mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,481,739 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Johannes Berg
|
fa01779ff9 |
wifi: skip DUO params when looking for NPCA
If DUO parameters are present, they need to be skipped. This was missed during the D1.3 -> D1.4 transition and causes frames to be mis-parsed for NPCA when DUO is also enabled. Link: https://patch.msgid.link/20260731140351.cb57484a68b1.I229dcd80b8e30c3fdfe8eedb81725dc35d9d9fe1@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
||
Rosen Penev
|
87beac0a1d |
wifi: b43legacy: Use flexible array for DMA metadata
Store the per-descriptor metadata in the DMA ring allocation instead of allocating it separately. This ties the metadata lifetime directly to the ring, removes a separate allocation failure path, and keeps the descriptor count available for __counted_by() bounds checking. Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260511041934.378209-1-rosenp@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
||
|
Rosen Penev
|
b120ec039f |
wifi: mwifiex: Use flexible array for RX reorder table
Embed the RX reorder pointer array in struct mwifiex_rx_reorder_tbl instead of allocating it separately. This ties the array to the reorder table lifetime and removes a separate allocation and cleanup path. Change the void pointer type to the proper one for clarity. Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260727003035.118047-1-rosenp@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
||
Lachlan Hodges
|
edad0797f1 |
wifi: cfg80211: remove duplicate s1g_cap kerneldoc
ieee80211_supported_band::s1g_cap is already annotated. Remove the duplicate. Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com> Link: https://patch.msgid.link/20260827054608.254883-1-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
||
|
Lachlan Hodges
|
00f623647c |
wifi: mac80211: don't seed an S1G sta's last_rate
When initialising the rate control system, ieee80211_s1g_sta_rate_init()
is called for S1G stations during association where it initialises a
last rate of type STA_STATS_RATE_TYPE_S1G but does not initialise
nss, mcs bw etc. Since the last_rate no longer has a value equivalent
to STA_STATS_RATE_INVALID, the invalid rate will be decoded and
the NL80211_STA_INFO_RX_BITRATE flag will be set.
As a result, there is a period during association before the first
data frame is rx'ed where the seeded value is overwritten by
ieee80211_rx_h_sta_process() while this invalid last_rate lives. If
the sta is desroyed during this process, nl80211_put_sta_rate() will
call into cfg80211_calculate_bitrate() and attempt to calculate
the bitrate using the invalid last_rate leading to a WARN:
4,336,675067400,-;------------[ cut here ]------------
4,337,675067524,-;WARNING: net/wireless/util.c:1960 at cfg80211_calculate_bitrate+0x4d8/0x8b0 [cfg80211], CPU#3: kworker/u16:3/874
4,338,675068176,-;invalid rate bw=0, mcs=0, nss=0
[snip loaded modules]
4,341,675068954,-;Hardware name: BCM2711
4,342,675068961,-;Workqueue: events_unbound cfg80211_wiphy_work [cfg80211]
4,343,675069386,-;Call trace:
4,344,675069392,-; unwind_backtrace from show_stack+0x10/0x14
4,345,675069440,-; show_stack from dump_stack_lvl+0xa8/0xb8
4,346,675069475,-; dump_stack_lvl from __warn+0x90/0x224
4,347,675069517,-; __warn from warn_slowpath_fmt+0x130/0x1a8
4,348,675069559,-; warn_slowpath_fmt from cfg80211_calculate_bitrate+0x4d8/0x8b0 [cfg80211]
4,349,675070005,-; cfg80211_calculate_bitrate [cfg80211] from nl80211_put_sta_rate+0x48/0x590 [cfg80211]
4,350,675070819,-; nl80211_put_sta_rate [cfg80211] from nl80211_put_sta_info_common+0x4f4/0xd50 [cfg80211]
4,351,675071616,-; nl80211_put_sta_info_common [cfg80211] from nl80211_send_station.constprop.0+0x114/0x424 [cfg80211]
4,352,675072427,-; nl80211_send_station.constprop.0 [cfg80211] from cfg80211_del_sta_sinfo+0xc4/0x368 [cfg80211]
4,353,675073222,-; cfg80211_del_sta_sinfo [cfg80211] from __sta_info_destroy_part2+0x108/0x2c0 [mac80211]
4,354,675074178,-; __sta_info_destroy_part2 [mac80211] from sta_info_destroy_addr+0x4c/0x88 [mac80211]
4,355,675075243,-; sta_info_destroy_addr [mac80211] from ieee80211_destroy_assoc_data+0x194/0x2d8 [mac80211]
4,356,675075920,-; ieee80211_destroy_assoc_data [mac80211] from ieee80211_rx_mgmt_assoc_resp+0x220/0x1d4c [mac80211]
4,357,675076558,-; ieee80211_rx_mgmt_assoc_resp [mac80211] from ieee80211_iface_work+0x1c0/0x5d0 [mac80211]
4,358,675077187,-; ieee80211_iface_work [mac80211] from cfg80211_wiphy_work+0x110/0x368 [cfg80211]
4,359,675077763,-; cfg80211_wiphy_work [cfg80211] from process_one_work+0x260/0x868
4,360,675078022,-; process_one_work from worker_thread+0x1bc/0x3ec
4,361,675078042,-; worker_thread from kthread+0x120/0x154
4,362,675078060,-; kthread from ret_from_fork+0x14/0x20
4,363,675078074,-;Exception stack(0xf0ac1fb0 to 0xf0ac1ff8)
4,364,675078081,-;1fa0: 00000000 00000000 00000000 00000000
4,365,675078088,-;1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
4,366,675078093,-;1fe0: 00000000 00000000 00000000 00000000 00000013 00000000
4,367,675080226,-;irq event stamp: 15780967
4,368,675080287,-;hardirqs last enabled at (15780975): [<c050c154>] __up_console_sem+0x50/0x60
4,369,675080395,-;hardirqs last disabled at (15780982): [<c050c140>] __up_console_sem+0x3c/0x60
4,370,675080497,-;softirqs last enabled at (15780966): [<c0476f14>] handle_softirqs+0x398/0x650
4,371,675080608,-;softirqs last disabled at (15780939): [<c0477388>] __irq_exit_rcu+0x150/0x1f0
4,372,675080715,-;---[ end trace 0000000000000000 ]---
To fix, we can simply not seed this psuedo rate. It was originally
implemented to avoid errornous paths that S1G shouldn't take, but those
have since been fixed / cleaned up. While we are here, we also don't
need to initialise the tx side's last rate with
IEEE80211_TX_RC_S1G_MCS (which is equivalent to
IEEE80211_TX_RC_VHT_MCS). The entire tx reporting side does not
support S1G widths and is assumed to be handled by the driver so
we can just remove the entire function.
Fixes:
|
||
Jakub Kicinski
|
a5249d1d9a |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Cross-merge networking fixes after downstream PR (net-7.3-rc2). No conflicts, or adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Linus Torvalds
|
adf50c47a4 |
Including fixes from bluetooth.
Previous releases - regressions:
- page_pool: keep frag_offset aligned for odd-sized requests
- sched: fix u32 duplicate handle when node ID pool is exhausted
- udp: create exceptions before socket matching
- igmp: convert struct ip_sf_list to RCU
- ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit
- rds: acquire the fastpath locks in rds_conn_shutdown()
- tipc:
- protect node reset trace dump with node lock
- fix NULL deref in tipc_named_node_up() on empty publication list
- bluetooth:
L2CAP: fix out-of-bounds write in l2cap_ecred_connect
hci_core: fix race condition during device registration
- eth: mlx5e: prevent stale XSK buffer release on refill retries
- eth: bridge: don't truncate the port group walk on teardown
Previous releases - always broken:
- gro: fix nesting of TCP GSO SKBs in skb_gro_receive_list()
- sched: fix skb sizing and action leak on reoffload delete
- tcp: fix use-after-free in do_tcp_getsockopt()
- af_packet: don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
- sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
- iptunnel: fix stale transport header during tunnel decapsulation
- eth: vxlan: fix use-after-free in vxlan_mdb_remote_src_del()
- eth: bonding: fix uninitialized transport header access in alb_determine_nd()
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-----BEGIN PGP SIGNATURE-----
iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmqZp4kSHHBhYmVuaUBy
ZWRoYXQuY29tAAoJECkkeY3MjxOkEjkQALMGg903vZ4TfGlzKayFzyhcd5ZC8G4F
R4M+UgTGRfNuas/1YwjpyOpvOYyFgGZ9xBmYNFdsW0YCzZwu8PxpXgu6WTZ+F4gu
sDtWoAbN5V6CfY3fdC7IbXTp8t4CX+shQAsVvEp39Y8SJF4AZeMn8N0+Lnu4DlD3
DAPo/lYSSfvv7RK/5Jvr9FWo7vyoEylfG+LekzGASmWGwhC3h7kWGB4RB4PhJmyq
vRIj2ZjnzdDxu4N7ZGh+EEu5SBCcLP0e/dIMCDg++HAghDqPJ+7pzbWC1kFtQ0ss
qOSyws/xMW3D0Rb68tkiikYWRwgvXUsfEL7Jdf2lhC1xDI8ZpxrrnPYYSZS4rsjb
hjeBwtzRZhv5R0PnNlaZyNpFICIW3XwqP0bYqH/Z/CgwwkKYd+Rp6Tm7hkLpafNx
Py607x2Ff/L2Aydp8csJEyqFP33QOHAfeW+X/YCo4jTc0zBTMSsOblG/EsPPBdNX
fvhVkx4NdqAvIdLYm65cdvhe5dZtIhOAhwAMcrGiMIia4vCIsXq3fWbAe6Phtu8T
KHpQ7Esg/if6blNPpflBuVPsoU+5N6mL7a+zsurqvilJBC5DgYaxwbMlgRSUmJzg
2rR6IlrOsb0FFITNUv+xgPEGzMGV1rL4wnaMSmVN0tjmFQvcu24XQ17D+ug27+eG
rD+E2lrX5rNn
=0sv8
-----END PGP SIGNATURE-----
Merge tag 'net-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from bluetooth.
Previous releases - regressions:
- page_pool: keep frag_offset aligned for odd-sized requests
- sched: fix u32 duplicate handle when node ID pool is exhausted
- udp: create exceptions before socket matching
- igmp: convert struct ip_sf_list to RCU
- ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit
- rds: acquire the fastpath locks in rds_conn_shutdown()
- tipc:
- protect node reset trace dump with node lock
- fix NULL deref in tipc_named_node_up() on empty publication
list
- bluetooth:
- L2CAP: fix out-of-bounds write in l2cap_ecred_connect
- hci_core: fix race condition during device registration
- eth:
- mlx5e: prevent stale XSK buffer release on refill retries
- bridge: don't truncate the port group walk on teardown
Previous releases - always broken:
- gro: fix nesting of TCP GSO SKBs in skb_gro_receive_list()
- sched: fix skb sizing and action leak on reoffload delete
- tcp: fix use-after-free in do_tcp_getsockopt()
- af_packet: don't cast tpacket_hdr.tp_len to int in
tpacket_parse_header()
- sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
- iptunnel: fix stale transport header during tunnel decapsulation
- eth:
- vxlan: fix use-after-free in vxlan_mdb_remote_src_del()
- bonding: fix uninitialized transport header access in
alb_determine_nd()"
* tag 'net-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (83 commits)
net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list()
net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset
net: airoha: enable RX_DONE interrupt for RX queue 31
net/rds: don't let rds_conn_shutdown() consume a concurrent drop
net/rds: acquire the fastpath locks in rds_conn_shutdown()
net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
net/rds: clear cp_flags bits individually in rds_conn_path_reset()
net/rds: use clear_bit_unlock() in release_refill()
net/rds: use wq_has_sleeper() in release_in_xmit()
net: usb: qmi_wwan: add Compal EXM-G1x support
net: macb: exclude software FCS from TX byte statistics
net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().
net: bridge: mcast: don't truncate the port group walk on teardown
bonding: do not clear curr_active_slave prematurely when releasing all slaves
net: qrtr: Send HELLO message on endpoint register
octeontx2-af: Fix limiting SRIOV VF count logic
bonding: alb: fix uninitialized transport header access in alb_determine_nd()
s390/ctcm: Prevent XID null dereference
net: psp: do not inherit the Rx association on clone
...
|
||
|
Linus Torvalds
|
8ab1afb2eb |
- dm-crypt: fix a race condition that could make errors not being reported
- dm-cache: fix rwsem being locked and unlocked from different processes
- dm-integrity: set the 'stable writes' flag
- dm-integrity: fix a buffer overflow introduced in this merge window
- dm-integrity: fix an infinite loop if tag size is greater than 64
- dm-cache: fix demotion statistics
- dm-integrity: fix NULL pointer dereference in the data-recovery mode
- dm-ebs: remove a bogus restriction on the starting sector offset
-----BEGIN PGP SIGNATURE-----
iIoEABYIADIWIQRnH8MwLyZDhyYfesYTAyx9YGnhbQUCapmHXxQcbXBhdG9ja2FA
cmVkaGF0LmNvbQAKCRATAyx9YGnhbXwlAP9TGvtNybtjhdQJmo3t528XRdwYrYuJ
TZTRcQ+KMXEAkgEAxG1l4vvECTwSkUhZXub2own7+IypiY8N5cFOWCkdVwc=
=hVzb
-----END PGP SIGNATURE-----
Merge tag 'for-7.3/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
Pull device mapper fixes from Mikulas Patocka:
- fix a dm-crypt race condition that could make errors not being reported
- dm-cache:
- fix rwsem being locked and unlocked from different processes
- fix demotion statistics
- dm-integrity:
- set the 'stable writes' flag
- fix a buffer overflow introduced in this merge window
- fix an infinite loop if tag size is greater than 64
- fix NULL pointer dereference in dm-integrity data-recovery mode
- remove a bogus restriction on the dm-ebs starting sector offset
* tag 'for-7.3/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
dm-ebs: fix incorrect device offset check in ebs_ctr()
dm-integrity: fix NULL pointer dereference when the 'R' flag is used
dm cache: fix demotion stats in passthrough mode
dm-integrity: fix infinite loop on discard with large tag size
dm-integrity: fix buffer overflow with keyed discard
dm-integrity: require stable writes for internal hash modes
dm cache: fix issue with background work locking
dm-crypt: fix a tiny race condition in crypt_dec_pending
|
||
|
Linus Torvalds
|
97be98b94d |
- Serialize truncate, fallocate, and mmap fault paths with
invalidate_lock, avoiding mmap failures during concurrent size changes
and exposure of uninitialized data during allocation.
- Correct fallocate signal and zeroing error handling.
- Fix FITRIM range alignment to prevent discard requests from extending
into allocated clusters.
- Fix free-cluster accounting when cluster-freeing rollback or bitmap
clearing fails.
- Keep volumes marked dirty when ntfs errors have been recorded.
- Compute bi_sector in 512-byte units, preventing silent corruption on
4Kn devices.
- Validate sectors_per_cluster values and prevent undefined shifts when
parsing MFT and index record sizes.
- Bound $AttrDef traversal to the loaded table size.
- Fix MFT record resizing, memmove overlap, and kmap_local cleanup issues.
- Improve error propagation across attribute, EA, and reparse operations,
including returning -ERANGE for undersized xattr buffers.
- Avoid modifying the HasEA flag when setxattr fails and return
DT_UNKNOWN when directory inode lookup fails.
- Reduce contention in WOF decompression by performing block reads outside
the decompression lock.
-----BEGIN PGP SIGNATURE-----
iQJKBAABCgA0FiEE6NzKS6Uv/XAAGHgyZwv7A1FEIQgFAmqZGasWHGxpbmtpbmpl
b25Aa2VybmVsLm9yZwAKCRBnC/sDUUQhCIdnD/9OEohX3GvIqwHT90GubLIGunJr
S2D1MSJz0AwNF0sNQhTawAc3fbjwI77B2H3mI/Xghkd4IvgtzcY/L/jYfaZ3M7sn
Grctto0BypHI5DuBbArfjTQdW/NkPR0IpXGyBLQ8sO6aYVUPGAG0lvL9tT1Zm52N
JQU1mtjEihE5ZpD79gx8PexuDJHIg0uuok4EANk9Vu+Ub68bDBsnl/Zyxm4spIEA
976QAdboGDvo+71IdpPSaMuSAMytOf7LDJqxECqZXN5aUOoz9wrJnjELVg+xRE6c
AFM9hHZ4tZ0zs5A0EpR835URaB/bxGWpbGdkCyDDBm+QMHiTGNp5nGFl/Sd/NO5B
NcSaj0Tc2+7DbcTLU2hk1FhUsEk8eTwBZK05gxE6OajAIfAyXqxTNeB1th5smLKG
PjKWjQh9F2okIB71D6jkdntAs/0RPyuu37bTl0EtJeuRoWYZooHkgeA+tV350BQz
vjOwQuVUnDoNRQ0z1egrqAZalgjoNG7xLu0fI+n7eXZ5a4XZvQpYlKWKsodXYVwX
TBwnQhst8zEx49fe5dIBGnLiZhhQMe2zxmh7lxAOu6VcVPE4Xv6jSwzcilyiPtQF
YrdZGOEgtByOLsD+m1PRYZvukvQDDpn+NX6w4dJ+YL3MjGB7X1e2c7imqonJJYM1
0hByGPAn3g+5XdGSig==
=gAcy
-----END PGP SIGNATURE-----
Merge tag 'ntfs-for-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs
Pull ntfs fixes from Namjae Jeon:
- Serialize truncate, fallocate, and mmap fault paths with
invalidate_lock, avoiding mmap failures during concurrent size
changes and exposure of uninitialized data during allocation
- Correct fallocate signal and zeroing error handling
- Fix FITRIM range alignment to prevent discard requests from extending
into allocated clusters
- Fix free-cluster accounting when cluster-freeing rollback or bitmap
clearing fails
- Keep volumes marked dirty when ntfs errors have been recorded
- Compute bi_sector in 512-byte units, preventing silent corruption on
4Kn devices
- Validate sectors_per_cluster values and prevent undefined shifts when
parsing MFT and index record sizes
- Bound $AttrDef traversal to the loaded table size
- Fix MFT record resizing, memmove overlap, and kmap_local cleanup
issues
- Improve error propagation across attribute, EA, and reparse
operations, including returning -ERANGE for undersized xattr buffers
- Avoid modifying the HasEA flag when setxattr fails and return
DT_UNKNOWN when directory inode lookup fails
- Reduce contention in WOF decompression by performing block reads
outside the decompression lock
* tag 'ntfs-for-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: (23 commits)
ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()
ntfs: take invalidate_lock in ntfs_setattr_size()
ntfs: handle signal interruption in fallocate
ntfs: fix FITRIM range alignment
ntfs: read WOF chunks outside the decompression lock
ntfs: leave HasEA flag untouched on setxattr failure
ntfs: fix race between fallocate and mmap reads
ntfs: fix memmove overlap in ntfs_new_attr_flags
ntfs: compute bi_sector in 512-byte units
ntfs: reject invalid sectors_per_cluster in the boot sector
ntfs: bound $AttrDef table walk to the loaded table size
ntfs: fix undefined behavior in mft/index record size calculation
ntfs: treat any nonzero dio zero-range return as an error
ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize
ntfs: do not mark the volume clean in sync_fs when errors were recorded
ntfs: skip free cluster decrement when rollback fails
ntfs: only count successfully cleared runs when freeing clusters
ntfs: fix kmap_local leak in write_mft_record_nolock() error paths
ntfs: return real error from ntfs_non_resident_attr_record_add()
ntfs: preserve error code in ntfs_resident_attr_record_add()
...
|
||
Jiawen Wu
|
7042c8c193 |
net: libwx: rename wx_pf_flags to wx_flags
The flags defined in `enum wx_pf_flags` and its terminator `WX_PF_FLAGS_NBITS` were originally named with a "PF" (Physical Function) prefix. However, these flags are not exclusive to PFs and are also utilized by Virtual Functions (VFs). Rename the enumeration to `enum wx_flags` and the bit count to `WX_FLAGS_NBITS` to accurately reflect their shared usage across both PF and VF drivers, and to prevent potential confusion. Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com> Reviewed-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/9479B0506F544556+20260901065659.41273-1-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
Sang-Heon Jeon
|
b35d3d2fae |
octeon_ep: remove redundant memset in octep_setup_pfvf_mbox()
vzalloc() returns zeroed memory, so the memset after the allocation is redundant. No functional change. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn> Link: https://patch.msgid.link/20260901110913.977745-1-ekffu200098@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
Naveen Mamindlapalli
|
60c1bcdeeb |
octeontx2-pf: Add NIXLF error and poison interrupt handlers
Register and handle the NIX LF error (NIX_LF_ERR_INT) and poison/RAS (NIX_LF_RAS) interrupt vectors, The handlers acknowledge the interrupt and log the status (ratelimited) to help debug NIX LF faults. Signed-off-by: Nitin Shetty J <nshettyj@marvell.com> Signed-off-by: Naveen Mamindlapalli <naveenm@marvell.com> Link: https://patch.msgid.link/20260831062600.839203-1-nshettyj@marvell.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
HW He
|
66817a9794 |
net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list()
Fraglist GRO and hardware GRO can create an fraglist of
HW-GRO packets. This cannot be segmented back into
the original form on TCP tethering scenario.
Avoid constructing such a GSO packet, by flushing an already
built fraglist GRO packet if a hardware GRO packet arrives.
Scenario (Tethering/Forwarding):
1.Driver submits a single TCP packet, P1. P1 is kept in the
gro_list as the first packet.
2. The driver submits a TCP GSO skb, P2. P2 has already aggregated
multiple TCP packets by HW_GRO, and its non-linear data is stored in
frags[].
3. P1 and P2 match the GRO rules, and since there is no local socket,
they are aggregated by skb_gro_receive_list(). The resulting skb,
P3, has a frag_list entry that still contains frags[]:
P3: [ Linear Data ] -> frag_list -> [ Linear Data ]
[ frag[1] ]
[ frag[2] ]
...
4. Later, tcp4_gso_segment() or tcp6_gso_segment() calls
skb_segment_list() to segment P3. However, skb_segment_list() only
segments the entries in frag_list. It does not segment the frags[]
inside P2, so P3 is not restored to the original packets, which leads
to IP fragmentation or packet drop in the following path.
Check skb_is_gso(skb) and current GRO method, make sure fraglist GRO
applies to consecutive non-GSO skb, others adopt regular GRO path.
Fixes:
|
||
Lorenzo Bianconi
|
8e2faf945a |
net: stmmac: drop the queue-0 pinning for GSO frames
stmmac_select_queue() forces every GSO frame (TCPv4/TCPv6/UDP-L4) onto TX queue 0, relying on the legacy assumption that at least queue 0 is always TSO/USO capable. This is no longer needed since stmmac_features_check() already validates each GSO frame against the capabilities of the queue it is mapped to, clearing the checksum and GSO features for queues that cannot perform TSO (e.g. TBS queues or queues without TX checksum offload support). Remove stmmac_select_queue() so GSO frames are selected through the regular queue selection path (XPS, flow hashing and priority mapping) and can be spread across all TX queues. This also fixes the case where queue 0 is not TSO-capable while other queues are, which previously forced all TSO traffic into software GSO. Non-GSO traffic is unaffected, since the core already falls back to netdev_pick_tx() when ndo_select_queue is not set. Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com> Link: https://patch.msgid.link/20260831-stmmac_select_queue-tso-fix-v3-1-d9c215fe7a85@oss.qualcomm.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
Juuso Rinta
|
e048669dcc |
octeontx2: use dev_err_probe() for deferred probe
The PF and VF drivers warn and return -EPROBE_DEFER when the AF has not programmed the RVUM revision or does not answer the mailbox READY message. That is expected until rvu_af has finished initializing, so the warning is repeated on every deferred retry. Use dev_err_probe() instead of dev_warn() so the expected deferral is not printed at warning level. -EPROBE_DEFER is logged at debug level and the reason is recorded in devices_deferred. Signed-off-by: Juuso Rinta <juuso.rinta@nokia.com> Acked-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260901-octeontx2-dev-err-probe-v1-1-1b5e1affb994@nokia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
|
Lorenzo Bianconi
|
6b8fed2675 |
net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset
The core software reset issued in stmmac_init_dma_engine() during
ndo_open() callback clears the MTL RX packet parser registers, but
stmmac_rxp_config() is only invoked from the cls_u32 add/delete paths.
After an ifdown/ifup cycle the hardware therefore runs with the default
all-pass table while priv->tc_entries still reports the filters as
installed. Re-apply the RX packet parser table from priv->tc_entries in
stmmac_hw_setup(), right after the software reset, so the filters are
restored when the interface is brought up again.
Fixes:
|
||
Lorenzo Bianconi
|
7db28abbea |
net: airoha: enable RX_DONE interrupt for RX queue 31
RX queue 31 has always been allocated and filled by airoha_qdma_init_rx()
since RX_DONE_INT_MASK spans queues 0-31, but none of the RX_IRQ*
_BANK_PIN_MASK values covered BIT(31). As a consequence the RX_DONE
interrupt for queue 31 was never enabled, airoha_qdma_rx_process() never
ran on that queue and its buffers were never reaped.
Route RX queue 31's RX_DONE interrupt to IRQ bank 1 so that the queue
is drained and its buffers returned to the page pool.
Fixes:
|
||
Paolo Abeni
|
1ab75e8bbf |
Merge branch 'net-stmmac-dwmac4-auto-discover-uc-filter-size'
Maxime Chevallier says: ==================== net: stmmac: dwmac4: Auto-discover UC filter size Following my attempts to get clean ethtool selftests runs on stmmac [1], several issues were found with the unicast filtering. [1]: https://lore.kernel.org/netdev/20260827134004.45ffb57e@kernel.org/ This lead to the discovery that on dwmac4 platforms, the unicast filter size is always falling back to the default value of 1 entry. On older variants, the size comes from devicetree. With a single-entry filter, we directly fallback to unicast promisc as soon as any entry is added in the dev->uc list. dwmac4 exposes through the HW_Features0 register the actual size of the unicast filter, which is made of 3 banks (details in patch 2). Let's use this feature to grab the filter size. Results on actual hardware : - imx8mp : goes from 1 entry to 64 - stm32mp1 : goes from 1 entry to 4 - jh7110 : goes from 1 entry to 9 - yt6801 : still 1 single entry, on extra implemented in HW ==================== Link: https://patch.msgid.link/20260831070121.349778-1-maxime.chevallier@bootlin.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
Maxime Chevallier
|
6815415d68 |
net: stmmac: dwmac4: Use the full perfect filter ability for UC filter
Contrary to dwmac1000 that gets its number of perfect filter entries through the 'snps,perfect-filter-entries' property, dwmac4 allows reading the filter size from the HW features registers. Perfect filter is used for Unicast filtering, and can contain up to 128 entries, each having its own set of registers to access it. The registers are always at the same location in the map, regardless whether or not the entry is implemented in hardware. Accessing a register for an un-implemented entry just doesn't do anything. The filter is made of one always-available entry, and 3 configurable banks : Entry 0 : Always implemented, stores the primary MAC address Entry 1 \ ... + -- Can contain between 0 and 31 entries. Number of available Entry 31 / entries in HW_Features0[18:22]. Entry 32 \ ... + -- Additional 32 entries, all or nothing. Availability is Entry 63 / specified by HW_Features0[23] Entry 64 \ ... + - Additional 64 entries, all or nothing. Availability is Entry 127 / specified by HW_Features0[24]. Each of the 3 configurable banks are independently selectable, meaning we can have gaps in the register banks. For instance, a setup with 50 addresses enabled will have 17 entries in the first bank and the additional 32 bank enabled (50 = 32 + 17 + 1). Another example with 70 addresses : 64 addr bank on, 5 addresses in the first bank (70 = 64 + 5 + 1). While I haven't seen HW with gaps in the banks, Synopsys confirmed this is a real possibility. Let's therefore introduce a dwmac4 helper to get the physical slot number of a given entry, allowing to configure the correct bank when populating the filter. As we need the HW feature-set to compute the index, store the bank info in the mac_device_info struct. The total number of available entries is computed based on the discovered parameters, instead of using the default value of 1. Results on HW that uses dwmac4 : - imx8mp : goes from 1 entry to 64 (1 + 31 + 32) - stm32mp1 : goes from 1 entry to 4 (1 + 3) - jh7110 : goes from 1 entry to 9 (1 + 8) - yt6801 : goes from 1 entry to hum, 1 entry (no extra addresses) Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Link: https://patch.msgid.link/20260831070121.349778-3-maxime.chevallier@bootlin.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
|
Maxime Chevallier
|
384ee2379a |
net: stmmac: dwmac4: Read the UC filter size from hardware capabilities
dwmac4 has multiple banks of perfect filter entries, independently configurable during IP integration. The multi_addr bank reports a number between 0 and 31 corresponding to the actual number of entries in that bank, while the 32 and 64 banks are all-or-nothing. Expose these caps over debugfs as well. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Link: https://patch.msgid.link/20260831070121.349778-2-maxime.chevallier@bootlin.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
||
|
Jakub Kicinski
|
e16acadb9a |
Merge branch 'net-dsa-motorcomm-add-led-support'
David Yang says: ==================== net: dsa: motorcomm: Add LED support LEDs can be described in the device tree using the standard LED node notation. Currently, only parallel mode and strict 1:1 mapping (i.e. the HW default) are supported. ==================== Link: https://patch.msgid.link/20260831044818.4103477-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
David Yang
|
5f28f63c5d |
dt-bindings: net: dsa: yt921x: Add LEDs definition example
Add LEDs definition example for yt921x to describe how they should be defined for a correct usage. Signed-off-by: David Yang <mmyangfl@gmail.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260831044818.4103477-6-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
David Yang
|
9af9a81682 |
net: dsa: motorcomm: Add LED support
Each port has at most 3 LEDs connected and can be declared using the standard LEDs structure. Currently, only parallel mode and strict 1:1 mapping (i.e. the HW default) are supported. Signed-off-by: David Yang <mmyangfl@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260831044818.4103477-5-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
David Yang
|
e9423a64d3 |
net: dsa: motorcomm: Split SMI module
SMI operations are going to be used across different modules. Minor changes are applied to fix build errors. Signed-off-by: David Yang <mmyangfl@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260831044818.4103477-4-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
David Yang
|
9c472a0d7c |
net: dsa: motorcomm: Move to subdirectory
yt921x is already the longest single-file DSA driver, so it's time to split it into parts. Signed-off-by: David Yang <mmyangfl@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260831044818.4103477-3-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
David Yang
|
b1950d0426 |
net: dsa: yt921x: Check lock status with lockdep_assert_held_once()
mutex_is_locked() was used to check the lock status. While it should not
be triggered unless a bug is introduced, it does not warn on lock being
held by another thread. Fix it with lockdep helpers.
Fixes:
|
||
|
Jakub Kicinski
|
2f38e26a57 |
Merge branch 'net-rds-own-the-fastpath-locks-across-connection-teardown'
Allison Henderson says:
====================
net/rds: own the fastpath locks across connection teardown
This is v5 of the follow-up set to "net/rds: Bug fix ports, part 2"
[1] (v1 at [2], v2 at [3], v3 at [4], v4 at [5]). During review of part 2,
the later half of that series needed more work than a respin, so it was
split off into this set together with the companion fixes identified
along the way. As discussed on the v2 thread, it is targeted at net.
RDS connection teardown quiesces the transmit and receive-refill fast
paths by waiting for the RDS_IN_XMIT/RDS_RECV_REFILL bits to be
sampled clear. Sampling a bit clear is not owning it: the fast path
can re-take its bit right after the wait returns and then run
concurrently with the transport shutdown and the send-state reset.
Oracle UEK closed this by making teardown acquire the bits as locks
("rds: Make sure transmit path and connection tear-down does not run
concurrently"); patches 5 and 6 do the same for the two
rds_send_path_reset() call sites upstream.
Making teardown block on the bits as locks promotes several latent
ordering bugs from rare to load-bearing, so they are fixed first:
Patches 1 and 2 fix the release side of the two bit locks.
release_in_xmit() and release_refill() both clear their bit and then
test for waiters, but the barrier is on the wrong side of the clear
to order the critical section's stores before the release, and the
waiter check does not order against the clear. Once teardown blocks
on these bits as locks (uninterruptible and untimed), a lost wake-up
or a store observed out of order stops mattering only in theory.
Use clear_bit_unlock() and wq_has_sleeper(), the pattern already
half-present in release_in_xmit().
Patch 3: rds_conn_path_reset() wipes the whole cp_flags word with a
plain store. Once teardown owns bits in that word across the reset,
a blanket store would end lock ownership early - and it already
races atomic RMWs on the same word today. Clear the bits the reset
is responsible for individually, as Oracle UEK also does.
Patch 4: rds_tcp_reset_callbacks() stores RDS_CONN_RESETTING
unconditionally, which can overwrite the RDS_CONN_ERROR or
RDS_CONN_DISCONNECTING of a shutdown already in progress on the same
path and send that shutdown through an extra drop cycle. Once the
accept path can park for the duration of a teardown (patch 6) that
window widens, so make the transition conditional first, as Oracle
UEK does.
With those in place, patch 5 converts rds_tcp_reset_callbacks() from
waiting on RDS_IN_XMIT to acquiring it, holding it across the socket
swap and rds_send_path_reset(), and patch 6 has rds_conn_shutdown()
hold both bit locks across the transport shutdown and path reset.
Patch 7 fixes a pre-existing teardown-state hole that this series
makes easier to hit but did not introduce. Since commit
|
||
Allison Henderson
|
260c6308fe |
net/rds: don't let rds_conn_shutdown() consume a concurrent drop
rds_conn_shutdown() finishes by moving the path from
RDS_CONN_DISCONNECTING to RDS_CONN_DOWN, and also accepts
RDS_CONN_ERROR as the starting state of that final transition, so that
a FIN processed in softirq context during the teardown does not derail
the shutdown into a noisy error path.
But consuming that RDS_CONN_ERROR also consumes the shutdown pass that
came with it: rds_conn_path_drop() sets RDS_CONN_ERROR and then queues
cp_down_w, and a pass that starts on a path already in RDS_CONN_DOWN
is a no-op. For the FIN case that is harmless - the socket the FIN
arrived on is the very socket the teardown just released. It is not
harmless for a dropper that attached something to the path first.
rds_tcp_accept_one() is such a dropper. Its path claim in
rds_tcp_accept_one_path() transitions RDS_CONN_DOWN ->
RDS_CONN_CONNECTING, and a concurrent drop - a FIN on a previous
socket in softirq context, an administrative reset - can put the path
into RDS_CONN_ERROR between that claim and the state check that
follows, which accepts RDS_CONN_ERROR. The accept then installs the
freshly accepted socket with rds_tcp_set_callbacks() while the queued
teardown - which sampled tc->t_sock before this socket existed - is
still running. rds_connect_path_complete() fails its transition to
RDS_CONN_UP and drops the path again, queueing the pass that should
reap the socket it just installed. If the in-flight shutdown's final
transition consumes that drop's RDS_CONN_ERROR, the queued pass finds
the path in RDS_CONN_DOWN and does nothing. The installed socket is
never torn down: it sits established with its callbacks armed and its
rds_tcp_connection on rds_tcp_tc_list, the peer sees a connection that
nothing ever reads, and the path is wedged in RDS_CONN_DOWN until some
later event drops it again. Reproduced with widened race windows as
an ever-growing receive queue on a socket owned by a path stuck in
RDS_CONN_DOWN, with the peer's send path wedged behind it.
Make the final transition only DISCONNECTING -> DOWN. If it fails
because the path is in RDS_CONN_ERROR, a drop raced the teardown:
cancel the reconnect timer and clear RDS_RECONNECT_PENDING - the one
piece of the skipped tail that must not be left behind - and return,
letting the pass the drop queued finish the job: it tears down
whatever attached to the path in the meantime, completes the
transition to RDS_CONN_DOWN, and re-arms the reconnect from its own
tail.
The timer quiesce in that branch matters because the racing drop does
not always queue that pass: rds_conn_path_drop() returns without
queueing when a destroy is pending - exactly the situation during a
netns teardown or module unload, when a FIN on the dying socket is
processed while rds_conn_path_destroy() flushes cp_down_w. If the
flushed pass is the one that takes this return, no later pass exists,
and rds_conn_path_destroy() would find cp_conn_w still armed
(WARN_ON) and then free a path whose reconnect timer can still fire.
With the cancel in the branch, every exit of a shutdown pass leaves
the timer quiesced no matter which pass completes the transition.
The FIN case keeps making progress, one pass later and still without
noisy logging. Any other state keeps today's rds_conn_path_error()
handling; no current cp_state writer can leave a DISCONNECTING path
in anything but RDS_CONN_ERROR (every other writer is a cmpxchg from
a non-DISCONNECTING state), so that branch is defensive.
On kernels without the preceding patches the same hazard exists with
the sample-based quiesce; the fix applies there equally.
Fixes:
|
||
Håkon Bugge
|
813f3582ac |
net/rds: acquire the fastpath locks in rds_conn_shutdown()
rds_conn_shutdown() quiesces the transmit and receive-refill paths by
waiting for RDS_IN_XMIT and RDS_RECV_REFILL to be sampled clear, and
then runs the transport shutdown and rds_conn_path_reset(). Sampling
the bits clear is not the same as owning them: the moment after the
wait_event() returns, rds_send_xmit() can re-acquire RDS_IN_XMIT (or
rds_ib_recv_refill() can re-acquire RDS_RECV_REFILL) and run
concurrently with the teardown.
The sender does recheck the connection state after taking the lock,
but that recheck is a classic store-buffering pattern: teardown writes
the state and reads the bit while the sender writes the bit and reads
the state. acquire_in_xmit() is only an acquire operation, so on
weakly ordered architectures both sides can miss each other's write,
and the transmit path then runs while the transport zeroes its rings
(e.g. rds_ib_ring_init()) and rds_send_path_reset() rewrites the
transmit state under it.
Oracle UEK fixed the same class of crashes - a 14-year tail of
BUG_ON()s in rds_ib_sub_signaled(), unexpected op-codes and NULL
dereferences in rds_ib_send_cqe_handler() during failover testing -
by making the teardown path *acquire* the fastpath bit locks instead
of testing them ("rds: Make sure transmit path and connection
tear-down does not run concurrently"). Ownership of a single word is
decided by RMW atomicity, so no cross-variable ordering is needed.
Do the same here: take both locks before calling the transport
shutdown, hold them across rds_conn_path_reset(), and release them
explicitly with a wake-up afterwards. Both are released with
clear_bit_unlock(), so that the ring re-initialization done by the
transport shutdown and the transmit state rewritten by
rds_send_path_reset() are ordered before either bit is seen clear by
the next acquire_in_xmit() or acquire_refill().
The fastpath users of these bits - rds_send_xmit() and
rds_ib_recv_refill() - are trylock style and back off while teardown
owns the locks, so no new lock dependency is introduced for them.
rds_tcp_reset_callbacks() is different: since the previous patch it
acquires RDS_IN_XMIT as well, and it blocks doing so, so its wait now
spans the teardown instead of at most one send batch. That waiter
runs from rds_tcp_accept_one() on the single-threaded krdsd workqueue
and holds rds_tcp_accept_lock and t_conn_path_lock while it waits, so
a duelling SYN accepted while its path is being torn down parks
accept processing for the duration of the teardown - for TCP bounded
by the (up to 5 s) drain loop in rds_tcp_conn_path_shutdown(). An IB
path's drain in rds_ib_conn_path_shutdown() has no round cap, but no
blocking waiter either: rds_tcp_reset_callbacks() is the only blocking
acquirer of these bits and waits only on its own TCP path, and the
fastpaths are trylock-and-back-off on both transports, so a long IB
drain lengthens only that path's own quiesce. The
window is narrow: the accept-side state check has to pass before the
teardown moves the path to RDS_CONN_DISCONNECTING.
Because krdsd is a single global workqueue, everything else queued
there - accept processing for other connections and network
namespaces, and the flush_workqueue(rds_wq) in rds_tcp_listen_stop()
during namespace teardown - waits behind the parked accept worker for
that time. It cannot deadlock, although the waits do point at each
other: the teardown blocks until the bit's holder releases it, and
the holder may be that krdsd accept worker. The holder finishes
without needing anything the teardown owns: the sync cancels
rds_tcp_reset_callbacks() issues target cp_send_w and cp_recv_w on
the path's ordered cp_wq, whose only execution slot is occupied by
the blocked cp_down_w itself, so they are pending at most and cancel
without flushing - a reliance on cp_wq being ordered that is now
noted next to those cancels (on the allocation-failure fallback where
a path shares rds_wq, the work items simply serialize).
Nor is the blocking wait itself new: rds_tcp_reset_callbacks() has
waited on RDS_IN_XMIT from the krdsd work item since
commit
|
||
|
Allison Henderson
|
02c5f9dc2e |
net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
rds_tcp_reset_callbacks() quiesces the transmit path by setting the
path state to RDS_CONN_RESETTING and then waiting for RDS_IN_XMIT to
be sampled clear before swapping the underlying socket and calling
rds_send_path_reset().
Sampling the bit clear is not the same as owning it: rds_send_xmit()
can re-acquire RDS_IN_XMIT right after the wait_event() returns. Its
state recheck after taking the lock is a store-buffering pattern (the
resetter writes the state and reads the bit, the sender writes the
bit and reads the state) and acquire_in_xmit() is only an acquire
operation, so on weakly ordered architectures both sides can miss
each other's write and the transmit path then runs concurrently with
rds_send_path_reset() rewriting cp_xmit_* state - which is exactly
what the comment above rds_send_path_reset() tells its callers to
prevent.
Take the lock instead, hold it across the socket swap and
rds_send_path_reset(), and release it with a wake-up at the end. The
lock-ordering constraint documented above the wait still holds: the
lock is acquired before lock_sock(), so a sender inside tcp_sendmsg()
can never be waited on while we hold the socket lock.
Two details of the old code go away with the same change:
- t_sock is now read only after the lock is acquired. The old code
cached it before waiting; the teardown in rds_conn_shutdown()
releases that socket and clears t_sock, so a pointer cached before
the wait can be stale by the time the accept path resumes. Reading
it under RDS_IN_XMIT is what makes the exclusion complete once the
teardown owns the same lock, which the next patch arranges; until
then the teardown still only samples the bit, and the two paths
remain as exposed to each other as they are today.
- The old !osock early path called rds_send_path_reset() with no
serialization at all. It now runs under the lock like the normal
path. The conditional RDS_CONN_RESETTING transition of the
previous patch happens before the socket check either way: a path
found without a socket is either still connecting (its reconnect
worker blocked on t_conn_path_lock) and legitimately goes
RESETTING -> UP on the new socket, or it has been torn down
meanwhile and is dropped.
The in-function comment describing the old wait-based quiesce is
rewritten to describe the lock-based one, and the stale block comment
above the function (which still described a return value and an
incomplete list of t_sock writers) is refreshed to name all four
writers - the connect, accept, teardown and swap paths - and what
serializes each of them.
Fixes:
|
||
Gerd Rausch
|
e8e60d74fe |
net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
rds_tcp_reset_callbacks() resolves a duelling SYN by storing RDS_CONN_RESETTING into cp_state unconditionally. Nothing serializes that store against the shutdown path: rds_tcp_accept_one() checks for RDS_CONN_CONNECTING or RDS_CONN_ERROR under t_conn_path_lock, but neither rds_conn_path_drop(), which forces RDS_CONN_ERROR, nor rds_conn_shutdown(), which moves the path to RDS_CONN_DISCONNECTING under cp_cm_lock, takes that lock. The store can therefore land on top of a shutdown that is already in progress, or that gets queued right after the accept-side check. When it does, the shutdown worker's final DISCONNECTING -> DOWN transition fails and the path goes through rds_conn_path_error() and a second drop/shutdown cycle instead of a clean reconnect, tearing down the socket the accept path has just installed. Before commit |
||
|
Allison Henderson
|
103c4b13c4 |
net/rds: clear cp_flags bits individually in rds_conn_path_reset()
rds_conn_path_reset() wipes the whole flag word with a plain
cp->cp_flags = 0 store. Every other accessor of that word uses
atomic bitops, and some of them can run concurrently with the reset:
RDS_LL_SEND_FULL is set from rds_send_xmit() and cleared from the
transport completion paths, neither of which holds anything that
excludes the shutdown worker. A plain store racing an atomic
read-modify-write on the same word is a data race, and whichever
side loses has its update silently discarded.
Clear the two bits the reset is actually responsible for instead.
RDS_IN_XMIT and RDS_RECV_REFILL need no store at all here: they
belong to the caller, rds_conn_shutdown(), which waits for both to be
clear before calling the transport shutdown and this reset.
This also gives every bit in cp_flags a single well-defined writer
discipline, which the following patches rely on when they turn
RDS_IN_XMIT and RDS_RECV_REFILL into bit locks held across the
teardown: a blanket store mid-teardown would destroy lock ownership
that an atomic clear preserves.
Oracle UEK carries the same conversion ("net/rds: Preserve essential
connection state flags"), motivated by its asynchronous shutdown
state machine, whose progress and destroy flags must survive the
reset. UEK's variant also clears RDS_IN_XMIT and RDS_RECV_REFILL
because there the reset runs as the final step of a teardown that
owns both bits, making those clears its unlock. Upstream that
release belongs in rds_conn_shutdown(): once a later patch in this
series turns the two bits into locks held across the teardown, ending
ownership needs release semantics and a wake-up that a plain clear
inside the reset would not provide.
Based on Oracle UEK commit "net/rds: Preserve essential connection
state flags" by Gerd Rausch.
Fixes:
|
||
|
Allison Henderson
|
17c4476dbb |
net/rds: use clear_bit_unlock() in release_refill()
release_refill() drops the RDS_RECV_REFILL bit with a plain
clear_bit(). clear_bit() has no ordering semantics, and the
smp_mb__after_atomic() that follows it sits on the wrong side for a
lock release: it orders the clear against the waitqueue_active() load
below it, but does nothing to order the refill critical section's ring
and descriptor stores before the clear itself.
That matters once connection teardown owns RDS_RECV_REFILL as a lock
across the transport shutdown and path reset, rather than sampling it
clear, which "net/rds: acquire the fastpath locks in
rds_conn_shutdown()" later in this series arranges: on a weakly
ordered architecture the teardown can win the bit and start the
shutdown and reset while some of the refill's stores are not yet
visible to it. The same gap existed under the sample-based scheme - a
waiter that saw the bit clear had no guarantee it also observed the
refill's stores - but taking the bit as a lock makes the missing
release pairing load-bearing.
Switch to clear_bit_unlock(), which orders the critical section before
the release, and replace the open-coded barrier-plus-waitqueue_active()
with wq_has_sleeper(), whose internal full barrier keeps the
store-buffering guarantee between clearing the bit and checking for
sleepers. This mirrors what "net/rds: use wq_has_sleeper() in
release_in_xmit()" does for RDS_IN_XMIT.
The fast-path acquire side, acquire_refill(), uses test_and_set_bit(),
a full-barrier RMW that pairs with this release. The teardown at this
point in the series still samples the bit, so on its own this change
is release-side hardening; the shutdown-conversion patch named above
makes the teardown acquire the bit with the same RMW, completing the
pairing at the end of the series.
Fixes:
|
||
|
Allison Henderson
|
6d0c8b7073 |
net/rds: use wq_has_sleeper() in release_in_xmit()
release_in_xmit() clears RDS_IN_XMIT with clear_bit_unlock() and then checks waitqueue_active() to decide whether anyone needs waking. clear_bit_unlock() is only a release operation: it orders the critical section before the bit clear, but does not order the subsequent plain load of the wait queue head after it. The waiter side does the mirror image - it adds itself to the wait queue and then tests the bit. That is the classic store-buffering pattern: the releasing CPU can read the wait queue as empty while the waiting CPU still reads the bit as set, so the sleeper is never woken. The waiters are rds_conn_shutdown() and rds_tcp_reset_callbacks(), both in uninterruptible wait_event() with no timeout. A lost wake-up strands the shutdown worker on its single-threaded workqueue until some other sender releases the bit again - and on a connection that is being torn down precisely because it failed, there may never be another sender. The barrier used to be there: release_in_xmit() did clear_bit() followed by smp_mb__after_atomic() until commit |
||
Ian Lin
|
08710f033e |
net: usb: qmi_wwan: add Compal EXM-G1x support
The Compal EXM-G1x is a Qualcomm SDX12-based LTE modem. Add support for its QMI WWAN interface 8 using the DTR quirk. Tested on a Compal EXM-G1x modem. Signed-off-by: Ian Lin <jisayme@gmail.com> Link: https://patch.msgid.link/20260831084124.65074-1-jisayme@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Nicolai Buchwitz
|
d85f521a9a |
net: macb: exclude software FCS from TX byte statistics
Frames for which macb_pad_and_fcs() supplies the FCS have four FCS
bytes appended, and TX completion then accounts the grown skb->len.
tx_bytes is defined to exclude the FCS, so these frames are reported
four bytes too large.
Track only the number of FCS bytes appended in software, 0 or
ETH_FCS_LEN, and subtract that from skb->len at completion. skb->len
already reflects the padded length by then, so there is nothing else
to store. macb_pad_and_fcs() already returns 0 on every non-error
path. Return the FCS length from there instead, rather than
recomputing the same check in the caller. BQL stays on the padded
skb->len that netdev_tx_sent_queue() saw.
Fixes:
|
||
Ziyou Xu
|
3498acda6b |
net: phy: air_en8811h: restore AN8811HB LED GPIO after MCU restart
Commit
|
||
|
Jakub Kicinski
|
17d7aa6954 |
netdev: don't use dev->flags for IFF_UP
dev->flags are not technically ops lock protected. The IFF_UP flag will not change when dev->lock is held, but other flags may change so KCSAN would probably not be impressed. Because of this we added a dedicated dev->up which is safe to read under dev->lock. qstats want to make sure device is up, use dev->up. Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com> Reviewed-by: Joe Damato <joe@dama.to> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260831164159.1124679-4-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Jakub Kicinski
|
fcfb5ff9df |
netdev: correct error code in netdev_nl_queue_fill_lease()
netdev_nl_queue_fill_lease() returns ENOMEM on nla_put failures. This is wrong, the error code should be EMSGSIZE. But it doesn't matter, caller of netdev_nl_queue_fill_lease() just checks if the retcode is zero or not, and uses EMSGSIZE. Reviewed-by: Joe Damato <joe@dama.to> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260831164159.1124679-2-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Vincent Jardin
|
e8965b0523 |
net: pcs: lynx: add support for 25GBASE-R
The Lynx PCS never supported 25GBASE-R. Add it, so that a 25G DPMAC on
LX2160A can be driven by phylink.
The SerDes side had the mode since the commit
|
||
|
Jakub Kicinski
|
795eb0feb4 |
Merge branch 'net-dsa-mt7530-modernise-register-access-and-add-two-dsa-ops'
Daniel Golle says: ==================== net: dsa: mt7530: modernise register access and add two DSA ops The mt7530 driver carries its own register accessors that predate the regmap conversion and now largely duplicate what regmap already provides, including locking. Most of this series removes that layer. It first moves the MDIO bus locking into the switch regmap via .lock/.unlock callbacks, matching the PCS regmaps, so any path reaching the regmap is serialised automatically. With the wrappers no longer adding locking, the thin mt7530_mii_* indirection is folded away and the remaining accessors are replaced mechanically with the plain regmap API, using the coccinelle semantic patches included in the commit messages. The two remaining reset polls are converted to regmap_read_poll_timeout() and the then-unused dummy poll machinery is dropped. Open-coded register fields are converted to FIELD_GET/FIELD_PREP. None of this is intended to change behaviour. The last two patches implement .port_fast_age, which flushes dynamically learned MAC entries on topology changes, and .port_change_conduit, which moves a user port's CPU-port affinity at runtime. The swallowed MDIO errors Sashiko flagged on v4 5/8 have meanwhile been fixed in tree by "fix swallowed MDIO read errors" and "fix remaining swallowed MDIO access errors", both merged into net-next. This respin is rebased on top of them: regmap_* return values are no longer ignored, which is what most of the semantic patches had to be reworked for. ==================== Link: https://patch.msgid.link/cover.1788190568.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Daniel Golle
|
e5ed29f156 |
net: dsa: mt7530: implement port_change_conduit op
Allow changing the CPU port affinity of user ports at runtime via the IFLA_DSA_CONDUIT netlink attribute. This updates the port matrix to forward to the new CPU port instead of the old one. Limit the operation to MT7531. There, trapped link-local frames follow the per-port affinity, as the MT7531_CPU_PMAP destination mask is further restricted by the port matrix. A conduit change is hence fully honoured by the hardware, for regular traffic as well as for trapped frames. The MT7530 switch, including the variant embedded in the MT7621 SoC, instead traps frames to the single CPU port set in the CPU_PORT field of the MFC register, regardless of the affinity of the inbound user port. With user ports affine to different CPU ports there is no correct value for that field, so per-port CPU affinity cannot be fully implemented for trapped frames. Routing a WAN port via the second SoC GMAC is conventionally covered by the PHY muxing feature on these switches, which bypasses the switch fabric and does not involve a CPU port at all. The switches on the MT7988, EN7581, AN7583 and EN7528 SoCs only have a single CPU port, leaving no other conduit to change to. As the op lives in the shared mt7530_switch_ops, populate the extack when rejecting the unsupported variants instead of returning a bare -EOPNOTSUPP. Also reject a conduit that belongs to a different switch in the tree, whose port index has no meaning in the local port matrix. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Acked-by: Chester A. Unal <chester.a.unal@arinc9.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/cfc6a478a384a7f309f08d9f76be8fd029c1f202.1788190568.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Daniel Golle
|
e1d532b6b0 |
net: dsa: mt7530: implement port_fast_age
Implement the .port_fast_age DSA operation by flushing all non-static (dynamically learned) MAC address entries from the address table. The switch does not offer a combined "non-static AND per-port" match mode, so the flush is global and the port argument is not used. Unlike b53 and realtek, which flush the dynamic entries of the affected port only, an STP topology change on one port therefore also flushes the dynamically learned entries of the other ports; they are quickly relearned. Access the address table control register under priv->reg_mutex, as done by all other ATC users (FDB and MDB add/del/dump), to serialise the write-then-poll command sequence, and log a message should the command fail. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/60f83ade0e371dfe2d974d5d192056935c3ab5c9.1788190568.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Daniel Golle
|
3d8ca6f904 |
net: dsa: mt7530: convert to use field accessor macros
Use FIELD_GET and FIELD_PREP instead of open-coding register fields. Replace 0x1f constant with (PHY_MAX_ADDR - 1). Some field macros (ATC_HASH, VTCR_VID and STAG_VPID) were previously defined as object-like macros referencing an undeclared 'x' and were therefore unusable; convert them into proper FIELD_PREP() accessors. The masks are equivalent to the open-coded values they replace, with one exception: mt7530_vlan_cmd() now masks vid through VTCR_VID(vid) instead of OR-ing it in raw, guarding the adjacent VTCR_FUNC field against any bits set above the 12-bit VID width. VLAN IDs are always in 0-4094, so this is a no-op in practice; it is a real hardening rather than a strictly equivalent mechanical substitution. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/bd4eaf10fb6aa7a1bd056514b61b4481175708a5.1788190568.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Daniel Golle
|
d7110c1dab |
net: dsa: mt7530: drop the dummy poll machinery
Convert the two remaining switch reset polls to
regmap_read_poll_timeout() and remove struct mt7530_dummy_poll,
INIT_MT7530_DUMMY_POLL() and the mt7530_mii_poll() helper. As with the
command polls addressed by the preceding fixes, a failed read now
terminates the poll with an error instead of being fed to the loop
condition as a zero value.
Generated using the following semantic patch, plus removal of the two
now-unused definitions from mt7530.h:
// Poll the register through regmap so a failed read ends the poll.
@@
expression priv, reg;
identifier p, ret, val;
@@
- INIT_MT7530_DUMMY_POLL(&p, priv, reg);
- ret = readx_poll_timeout(mt7530_mii_poll, &p, val, val != 0,
- 20, 1000000);
+ ret = regmap_read_poll_timeout(priv->regmap, reg, val, val != 0,
+ 20, 1000000);
@@
identifier p;
@@
- struct mt7530_dummy_poll p;
... when != p
@@
identifier p;
type T;
@@
-static T mt7530_mii_poll(struct mt7530_dummy_poll *p) { ... }
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/609dcd8dd0c335e36bbc8df41413da58af1dbfb4.1788190568.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
||
|
Daniel Golle
|
10d9d8328e |
net: dsa: mt7530: replace mt7530_read with regmap_read
Replace all mt7530_read() calls with direct regmap_read() calls and remove the wrapper function. The wrapper returned 0 on failed reads; preserve that behaviour by zeroing the read-back buffer at the start of mt7530_regmap_read(), so callers that do not check the return code keep seeing a deterministic value. The WARN_ON_ONCE error logging is dropped. Most callsites follow the val = mt7530_read(priv, reg) pattern and are converted mechanically using the following semantic patch: @@ expression priv, reg; identifier val; @@ -val = mt7530_read(priv, reg); +regmap_read(priv->regmap, reg, &val); Remaining inline uses are converted by hand. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/a1dc338ae368554ec6faa974df7ba6f3660ae12b.1788190568.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Daniel Golle
|
f6692ee8de |
net: dsa: mt7530: replace mt7530_rmw/set/clear with regmap API
Replace all mt7530_rmw() calls with regmap_update_bits(), mt7530_set() with regmap_set_bits(), and mt7530_clear() with regmap_clear_bits(). Remove the wrapper function definitions. Generated using the following semantic patch: @@ expression priv, reg, mask, set; @@ -mt7530_rmw(priv, reg, mask, set) +regmap_update_bits(priv->regmap, reg, mask, set) @@ expression priv, reg, val; @@ -mt7530_set(priv, reg, val) +regmap_set_bits(priv->regmap, reg, val) @@ expression priv, reg, val; @@ -mt7530_clear(priv, reg, val) +regmap_clear_bits(priv->regmap, reg, val) Six regmap_update_bits() call sites with multi-line masks are rewrapped by hand afterwards, as spatch joins their argument lines. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/182be19b483e77eb1d4ed835813359a27acd8e9c.1788190568.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Daniel Golle
|
63ba2b7589 |
net: dsa: mt7530: replace mt7530_write with regmap_write
Replace all mt7530_write() calls with direct regmap_write() calls and remove the wrapper function. The per-call error logging is dropped -- regmap has its own tracing infrastructure. Generated using the following semantic patch: @@ expression priv, reg, val; @@ -mt7530_write(priv, reg, val) +regmap_write(priv->regmap, reg, val) Signed-off-by: Daniel Golle <daniel@makrotopia.org> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/fbb6ee8860fa60326a8af132ed114555e7163350.1788190568.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Daniel Golle
|
b62351d125 |
net: dsa: mt7530: fold mt7530_mii_write/read into mt7530_write/read
With the lock wrappers removed in the previous commit, mt7530_write() was a trivial wrapper around mt7530_mii_write(), and mt7530_read() around mt7530_mii_read() via _mt7530_read(). Fold the function bodies and eliminate the intermediate functions. The _mt7530_read() poll helper for readx_poll_timeout() is renamed to mt7530_mii_poll() and calls mt7530_read(). Callers are updated using the following semantic patch: @@ expression E1, E2, E3; @@ -mt7530_mii_write(E1, E2, E3) +mt7530_write(E1, E2, E3) @@ expression E1, E2; @@ -mt7530_mii_read(E1, E2) +mt7530_read(E1, E2) @@ expression list args; @@ -readx_poll_timeout(_mt7530_read, args) +readx_poll_timeout(mt7530_mii_poll, args) The two readx_poll_timeout() call sites keep their original line wrapping, which spatch reflows for the longer helper name. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/591c4e7ff5b1b6d39aac7f0f04eb67f36f40d8a2.1788190568.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Daniel Golle
|
fbf5096f54 |
net: dsa: mt7530: move MDIO bus locking into regmap
The switch register regmap was created with .disable_locking = true,
relying on callers to manually lock the MDIO bus. Move the locking
into the regmap using .lock/.unlock callbacks, matching the PCS
regmaps that already do this. This allows any code path reaching the
regmap to be automatically protected.
With regmap handling bus locking, the manual mt7530_mutex_lock/unlock
calls in mt7530_write(), _mt7530_read(), mt7530_rmw() and
mt7530_port_change_mtu() become redundant and are removed, as is the
bus lock held across the ATC/VTCR command poll sequences.
The handle_mask_sync callback added by commit
|