that was the actual change between v1 and v2
>>>> as suggested by Sean. It does not depend on the actual link speed,
>>>> but the maximum link speed. So it is not relevant if the link
>>>> negotiates to a slower speed or not. At least that now matches the
>>>> behavior prior to the phylink conversion. If that was working -
>>>> that I can't tell you.
>>>
>>> I'm sorry, following all cross revision discussion is a bit hard here.
>>>
>>> I don't understand if the 'link never established' is specific of your
>>> board, or it a constant with this driver. Could you please clarify?
I don't think it's related to my board, but rather to the link being
a SGMII one on my board. I assume Sean had an RGMII link while
converting the driver (?) and moreover, that it worked correctly
there :)
>> I think we should set byte/nibble mode in link_up as well as mac_config. That
>> should fix the problem where the link never comes up (possibly broken since
>> the phylink conversion). I think it's unlikely that this config is supposed
>> to match the phy interface speed and not the link speed, but you never know...
> FTR, the above does not answer my question ;)
>
> Still I think (mostly guess) bringing the mode initialization in both
> link_up and mac_config should be safer (that is, I agree with the above
> plan).
I agree. I looked at the original driver and there adjust_link()
will also select between byte and nibble mode. I'll prepare a v3.
Sorry, I misunderstood Sean's intention/suggestion, thanks for
pushing on this. FWIW, I also tried with nibble mode as the initial
configuration on my board and link_up() is getting called. Whereas
if it's 0 (as in being documented as "reserved", though it's the
default), .link_up() is never called. Thus, it seems that it just
has to be any valid setting until link_up() will set the correct
value.
-michael
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 297 bytes --]
^ permalink raw reply
* Re: [PATCH net-next v6 1/2] net: dsa: realtek: rtl8365mb: add SGMII support for RTL8367S
From: Stanislaw @ 2026-07-17 12:51 UTC (permalink / raw)
To: Johan Alvarado, Mieczyslaw Nalewaj
Cc: Linus Walleij, Alvin Sipraga, Andrew Lunn, Vladimir Oltean,
David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Russell King, Maxime Chevallier, Luiz Angelo Daros de Luca,
netdev, linux-kernel
In-Reply-To: <e252cb3c-bfb2-4d62-aec7-e04b9aafe223@yahoo.com>
Hi,
I have been testing this series on a second RTL8367S board: a TP-Link
Archer AX55 v1, where the switch SerDes runs HSGMII (2500base-x) on
external interface 1 to an IPQ5018 gmac1 (stmmac, fixed-link), on an
OpenWrt 6.12 kernel. Some cold-boot results that may be relevant to the
calibration discussion.
Test image carried, on top of the v6 series:
- the SDS indirect-access busy-wait fix, and
- the ~98 ms PLL-settle delay plus the 0x060C-0x060F "Local Jam
Table" analog calibration proposed in this thread.
Result: after the router sat powered off overnight (multi-hour cold
soak), the first boot still came up with the trunk degraded - in this
run completely dead. The switch reported link up (2.5G/Full), no
CRC/symbol error counters moving, but dot1dTpPortInDiscards climbing
on the CPU-facing port, and the WAN never got a DHCP lease (ping:
sendto: Network unreachable). Milder runs of the same state show
55-70 % packet loss with sub-ms RTT on the frames that do pass. So on
this board the analog calibration, like the BMCR data-path reset and
the busy-wait before it, does not prevent the cold-start bad state.
What does cure it, without a reboot: a full driver re-probe. Unbinding
and re-binding the switch device re-runs the whole probe path - the
GPIO hardware reset of the RTL8367S plus the complete chip init (all
jam tables) - and the trunk comes back clean immediately:
----- BEFORE: ping upstream router
ping: sendto: Network unreachable
----- BEFORE: CPU port discards
dot1dTpPortInDiscards: 17 (climbing)
===== echo <dev> > .../unbind ; echo <dev> > .../bind =====
... wan: Link is Up - 1Gbps/Full - flow control rx/tx
----- AFTER: ping upstream router
20 packets transmitted, 20 received, 0% packet loss
A soft reboot fixes it the same way (sometimes on the second try).
Short power-cycles (~1 min off) do not reproduce it; only a multi-hour
cold soak does. Anything that resets the SerDes without the full chip
re-init (BMCR data-path reset, repeated reset pulses) leaves the bad
state in place - one variant I tried even reports the port healthy
after a reset pulse while the datapath keeps mangling frames.
To me this points away from the SerDes analog front-end tuning values:
the first full init on cold silicon lands the chip in a bad state, and
a repeated full init clears it, hours later, with the silicon warm or
cold. That looks more like an ordering/settling problem in the early
init sequence than like the calibration vector itself.
On the hardware-health question raised elsewhere: the board looks
clean, no bulging/dried capacitors, and the 3.3 V and 1.8 V rails
measure correct. But this is a single unit, so I cannot rule out a
marginal sample - the cold-soak state does reproduce reliably here
every morning, which at least makes it a good test bench.
Happy to test any patch or instrumented build on this hardware.
Best regards,
Stanislaw
^ permalink raw reply
* Re: [PATCH net v2] net: dpaa: fix mode setting
From: Paolo Abeni @ 2026-07-17 12:44 UTC (permalink / raw)
To: Sean Anderson, Michael Walle, Madalin Bucur, Andrew Lunn,
David S . Miller, Eric Dumazet, Jakub Kicinski, Russell King
Cc: netdev, linux-kernel
In-Reply-To: <eee42ee1-386e-996f-b9d8-8aa2e820d311@linux.dev>
On 7/17/26 2:05 PM, Sean Anderson wrote:
> On 7/17/26 07:11, Paolo Abeni wrote:
>> On 7/17/26 12:13 PM, Michael Walle wrote:
>>> I've seen that, but.. that was the actual change between v1 and v2
>>> as suggested by Sean. It does not depend on the actual link speed,
>>> but the maximum link speed. So it is not relevant if the link
>>> negotiates to a slower speed or not. At least that now matches the
>>> behavior prior to the phylink conversion. If that was working -
>>> that I can't tell you.
>>
>> I'm sorry, following all cross revision discussion is a bit hard here.
>>
>> I don't understand if the 'link never established' is specific of your
>> board, or it a constant with this driver. Could you please clarify?
>
> I think we should set byte/nibble mode in link_up as well as mac_config. That
> should fix the problem where the link never comes up (possibly broken since
> the phylink conversion). I think it's unlikely that this config is supposed
> to match the phy interface speed and not the link speed, but you never know...
FTR, the above does not answer my question ;)
Still I think (mostly guess) bringing the mode initialization in both
link_up and mac_config should be safer (that is, I agree with the above
plan).
/P
^ permalink raw reply
* Re: [PATCH net-next v9 1/9] net: Use helpers to get/set UDP len tree-wide
From: Simon Horman @ 2026-07-17 12:40 UTC (permalink / raw)
To: Alice Mikityanska
Cc: alice.kernel, daniel, davem, edumazet, kuba, pabeni, lucien.xin,
willemdebruijn.kernel, willemb, dsahern, razor, shuah, stfomichev,
andrew+netdev, fw, netdev
In-Reply-To: <CAD0BsJWRPNsQrBT06QqCtB5atqjBQz4y8QWvGg-v2WZDqRiPRA@mail.gmail.com>
On Thu, Jul 16, 2026 at 06:18:59PM +0300, Alice Mikityanska wrote:
> On Thu, 16 Jul 2026 at 17:47, Simon Horman <horms@kernel.org> wrote:
> >
> > This is an AI-generated review of your patch. The human sending this
> > email has considered the AI review valid, or at least plausible.
> > Full review at: https://sashiko.dev
> > ---
> > --- Patch [1]: [PATCH net-next v9 1/9] net: Use helpers to get/set UDP len tree-wide ---
> > commit 113d28557bcedccc492f330fafdaaf1377eb2e79
> > Author: Alice Mikityanska <alice@isovalent.com>
> >
> > net: Use helpers to get/set UDP len tree-wide
> >
> > This commit introduces helpers for setting and getting the UDP header length
> > tree-wide. It prepares the codebase to support BIG TCP for UDP tunnels by
> > explicitly handling cases where UDP length might be 0 for packets larger
> > than 65535 bytes.
> >
> > > diff --git a/net/6lowpan/nhc_udp.c b/net/6lowpan/nhc_udp.c
> > > index 0a506c77283dd..ed4227e6db744 100644
> > > --- a/net/6lowpan/nhc_udp.c
> > > +++ b/net/6lowpan/nhc_udp.c
> > > @@ -88,16 +88,16 @@ static int udp_uncompress(struct sk_buff *skb, size_t needed)
> > > switch (lowpan_dev(skb->dev)->lltype) {
> > > case LOWPAN_LLTYPE_IEEE802154:
> > > if (lowpan_802154_cb(skb)->d_size)
> > > - uh.len = htons(lowpan_802154_cb(skb)->d_size -
> > > - sizeof(struct ipv6hdr));
> > > + udp_set_len_short(&uh, lowpan_802154_cb(skb)->d_size -
> > > + sizeof(struct ipv6hdr));
> >
> > [Severity: High]
> > If a crafted packet specifies a datagram size smaller than
> > sizeof(struct ipv6hdr), won't this subtraction underflow?
>
> First, I'd like to emphasize that I'm merely converting direct uh.len
> access to the new helper. If there is an existing bug with underflow,
> my new helper will expose it with a WARN, which is good. But should
> such bugs exist before this refactoring, I don't think that fixing all
> of them is in scope of this series.
Yes, point taken.
...
> > [Severity: High]
> > If gro_max_size is configured larger than 65535 (which is supported and used
> > for BIG TCP), can't UDP GRO aggregate packets such that newlen > 65535?
>
> This is the first patch that just converted direct access to helpers.
> Patch 4 "udp: Support gro_ipv4_max_size > 65536" explicitly enables
> len > 64k and replaces this line with udp_set_len. This comment on
> patch 1 is irrelevant because it assumes that functionality added in a
> later patch should work in a prior patch.
Agreed, the AI-generated review seems wide of the mark here.
...
> > [Severity: High]
> > When transmitting a TCP BIG TCP packet (which can be > 64K) over a UDP
> > tunnel like VXLAN, skb->len will exceed 65535.
> >
> > Does using udp_set_len_short() here incorrectly trigger the warning for
> > valid large GSO payloads?
>
> Same here. This is replaced by udp_set_len, which supports len > 64k,
> in the patch that actually enables len > 64k.
>
> > > [ ... ]
> > > diff --git a/net/ipv6/ip6_udp_tunnel.c b/net/ipv6/ip6_udp_tunnel.c
> > > index 9adb5775487fa..dcff7fb16ff64 100644
> > > --- a/net/ipv6/ip6_udp_tunnel.c
> > > +++ b/net/ipv6/ip6_udp_tunnel.c
> > > @@ -93,7 +93,7 @@ void udp_tunnel6_xmit_skb(struct dst_entry *dst, struct sock *sk,
> > > uh->dest = dst_port;
> > > uh->source = src_port;
> > >
> > > - uh->len = htons(skb->len);
> > > + udp_set_len_short(uh, skb->len);
> >
> > [Severity: High]
> > This appears to have the same issue as IPv4 tunnels. If a large GSO payload
> > is sent through an IPv6 UDP tunnel, won't skb->len exceed 65535 and trigger
> > the warning?
>
> Same here.
>
> I'm sorry, but I highly doubt that these AI review comments were validated.
Clearly my validation was insufficient.
Sorry about that.
^ permalink raw reply
* Re: [PATCH] net: use sync wakeups for socket error reports
From: Usama Arif @ 2026-07-17 12:31 UTC (permalink / raw)
To: Breno Leitao, Eric Dumazet, guohua.yan, xuewen.yan
Cc: davem, horms, kuba, kuniyu, linux-kernel, netdev, pabeni, willemb,
shakeel.butt, hannes, riel, kernel-team
In-Reply-To: <alodxQoCH5A5iVGG@gmail.com>
On 17/07/2026 13:20, Breno Leitao wrote:
> On Wed, Jul 08, 2026 at 06:32:02PM +0200, Eric Dumazet wrote:
>
>> Perhaps this SYNC heuristic should be a per-socket choice so that
>> applications can decide what is best for them.
>
> Something like this?
>
> net: add SO_ERR_WAKE_SYNC for sync error-report wakeups
>
> sock_def_error_report() wakes EPOLLERR waiters with
> wake_up_interruptible_poll(), while sock_def_readable() and
> sock_def_write_space() already pass the sync hint. A socket with
> SO_TIMESTAMPING enabled delivers every TX and ACK timestamp through
> sk_error_queue and raises EPOLLERR, so the error path wakes a sleeping
> consumer very often.
>
> Without the sync hint the scheduler often places the woken consumer on a
> remote CPU, which costs a rescheduling IPI. Usama Arif measured 16,326
> such IPIs/min on a 176-core host running a production workload with
> SO_TIMESTAMPING enabled. [1]
>
> Switching the error path to a sync wakeup unconditionally is not the
> right fix, as there are different requirements for it to be async, see
> [2].
>
> Eric suggested that an options is to add SO_ERR_WAKE_SYNC so
> applications choose per socket, so a consumer draining a high-rate error
> queue can opt in to keep the wakeup local and drop the IPI, using socket
> flag SO_ERR_WAKE_SYNC.
>
> Link: https://lore.kernel.org/all/CANn89iLc1Bv_wmKvr_9mtGRM3gL7kgoy2Prr2SgtHY4C=ZgfBg@mail.gmail.com/ [1]
> Link: https://lore.kernel.org/netdev/20260526063650.952-1-xuewen.yan@unisoc.com/ [2]
> Suggested-by: Eric Dumazet <edumazet@google.com>
> Signed-off-by: Breno Leitao <leitao@debian.org>
>
> diff --git a/arch/alpha/include/uapi/asm/socket.h b/arch/alpha/include/uapi/asm/socket.h
> index 5ef57f88df6b3..2a3c27aaf4e95 100644
> --- a/arch/alpha/include/uapi/asm/socket.h
> +++ b/arch/alpha/include/uapi/asm/socket.h
> @@ -155,6 +155,8 @@
> #define SO_INQ 84
> #define SCM_INQ SO_INQ
>
> +#define SO_ERR_WAKE_SYNC 85
> +
> #if !defined(__KERNEL__)
>
> #if __BITS_PER_LONG == 64
> diff --git a/arch/mips/include/uapi/asm/socket.h b/arch/mips/include/uapi/asm/socket.h
> index 72fb1b006da93..00f31c74a63df 100644
> --- a/arch/mips/include/uapi/asm/socket.h
> +++ b/arch/mips/include/uapi/asm/socket.h
> @@ -166,6 +166,8 @@
> #define SO_INQ 84
> #define SCM_INQ SO_INQ
>
> +#define SO_ERR_WAKE_SYNC 85
> +
> #if !defined(__KERNEL__)
>
> #if __BITS_PER_LONG == 64
> diff --git a/arch/parisc/include/uapi/asm/socket.h b/arch/parisc/include/uapi/asm/socket.h
> index c16ec36dfee6b..db5b6cad17d49 100644
> --- a/arch/parisc/include/uapi/asm/socket.h
> +++ b/arch/parisc/include/uapi/asm/socket.h
> @@ -147,6 +147,8 @@
> #define SO_INQ 0x4052
> #define SCM_INQ SO_INQ
>
> +#define SO_ERR_WAKE_SYNC 0x4053
> +
> #if !defined(__KERNEL__)
>
> #if __BITS_PER_LONG == 64
> diff --git a/arch/sparc/include/uapi/asm/socket.h b/arch/sparc/include/uapi/asm/socket.h
> index 71befa109e1cf..5e9ff3634265c 100644
> --- a/arch/sparc/include/uapi/asm/socket.h
> +++ b/arch/sparc/include/uapi/asm/socket.h
> @@ -148,6 +148,8 @@
> #define SO_INQ 0x005d
> #define SCM_INQ SO_INQ
>
> +#define SO_ERR_WAKE_SYNC 0x005e
> +
> #if !defined(__KERNEL__)
>
>
> diff --git a/include/net/sock.h b/include/net/sock.h
> index 51185222aac29..d8ee1dae8ecaf 100644
> --- a/include/net/sock.h
> +++ b/include/net/sock.h
> @@ -1022,6 +1022,7 @@ enum sock_flags {
> SOCK_RCVMARK, /* Receive SO_MARK ancillary data with packet */
> SOCK_RCVPRIORITY, /* Receive SO_PRIORITY ancillary data with packet */
> SOCK_TIMESTAMPING_ANY, /* Copy of sk_tsflags & TSFLAGS_ANY */
> + SOCK_ERR_WAKE_SYNC, /* Sync wakeup on error report, %SO_ERR_WAKE_SYNC */
> };
>
> #define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE))
> diff --git a/include/uapi/asm-generic/socket.h b/include/uapi/asm-generic/socket.h
> index 53b5a8c002b1e..5527c9318b40e 100644
> --- a/include/uapi/asm-generic/socket.h
> +++ b/include/uapi/asm-generic/socket.h
> @@ -150,6 +150,8 @@
> #define SO_INQ 84
> #define SCM_INQ SO_INQ
>
> +#define SO_ERR_WAKE_SYNC 85
> +
> #if !defined(__KERNEL__)
>
> #if __BITS_PER_LONG == 64 || (defined(__x86_64__) && defined(__ILP32__))
> diff --git a/net/core/sock.c b/net/core/sock.c
> index 498a57f34f5b5..59caab6a7223a 100644
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -1557,6 +1557,10 @@ int sk_setsockopt(struct sock *sk, int level, int optname,
> sock_valbool_flag(sk, SOCK_SELECT_ERR_QUEUE, valbool);
> break;
>
> + case SO_ERR_WAKE_SYNC:
> + sock_valbool_flag(sk, SOCK_ERR_WAKE_SYNC, valbool);
> + break;
> +
> case SO_PASSCRED:
> if (sk_may_scm_recv(sk))
> sk->sk_scm_credentials = valbool;
> @@ -2064,6 +2068,10 @@ int sk_getsockopt(struct sock *sk, int level, int optname,
> v.val = sock_flag(sk, SOCK_SELECT_ERR_QUEUE);
> break;
>
> + case SO_ERR_WAKE_SYNC:
> + v.val = sock_flag(sk, SOCK_ERR_WAKE_SYNC);
> + break;
> +
> #ifdef CONFIG_NET_RX_BUSY_POLL
> case SO_BUSY_POLL:
> v.val = READ_ONCE(sk->sk_ll_usec);
> @@ -3641,8 +3649,12 @@ static void sock_def_error_report(struct sock *sk)
>
> rcu_read_lock();
> wq = rcu_dereference(sk->sk_wq);
> - if (skwq_has_sleeper(wq))
> - wake_up_interruptible_poll(&wq->wait, EPOLLERR);
> + if (skwq_has_sleeper(wq)) {
> + if (sock_flag(sk, SOCK_ERR_WAKE_SYNC))
> + wake_up_interruptible_sync_poll(&wq->wait, EPOLLERR);
> + else
> + wake_up_interruptible_poll(&wq->wait, EPOLLERR);
> + }
Not just in report, but sock_def_write_space() and sock_def_readable() as well?
> sk_wake_async_rcu(sk, SOCK_WAKE_IO, POLL_ERR);
> rcu_read_unlock();
> }
^ permalink raw reply
* Re: [PATCH] netconsole configfs target release NULL dereference
From: Breno Leitao @ 2026-07-17 12:29 UTC (permalink / raw)
To: David Lee
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, netdev, Dominik 'Disconnect3d' Czarnota,
linux-kernel
In-Reply-To: <20260717103903.38514-1-david.lee@trailofbits.com>
Hello David,
On Fri, Jul 17, 2026 at 10:39:02AM +0000, David Lee wrote:
> configfs target release can call netpoll cleanup with missing netpoll state.
>
> Mark targets as disabled before releasing their netpoll state and skip
> cleanup when no netpoll device is present. This prevents teardown races
> from reaching netpoll cleanup after nt->np.dev has already been cleared.
>
> Fixes: 97714695ef90 ("net: netconsole: Defer netpoll cleanup to avoid lock release during list traversal")
> Signed-off-by: David Lee <david.lee@trailofbits.com>
> Assisted-by: Codex:gpt-5.5
> ---
>
> drivers/net/netconsole.c | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
> index 862001d..ad30e2e 100644
> --- a/drivers/net/netconsole.c
> +++ b/drivers/net/netconsole.c
> @@ -287,6 +287,8 @@ static bool bound_by_mac(struct netconsole_target *nt)
>
> static void netcons_release_dev(struct netconsole_target *nt)
> {
> + if (!nt->np.dev)
> + return;
I am not sure we get here with nt->np.dev unset, otherwise it will
panic in the next lines:
netcons_release_dev() calls do_netpoll_cleanup(), which calls calls
__netpoll_cleanup() which dereferences dev, as in:
static void __netpoll_cleanup(struct netpoll *np)
...
npinfo = rtnl_dereference(np->dev->npinfo);
Are you hitting this NULL pointer dereference, thus, we need the early
return above?
Thanks for the patch,
--breno
^ permalink raw reply
* Re: [PATCH] net: use sync wakeups for socket error reports
From: Breno Leitao @ 2026-07-17 12:20 UTC (permalink / raw)
To: Eric Dumazet, guohua.yan, xuewen.yan, usama.arif
Cc: davem, horms, kuba, kuniyu, linux-kernel, netdev, pabeni, willemb,
shakeel.butt, hannes, riel, kernel-team
In-Reply-To: <CANn89iLc1Bv_wmKvr_9mtGRM3gL7kgoy2Prr2SgtHY4C=ZgfBg@mail.gmail.com>
On Wed, Jul 08, 2026 at 06:32:02PM +0200, Eric Dumazet wrote:
> Perhaps this SYNC heuristic should be a per-socket choice so that
> applications can decide what is best for them.
Something like this?
net: add SO_ERR_WAKE_SYNC for sync error-report wakeups
sock_def_error_report() wakes EPOLLERR waiters with
wake_up_interruptible_poll(), while sock_def_readable() and
sock_def_write_space() already pass the sync hint. A socket with
SO_TIMESTAMPING enabled delivers every TX and ACK timestamp through
sk_error_queue and raises EPOLLERR, so the error path wakes a sleeping
consumer very often.
Without the sync hint the scheduler often places the woken consumer on a
remote CPU, which costs a rescheduling IPI. Usama Arif measured 16,326
such IPIs/min on a 176-core host running a production workload with
SO_TIMESTAMPING enabled. [1]
Switching the error path to a sync wakeup unconditionally is not the
right fix, as there are different requirements for it to be async, see
[2].
Eric suggested that an options is to add SO_ERR_WAKE_SYNC so
applications choose per socket, so a consumer draining a high-rate error
queue can opt in to keep the wakeup local and drop the IPI, using socket
flag SO_ERR_WAKE_SYNC.
Link: https://lore.kernel.org/all/CANn89iLc1Bv_wmKvr_9mtGRM3gL7kgoy2Prr2SgtHY4C=ZgfBg@mail.gmail.com/ [1]
Link: https://lore.kernel.org/netdev/20260526063650.952-1-xuewen.yan@unisoc.com/ [2]
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Breno Leitao <leitao@debian.org>
diff --git a/arch/alpha/include/uapi/asm/socket.h b/arch/alpha/include/uapi/asm/socket.h
index 5ef57f88df6b3..2a3c27aaf4e95 100644
--- a/arch/alpha/include/uapi/asm/socket.h
+++ b/arch/alpha/include/uapi/asm/socket.h
@@ -155,6 +155,8 @@
#define SO_INQ 84
#define SCM_INQ SO_INQ
+#define SO_ERR_WAKE_SYNC 85
+
#if !defined(__KERNEL__)
#if __BITS_PER_LONG == 64
diff --git a/arch/mips/include/uapi/asm/socket.h b/arch/mips/include/uapi/asm/socket.h
index 72fb1b006da93..00f31c74a63df 100644
--- a/arch/mips/include/uapi/asm/socket.h
+++ b/arch/mips/include/uapi/asm/socket.h
@@ -166,6 +166,8 @@
#define SO_INQ 84
#define SCM_INQ SO_INQ
+#define SO_ERR_WAKE_SYNC 85
+
#if !defined(__KERNEL__)
#if __BITS_PER_LONG == 64
diff --git a/arch/parisc/include/uapi/asm/socket.h b/arch/parisc/include/uapi/asm/socket.h
index c16ec36dfee6b..db5b6cad17d49 100644
--- a/arch/parisc/include/uapi/asm/socket.h
+++ b/arch/parisc/include/uapi/asm/socket.h
@@ -147,6 +147,8 @@
#define SO_INQ 0x4052
#define SCM_INQ SO_INQ
+#define SO_ERR_WAKE_SYNC 0x4053
+
#if !defined(__KERNEL__)
#if __BITS_PER_LONG == 64
diff --git a/arch/sparc/include/uapi/asm/socket.h b/arch/sparc/include/uapi/asm/socket.h
index 71befa109e1cf..5e9ff3634265c 100644
--- a/arch/sparc/include/uapi/asm/socket.h
+++ b/arch/sparc/include/uapi/asm/socket.h
@@ -148,6 +148,8 @@
#define SO_INQ 0x005d
#define SCM_INQ SO_INQ
+#define SO_ERR_WAKE_SYNC 0x005e
+
#if !defined(__KERNEL__)
diff --git a/include/net/sock.h b/include/net/sock.h
index 51185222aac29..d8ee1dae8ecaf 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1022,6 +1022,7 @@ enum sock_flags {
SOCK_RCVMARK, /* Receive SO_MARK ancillary data with packet */
SOCK_RCVPRIORITY, /* Receive SO_PRIORITY ancillary data with packet */
SOCK_TIMESTAMPING_ANY, /* Copy of sk_tsflags & TSFLAGS_ANY */
+ SOCK_ERR_WAKE_SYNC, /* Sync wakeup on error report, %SO_ERR_WAKE_SYNC */
};
#define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE))
diff --git a/include/uapi/asm-generic/socket.h b/include/uapi/asm-generic/socket.h
index 53b5a8c002b1e..5527c9318b40e 100644
--- a/include/uapi/asm-generic/socket.h
+++ b/include/uapi/asm-generic/socket.h
@@ -150,6 +150,8 @@
#define SO_INQ 84
#define SCM_INQ SO_INQ
+#define SO_ERR_WAKE_SYNC 85
+
#if !defined(__KERNEL__)
#if __BITS_PER_LONG == 64 || (defined(__x86_64__) && defined(__ILP32__))
diff --git a/net/core/sock.c b/net/core/sock.c
index 498a57f34f5b5..59caab6a7223a 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1557,6 +1557,10 @@ int sk_setsockopt(struct sock *sk, int level, int optname,
sock_valbool_flag(sk, SOCK_SELECT_ERR_QUEUE, valbool);
break;
+ case SO_ERR_WAKE_SYNC:
+ sock_valbool_flag(sk, SOCK_ERR_WAKE_SYNC, valbool);
+ break;
+
case SO_PASSCRED:
if (sk_may_scm_recv(sk))
sk->sk_scm_credentials = valbool;
@@ -2064,6 +2068,10 @@ int sk_getsockopt(struct sock *sk, int level, int optname,
v.val = sock_flag(sk, SOCK_SELECT_ERR_QUEUE);
break;
+ case SO_ERR_WAKE_SYNC:
+ v.val = sock_flag(sk, SOCK_ERR_WAKE_SYNC);
+ break;
+
#ifdef CONFIG_NET_RX_BUSY_POLL
case SO_BUSY_POLL:
v.val = READ_ONCE(sk->sk_ll_usec);
@@ -3641,8 +3649,12 @@ static void sock_def_error_report(struct sock *sk)
rcu_read_lock();
wq = rcu_dereference(sk->sk_wq);
- if (skwq_has_sleeper(wq))
- wake_up_interruptible_poll(&wq->wait, EPOLLERR);
+ if (skwq_has_sleeper(wq)) {
+ if (sock_flag(sk, SOCK_ERR_WAKE_SYNC))
+ wake_up_interruptible_sync_poll(&wq->wait, EPOLLERR);
+ else
+ wake_up_interruptible_poll(&wq->wait, EPOLLERR);
+ }
sk_wake_async_rcu(sk, SOCK_WAKE_IO, POLL_ERR);
rcu_read_unlock();
}
^ permalink raw reply related
* Re: [PATCH iwl] ice: acquire NVM lock around each flash read
From: Robert Malz @ 2026-07-17 12:15 UTC (permalink / raw)
To: Jacob Keller
Cc: Tony Nguyen, Przemek Kitszel, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Alexander Lobakin,
Jesse Brandeburg, intel-wired-lan, netdev, linux-kernel
In-Reply-To: <5b420008-96f9-4f62-b155-a4b694a58369@intel.com>
Hey Jacob, Tony, Przemek
Thanks again for the review.
I have submitted the v2 patch with the mentioned changes.
ref: https://lists.osuosl.org/pipermail/intel-wired-lan/Week-of-Mon-20260713/056079.html
Regards,
Robert
On Wed, Jul 15, 2026 at 8:22 PM Jacob Keller <jacob.e.keller@intel.com> wrote:
>
> On 7/15/2026 10:04 AM, Tony Nguyen wrote:
> >
> >
> > On 7/15/2026 3:22 AM, Robert Malz wrote:
> >
> > ...
> >
> >>>> - if (status)
> >>>> + if (status) {
> >>>> + /* ice_release_nvm() issues an AQ command that
> >>>> would
> >>>> + * overwrite sq_last_status, which some callers
> >>>> + * inspect after a failed read. Preserve the
> >>>> read's
> >>>> + * AQ error across the release.
> >>>> + */
> >>>> + aq_err = hw->adminq.sq_last_status;
> >>>> +
> >>>> + ice_release_nvm(hw);
> >>>> + hw->adminq.sq_last_status = aq_err;
> >>>
> >>> Does restoring hw->adminq.sq_last_status here without holding the Admin
> >>> Queue
> >>> lock risk overwriting the status of a concurrent AdminQ command?
> >>> If another thread acquires the lock and sends a command immediately
> >>> after
> >>> ice_release_nvm(hw), this lockless write could corrupt its error status.
> >>>
> >>> [TN] I don't believe the AQ lock will work as desired we can't guarantee
> >>> that we will have the lock directly following the release in order to
> >>> restore the AQ error. Similar to the NVM lock issue, I think this is a
> >>> small window but wanted to bring this here in case others had
> >>> thoughts/comments on this.
> >>
> >> [RM] Agree, this can cause issues. We can't drop sq_last_status as
> >> ice_discover_flash_size depends on it.
> >> Proposed fix: drop the save/restore sq_last_status and propagate the
> >> read AQ error through a real return path instead of the shared global.
> >> I could add optional enum libie_aq_err *read_aq_err out param to
> >> ice_read_flat_nvm(), capture sq_last_status before the
> >> ice_release_nvm, and have ice_discover_flash_size() test that instead.
> >> The log-only callers (devlink/ethtool) don't care about it.
> >> Let me know what you think about it.
> > This sounds good to me.
> >
> > Thanks,
> > Tony
>
> I concur as well. In theory we should probably try to fully refactor the
> send_sq commands to propagate the error out from the lowest level
> without sq_last_status at all.. but thats a bigger ask and I don't think
> Robert needs to be asked to do that.
>
> The approach described here seems like a reasonable compromise fornow.
>
> Thanks,
> Jake
^ permalink raw reply
* [PATCH iwl v2] ice: acquire NVM lock around each flash read
From: Robert Malz @ 2026-07-17 12:12 UTC (permalink / raw)
To: Tony Nguyen, Przemek Kitszel, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Alexander Lobakin,
Jacob Keller, Jesse Brandeburg
Cc: Robert Malz, intel-wired-lan, netdev, linux-kernel
FW caps the NVM read lock at a maximum of 3000ms regardless of the timeout
requested via ice_acquire_nvm(). ice_read_flat_nvm() splits a read into
multiple ice_aq_read_nvm() commands, one per 4KB sector, all issued under a
single lock taken by the caller. Reading a large region can exceed 3000ms,
so FW reclaims the lock mid-read and the remaining commands might fail.
Move the lock acquire/release into ice_read_flat_nvm() so it brackets each
individual ice_aq_read_nvm() command, ensuring the lock is never held
across more than one FW read.
ice_release_nvm() issues its own AQ command and overwrites
hw->adminq.sq_last_status, which some callers inspect after a failed read.
Add an optional read_aq_err output parameter to ice_read_flat_nvm() to
capture the failing read's AQ error before the release; callers that need
it (ice_discover_flash_size() and the ethtool/devlink log paths) use it
instead of sq_last_status, others pass NULL.
Callers that previously took the lock around ice_read_flat_nvm(),
ice_read_sr_word() or ice_read_flash_module() now call them without it.
The now-redundant per-block locking in ice_devlink_nvm_snapshot() is
dropped.
Fixes: e94509906d6b ("ice: create function to read a section of the NVM and Shadow RAM")
Signed-off-by: Robert Malz <robert.malz@canonical.com>
---
v2:
- Replace the save/restore of sq_last_status across ice_release_nvm(),
which could race with a concurrent AdminQ command, with a new optional
read_aq_err output parameter.
- Add missing "Return:" kdoc to ice_read_sr_word().
---
.../net/ethernet/intel/ice/devlink/devlink.c | 32 ++------
drivers/net/ethernet/intel/ice/ice_ethtool.c | 16 +---
drivers/net/ethernet/intel/ice/ice_nvm.c | 76 +++++++++++--------
drivers/net/ethernet/intel/ice/ice_nvm.h | 2 +-
4 files changed, 56 insertions(+), 70 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/devlink/devlink.c b/drivers/net/ethernet/intel/ice/devlink/devlink.c
index 22b7d8e6bd9e..5a1ab9654fb8 100644
--- a/drivers/net/ethernet/intel/ice/devlink/devlink.c
+++ b/drivers/net/ethernet/intel/ice/devlink/devlink.c
@@ -1856,6 +1856,7 @@ static int ice_devlink_nvm_snapshot(struct devlink *devlink,
{
struct ice_pf *pf = devlink_priv(devlink);
struct device *dev = ice_pf_to_dev(pf);
+ enum libie_aq_err read_aq_err = LIBIE_AQ_RC_OK;
struct ice_hw *hw = &pf->hw;
bool read_shadow_ram;
u8 *nvm_data, *tmp, i;
@@ -1891,26 +1892,16 @@ static int ice_devlink_nvm_snapshot(struct devlink *devlink,
for (i = 0; i < num_blks; i++) {
u32 read_sz = min_t(u32, ICE_DEVLINK_READ_BLK_SIZE, left);
- status = ice_acquire_nvm(hw, ICE_RES_READ);
- if (status) {
- dev_dbg(dev, "ice_acquire_nvm failed, err %d aq_err %d\n",
- status, hw->adminq.sq_last_status);
- NL_SET_ERR_MSG_MOD(extack, "Failed to acquire NVM semaphore");
- vfree(nvm_data);
- return -EIO;
- }
-
status = ice_read_flat_nvm(hw, i * ICE_DEVLINK_READ_BLK_SIZE,
- &read_sz, tmp, read_shadow_ram);
+ &read_sz, tmp, read_shadow_ram,
+ &read_aq_err);
if (status) {
dev_dbg(dev, "ice_read_flat_nvm failed after reading %u bytes, err %d aq_err %d\n",
- read_sz, status, hw->adminq.sq_last_status);
+ read_sz, status, read_aq_err);
NL_SET_ERR_MSG_MOD(extack, "Failed to read NVM contents");
- ice_release_nvm(hw);
vfree(nvm_data);
return -EIO;
}
- ice_release_nvm(hw);
tmp += read_sz;
left -= read_sz;
@@ -1945,6 +1936,7 @@ static int ice_devlink_nvm_read(struct devlink *devlink,
{
struct ice_pf *pf = devlink_priv(devlink);
struct device *dev = ice_pf_to_dev(pf);
+ enum libie_aq_err read_aq_err = LIBIE_AQ_RC_OK;
struct ice_hw *hw = &pf->hw;
bool read_shadow_ram;
u64 nvm_size;
@@ -1966,24 +1958,14 @@ static int ice_devlink_nvm_read(struct devlink *devlink,
return -ERANGE;
}
- status = ice_acquire_nvm(hw, ICE_RES_READ);
- if (status) {
- dev_dbg(dev, "ice_acquire_nvm failed, err %d aq_err %d\n",
- status, hw->adminq.sq_last_status);
- NL_SET_ERR_MSG_MOD(extack, "Failed to acquire NVM semaphore");
- return -EIO;
- }
-
status = ice_read_flat_nvm(hw, (u32)offset, &size, data,
- read_shadow_ram);
+ read_shadow_ram, &read_aq_err);
if (status) {
dev_dbg(dev, "ice_read_flat_nvm failed after reading %u bytes, err %d aq_err %d\n",
- size, status, hw->adminq.sq_last_status);
+ size, status, read_aq_err);
NL_SET_ERR_MSG_MOD(extack, "Failed to read NVM contents");
- ice_release_nvm(hw);
return -EIO;
}
- ice_release_nvm(hw);
return 0;
}
diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
index 49371b065845..ce5f5fbaea69 100644
--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
+++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
@@ -854,6 +854,7 @@ ice_get_eeprom(struct net_device *netdev, struct ethtool_eeprom *eeprom,
u8 *bytes)
{
struct ice_pf *pf = ice_netdev_to_pf(netdev);
+ enum libie_aq_err read_aq_err = LIBIE_AQ_RC_OK;
struct ice_hw *hw = &pf->hw;
struct device *dev;
int ret;
@@ -869,24 +870,15 @@ ice_get_eeprom(struct net_device *netdev, struct ethtool_eeprom *eeprom,
if (!buf)
return -ENOMEM;
- ret = ice_acquire_nvm(hw, ICE_RES_READ);
- if (ret) {
- dev_err(dev, "ice_acquire_nvm failed, err %d aq_err %s\n",
- ret, libie_aq_str(hw->adminq.sq_last_status));
- goto out;
- }
-
ret = ice_read_flat_nvm(hw, eeprom->offset, &eeprom->len, buf,
- false);
+ false, &read_aq_err);
if (ret) {
dev_err(dev, "ice_read_flat_nvm failed, err %d aq_err %s\n",
- ret, libie_aq_str(hw->adminq.sq_last_status));
- goto release;
+ ret, libie_aq_str(read_aq_err));
+ goto out;
}
memcpy(bytes, buf, eeprom->len);
-release:
- ice_release_nvm(hw);
out:
kfree(buf);
return ret;
diff --git a/drivers/net/ethernet/intel/ice/ice_nvm.c b/drivers/net/ethernet/intel/ice/ice_nvm.c
index 7e187a804dfa..5b7373a1c06d 100644
--- a/drivers/net/ethernet/intel/ice/ice_nvm.c
+++ b/drivers/net/ethernet/intel/ice/ice_nvm.c
@@ -53,17 +53,27 @@ int ice_aq_read_nvm(struct ice_hw *hw, u16 module_typeid, u32 offset,
* @length: (in) number of bytes to read; (out) number of bytes actually read
* @data: buffer to return data in (sized to fit the specified length)
* @read_shadow_ram: if true, read from shadow RAM instead of NVM
+ * @read_aq_err: if non-NULL, receives the AQ error status of the failing read
*
* Reads a portion of the NVM, as a flat memory space. This function correctly
* breaks read requests across Shadow RAM sectors and ensures that no single
* read request exceeds the maximum 4KB read for a single AdminQ command.
*
+ * FW caps the read lock at a maximum of 3000ms, so a read spanning multiple
+ * 4KB sectors cannot be done under a single lock without FW reclaiming it
+ * mid-read. The NVM lock is therefore acquired and released around each AQ
+ * read, so this function must be called without the lock held.
+ *
+ * Since ice_release_nvm() issues an AQ command that overwrites
+ * hw->adminq.sq_last_status, callers that need the failing read's AQ error
+ * must use @read_aq_err rather than inspecting sq_last_status afterwards.
+ *
* Returns a status code on failure. Note that the data pointer may be
* partially updated if some reads succeed before a failure.
*/
int
ice_read_flat_nvm(struct ice_hw *hw, u32 offset, u32 *length, u8 *data,
- bool read_shadow_ram)
+ bool read_shadow_ram, enum libie_aq_err *read_aq_err)
{
u32 inlen = *length;
u32 bytes_read = 0;
@@ -92,12 +102,27 @@ ice_read_flat_nvm(struct ice_hw *hw, u32 offset, u32 *length, u8 *data,
last_cmd = !(bytes_read + read_size < inlen);
+ status = ice_acquire_nvm(hw, ICE_RES_READ);
+ if (status)
+ break;
+
status = ice_aq_read_nvm(hw, ICE_AQC_NVM_START_POINT,
offset, read_size,
data + bytes_read, last_cmd,
read_shadow_ram, NULL);
- if (status)
+ if (status) {
+ /* Capture the read's AQ error before ice_release_nvm()
+ * issues its own AQ command and overwrites
+ * sq_last_status.
+ */
+ if (read_aq_err)
+ *read_aq_err = hw->adminq.sq_last_status;
+
+ ice_release_nvm(hw);
break;
+ }
+
+ ice_release_nvm(hw);
bytes_read += read_size;
offset += read_size;
@@ -194,7 +219,7 @@ static int ice_read_sr_word_aq(struct ice_hw *hw, u16 offset, u16 *data)
* Shadow RAM sector restrictions necessary when reading from the NVM.
*/
status = ice_read_flat_nvm(hw, offset * sizeof(u16), &bytes,
- (__force u8 *)&data_local, true);
+ (__force u8 *)&data_local, true, NULL);
if (status)
return status;
@@ -330,13 +355,8 @@ ice_read_flash_module(struct ice_hw *hw, enum ice_bank_select bank, u16 module,
return -EINVAL;
}
- status = ice_acquire_nvm(hw, ICE_RES_READ);
- if (status)
- return status;
-
- status = ice_read_flat_nvm(hw, start + offset, &length, data, false);
-
- ice_release_nvm(hw);
+ status = ice_read_flat_nvm(hw, start + offset, &length, data, false,
+ NULL);
return status;
}
@@ -419,24 +439,21 @@ ice_read_netlist_module(struct ice_hw *hw, enum ice_bank_select bank, u32 offset
}
/**
- * ice_read_sr_word - Reads Shadow RAM word and acquire NVM if necessary
+ * ice_read_sr_word - Reads Shadow RAM word
* @hw: pointer to the HW structure
* @offset: offset of the Shadow RAM word to read (0x000000 - 0x001FFF)
* @data: word read from the Shadow RAM
*
- * Reads one 16 bit word from the Shadow RAM using the ice_read_sr_word_aq.
+ * Reads one 16 bit word from the Shadow RAM using ice_read_sr_word_aq.
+ *
+ * The NVM lock is acquired and released internally by ice_read_flat_nvm()
+ * around the FW read, so this function must be called without the lock held.
+ *
+ * Return: zero on success, or a negative error code on failure.
*/
int ice_read_sr_word(struct ice_hw *hw, u16 offset, u16 *data)
{
- int status;
-
- status = ice_acquire_nvm(hw, ICE_RES_READ);
- if (!status) {
- status = ice_read_sr_word_aq(hw, offset, data);
- ice_release_nvm(hw);
- }
-
- return status;
+ return ice_read_sr_word_aq(hw, offset, data);
}
/**
@@ -856,20 +873,18 @@ int ice_get_inactive_netlist_ver(struct ice_hw *hw, struct ice_netlist_info *net
static int ice_discover_flash_size(struct ice_hw *hw)
{
u32 min_size = 0, max_size = ICE_AQC_NVM_MAX_OFFSET + 1;
- int status;
-
- status = ice_acquire_nvm(hw, ICE_RES_READ);
- if (status)
- return status;
+ int status = 0;
while ((max_size - min_size) > 1) {
u32 offset = (max_size + min_size) / 2;
+ enum libie_aq_err read_aq_err = LIBIE_AQ_RC_OK;
u32 len = 1;
u8 data;
- status = ice_read_flat_nvm(hw, offset, &len, &data, false);
+ status = ice_read_flat_nvm(hw, offset, &len, &data, false,
+ &read_aq_err);
if (status == -EIO &&
- hw->adminq.sq_last_status == LIBIE_AQ_RC_EINVAL) {
+ read_aq_err == LIBIE_AQ_RC_EINVAL) {
ice_debug(hw, ICE_DBG_NVM, "%s: New upper bound of %u bytes\n",
__func__, offset);
status = 0;
@@ -880,7 +895,7 @@ static int ice_discover_flash_size(struct ice_hw *hw)
min_size = offset;
} else {
/* an unexpected error occurred */
- goto err_read_flat_nvm;
+ return status;
}
}
@@ -888,9 +903,6 @@ static int ice_discover_flash_size(struct ice_hw *hw)
hw->flash.flash_size = max_size;
-err_read_flat_nvm:
- ice_release_nvm(hw);
-
return status;
}
diff --git a/drivers/net/ethernet/intel/ice/ice_nvm.h b/drivers/net/ethernet/intel/ice/ice_nvm.h
index 63cdc6bdac58..e1d1a11f5ca4 100644
--- a/drivers/net/ethernet/intel/ice/ice_nvm.h
+++ b/drivers/net/ethernet/intel/ice/ice_nvm.h
@@ -19,7 +19,7 @@ int ice_aq_read_nvm(struct ice_hw *hw, u16 module_typeid, u32 offset,
bool read_shadow_ram, struct ice_sq_cd *cd);
int
ice_read_flat_nvm(struct ice_hw *hw, u32 offset, u32 *length, u8 *data,
- bool read_shadow_ram);
+ bool read_shadow_ram, enum libie_aq_err *read_aq_err);
int
ice_get_pfa_module_tlv(struct ice_hw *hw, u16 *module_tlv, u16 *module_tlv_len,
u16 module_type);
--
2.34.1
^ permalink raw reply related
* Re: [PATCH net v2] net: dpaa: fix mode setting
From: Sean Anderson @ 2026-07-17 12:05 UTC (permalink / raw)
To: Paolo Abeni, Michael Walle, Madalin Bucur, Andrew Lunn,
David S . Miller, Eric Dumazet, Jakub Kicinski, Russell King
Cc: netdev, linux-kernel
In-Reply-To: <26cb3349-5344-48c0-b0b7-37133b4e0662@redhat.com>
On 7/17/26 07:11, Paolo Abeni wrote:
> On 7/17/26 12:13 PM, Michael Walle wrote:
>> On Fri Jul 17, 2026 at 12:01 PM CEST, Paolo Abeni wrote:
>>> On 7/10/26 4:47 PM, Michael Walle wrote:
>>>> On Fri Jul 10, 2026 at 4:39 PM CEST, Sean Anderson wrote:
>>>>> On 7/10/26 10:22, Michael Walle wrote:
>>>>>> Before converting to the phylink interface, the init function would have
>>>>>> set the correct I/F mode depending on the maximum link speed of an
>>>>>> interface. After converting to phylink, the established link speed
>>>>>> is used to determine this setting and is set in the .link_up()
>>>>>> callback. The callback isn't called because the link is never
>>>>>> established between the PCS and a connected SGMII PHY.
>>>>>> To fix it, don't use the current speed, but set the mode depending on
>>>>>> the interface (which implies the maximum speed) in .mac_config().
>>>>>>
>>>>>> Fixes: 5d93cfcf7360 ("net: dpaa: Convert to phylink")
>>>>>> Suggested-by: Sean Anderson <sean.anderson@linux.dev>
>>>>>> Signed-off-by: Michael Walle <mwalle@kernel.org>
>>>>>> ---
>>>>>> FWIW, I dropped setting a non-reserved mode in init(). The hardware
>>>>>> default is 0 and the mac_config() will set a valid mode anyway.
>>>>>>
>>>>>> Changes in v2:
>>>>>> - the setting is/was based on the maximum speed, not the current
>>>>>> speed. thus, move the setting into mac_config().
>>>>>> - Link to v1: https://lore.kernel.org/r/20260706121011.1948906-1-mwalle@kernel.org/
>>>>>>
>>>>>> .../net/ethernet/freescale/fman/fman_dtsec.c | 26 ++++++++++---------
>>>>>> 1 file changed, 14 insertions(+), 12 deletions(-)
>>>>>>
>>>>>> diff --git a/drivers/net/ethernet/freescale/fman/fman_dtsec.c b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
>>>>>> index fe35703c509e..7075f93bab49 100644
>>>>>> --- a/drivers/net/ethernet/freescale/fman/fman_dtsec.c
>>>>>> +++ b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
>>>>>> @@ -900,22 +900,28 @@ static void dtsec_mac_config(struct phylink_config *config, unsigned int mode,
>>>>>> {
>>>>>> struct mac_device *mac_dev = fman_config_to_mac(config);
>>>>>> struct dtsec_regs __iomem *regs = mac_dev->fman_mac->regs;
>>>>>> - u32 tmp;
>>>>>> + u32 ecntrl, maccfg2;
>>>>>> +
>>>>>> + maccfg2 = ioread32be(®s->maccfg2);
>>>>>> + maccfg2 &= ~(MACCFG2_NIBBLE_MODE | MACCFG2_BYTE_MODE);
>>>>>>
>>>>>> switch (state->interface) {
>>>>>> case PHY_INTERFACE_MODE_RMII:
>>>>>> - tmp = DTSEC_ECNTRL_RMM;
>>>>>> + ecntrl = DTSEC_ECNTRL_RMM;
>>>>>> + maccfg2 |= MACCFG2_NIBBLE_MODE;
>>>>>> break;
>>>>>> case PHY_INTERFACE_MODE_RGMII:
>>>>>> case PHY_INTERFACE_MODE_RGMII_ID:
>>>>>> case PHY_INTERFACE_MODE_RGMII_RXID:
>>>>>> case PHY_INTERFACE_MODE_RGMII_TXID:
>>>>>> - tmp = DTSEC_ECNTRL_GMIIM | DTSEC_ECNTRL_RPM;
>>>>>> + ecntrl = DTSEC_ECNTRL_GMIIM | DTSEC_ECNTRL_RPM;
>>>>>> + maccfg2 |= MACCFG2_BYTE_MODE;
>>>>>> break;
>>>>>> case PHY_INTERFACE_MODE_SGMII:
>>>>>> case PHY_INTERFACE_MODE_1000BASEX:
>>>>>> case PHY_INTERFACE_MODE_2500BASEX:
>>>>>> - tmp = DTSEC_ECNTRL_TBIM | DTSEC_ECNTRL_SGMIIM;
>>>>>> + ecntrl = DTSEC_ECNTRL_TBIM | DTSEC_ECNTRL_SGMIIM;
>>>>>> + maccfg2 |= MACCFG2_BYTE_MODE;
>>>>>> break;
>>>>>> default:
>>>>>> dev_warn(mac_dev->dev, "cannot configure dTSEC for %s\n",
>>>>>> @@ -923,7 +929,8 @@ static void dtsec_mac_config(struct phylink_config *config, unsigned int mode,
>>>>>> return;
>>>>>> }
>>>>>>
>>>>>> - iowrite32be(tmp, ®s->ecntrl);
>>>>>> + iowrite32be(ecntrl, ®s->ecntrl);
>>>>>> + iowrite32be(maccfg2, ®s->maccfg2);
>>>>>> }
>>>>>>
>>>>>> static void dtsec_link_up(struct phylink_config *config, struct phy_device *phy,
>>>>>> @@ -948,15 +955,10 @@ static void dtsec_link_up(struct phylink_config *config, struct phy_device *phy,
>>>>>> iowrite32be(tmp, ®s->ecntrl);
>>>>>>
>>>>>> tmp = ioread32be(®s->maccfg2);
>>>>>> - tmp &= ~(MACCFG2_NIBBLE_MODE | MACCFG2_BYTE_MODE | MACCFG2_FULL_DUPLEX);
>>>>>> - if (speed >= SPEED_1000)
>>>>>> - tmp |= MACCFG2_BYTE_MODE;
>>>>>> - else
>>>>>> - tmp |= MACCFG2_NIBBLE_MODE;
>>>>>> -
>>>>>> if (duplex == DUPLEX_FULL)
>>>>>> tmp |= MACCFG2_FULL_DUPLEX;
>>>>>> -
>>>>>> + else
>>>>>> + tmp &= ~MACCFG2_FULL_DUPLEX;
>>>>>
>>>>> Did you test this when forcing 10/100 speed?
>>>>
>>>> No I didn't. Well I can't. I have a very weird board which only
>>>> supports 1000base-X (and copper SFPs in 1000basex autoneg mode). On
>>>> top of that there is a Marvell 88E1112 in between the SFP and the
>>>> MAC, for which the PHY driver is completely broken. Long story
>>>> short, I'm not able to test that (yet/at all? Not sure).
>>> FTR, sashiko suspect this patch will broke such setup:
>>> https://sashiko.dev/#/patchset/20260710143430.2276141-1-mwalle%40kernel.org
>>
>> I've seen that, but.. that was the actual change between v1 and v2
>> as suggested by Sean. It does not depend on the actual link speed,
>> but the maximum link speed. So it is not relevant if the link
>> negotiates to a slower speed or not. At least that now matches the
>> behavior prior to the phylink conversion. If that was working -
>> that I can't tell you.
>
> I'm sorry, following all cross revision discussion is a bit hard here.
>
> I don't understand if the 'link never established' is specific of your
> board, or it a constant with this driver. Could you please clarify?
I think we should set byte/nibble mode in link_up as well as mac_config. That
should fix the problem where the link never comes up (possibly broken since
the phylink conversion). I think it's unlikely that this config is supposed
to match the phy interface speed and not the link speed, but you never know...
--Sean
^ permalink raw reply
* Re: [PATCH net-next v10 5/5] net: wangxun: add pcie error handler
From: Simon Horman @ 2026-07-17 11:40 UTC (permalink / raw)
To: Jiawen Wu
Cc: netdev, mengyuanlou, andrew+netdev, davem, edumazet, kuba, pabeni,
richardcochran, linux, aleksandr.loktionov, jacob.e.keller,
michal.swiatkowski, kees, joe, leitao, shaojijie, u.kleine-koenig,
weirongguang, larysa.zaremba, fabio.baltieri
In-Reply-To: <0ecb01dd14f0$17488c80$45d9a580$@trustnetic.com>
On Thu, Jul 16, 2026 at 02:55:30PM +0800, Jiawen Wu wrote:
> On Tue, Jul 14, 2026 5:11 PM, Simon Horman wrote:
> > This is an AI-generated review of your patch. The human sending this
> > email has considered the AI review valid, or at least plausible.
> > Full review at: https://sashiko.dev
> > ---
> > --- Patch [5]: [PATCH net-next v10 5/5] net: wangxun: add pcie error handler ---
> > commit 91baa4e77d07ab6772569a7d37ed86cfda625c00
> > Author: Jiawen Wu <jiawenwu@trustnetic.com>
> > Subject: net: wangxun: add pcie error handler
> >
> > This commit adds PCIe error handling support (AER) to the wangxun drivers
> > (ngbe and txgbe). It detects hardware errors, attempts to soft quiesce,
> > and registers standard PCI error handler callbacks.
> >
> > > diff --git a/drivers/net/ethernet/wangxun/libwx/wx_err.c b/drivers/net/ethernet/wangxun/libwx/wx_err.c
> > > index ee27f96735dc7..0cb99e456a1c9 100644
> > > --- a/drivers/net/ethernet/wangxun/libwx/wx_err.c
> > > +++ b/drivers/net/ethernet/wangxun/libwx/wx_err.c
> >
> > [ ... ]
> >
> > > +static void wx_io_resume(struct pci_dev *pdev)
> > > +{
> > > + struct wx *wx = pci_get_drvdata(pdev);
> > > + struct net_device *netdev;
> > > + int err;
> > > +
> > > + netdev = wx->netdev;
> > > + rtnl_lock();
> > > + if (netif_running(netdev)) {
> > > + err = netdev->netdev_ops->ndo_open(netdev);
> >
> > [Severity: High]
> > Does this sequence risk corrupting the hw_tc_lock seqlock?
> >
> > During AER recovery, wx_io_slot_reset() calls down_suspend(), which bypasses
> > wx_ptp_stop(). This leaves the PTP clock registered and potentially in use by
> > userspace.
> >
> > When wx_io_resume() then calls ndo_open(), this triggers txgbe_up() or
> > ngbe_up(), which in turn calls wx_ptp_init(). Since wx_ptp_init()
> > unconditionally calls seqlock_init(&wx->hw_tc_lock), won't this corrupt the
> > lock if userspace is actively issuing PTP ioctls?
>
> PTP clock was destroyed in wx_ptp_quiesce() before V8 patch set. The
> piece of code was removed based on the Sashiko's comment. I think it
> should be added back because the order of the calls in wx_soft_quiesce()
> has been changed.
Thanks.
>
> >
> > > + if (err) {
> > > + wx_err(wx, "Failed to open netdev after reset\n");
> >
> > [ ... ]
> >
> > > diff --git a/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c b/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c
> > > index 92895f5035118..56d4b63387fd6 100644
> > > --- a/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c
> > > +++ b/drivers/net/ethernet/wangxun/ngbe/ngbe_main.c
> >
> > [ ... ]
> >
> > > @@ -413,6 +428,9 @@ static void ngbe_disable_device(struct wx *wx)
> > >
> > > static void ngbe_reset(struct wx *wx)
> > > {
> > > + if (test_bit(WX_FLAG_NEED_PCIE_RECOVERY, wx->flags))
> > > + return;
> > > +
> > > wx_flush_sw_mac_table(wx);
> >
> > [Severity: High]
> > Is the hardware properly reinitialized here after an AER slot reset?
> >
> > In wx_io_slot_reset(), the hardware needs to be restarted from scratch.
> > While txgbe_reset() calls txgbe_reset_hw(), ngbe_reset() only flushes the
> > software MAC tables and skips calling ngbe_reset_hw().
> >
> > Because this patch registers wx_err_handler for the ngbe driver, won't this
> > leave the hardware uninitialized and the interface broken after a PCIe slot
> > reset?
>
> I think I have answered this question many times and also described
> ngbe's lack of functionality in the commit and cover-letter messages.
Sorry about that, I missed that this is already covered.
...
^ permalink raw reply
* Re: [PATCH v2] mac802154: hold an interface reference across the scan worker
From: Miquel Raynal @ 2026-07-17 11:37 UTC (permalink / raw)
To: Ibrahim Hashimov
Cc: alex.aring, stefan, linux-wpan, netdev, linux-kernel, stable
In-Reply-To: <20260717105810.26226-1-security@auditcode.ai>
Hello,
> Fixes: 57588c71177f ("mac802154: Handle passive scanning")
> Cc: stable@vger.kernel.org
> Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
> Assisted-by: AuditCode-AI:2026.07
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Thanks,
Miquèl
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox