summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-04-12net: enetc: add unstructured counters for ENETC v4Wei Fang
Like ENETC v1, ENETC v4 also has many non-standard counters, so these counters are added to improve statistical coverage. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260408055849.1314033-6-wei.fang@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: enetc: add unstructured pMAC counters for ENETC v1Wei Fang
The ENETC v1 has two MACs (eMAC and pMAC) to support preemption. The existing unstructured counters include the eMAC counters, but not the pMAC counters. So add pMAC counters to improve statistical coverage. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260408055849.1314033-5-wei.fang@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: enetc: remove standardized counters from enetc_pm_countersWei Fang
The standardized counters are already exposed via the get_pause_stats(), get_rmon_stats(), get_eth_ctrl_stats() and get_eth_mac_stats() interfaces. Keeping the same counters in enetc_pm_counters results in redundant output. Remove these standardized counters from enetc_pm_counters and rely on the existing statistics interfaces to report them. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260408055849.1314033-4-wei.fang@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: enetc: show RX drop counters only for assigned RX ringsWei Fang
For ENETC v1, each SI provides 16 RBDCR registers for RX ring drop counters, but this does not imply that an SI actually owns 16 RX rings. The ENETC hardware supports a total of 16 RX rings, which are assigned to 3 SIs (1 PSI and 2 VSIs), so each SI is assigned fewer than 16 RX rings. The current implementation always reports 16 RX drop counters per SI, leading to redundant output for SIs with fewer RX rings. Update the logic to display drop counters only for the RX rings that are actually assigned to the SI. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260408055849.1314033-3-wei.fang@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: enetc: add support for the standardized countersWei Fang
ENETC v4 provides 64-bit counters for IEEE 802.3 basic and mandatory managed objects, the IETF Management Information Database (MIB) package (RFC2665), and Remote Network Monitoring (RMON) statistics. In addition, some ENETCs support preemption, so these ENETCs have two MACs: MAC 0 is the express MAC (eMAC), MAC 1 is the preemptible MAC (pMAC). Both MACs support these statistics. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260408055849.1314033-2-wei.fang@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12selftests/bpf: Add tests for non-arena/arena operationsEmil Tsalapatis
Add a selftest that ensures instructions with arena source and non-arena destination registers are accepted by the verifier. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: Song Liu <song@kernel.org> Link: https://lore.kernel.org/r/20260412174546.18684-3-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-12bpf: Allow instructions with arena source and non-arena dest registersEmil Tsalapatis
The compiler sometimes stores the result of a PTR_TO_ARENA and SCALAR operation into the scalar register rather than the pointer register. Relax the verifier to allow operations between a source arena register and a destination non-arena register, marking the destination's value as a PTR_TO_ARENA. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: Song Liu <song@kernel.org> Fixes: 6082b6c328b5 ("bpf: Recognize addr_space_cast instruction in the verifier.") Link: https://lore.kernel.org/r/20260412174546.18684-2-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-12Merge branch 'bpf-add-the-missing-fsession'Alexei Starovoitov
Menglong Dong says: ==================== bpf: add the missing fsession Add the missing fsession attach type to the BPF docs, verifier log and bpftool. Changes since v2: - replace "FENTRY/FEXIT/FSESSION" with "Tracing" in the 1st patch - v2: https://lore.kernel.org/all/20260408062109.386083-1-dongml2@chinatelecom.cn/ Changes since v1: - add a missing FSESSION in bpf_check_attach_target() in the 1st patch - v1: https://lore.kernel.org/all/20260408031416.266229-1-dongml2@chinatelecom.cn/ ==================== Link: https://patch.msgid.link/20260412060346.142007-1-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-12bpftool: add missing fsession to the usage and docs of bpftoolMenglong Dong
Add the fsession attach type to the usage of bpftool in do_help(). Meanwhile, add it to the bash-completion and bpftool-prog.rst too. Acked-by: Leon Hwang <leon.hwang@linux.dev> Acked-by: Quentin Monnet <qmo@kernel.org> Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn> Link: https://lore.kernel.org/r/20260412060346.142007-4-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-12docs/bpf: add missing fsession attach type to docsMenglong Dong
Add the fsession attach type to program_types.rst and drgn.rst. Acked-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn> Link: https://lore.kernel.org/r/20260412060346.142007-3-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-12bpf: add missing fsession to the verifier logMenglong Dong
The fsession attach type is missed in the verifier log in check_get_func_ip(), bpf_check_attach_target() and check_attach_btf_id(). Update them to make the verifier log proper. Meanwhile, update the corresponding selftests. Acked-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn> Link: https://lore.kernel.org/r/20260412060346.142007-2-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-12Merge branch 'bpf-split-verifier-c'Alexei Starovoitov
Alexei Starovoitov says: ==================== v3->v4: Restore few minor comments and undo few function moves v2->v3: Actually restore comments lost in patch 3 (instead of adding them to patch 4) v1->v2: Restore comments lost in patch 3 verifier.c is huge. Split it into logically independent pieces. No functional changes. The diff is impossible to review over email. 'git show' shows minimal actual changes. Only plenty of moved lines. Such split may cause backport headaches. We should have split it long ago. Even after split verifier.c is still 20k lines, but further split is harder. ==================== Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://patch.msgid.link/20260412152936.54262-1-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-12bpf: Move BTF checking logic into check_btf.cAlexei Starovoitov
BTF validation logic is independent from the main verifier. Move it into check_btf.c Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260412152936.54262-7-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-12bpf: Move backtracking logic to backtrack.cAlexei Starovoitov
Move precision propagation and backtracking logic to backtrack.c to reduce verifier.c size. No functional changes. Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260412152936.54262-6-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-12bpf: Move state equivalence logic to states.cAlexei Starovoitov
verifier.c is huge. Move is_state_visited() to states.c, so that all state equivalence logic is in one file. Mechanical move. No functional changes. Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260412152936.54262-5-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-12bpf: Move check_cfg() into cfg.cAlexei Starovoitov
verifier.c is huge. Move check_cfg(), compute_postorder(), compute_scc() into cfg.c Mechanical move. No functional changes. Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260412152936.54262-4-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-12bpf: Move compute_insn_live_regs() into liveness.cAlexei Starovoitov
verifier.c is huge. Move compute_insn_live_regs() into liveness.c. Mechanical move. No functional changes. Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260412152936.54262-3-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-12bpf: Move fixup/post-processing logic from verifier.c into fixups.cAlexei Starovoitov
verifier.c is huge. Split fixup/post-processing logic that runs after the verifier accepted the program into fixups.c. Mechanical move. No functional changes. Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260412152936.54262-2-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-12gre: Count GRE packet dropsGal Pressman
GRE is silently dropping packets without updating statistics. In case of drop, increment rx_dropped counter to provide visibility into packet loss. For the case where no GRE protocol handler is registered, use rx_nohandler. Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Reviewed-by: Nimrod Oren <noren@nvidia.com> Signed-off-by: Gal Pressman <gal@nvidia.com> Link: https://patch.msgid.link/20260409090945.1542440-1-gal@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12Merge branch ↵Jakub Kicinski
'bpf-fix-sock_ops_get_sk-same-register-oob-read-in-sock_ops-and-add-selftest' Jiayuan Chen says: ==================== bpf: Fix SOCK_OPS_GET_SK same-register OOB read in sock_ops and add selftest When a BPF sock_ops program accesses ctx fields with dst_reg == src_reg, the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the destination register in the !fullsock / !locked_tcp_sock path, leading to OOB read (GET_SK) and kernel pointer leak (GET_FIELD). Patch 1: Fix both macros by adding BPF_MOV64_IMM(si->dst_reg, 0) in the !fullsock landing pad. Patch 2: Add selftests covering same-register and different-register cases for both GET_SK and GET_FIELD. [1] https://lore.kernel.org/bpf/6fe1243e-149b-4d3b-99c7-fcc9e2f75787@std.uestc.edu.cn/T/#u ==================== Link: https://patch.msgid.link/20260407022720.162151-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12selftests/bpf: Add tests for sock_ops ctx access with same src/dst registerJiayuan Chen
Add selftests to verify SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() correctly return NULL/zero when dst_reg == src_reg and is_fullsock == 0. Three subtests are included: - get_sk: ctx->sk with same src/dst register (SOCK_OPS_GET_SK) - get_field: ctx->snd_cwnd with same src/dst register (SOCK_OPS_GET_FIELD) - get_sk_diff_reg: ctx->sk with different src/dst register (baseline) Each BPF program uses inline asm (__naked) to force specific register allocation, reads is_fullsock first, then loads the field using the same (or different) register. The test triggers TCP_NEW_SYN_RECV via a TCP handshake and checks that the result is NULL/zero when is_fullsock == 0. Reviewed-by: Sun Jian <sun.jian.kdev@gmail.com> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Acked-by: Martin KaFai Lau <martin.lau@kernel.org> Link: https://patch.msgid.link/20260407022720.162151-3-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12bpf: Fix same-register dst/src OOB read and pointer leak in sock_opsJiayuan Chen
When a BPF sock_ops program accesses ctx fields with dst_reg == src_reg, the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the destination register in the !fullsock / !locked_tcp_sock path. Both macros borrow a temporary register to check is_fullsock / is_locked_tcp_sock when dst_reg == src_reg, because dst_reg holds the ctx pointer. When the check is false (e.g., TCP_NEW_SYN_RECV state with a request_sock), dst_reg should be zeroed but is not, leaving the stale ctx pointer: - SOCK_OPS_GET_SK: dst_reg retains the ctx pointer, passes NULL checks as PTR_TO_SOCKET_OR_NULL, and can be used as a bogus socket pointer, leading to stack-out-of-bounds access in helpers like bpf_skc_to_tcp6_sock(). - SOCK_OPS_GET_FIELD: dst_reg retains the ctx pointer which the verifier believes is a SCALAR_VALUE, leaking a kernel pointer. Fix both macros by: - Changing JMP_A(1) to JMP_A(2) in the fullsock path to skip the added instruction. - Adding BPF_MOV64_IMM(si->dst_reg, 0) after the temp register restore in the !fullsock path, placed after the restore because dst_reg == src_reg means we need src_reg intact to read ctx->temp. Fixes: fd09af010788 ("bpf: sock_ops ctx access may stomp registers in corner case") Fixes: 84f44df664e9 ("bpf: sock_ops sk access may stomp registers when dst_reg = src_reg") Reported-by: Quan Sun <2022090917019@std.uestc.edu.cn> Reported-by: Yinhao Hu <dddddd@hust.edu.cn> Reported-by: Kaiyan Mei <M202472210@hust.edu.cn> Reported-by: Dongliang Mu <dzm91@hust.edu.cn> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Closes: https://lore.kernel.org/bpf/6fe1243e-149b-4d3b-99c7-fcc9e2f75787@std.uestc.edu.cn/T/#u Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Acked-by: Martin KaFai Lau <martin.lau@kernel.org> Link: https://patch.msgid.link/20260407022720.162151-2-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12perf sample: Fix documentation typoIan Rogers
s/PEF/PERF/ Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-04-12Documentation: core-api: real-time: correct spellingSukrut Heroorkar
Fix typo "excpetion" with "exception". Signed-off-by: Sukrut Heroorkar <hsukrut3@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260411155120.233357-1-hsukrut3@gmail.com>
2026-04-12doc: Add CPU Isolation documentationFrederic Weisbecker
nohz_full was introduced in v3.10 in 2013, which means this documentation is overdue for 13 years. Fortunately Paul wrote a part of the needed documentation a while ago, especially concerning nohz_full in Documentation/timers/no_hz.rst and also about per-CPU kthreads in Documentation/admin-guide/kernel-per-CPU-kthreads.rst Introduce a new page that gives an overview of CPU isolation in general. Acked-by: Waiman Long <longman@redhat.com> Reviewed-by: Valentin Schneider <vschneid@redhat.com> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Frederic Weisbecker <frederic@kernel.org> Reviewed-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260402094749.18879-1-frederic@kernel.org>
2026-04-12Merge tag 'edac_urgent_for_7.0' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - Fix the error path ordering when the driver-private descriptor allocation fails * tag 'edac_urgent_for_7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/mc: Fix error path ordering in edac_mc_alloc()
2026-04-12NFC: digital: Bounds check NFC-A cascade depth in SDD response handlerGreg Kroah-Hartman
The NFC-A anti-collision cascade in digital_in_recv_sdd_res() appends 3 or 4 bytes to target->nfcid1 on each round, but the number of cascade rounds is controlled entirely by the peer device. The peer sets the cascade tag in the SDD_RES (deciding 3 vs 4 bytes) and the cascade-incomplete bit in the SEL_RES (deciding whether another round follows). ISO 14443-3 limits NFC-A to three cascade levels and target->nfcid1 is sized accordingly (NFC_NFCID1_MAXSIZE = 10), but nothing in the driver actually enforces this. This means a malicious peer can keep the cascade running, writing past the heap-allocated nfc_target with each round. Fix this by rejecting the response when the accumulated UID would exceed the buffer. Commit e329e71013c9 ("NFC: nci: Bounds check struct nfc_target arrays") fixed similar missing checks against the same field on the NCI path. Cc: Simon Horman <horms@kernel.org> Cc: Kees Cook <kees@kernel.org> Cc: Thierry Escande <thierry.escande@linux.intel.com> Cc: Samuel Ortiz <sameo@linux.intel.com> Fixes: 2c66daecc409 ("NFC Digital: Add NFC-A technology support") Cc: stable <stable@kernel.org> Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/2026040913-figure-seducing-bd3f@gregkh Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net_sched: fix skb memory leak in deferred qdisc dropsFernando Fernandez Mancera
When the network stack cleans up the deferred list via qdisc_run_end(), it operates on the root qdisc. If the root qdisc do not implement the TCQ_F_DEQUEUE_DROPS flag the packets queue to free are never freed and gets stranded on the child's local to_free list. Fix this by making qdisc_dequeue_drop() aware of the root qdisc. It fetches the root qdisc and check for the TCQ_F_DEQUEUE_DROPS flag. If the flag is present, the packet is appended directly to the root's to_free list. Otherwise, drop it directly as it was done before the optimization was implemented. Fixes: a6efc273ab82 ("net_sched: use qdisc_dequeue_drop() in cake, codel, fq_codel") Reported-by: Damilola Bello <damilola@aterlo.com> Closes: https://lore.kernel.org/netdev/CAPgFtOLaedBMU0f_BxV2bXftTJSmJr018Q5uozOo5vVo6b9tjw@mail.gmail.com/ Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260408100044.4530-1-fmancera@suse.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12Merge branch 'net-phy-add-support-for-disabling-autonomous-eee'Jakub Kicinski
Nicolai Buchwitz says: ==================== net: phy: add support for disabling autonomous EEE Some PHYs implement autonomous EEE where the PHY manages EEE independently, preventing the MAC from controlling LPI signaling. This conflicts with MACs that implement their own LPI control. This series adds a .disable_autonomous_eee callback to struct phy_driver and calls it from phy_support_eee(). When a MAC indicates it supports EEE, the PHY's autonomous EEE is automatically disabled. The setting is persisted across suspend/resume by re-applying it in phy_init_hw() after soft reset, following the same pattern suggested by Russell King for PHY tunables [1]. Patch 1 adds the phylib infrastructure. Patch 2 implements it for Broadcom BCM54xx (AutogrEEEn). Patch 3 converts the Realtek RTL8211F, which previously unconditionally disabled PHY-mode EEE in config_init. This came up while adding EEE support to the Cadence macb driver (used on Raspberry Pi 5 with a BCM54210PE PHY). The PHY's AutogrEEEn mode prevented the MAC from tracking LPI state. The Realtek RTL8211F has the same pattern, unconditionally disabling PHY-mode EEE with the comment "Disable PHY-mode EEE so LPI is passed to the MAC". Other BCM54xx PHYs likely have the same AutogrEEEn register layout, but I only have access to the BCM54210PE/BCM54213PE datasheets. It would be appreciated if Florian or others could confirm which other BCM54xx variants share this register so we can wire them up too. Tested on Raspberry Pi CM4 (bcmgenet + BCM54210PE), Raspberry Pi CM5 (Cadence GEM + BCM54210PE) and Raspberry Pi 5 (Cadence GEM + BCM54213PE). [1] https://lore.kernel.org/netdev/acuwvoydmJusuj9x@shell.armlinux.org.uk/ ==================== Link: https://patch.msgid.link/20260406-devel-autonomous-eee-v1-0-b335e7143711@tipi-net.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: phy: realtek: convert RTL8211F to .disable_autonomous_eeeNicolai Buchwitz
The RTL8211F previously unconditionally disabled PHY-mode EEE in config_init. Convert this to use the new .disable_autonomous_eee callback so it is only disabled when the MAC indicates EEE support via phy_support_eee(). This preserves PHY-autonomous EEE for MACs that do not support EEE, while still disabling it when the MAC manages LPI. Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de> Link: https://patch.msgid.link/20260406-devel-autonomous-eee-v1-3-b335e7143711@tipi-net.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: phy: broadcom: implement .disable_autonomous_eee for BCM54xxNicolai Buchwitz
Implement the .disable_autonomous_eee callback for the BCM54210E. In AutogrEEEn mode the PHY manages EEE autonomously. Clearing the AutogrEEEn enable bit in MII_BUF_CNTL_0 switches the PHY to Native EEE mode. Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de> Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Link: https://patch.msgid.link/20260406-devel-autonomous-eee-v1-2-b335e7143711@tipi-net.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: phy: add support for disabling PHY-autonomous EEENicolai Buchwitz
Some PHYs (e.g. Broadcom BCM54xx, Realtek RTL8211F) implement autonomous EEE where the PHY manages LPI signaling without forwarding it to the MAC. This conflicts with MAC drivers that implement their own LPI control. Add a .disable_autonomous_eee callback to struct phy_driver and call it from phy_support_eee(). When a MAC driver indicates it supports EEE via phy_support_eee(), the PHY's autonomous EEE is automatically disabled so the MAC can manage LPI entry/exit. Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de> Link: https://patch.msgid.link/20260406-devel-autonomous-eee-v1-1-b335e7143711@tipi-net.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: airoha: Add missing RX_CPU_IDX() configuration in ↵Lorenzo Bianconi
airoha_qdma_cleanup_rx_queue() When the descriptor index written in REG_RX_CPU_IDX() is equal to the one stored in REG_RX_DMA_IDX(), the hw will stop since the QDMA RX ring is empty. Add missing REG_RX_CPU_IDX() configuration in airoha_qdma_cleanup_rx_queue routine during QDMA RX ring cleanup. Fixes: 514aac359987 ("net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue()") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260408-airoha-cpu-idx-airoha_qdma_cleanup_rx_queue-v1-1-8efa64844308@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12Merge branch 'ynl-ethtool-netlink-fix-nla_len-overflow-for-large-string-sets'Jakub Kicinski
Hangbin Liu says: ==================== ynl/ethtool/netlink: fix nla_len overflow for large string sets This series addresses a silent data corruption issue triggered when ynl retrieves string sets from NICs with a large number of statistics entries (e.g. mlx5_core with thousands of ETH_SS_STATS strings). The root cause is that struct nlattr.nla_len is a __u16 (max 65535 bytes). When a NIC exports enough statistics strings, the ETHTOOL_A_STRINGSET_STRINGS nest built by strset_fill_set() exceeds this limit. nla_nest_end() silently truncates the length on assignment, producing a corrupted netlink message. Patch 1 moves ethtool.py to selftest. Patch 2 improves the ethtool tool: rename the doit/dumpit helpers to do_set/do_get and convert do_get to use ynl.do() with an explicit device header instead of a full dump with client-side filtering. Patch 3 adds a --dbg-small-recv option to the YNL ethtool tool, matching the same option already present in cli.py, to help debug netlink message size issues Patch 4 adds a new helper nla_nest_end_safe() to check whether the nla_len is overflow and return -EMSGSIZE early if so. Patch 5 uses the new helper in ethtool to make sure the ethtool doesn't reply a corrupted netlink message. ==================== Link: https://patch.msgid.link/20260408-b4-ynl_ethtool-v2-0-7623a5e8f70b@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12ethtool: strset: check nla_len overflowHangbin Liu
The netlink attribute length field nla_len is a __u16, which can only represent values up to 65535 bytes. NICs with a large number of statistics strings (e.g. mlx5_core with thousands of ETH_SS_STATS entries) can produce a ETHTOOL_A_STRINGSET_STRINGS nest that exceeds this limit. When nla_nest_end() writes the actual nest size back to nla_len, the value is silently truncated. This results in a corrupted netlink message being sent to userspace: the parser reads a wrong (truncated) attribute length and misaligns all subsequent attribute boundaries, causing decode errors. Fix this by using the new helper nla_nest_end_safe and error out if the size exceeds U16_MAX. Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> Link: https://patch.msgid.link/20260408-b4-ynl_ethtool-v2-5-7623a5e8f70b@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12netlink: add a nla_nest_end_safe() helperHangbin Liu
The nla_len field in struct nlattr is a __u16, which can only hold values up to 65535. If a nested attribute grows beyond this limit, nla_nest_end() silently truncates the length, producing a corrupted netlink message with no indication of the problem. Since nla_nest_end() is used everywhere and this issue rarely happens, let's add a new helper to check the length. Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> Link: https://patch.msgid.link/20260408-b4-ynl_ethtool-v2-4-7623a5e8f70b@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12tools: ynl: ethtool: add --dbg-small-recv optionHangbin Liu
Add a --dbg-small-recv debug option to control the recv() buffer size used by YNL, matching the same option already present in cli.py. This is useful if user need to get large netlink message. Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> Link: https://patch.msgid.link/20260408-b4-ynl_ethtool-v2-3-7623a5e8f70b@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12tools: ynl: ethtool: use doit instead of dumpit for per-device GETHangbin Liu
Rename the local helper doit() to do_set() and dumpit() to do_get() to better reflect their purpose. Convert do_get() to use ynl.do() with an explicit device header instead of ynl.dump() followed by client-side filtering. This is more efficient as the kernel only processes and returns data for the requested device, rather than dumping all devices across the netns. Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> Link: https://patch.msgid.link/20260408-b4-ynl_ethtool-v2-2-7623a5e8f70b@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12tools: ynl: move ethtool.py to selftestHangbin Liu
We have converted all the samples to selftests. This script is the last piece of random "PoC" code we still have lying around. Let's move it to tests. Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> Link: https://patch.msgid.link/20260408-b4-ynl_ethtool-v2-1-7623a5e8f70b@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12Merge branch 'net-mana-fix-debugfs-directory-naming-and-file-lifecycle'Jakub Kicinski
Erni Sri Satya Vennela says: ==================== net: mana: Fix debugfs directory naming and file lifecycle This series fixes two pre-existing debugfs issues in the MANA driver. Patch 1 fixes the per-device debugfs directory naming to use the unique PCI BDF address via pci_name(), avoiding a potential NULL pointer dereference when pdev->slot is NULL (e.g. VFIO passthrough, nested KVM) and preventing name collisions across multiple PFs or VFs. Patch 2 moves the current_speed debugfs file creation from mana_probe_port() to mana_init_port() so it survives detach/attach cycles triggered by MTU changes or XDP program changes. ==================== Link: https://patch.msgid.link/20260408081224.302308-1-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: mana: Move current_speed debugfs file to mana_init_port()Erni Sri Satya Vennela
Move the current_speed debugfs file creation from mana_probe_port() to mana_init_port(). The file was previously created only during initial probe, but mana_cleanup_port_context() removes the entire vPort debugfs directory during detach/attach cycles. Since mana_init_port() recreates the directory on re-attach, moving current_speed here ensures it survives these cycles. Fixes: 75cabb46935b ("net: mana: Add support for net_shaper_ops") Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260408081224.302308-3-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12net: mana: Use pci_name() for debugfs directory namingErni Sri Satya Vennela
Use pci_name(pdev) for the per-device debugfs directory instead of hardcoded "0" for PFs and pci_slot_name(pdev->slot) for VFs. The previous approach had two issues: 1. pci_slot_name() dereferences pdev->slot, which can be NULL for VFs in environments like generic VFIO passthrough or nested KVM, causing a NULL pointer dereference. 2. Multiple PFs would all use "0", and VFs across different PCI domains or buses could share the same slot name, leading to -EEXIST errors from debugfs_create_dir(). pci_name(pdev) returns the unique BDF address, is always valid, and is unique across the system. Fixes: 6607c17c6c5e ("net: mana: Enable debugfs files for MANA device") Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260408081224.302308-2-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12nfc: llcp: add missing return after LLCP_CLOSED checksJunxi Qian
In nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket state is LLCP_CLOSED, the code correctly calls release_sock() and nfc_llcp_sock_put() but fails to return. Execution falls through to the remainder of the function, which calls release_sock() and nfc_llcp_sock_put() again. This results in a double release_sock() and a refcount underflow via double nfc_llcp_sock_put(), leading to a use-after-free. Add the missing return statements after the LLCP_CLOSED branches in both functions to prevent the fall-through. Fixes: d646960f7986 ("NFC: Initial LLCP support") Signed-off-by: Junxi Qian <qjx1298677004@gmail.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260408081006.3723-1-qjx1298677004@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12Merge branch 'bng_en-add-link-management-and-statistics-support'Jakub Kicinski
Bhargava Marreddy says: ==================== bng_en: add link management and statistics support This series enhances the bng_en driver by adding: 1. Link/PHY support a. Link query b. Async Link events c. Ethtool link set/get functionality 2. Hardware statistics reporting via ethtool -S This version incorporates feedback received prior to splitting the original series into two parts. ==================== Link: https://patch.msgid.link/20260406180420.279470-1-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12bng_en: add support for ethtool -S stats displayBhargava Marreddy
Implement the legacy ethtool statistics interface (get_sset_count, get_strings, get_ethtool_stats) to expose hardware counters not available through standard kernel stats APIs. Ex: a) Per-queue ring stats rxq0_ucast_packets: 2 rxq0_mcast_packets: 0 rxq0_bcast_packets: 15 rxq0_ucast_bytes: 120 rxq0_mcast_bytes: 0 rxq0_bcast_bytes: 900 txq0_ucast_packets: 0 txq0_mcast_packets: 0 txq0_bcast_packets: 0 txq0_ucast_bytes: 0 txq0_mcast_bytes: 0 txq0_bcast_bytes: 0 b) Per-queue TPA(LRO/GRO) stats rxq4_tpa_eligible_pkt: 0 rxq4_tpa_eligible_bytes: 0 rxq4_tpa_pkt: 0 rxq4_tpa_bytes: 0 rxq4_tpa_errors: 0 rxq4_tpa_events: 0 c) Port level stats rxp_good_vlan_frames: 0 rxp_mtu_err_frames: 0 rxp_tagged_frames: 0 rxp_double_tagged_frames: 0 rxp_pfc_ena_frames_pri0: 0 rxp_pfc_ena_frames_pri1: 0 rxp_pfc_ena_frames_pri2: 0 rxp_pfc_ena_frames_pri3: 0 rxp_pfc_ena_frames_pri4: 0 rxp_pfc_ena_frames_pri5: 0 rxp_pfc_ena_frames_pri6: 0 rxp_pfc_ena_frames_pri7: 0 rxp_eee_lpi_events: 0 rxp_eee_lpi_duration: 0 rxp_runt_bytes: 0 rxp_runt_frames: 0 txp_good_vlan_frames: 0 txp_jabber_frames: 0 txp_fcs_err_frames: 0 txp_pfc_ena_frames_pri0: 0 txp_pfc_ena_frames_pri1: 0 txp_pfc_ena_frames_pri2: 0 txp_pfc_ena_frames_pri3: 0 txp_pfc_ena_frames_pri4: 0 txp_pfc_ena_frames_pri5: 0 txp_pfc_ena_frames_pri6: 0 txp_pfc_ena_frames_pri7: 0 txp_eee_lpi_events: 0 txp_eee_lpi_duration: 0 txp_xthol_frames: 0 d) Per-priority stats rx_bytes_pri0: 4182650 rx_bytes_pri1: 4182650 rx_bytes_pri2: 4182650 rx_bytes_pri3: 4182650 rx_bytes_pri4: 4182650 rx_bytes_pri5: 4182650 rx_bytes_pri6: 4182650 rx_bytes_pri7: 4182650 Signed-off-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com> Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com> Link: https://patch.msgid.link/20260406180420.279470-11-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12bng_en: implement netdev_stat_opsBhargava Marreddy
Implement netdev_stat_ops to provide standardized per-queue statistics via the Netlink API. Below is the description of the hardware drop counters: rx-hw-drop-overruns: Packets dropped by HW due to resource limitations (e.g., no BDs available in the host ring). rx-hw-drops: Total packets dropped by HW (sum of overruns and error drops). tx-hw-drop-errors: Packets dropped by HW because they were invalid or malformed. tx-hw-drops: Total packets dropped by HW (sum of resource limitations and error drops). The implementation was verified using the ynl tool: ./tools/net/ynl/pyynl/cli.py --spec \ Documentation/netlink/specs/netdev.yaml --dump qstats-get --json \ '{"ifindex":14, "scope":"queue"}' [{'ifindex': 14, 'queue-id': 0, 'queue-type': 'rx', 'rx-bytes': 758, 'rx-hw-drop-overruns': 0, 'rx-hw-drops': 0, 'rx-packets': 11}, {'ifindex': 14, 'queue-id': 1, 'queue-type': 'rx', 'rx-bytes': 0, 'rx-hw-drop-overruns': 0, 'rx-hw-drops': 0, 'rx-packets': 0}, {'ifindex': 14, 'queue-id': 0, 'queue-type': 'tx', 'tx-bytes': 0, 'tx-hw-drop-errors': 0, 'tx-hw-drops': 0, 'tx-packets': 0}, {'ifindex': 14, 'queue-id': 1, 'queue-type': 'tx', 'tx-bytes': 0, 'tx-hw-drop-errors': 0, 'tx-hw-drops': 0, 'tx-packets': 0}, {'ifindex': 14, 'queue-id': 2, 'queue-type': 'tx', 'tx-bytes': 810, 'tx-hw-drop-errors': 0, 'tx-hw-drops': 0, 'tx-packets': 10},] Signed-off-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com> Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com> Link: https://patch.msgid.link/20260406180420.279470-10-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12bng_en: implement ndo_get_stats64Bhargava Marreddy
Implement the ndo_get_stats64 callback to report aggregate network statistics. The driver gathers these by accumulating the per-ring counters into the provided rtnl_link_stats64 structure. Signed-off-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com> Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com> Link: https://patch.msgid.link/20260406180420.279470-9-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12bng_en: periodically fetch and accumulate hardware statisticsBhargava Marreddy
Use the timer to schedule periodic stats collection via the workqueue when the link is up. Fetch fresh counters from hardware via DMA and accumulate them into 64-bit software shadows, handling wrap-around for counters narrower than 64 bits. Signed-off-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com> Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com> Reviewed-by: Rahul Gupta <rahul-rg.gupta@broadcom.com> Reviewed-by: Ajit Kumar Khaparde <ajit.khaparde@broadcom.com> Link: https://patch.msgid.link/20260406180420.279470-8-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12bng_en: add HW stats infra and structured ethtool opsBhargava Marreddy
Implement the hardware-level statistics foundation and modern structured ethtool operations. 1. Infrastructure: Add HWRM firmware wrappers (FUNC_QSTATS_EXT, PORT_QSTATS_EXT, and PORT_QSTATS) to query ring and port counters. 2. Structured ops: Implement .get_eth_phy_stats, .get_eth_mac_stats, .get_eth_ctrl_stats, .get_pause_stats, and .get_rmon_stats. Stats are initially reported as 0; accumulation logic is added in a subsequent patch. Signed-off-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com> Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com> Link: https://patch.msgid.link/20260406180420.279470-7-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-12bng_en: add support for link async eventsBhargava Marreddy
Register for firmware asynchronous events, including link-status, link-speed, and PHY configuration changes. Upon event reception, re-query the PHY and update ethtool settings accordingly. Signed-off-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com> Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com> Reviewed-by: Rajashekar Hudumula <rajashekar.hudumula@broadcom.com> Reviewed-by: Ajit Kumar Khaparde <ajit.khaparde@broadcom.com> Link: https://patch.msgid.link/20260406180420.279470-6-bhargava.marreddy@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-13 23:27:53 +0000