)]}' { "log": [ { "commit": "c0aa5f13826dcb035bec3d6b252e6b2020fa5f88", "tree": "1e7ea7d23cefc6c2448368ae1678c2b90b479968", "parents": [ "fd1cdeddd7bc37419415a5a596d18f27f61c0225", "2b0c672543cd98c4fa07c35b599623651fff07e7" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 18:40:50 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 18:40:51 2026 -0700" }, "message": "Merge branch \u0027net-dsa-microchip-remove-unnecessary-ksz_dev_ops-callbacks\u0027\n\nBastien Curutchet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: dsa: microchip: Remove unnecessary ksz_dev_ops callbacks\n\nThis series continues the rework of the KSZ driver initiated by a previous\nseries (see [1]), following the discussion we had here [2].\n\nThe KSZ driver got way too convoluted over time because it uses a common\nframework to handle more than 20 switches split in 5 families (see below\ntable)\n\n+----------+---------+---------+---------+---------+---------+\n| Family | KSZ8463 | KSZ87xx | KSZ88xx | KSZ9477 | LAN937X |\n+----------+---------+---------+---------+---------+---------+\n| Switches | KSZ8463 | KSZ8795 | KSZ88X3 | KSZ8563 | LAN9370 |\n| | | KSZ8794 | KSZ8864 | KSZ9477 | LAN9371 |\n| | | KSZ8765 | KSZ8895 | KSZ9896 | LAN9372 |\n| | | | | KSZ9897 | LAN9373 |\n| | | | | KSZ9893 | LAN9374 |\n| | | | | KSZ9563 | |\n| | | | | KSZ8567 | |\n| | | | | KSZ9567 | |\n| | | | | LAN9646 | |\n+----------+---------+---------+---------+---------+---------+\n\nThe previous series ([1]) replaced the unique dsa_swicth_ops struct used\nby all the KSZ families with one dsa_switch_ops struct for each family.\n\nThese dsa_switch_ops structs still rely on common functions that redirect\nthe calls to ksz_dev_ops operations which are custom to each switch\nfamily. Many of hese ksz_dev_ops callbacks have a direct equivalent in the\nstruct dsa_switch_ops. This series directly connects the implementations of\nthese ksz_dev_ops operations to the relevant dsa_switch_ops attribute\nto get rid of one unnecessary level of indirection.\n\nOn top of this on-going rework I added PTP and periodic output support for\nthe KSZ8463 (which was my first goal). There are more than 60 patches for\nall this so this series will be followed by several others and if you\nwant to see the full picture we can check my github ([3]).\n\nI haven\u0027t finished yet to group all the patches into meaningful series\nbut here is more or less what I plan to do next:\n\n- A series will split again some operations to get rid of the\n if (is_kszXYZ) branches.\n- Maybe another series will be needed to completely move out of\n ksz_common.c everything that isn\u0027t truly common to all the switches\n- A series will add PTP support for the KSZ8463\n- A final series will add periodic output support for the KSZ8463\n\nFYI, I only have a KSZ8463 so, unfortunately, I can\u0027t test other switches.\n\n[1]: https://lore.kernel.org/r/20260505-clean-ksz-driver-v1-0-05d70fa42461@bootlin.com\n[2]: https://lore.kernel.org/r/20260304-ksz8463-ptp-v6-0-3f4c47954c71@bootlin.com)\n[3]: https://github.com/bastien-curutchet/linux/tree/ksz_rework\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260521-clean-ksz-2nd-series-v3-0-75c38971c19a@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2b0c672543cd98c4fa07c35b599623651fff07e7", "tree": "1e7ea7d23cefc6c2448368ae1678c2b90b479968", "parents": [ "932fc72b9849ddc85eb7865b038e83c0e2b8696d" ], "author": { "name": "Bastien Curutchet (Schneider Electric)", "email": "bastien.curutchet@bootlin.com", "time": "Thu May 21 08:12:43 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 18:40:49 2026 -0700" }, "message": "net: dsa: microchip: bypass dev_ops for phy_read()/phy_write()\n\nphy_read() and phy_write() are handled through common functions that\nredirect the treatment to ksz_dev_ops callbacks. This layer of\nindirection isn\u0027t needed since we now have a dsa_switch_ops for each\nkind of switch\n\nRemove one indirection layer for KSZ switches, by connecting the\nksz_dev_ops::phy_r() and ksz_dev_ops::phy_w() operations directly to\ndsa_switch_ops.\nRemove the now unused phy_r()/phy_w() callbacks from ksz_dev_ops.\n\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260521-clean-ksz-2nd-series-v3-8-75c38971c19a@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "932fc72b9849ddc85eb7865b038e83c0e2b8696d", "tree": "73e127b80957ae1b8ec04255067a8b26ee075193", "parents": [ "aa6902098914bd863fda7d22ccf84edf623d0685" ], "author": { "name": "Bastien Curutchet (Schneider Electric)", "email": "bastien.curutchet@bootlin.com", "time": "Thu May 21 08:12:42 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 18:40:49 2026 -0700" }, "message": "net: dsa: microchip: call DSA\u0027s phy_{read/write} to do mdio {read/write}\n\nksz_sw_mdio_read() and ksz_sw_mdio_write() respectively call\nksz_dev_ops::phy_r() and ksz_dev_ops::phy_w() just like\ndsa_switch_ops::phy_read() and dsa_switch_ops::phy_write() do.\n\nCall dsa_switch_ops::phy_read() from ksz_sw_mdio_read() and\ndsa_switch_ops::phy_write() from ksz_sw_mdio_write() so we\u0027ll be able\nto get rid of the useless indirections provided by ksz_dev_ops in\nupcoming patch.\n\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260521-clean-ksz-2nd-series-v3-7-75c38971c19a@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "aa6902098914bd863fda7d22ccf84edf623d0685", "tree": "a07e091c4dfebd674ddcc75c2ecd5d79efdd7444", "parents": [ "df478153cb2d02f13cbcc61300a977b9176dfdb5" ], "author": { "name": "Bastien Curutchet (Schneider Electric)", "email": "bastien.curutchet@bootlin.com", "time": "Thu May 21 08:12:41 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 18:40:49 2026 -0700" }, "message": "net: dsa: microchip: bypass dev_ops for port_setup()\n\nport_setup() is handled through a common function that redirects\nthe treatment to ksz_dev_ops callbacks. This layer of indirection\nisn\u0027t needed since we now have a dsa_switch_ops for each switch family\n\nRemove one indirection layer for KSZ switches, by connecting the\nksz_dev_ops :: port_setup() operations directly to dsa_switch_ops.\nMake ksz9477_set_default_prio_queue_mapping() non-static since it\u0027s used\nby ksz_common for tc operations and by ksz9477.c for this port_setup().\nRemove the now unused port_setup() callback from ksz_dev_ops.\n\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260521-clean-ksz-2nd-series-v3-6-75c38971c19a@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "df478153cb2d02f13cbcc61300a977b9176dfdb5", "tree": "a5896d7dd2beab8ca92f5b3e1893127721a7c6d3", "parents": [ "4c54f910eefdb6971083d2483c3c1d9f1d973e99" ], "author": { "name": "Vladimir Oltean", "email": "vladimir.oltean@nxp.com", "time": "Thu May 21 08:12:40 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 18:40:49 2026 -0700" }, "message": "net: dsa: microchip: remove dev_ops-\u003esetup() and teardown()\n\nAll switch families have been converted to have their own\nds-\u003eops-\u003esetup() methods and to call the common ksz_teardown().\n\nRemove the no longer used ksz_setup() function and the associated\nksz_dev_ops callbacks.\n\nSigned-off-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260521-clean-ksz-2nd-series-v3-5-75c38971c19a@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4c54f910eefdb6971083d2483c3c1d9f1d973e99", "tree": "1f64e55f7b68a0cc0260eb2d8a2616b578db7378", "parents": [ "7c494a10f937eb9a7612c9ba1eb3e1fbc1e090a2" ], "author": { "name": "Vladimir Oltean", "email": "vladimir.oltean@nxp.com", "time": "Thu May 21 08:12:39 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 18:40:48 2026 -0700" }, "message": "net: dsa: microchip: bypass dev_ops-\u003esetup() and teardown() for ksz8\n\nThe KSZ switch families are sufficiently different that a common\nds-\u003eops-\u003esetup() - ksz_setup() with micro-managed dev_ops-\u003ereset(),\ndev_ops-\u003epcs_create(), dev_ops-\u003econfig_cpu_port(),\ndev_ops-\u003eenable_stp_addr(), dev_ops-\u003esetup() seems to be too convoluted.\n\nI am proposing to make each KSZ switch family part ways for\ndsa_switch_ops :: setup() and teardown(), to allow them greater\nflexibility. This here is the implementation for ksz8, which is\nnothing other than a copy of ksz_setup() with the dev_ops function\npointers replaced with direct function calls.\n\nSigned-off-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260521-clean-ksz-2nd-series-v3-4-75c38971c19a@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7c494a10f937eb9a7612c9ba1eb3e1fbc1e090a2", "tree": "236a0d32f2fdcdce1d7a73047c79c9031e7a69fd", "parents": [ "dfc5c56829b98cdc9ba1852370255bb2c4fff0a5" ], "author": { "name": "Vladimir Oltean", "email": "vladimir.oltean@nxp.com", "time": "Thu May 21 08:12:38 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 18:40:48 2026 -0700" }, "message": "net: dsa: microchip: bypass dev_ops-\u003esetup() and teardown() for ksz9477\n\nThe KSZ switch families are sufficiently different that a common\nds-\u003eops-\u003esetup() - ksz_setup() with micro-managed dev_ops-\u003ereset(),\ndev_ops-\u003epcs_create(), dev_ops-\u003econfig_cpu_port(),\ndev_ops-\u003eenable_stp_addr(), dev_ops-\u003esetup() seems to be too convoluted.\n\nI am proposing to make each KSZ switch family part ways for\ndsa_switch_ops :: setup() and teardown(), to allow them greater\nflexibility. This here is the implementation for ksz9477, which is\nnothing other than a copy of ksz_setup() with the dev_ops function\npointers replaced with direct function calls.\n\nSigned-off-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260521-clean-ksz-2nd-series-v3-3-75c38971c19a@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dfc5c56829b98cdc9ba1852370255bb2c4fff0a5", "tree": "d8dadf5ec3c37e0cc14ffbfb8188425e8fdd63c9", "parents": [ "5fe0b938bde709795422c24e27ed493c7c5fa4a3" ], "author": { "name": "Vladimir Oltean", "email": "vladimir.oltean@nxp.com", "time": "Thu May 21 08:12:37 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 18:40:48 2026 -0700" }, "message": "net: dsa: microchip: bypass dev_ops-\u003esetup() and teardown() for lan937x\n\nThe KSZ switch families are sufficiently different that a common\nds-\u003eops-\u003esetup() - ksz_setup() with micro-managed dev_ops-\u003ereset(),\ndev_ops-\u003epcs_create(), dev_ops-\u003econfig_cpu_port(),\ndev_ops-\u003eenable_stp_addr(), dev_ops-\u003esetup() seems to be too convoluted.\n\nI am proposing to make each KSZ switch family part ways for\ndsa_switch_ops :: setup() and teardown(), to allow them greater\nflexibility. This here is the implementation for lan937x, which is\nnothing other than a copy of ksz_setup() with the dev_ops function\npointers replaced with direct function calls.\n\nSigned-off-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260521-clean-ksz-2nd-series-v3-2-75c38971c19a@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5fe0b938bde709795422c24e27ed493c7c5fa4a3", "tree": "f28160e242eef4211ef8d6377fb13292647a33d1", "parents": [ "fd1cdeddd7bc37419415a5a596d18f27f61c0225" ], "author": { "name": "Vladimir Oltean", "email": "vladimir.oltean@nxp.com", "time": "Thu May 21 08:12:36 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 18:40:48 2026 -0700" }, "message": "net: dsa: microchip: don\u0027t reset on shutdown or driver removal\n\nThe ksz_switch driver is one of the few which reset the switch when\nunbinding the driver or shutting down - in the same category with\nar9331_sw_remove(), bcm_sf2_sw_remove(), and ks8995_remove(),\nvsc73xx_remove() and lan9303_remove().\n\nI don\u0027t think there exists any requirement to do this, and in fact it\ndoes create complications for WoL, as the code already shows.\n\nMy issue with this logic is that it is the only thing keeping\ndev_ops-\u003ereset() necessary, which I would like to remove after\nindividual KSZ switch families get their own setup() and teardown()\nmethods that don\u0027t go through dev_ops.\n\nDon\u0027t reset the switch when unbinding the driver or shutting down.\nRemove the exit callbacks from the ksz_dev_ops.\n\nSigned-off-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nLink: https://patch.msgid.link/20260521-clean-ksz-2nd-series-v3-1-75c38971c19a@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fd1cdeddd7bc37419415a5a596d18f27f61c0225", "tree": "d6294bd297e819f28613e7a0c32f1ff5d41be3cf", "parents": [ "7409fad779e271f252d844ae16e1a7429626b13e" ], "author": { "name": "Abid Ali", "email": "dev.taqnialabs@gmail.com", "time": "Thu May 21 16:32:46 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:34:34 2026 -0700" }, "message": "net: stmmac: mmc: Remove duplicate mmc_rx crc\n\nMMC_XGMAC_RX_CRC_ERR is clear-on-read, and just a single read would\nupdate the mmc_rx_crc_error counter.\n\nThe duplicate read appears to have been unintentionally introduced in\nthe intial MMC counter implementation [1]. The databook does not mention\nMMC_XGMAC_RX_CRC_ERR needing the additional read.\n\n[1] commit b6cdf09f51c2 (\"net: stmmac: xgmac: Implement MMC counters\")\n\nSigned-off-by: Abid Ali \u003cdev.taqnialabs@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260521-xgmac-mmc_rx_crc-cleanup-v2-1-7d9de09f5898@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7409fad779e271f252d844ae16e1a7429626b13e", "tree": "7a5e108a5a1d3bb2289625fc7b8fa804f067e458", "parents": [ "b8de39a06535bfccf9f693e42dc8cfbee35d07be" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu May 21 17:14:39 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:33:22 2026 -0700" }, "message": "dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used\n\nWe plan to no longer hold RTNL in \"ip link show\", and use RCU instead.\n\nAssume rtnl_fill_dpll_pin() will have to fill DPLL_A_PIN_ID.\n\nIt is fine to over-estimate skb size (by 8 bytes) in if_nlmsg_size().\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nLink: https://patch.msgid.link/20260521171440.114956-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b8de39a06535bfccf9f693e42dc8cfbee35d07be", "tree": "786c2d9e9f331ee9db097e53c89919b008275520", "parents": [ "24822968aa928ab087fc612ec1c6d2751ec91a4a" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu May 21 17:40:38 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:32:56 2026 -0700" }, "message": "rtnetlink: do not use RTNL in rtnl_af_register() and rtnl_af_unregister()\n\nrtnl_af_lookup() does not rely on RTNL anymoe, remove the stale\nASSERT_RTNL().\n\nAdd a private spinlock (rtnl_af_ops_lock) to protect rtnl_af_ops\nlist instead of using RTNL.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260521174038.204481-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "24822968aa928ab087fc612ec1c6d2751ec91a4a", "tree": "515eaf85eeb3bebf682bc3548b950c2d3732901b", "parents": [ "a482b630854ebfb18ab12d1f50c5e459d54d7f51", "09ac78477ab9f05fd6a740454bc8190f729938b5" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:23:43 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:23:43 2026 -0700" }, "message": "Merge branch \u0027net-dsa-yt921x-add-port-tbf-support\u0027\n\nDavid Yang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: dsa: yt921x: Add port TBF support\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260521010320.208138-1-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "09ac78477ab9f05fd6a740454bc8190f729938b5", "tree": "515eaf85eeb3bebf682bc3548b950c2d3732901b", "parents": [ "b7b1b8464b4712da8cce2015709ead71050c5a8b" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Thu May 21 09:03:07 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:23:37 2026 -0700" }, "message": "net: dsa: yt921x: Add port TBF support\n\nReact to TC_SETUP_QDISC_TBF and configure the egress shaper as\nappropriate with the maximum rate and burst size requested by the user.\nPer queue shaper is possible, though not touched in this commit.\n\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nLink: https://patch.msgid.link/20260521010320.208138-4-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b7b1b8464b4712da8cce2015709ead71050c5a8b", "tree": "910b0eb6741677a759f6440d68e668034a791a85", "parents": [ "d8785b59c330fcea7b23f63fe8ad904e436e4584" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Thu May 21 09:03:06 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:23:37 2026 -0700" }, "message": "net/sched: tbf: add extack to offload params\n\nDrivers might have error messages to propagate to user space. Propagate\nthe netlink extack so that they can inform user space in a verbal way of\ntheir limitations.\n\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nLink: https://patch.msgid.link/20260521010320.208138-3-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d8785b59c330fcea7b23f63fe8ad904e436e4584", "tree": "ac45d626abf68e1d3e67a3ddef70bd9330cba1ba", "parents": [ "a482b630854ebfb18ab12d1f50c5e459d54d7f51" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Thu May 21 09:03:05 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:23:37 2026 -0700" }, "message": "net/sched: prefer existing extack message in qdisc_offload_graft_helper()\n\nUse NL_SET_ERR_MSG_WEAK so any existing error message (probably from the\nunderlying driver) is used instead of the generic fallback.\n\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nLink: https://patch.msgid.link/20260521010320.208138-2-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a482b630854ebfb18ab12d1f50c5e459d54d7f51", "tree": "877f9d71a5701d81a8f093b75952b0ac861eeead", "parents": [ "6ec863c1848167fdd7124717a24f0a2b99e160ba", "eb8ffe14a554808eb68cf050ba5343dbbe15bb54" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:20:59 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:21:18 2026 -0700" }, "message": "Merge branch \u0027arcnet-remove-outdated-drivers-and-information-and-unused-code-small-cleanups-and-documentation-improvements\u0027\n\nEthan Nelson-Moore says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nARCnet: remove outdated drivers and information and unused code; small cleanups and documentation improvements\n\nThis patch series mainly removes the ISA and PCMCIA ARCnet drivers and\ndocumentation for them and hardware they supported. While ARCnet is still\nused in industrial environments, and cards are still manufactured,\nit is unlikely anyone is still using it with ISA and PCMCIA cards.\nRemoving these drivers reduces future maintenance burden.\n\nWhile updating the ARCnet documentation to remove references to the removed\ndrivers, I noticed that it contained thousands of lines of outdated and\nirrelevant information (much of it so outdated that it would not even work\non modern kernels). I took the opportunity to remove this information\nand improve the writing style slightly.\n\nI noticed that the BUS_ALIGN macro was always defined to 1, which meant\nthat the custom arcnet_in/out/read/write* I/O macros were unnecessary.\nI expanded and removed them to make the code more straightforwards.\n\nI also corrected some typos and comments.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260521001631.45434-1-enelsonmoore@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "eb8ffe14a554808eb68cf050ba5343dbbe15bb54", "tree": "877f9d71a5701d81a8f093b75952b0ac861eeead", "parents": [ "19d554d3296cafdcd95000b166370cdf60c6ea73" ], "author": { "name": "Ethan Nelson-Moore", "email": "enelsonmoore@gmail.com", "time": "Wed May 20 17:16:19 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:20:57 2026 -0700" }, "message": "net: arcnet: com20020-pci: avoid -Wformat-truncation warning\n\nWhen compiling the com20020-pci driver with W\u003d1, I received the\nfollowing warning:\n\ndrivers/net/arcnet/com20020-pci.c:224:71: warning: ‘%d’ directive\noutput may be truncated writing between 1 and 11 bytes into a region of\nsize between 10 and 11 [-Wformat-truncation\u003d]\n 224 | snprintf(dev-\u003ename, sizeof(dev-\u003ename), \"arc%d-%d\", dev-\u003edev_id, i);\n\nIn reality, this does not represent a problem, because i is bounded by\nthe .devcount field in struct com20020_pci_card_info, which is\nstatically defined for each card and very small. Quiet the invalid\nwarning by changing the type of i and the .devcount field to be\nnarrower.\n\nSigned-off-by: Ethan Nelson-Moore \u003cenelsonmoore@gmail.com\u003e\nLink: https://patch.msgid.link/20260521001631.45434-8-enelsonmoore@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "19d554d3296cafdcd95000b166370cdf60c6ea73", "tree": "8b3a7b4da72aec66d2955229f624326ef40202d5", "parents": [ "e859db8ac490832d25122ca90db1d14ef8c78283" ], "author": { "name": "Ethan Nelson-Moore", "email": "enelsonmoore@gmail.com", "time": "Wed May 20 17:16:18 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:20:57 2026 -0700" }, "message": "docs: net: arcnet: remove outdated/irrelevant information; improve style\n\nThe ARCnet documentation contains a lot of outdated and irrelevant\ninformation (such as changes in decades-old driver versions and\nmessages from a former maintainer) and has some writing style issues.\nRemove this unnecessary information and improve the writing style. Also\nremove links to pages that no longer exist.\n\nSigned-off-by: Ethan Nelson-Moore \u003cenelsonmoore@gmail.com\u003e\nLink: https://patch.msgid.link/20260521001631.45434-7-enelsonmoore@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e859db8ac490832d25122ca90db1d14ef8c78283", "tree": "1a05ad869d6925c4480944b2567ae858ef2adfca", "parents": [ "c1125f6d4843e49bbbf7127b4b48a57fef50cc06" ], "author": { "name": "Ethan Nelson-Moore", "email": "enelsonmoore@gmail.com", "time": "Wed May 20 17:16:17 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:20:57 2026 -0700" }, "message": "net: arcnet: expand unnecessary I/O abstraction macros\n\nNow that the BUS_ALIGN variable has been removed, the\narcnet_in/out/read/write* macros behave identically to the functions\nthey wrap. Expand them and remove their definitions to make the code\neasier to maintain.\n\nSigned-off-by: Ethan Nelson-Moore \u003cenelsonmoore@gmail.com\u003e\nLink: https://patch.msgid.link/20260521001631.45434-6-enelsonmoore@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c1125f6d4843e49bbbf7127b4b48a57fef50cc06", "tree": "45b0fcfe47a24530382e339721294eeae0cc81cd", "parents": [ "910394c74c5aa75a2e627812eca1fd37242aec5c" ], "author": { "name": "Ethan Nelson-Moore", "email": "enelsonmoore@gmail.com", "time": "Wed May 20 17:16:16 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:20:56 2026 -0700" }, "message": "net: arcnet: remove code depending on nonexistent config option\n\nThe CONFIG_SA1100_CT6001 option has never existed in the kernel. Remove\ncode in arcdevice.h referring to it. This allows the\narcnet_(in|out)(s|)b macros to be simplified by removing the BUS_ALIGN\nmacro.\n\nSigned-off-by: Ethan Nelson-Moore \u003cenelsonmoore@gmail.com\u003e\nLink: https://patch.msgid.link/20260521001631.45434-5-enelsonmoore@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "910394c74c5aa75a2e627812eca1fd37242aec5c", "tree": "2c460ca92287aa468e179a9ddc5f1d330d4b261a", "parents": [ "5bc0c090bcad2424f13692ba1d1b4a7e80c08c7a" ], "author": { "name": "Ethan Nelson-Moore", "email": "enelsonmoore@gmail.com", "time": "Wed May 20 17:16:15 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:20:56 2026 -0700" }, "message": "net: arcnet: remove ISA and PCMCIA support; modernize documentation\n\nWhile ARCnet is still used in industrial environments, and cards are\nstill manufactured, it is unlikely anyone is still using it with ISA\nand PCMCIA cards. Reduce future maintenance burden by removing all ISA\nand PCMCIA ARCnet drivers and documentation related to them. Update\ninstructions for loading modules and passing parameters to work on\nmodern kernels and with the com20020_pci driver. Also take the\nopportunity to document the rest of the module parameters, correct a\nfile path in Documentation/networking/arcnet.rst, and change a\nreference to /etc/rc.inet1, which no longer exists, to refer to\nifconfig.\n\nSigned-off-by: Ethan Nelson-Moore \u003cenelsonmoore@gmail.com\u003e\nLink: https://patch.msgid.link/20260521001631.45434-4-enelsonmoore@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5bc0c090bcad2424f13692ba1d1b4a7e80c08c7a", "tree": "cb58438831c3eea78608032b3356b10c9a5f356b", "parents": [ "ced9c8cf5768802d511e186e5fa9400b91e55f83" ], "author": { "name": "Ethan Nelson-Moore", "email": "enelsonmoore@gmail.com", "time": "Wed May 20 17:16:14 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:20:56 2026 -0700" }, "message": "net: arcnet: fix typos in comments\n\nThe ARCnet code contains quite a few typos in comments. Fix them.\nInitially noticed by inspection, then augmented using codespell.\n\nSigned-off-by: Ethan Nelson-Moore \u003cenelsonmoore@gmail.com\u003e\nLink: https://patch.msgid.link/20260521001631.45434-3-enelsonmoore@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ced9c8cf5768802d511e186e5fa9400b91e55f83", "tree": "56eb02a2fee7b4ad88140ead36e1ba4dc2848b06", "parents": [ "6ec863c1848167fdd7124717a24f0a2b99e160ba" ], "author": { "name": "Ethan Nelson-Moore", "email": "enelsonmoore@gmail.com", "time": "Wed May 20 17:16:13 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 17:20:56 2026 -0700" }, "message": "net: arcnet: com20020: remove misleading references to multicast\n\nARCnet does not support multicast, only unicast and broadcast. In spite\nof this, the com20020 driver contains several references to multicast\nin a comment and a function name, including a FIXME that it should be\nimplemented. Adjust the comment to make the lack of multicast support\nclear and rename com20020_set_mc_list to com20020_set_rx_mode.\n\nSigned-off-by: Ethan Nelson-Moore \u003cenelsonmoore@gmail.com\u003e\nLink: https://patch.msgid.link/20260521001631.45434-2-enelsonmoore@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6ec863c1848167fdd7124717a24f0a2b99e160ba", "tree": "93a499c37774083661ea8caa674483baeeaec5aa", "parents": [ "95fab46aea57d6d7b76b319341acbefe8a9293c8" ], "author": { "name": "Geliang Tang", "email": "tanggeliang@kylinos.cn", "time": "Thu May 21 17:11:53 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 15:36:51 2026 -0700" }, "message": "selftests: tls: use ASSERT_GE in test_mutliproc\n\nIn test_mutliproc(), when send() or recv() returns an error (e.g.,\n-1), the test continues to execute the remaining code and fails\nrepeatedly due to using EXPECT_GE.\n\nFor example, if a TLS connection is broken and recv() returns -1,\nEXPECT_GE(res, 0) records a failure but does not stop the test.\nThe test then proceeds with left -\u003d res (where res \u003d -1), causing\nleft to increase unexpectedly, and the loop continues indefinitely.\n\nThis results in a massive number of identical failure messages:\n\n # tls.c:1686:mutliproc_sendpage_writers:Expected res (-1) \u003e\u003d 0 (0)\n # tls.c:1686:mutliproc_sendpage_writers:Expected res (-1) \u003e\u003d 0 (0)\n ... (hundreds of identical failures)\n\nFix this by replacing EXPECT_GE with ASSERT_GE. When send() or recv()\nfails, ASSERT_GE immediately aborts the current test, preventing\nthe subsequent undefined behavior and endless failure messages.\n\nSigned-off-by: Geliang Tang \u003ctanggeliang@kylinos.cn\u003e\nLink: https://patch.msgid.link/0ee9f412b6bd1a260a547d19f979f73b396746ac.1779354585.git.tanggeliang@kylinos.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "95fab46aea57d6d7b76b319341acbefe8a9293c8", "tree": "208c365c3d8ec85c01ba1e00d2e8271eff45f887", "parents": [ "c227f8aaf22cf5acc3a55a4fef1dd2bf110caebe", "c56dbb469fe2a9263de77941c71a547f2a2b0331" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 11:11:11 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 11:11:12 2026 -0700" }, "message": "Merge branch \u0027net-convert-atm-xdp-af_iucv-l2tp_ppp-rxrpc-tipc-to-getsockopt_iter\u0027\n\nBreno Leitao says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: convert atm/xdp/af_iucv/l2tp_ppp/rxrpc/tipc to getsockopt_iter\n\nThis series continues the conversion of the remaining proto_ops getsockopt\ncallbacks to the new getsockopt_iter callback introduced in commit 67fab22a7adc\n(\"net: add getsockopt_iter callback to proto_ops\").\n\nThe new callback takes a sockopt_t — a type-safe wrapper around iov_iter\nplus an optlen field — instead of raw __user pointers. This:\n\n - Replaces (char __user *optval, int __user *optlen) with sockopt_t *opt\n - Reads the input buffer size from opt-\u003eoptlen instead of get_user()\n - Writes the option value via copy_to_iter() instead of copy_to_user()\n - Reports the returned length via opt-\u003eoptlen instead of put_user(),\n independently of the bytes copied through the iter\n\nEach conversion is a behaviour-preserving and code-style-preserving refactor;\nno big changes being introduced, even when the code looks weird.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260520-getsock_four-v3-0-b8c0b16b7780@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c56dbb469fe2a9263de77941c71a547f2a2b0331", "tree": "208c365c3d8ec85c01ba1e00d2e8271eff45f887", "parents": [ "4b94edae0b6ceed7fba668bd8e2b10debe3252df" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Wed May 20 09:53:51 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 11:11:10 2026 -0700" }, "message": "tipc: convert to getsockopt_iter\n\nConvert TIPC sockets (msg, packet, stream proto_ops) to use the new\ngetsockopt_iter callback with sockopt_t.\n\nKey changes:\n- Replace (char __user *optval, int __user *optlen) with sockopt_t *sopt\n- Use sopt-\u003eoptlen for buffer length (input) and returned size (output)\n- Use copy_to_iter() instead of put_user()/copy_to_user()\n\nThe sockopt_t parameter is named sopt to avoid collision with the\nexisting optname parameter named opt.\n\nNote: Dropped the unnecessary parentheses to make checkpatch happier.\nAlso dropped two now-stale comments that referred to the old \"res\"\nvariable handling.\n\nAcked-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260520-getsock_four-v3-6-b8c0b16b7780@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4b94edae0b6ceed7fba668bd8e2b10debe3252df", "tree": "dd4b69fdb3789e86a03826a69242aaa29b7f13d8", "parents": [ "f83e9cd645931f87381b057d6a94496b59f1aeb3" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Wed May 20 09:53:50 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 11:11:10 2026 -0700" }, "message": "rxrpc: convert to getsockopt_iter\n\nConvert RxRPC socket\u0027s getsockopt implementation to use the new\ngetsockopt_iter callback with sockopt_t.\n\nKey changes:\n- Replace (char __user *optval, int __user *optlen) with sockopt_t *opt\n- Use opt-\u003eoptlen for buffer length (input) and returned size (output)\n- Use copy_to_iter() instead of put_user()/copy_to_user()\n\nAcked-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260520-getsock_four-v3-5-b8c0b16b7780@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f83e9cd645931f87381b057d6a94496b59f1aeb3", "tree": "180a061c3e34dc62d0ca29df994718c76e460389", "parents": [ "3c6776b5b9120f912ff3a02a2c205a90104e2b0f" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Wed May 20 09:53:49 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 11:11:09 2026 -0700" }, "message": "l2tp: ppp: convert to getsockopt_iter\n\nConvert PPPoL2TP socket\u0027s getsockopt implementation to use the new\ngetsockopt_iter callback with sockopt_t.\n\nKey changes:\n- Replace (char __user *optval, int __user *optlen) with sockopt_t *opt\n- Use opt-\u003eoptlen for buffer length (input) and returned size (output)\n- Use copy_to_iter() instead of put_user()/copy_to_user()\n\nAcked-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260520-getsock_four-v3-4-b8c0b16b7780@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3c6776b5b9120f912ff3a02a2c205a90104e2b0f", "tree": "1cd43097cd3d9d2d7ec70d7ef50f6ce66418d380", "parents": [ "4177767daf83f4e7bd9b017febd4198b3fad20e9" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Wed May 20 09:53:48 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 11:11:09 2026 -0700" }, "message": "xdp: convert to getsockopt_iter\n\nConvert XDP socket\u0027s getsockopt implementation to use the new\ngetsockopt_iter callback with sockopt_t.\n\nKey changes:\n- Replace (char __user *optval, int __user *optlen) with sockopt_t *opt\n- Use opt-\u003eoptlen for buffer length (input) and returned size (output)\n- Use copy_to_iter() instead of put_user()/copy_to_user()\n\nAcked-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260520-getsock_four-v3-3-b8c0b16b7780@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4177767daf83f4e7bd9b017febd4198b3fad20e9", "tree": "2493c5dfdf648d5e4df53e6d210ecf3803c052af", "parents": [ "347fdd4df85fc14a45a90c89fe54fccce36bd317" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Wed May 20 09:53:47 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 11:11:09 2026 -0700" }, "message": "atm: convert to getsockopt_iter\n\nConvert the ATM SVC and PVC sockets, along with the shared\nvcc_getsockopt() helper, to use the new getsockopt_iter callback with\nsockopt_t.\n\nKey changes:\n- Replace (char __user *optval, int __user *optlen) with sockopt_t *opt\n- Use opt-\u003eoptlen for buffer length (input)\n- Use copy_to_iter() instead of put_user()/copy_to_user()\n\nAcked-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260520-getsock_four-v3-2-b8c0b16b7780@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "347fdd4df85fc14a45a90c89fe54fccce36bd317", "tree": "a836dc3a6294d24482562deb44bebde10235399e", "parents": [ "c227f8aaf22cf5acc3a55a4fef1dd2bf110caebe" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Wed May 20 09:53:46 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 11:11:09 2026 -0700" }, "message": "af_iucv: convert to getsockopt_iter\n\nConvert IUCV socket\u0027s getsockopt implementation to use the new\ngetsockopt_iter callback with sockopt_t.\n\nKey changes:\n- Replace (char __user *optval, int __user *optlen) with sockopt_t *opt\n- Use opt-\u003eoptlen for buffer length (input) and returned size (output)\n- Use copy_to_iter() instead of put_user()/copy_to_user()\n\nAcked-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nAcked-by: Alexandra Winter \u003cwintera@linux.ibm.com\u003e\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260520-getsock_four-v3-1-b8c0b16b7780@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c227f8aaf22cf5acc3a55a4fef1dd2bf110caebe", "tree": "ba3af9fa1532f8b6edd08b5b30c4e9d395058889", "parents": [ "bde2a04d9b6fd0e6442353416cf0de27d6925f0f" ], "author": { "name": "Erni Sri Satya Vennela", "email": "ernis@linux.microsoft.com", "time": "Mon May 18 23:46:10 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 11:08:54 2026 -0700" }, "message": "net: mana: Expose hardware diagnostic info via debugfs\n\nAdd debugfs entries to expose hardware configuration and diagnostic\ninformation that aids in debugging driver initialization and runtime\noperations without adding noise to dmesg.\n\nThe debugfs directory for each PCI device is named using pci_name()\n(the unique BDF address), and its creation and removal is integrated\ninto mana_gd_setup() and mana_gd_cleanup_device() respectively, so\nthat all callers (probe, remove, suspend, resume, shutdown) share a\nsingle code path.\n\nDevice-level entries (under /sys/kernel/debug/mana/\u003cBDF\u003e/):\n - num_msix_usable, max_num_queues: Max resources from hardware\n - gdma_protocol_ver, pf_cap_flags1: VF version negotiation results\n - num_vports, bm_hostmode: Device configuration\n\nPer-vPort entries (under /sys/kernel/debug/mana/\u003cBDF\u003e/vportN/):\n - port_handle: Hardware vPort handle\n - max_sq, max_rq: Max queues from vPort config\n - indir_table_sz: Indirection table size\n - steer_rx, steer_rss, steer_update_tab, steer_cqe_coalescing:\n Last applied steering configuration parameters\n\nSigned-off-by: Erni Sri Satya Vennela \u003cernis@linux.microsoft.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260519064621.772154-1-ernis@linux.microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bde2a04d9b6fd0e6442353416cf0de27d6925f0f", "tree": "d065587efb4877ee177314949c5b5eb38fb8b2f2", "parents": [ "4177fd4469824b7cb58ef197ede868f9228f4fa7" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Thu May 21 12:08:11 2026 -0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 10:08:29 2026 -0700" }, "message": "selftests/tc-testing: Adapt idempotent qdisc notify callback tests to recent fq_codel changes\n\nCommit 150061a20651 (\"net/sched: fq_codel: local packets no longer count against memory limit\")\nmade fq_codel not account for local packets in the\nmemory limit. Since tests a4bb, a4be, a4bf, a4c0, a4c1 were relying on\nthese packets being accounted so that parent\u0027s qlen notify callback was\nexecuted, they broke.\n\nFix the tests by adding the qdiscs to ifb instead and making it see\nmirred packets that came from scapy. That way the packets are accounted\nin the memory limit and the parent\u0027s qlen notify callback is still\nexecuted.\n\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260521150811.1896373-2-victor@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4177fd4469824b7cb58ef197ede868f9228f4fa7", "tree": "2217df65466086ba264d2ba681915695b6b1ba98", "parents": [ "1a1f055318d82e64485a6ff8420e5f70b4267998" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Thu May 21 12:08:10 2026 -0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri May 22 10:08:29 2026 -0700" }, "message": "selftests/tc-testing: Add support for ifb devices\n\nAdd support for ifb devices in tdc so that tests with the nsPlugin are\nable to use it when necessary.\n\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260521150811.1896373-1-victor@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1a1f055318d82e64485a6ff8420e5f70b4267998", "tree": "915bd712b64e1e5afe9e144e23b59432c1ac81fa", "parents": [ "6a20b34fe3b31b292078bc79ec18a2ab0d9f7719", "1d174fec87850e1005db9b106f84bbbb19cb59b9" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 16:00:06 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 16:00:06 2026 -0700" }, "message": "Merge tag \u0027wireless-next-2026-05-21\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNot much going on here right now:\n - mac80211/hwsim:\n - some NAN related things\n - MCS/NSS rate issues with S1G\n - p54: port SPI version to device-tree\n - (a few other random things)\n\n* tag \u0027wireless-next-2026-05-21\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next:\n ARM: dts: omap2: add stlc4560 spi-wireless node\n p54spi: convert to devicetree\n dt-bindings: net: add st,stlc4560/p54spi binding\n wifi: mac80211: allow cipher change on NAN_DATA interfaces\n wifi: mac80211_hwsim: Do not declare NAN support for Extended Key ID\n wifi: cfg80211: add a function to parse UHR DBE\n wifi: mac80211: don\u0027t call ieee80211_handle_reconfig_failure when not needed\n wifi: mac80211: Allow per station GTK for NAN Data interfaces\n wifi: mac80211_hwsim: advertise NPCA capability\n wifi: mac80211_hwsim: reject NAN on multi-radio wiphys\n wifi: plfxlc: use module_usb_driver() macro\n wifi: mac80211: don\u0027t recalc min def for S1G chan ctx\n wifi: mac80211: skip NSS and BW init for S1G sta\n wifi: mac80211: check stations are removed before MLD change\n wifi: rt2x00: allocate anchor with rt2x00dev\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260521153519.380276-3-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6a20b34fe3b31b292078bc79ec18a2ab0d9f7719", "tree": "3d691b402ee221c67875b04f4cef738b0d2ef7cb", "parents": [ "73366893d1d58d247bef70406280f71030495424", "68993ced0f618e36cf33388f1e50223e5e6e78cc" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 15:02:54 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 15:09:02 2026 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nCross-merge networking fixes after downstream PR (net-7.1-rc5).\n\nNo conflicts, adjacent changes:\n\ndrivers/net/ethernet/mellanox/mlx5/core/en_txrx.c\n cc199cd1b912 (\"net/mlx5e: Reduce branches in napi poll\")\n c326f9c68921 (\"net/mlx5e: xsk: Fix unlocked writing to ICOSQ\")\n\ndrivers/net/ethernet/mellanox/mlx5/core/eswitch.c\n c6df9a65cbb0 (\"net/mlx5: Skip disabled vports when setting max TX speed\")\n 1fba57c91416 (\"net/mlx5: Add VHCA_ID page management mode support\")\n\nnet/mac80211/mlme.c\n a6e6ccd5bd07 (\"wifi: mac80211: consume only present negotiated TTLM maps\")\n 49e62ec6eb06 (\"wifi: mac80211: move frame RX handling to type files\")\n\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "68993ced0f618e36cf33388f1e50223e5e6e78cc", "tree": "eeecfdda57b25b9e73bd3684ccabee83132edfea", "parents": [ "6d3b2673e1fd553395933b6f2bc88c9e9d2a2bc5", "0e3c08f1b7b79b2e9635e70fde3a2f053c99eff1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:39:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:39:12 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from Bluetooth, wireless and netfilter.\n\n Craziness continues with no end in sight. Even discounting the driver\n revert this is a pretty huge PR for standards of the previous era. I\u0027d\n speculate - we haven\u0027t seen the worst of it, yet. Good news, I guess,\n is that so far we haven\u0027t seen many (any?) cases of \"AI reported a\n bug, we fixed it and a real user regressed\".\n\n Current release - fix to a fix:\n\n - Bluetooth: btmtk: accept too short WMT FUNC_CTRL events\n\n - vsock/virtio: relax the recently added memory limit a little\n\n Current release - regressions:\n\n - IB/IPoIB: make sure IB drivers always use async set_rx_mode since\n some (mlx5) are now required to use it due to locking changes\n\n Previous releases - regressions:\n\n - udp: fix UDP length on last GSO_PARTIAL segment\n\n - af_unix: fix UAF read of tail-\u003elen in unix_stream_data_wait()\n\n - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction\n\n - mlx5e: fix unlocked writing to ICOSQ, breaking AF_XDP\n\n Previous releases - always broken:\n\n - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR\n\n - ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5\n\n - Bluetooth: a lot of locking and concurrency fixes (as always)\n\n - batman-adv (mesh wireless networking): a lot of random fixes for\n issues reported by security researchers and Sashiko\n\n - netfilter: same thing, a lot of small security-ish fixes all over\n the place, nothing really stands out\n\n Misc:\n\n - bring back the old 3c509 driver, Maciej wants to maintain it\"\n\n* tag \u0027net-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (187 commits)\n net: enetc: avoid VF-\u003ePF mailbox timeout during SR-IOV teardown\n net: enetc: fix init and teardown order to prevent use of unsafe resources\n net: enetc: fix unbounded loop and interrupt handling in VF-to-PF messaging\n net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx()\n net: enetc: fix race condition in VF MAC address configuration\n net: enetc: fix TOCTOU race and validate VF MAC address\n net: enetc: add ratelimiting to VF mailbox error messages\n net: enetc: fix missing error code when pf-\u003evf_state allocation fails\n net: enetc: fix incorrect mailbox message status returned to VFs\n net: bridge: prevent too big nested attributes in br_fill_linkxstats()\n l2tp: use list_del_rcu in l2tp_session_unhash\n net: bcmgenet: keep RBUF EEE/PM disabled\n ethernet: 3c509: Fix most coding style issues\n ethernet: 3c509: Update documentation to match MAINTAINERS\n ethernet: 3c509: Add GPL 2.0 SPDX license identifier\n ethernet: 3c509: Fix AUI transceiver type selection\n Revert \"drivers: net: 3com: 3c509: Remove this driver\"\n tools: ynl: support listening on all nsids\n net: gro: don\u0027t merge zcopy skbs\n pds_core: ensure null-termination for firmware version strings\n ...\n" }, { "commit": "6d3b2673e1fd553395933b6f2bc88c9e9d2a2bc5", "tree": "f5bfe0752de92f43bc01f17f3b9581a90d5a7583", "parents": [ "7acfa2c5f4366d63653380646ffa7dbd1bfaccc0", "9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:17:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:17:28 2026 -0700" }, "message": "Merge tag \u0027ceph-for-7.1-rc5\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph fix from Ilya Dryomov:\n \"A fix for an \u0027rbd unmap\u0027 race condition which popped up on a\n production setup where many RBD devices are frequently mapped and\n unmapped, marked for stable\"\n\n* tag \u0027ceph-for-7.1-rc5\u0027 of https://github.com/ceph/ceph-client:\n rbd: eliminate a race in lock_dwork draining on unmap\n" }, { "commit": "7acfa2c5f4366d63653380646ffa7dbd1bfaccc0", "tree": "e91cf187e8c5f748a06c0195b8f97fee74a5a362", "parents": [ "758c807bb943138f887d42d986b645e12446ba9c", "057caace5214da3b457bbd295e1a2ad34d3685ea" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:05:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:05:09 2026 -0700" }, "message": "Merge tag \u0027trace-ringbuffer-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull ring-buffer fixes from Steven Rostedt:\n\n - Fix reporting MISSED EVENTS in trace iterator\n\n When the \"trace\" file is read with tracing enabled, if the writer\n were to pass the iterator reader, it resets, sets a \"missed_events\"\n flag and continues. The tracing output checks for missed events and\n if there are some, it prints out \"[LOST EVENTS]\" to let the user know\n events were dropped.\n\n But the clearing of the missed_events happened when the tracing\n system queried the ring buffer iterator about missed events. This was\n premature as the ring buffer is per CPU, and the tracing code reads\n all the CPU buffers and checks for missed events when it is read. If\n the CPU iterator that had missed events isn\u0027t printed next, the\n output for the LOST EVENTS is lost.\n\n Clear the missed_events flag when the iterator moves to the next\n event and not when the missed_events flag is queried. Also clear it\n on reset.\n\n - Flush and stop the persistent ring buffer on panic\n\n On panic the persistent ring buffer is used to debug what caused the\n panic. But on some architectures, it requires flushing the memory\n from cache, otherwise, the ring buffer persistent memory may not have\n the last events and this could also cause the ring buffer to be\n corrupted on the next boot.\n\n - Fix nr_subbufs initialization in simple_ring_buffer_init_mm\n\n The remote simple ring buffer meta data nr_subbufs is initialized too\n early and gets cleared later on, making it zero and not reflect the\n actual number of sub-buffers.\n\n - Fix unload_page for simple_ring_buffer init rollback\n\n On error, the pages loaded need to be unloaded. To unload a page it\n is expected that: page \u003d load_page(va); -\u003e unload_page(page). But the\n code was doing: unload_page(va) and not unload_page(page).\n\n - Create output file from cmd_check_undefined\n\n The check for undefined symbols checks if the file *.o.checked exists\n and if so it skips doing the work. But the *.o.checked file never was\n created making every build do the work even when it was already done\n previously.\n\n* tag \u0027trace-ringbuffer-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: Create output file from cmd_check_undefined\n tracing: Fix unload_page for simple_ring_buffer init rollback\n tracing: Fix nr_subbufs initialization in simple_ring_buffer_init_mm()\n ring-buffer: Flush and stop persistent ring buffer on panic\n ring-buffer: Fix reporting of missed events in iterator\n" }, { "commit": "0e3c08f1b7b79b2e9635e70fde3a2f053c99eff1", "tree": "e4de5b98b10601922652fc18b89c083c6ecd6860", "parents": [ "c33f944a33d63c65f3506eee6f2ca3771b68454f", "dc14686f27df6454b13b16ad1c9203ab3e9b0375" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 11:03:58 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 11:03:58 2026 -0700" }, "message": "Merge tag \u0027wireless-2026-05-21\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nQuite a few more updates:\n - cfg80211/mac80211:\n - various security(-ish) fixes\n - fix A-MSDU subframe handling\n - fix multi-link element parsing\n - ath10: avoid sending commands to dead device\n - ath11k:\n - fix WMI buffer leaks on error conditions\n - fix UAF in RX MSDU coalesce path\n - allow peer ID 0 on RX path (legal for mobile devices)\n - reinitialize shared SRNG pointers on restart\n - ath12k:\n - fix 20 MHz-only parsing of EHT-MCS map\n - iwlwifi:\n - fix TSO segmentation explosion\n - don\u0027t TX to dead device\n - fix warning in WoWLAN\n - fix TX rates on old devices\n - disconnect on beacon loss only if also no other traffic\n - fill NULL-ptr deref\n - fix STEP_URM hardware access\n\n* tag \u0027wireless-2026-05-21\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (24 commits)\n wifi: cfg80211: wext: validate chandef in monitor mode\n wifi: mac80211: consume only present negotiated TTLM maps\n wifi: wilc1000: fix dma_buffer leak on bus acquire failure\n wifi: mac80211: capture fast-RX rate before mesh reuses skb-\u003ecb\n wifi: mac80211: fix multi-link element inheritance\n wifi: mac80211: fix MLE defragmentation\n wifi: mac80211: don\u0027t override max_amsdu_subframes\n wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs\n wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only parsing\n wifi: ath11k: clear shared SRNG pointer state on restart\n wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce()\n wifi: ath11k: fix peer resolution on rx path when peer_id\u003d0\n wifi: iwlwifi: mld: disconnect only after 6 beacons without Rx\n wifi: iwlwifi: mld: don\u0027t WARN on WoWLAN suspend w/o BSS vif\n wifi: iwlwifi: use correct function to read STEP_URM register\n wifi: iwlwifi: mvm: fix driver-set TX rates on old devices\n wifi: iwlwifi: mld: don\u0027t dereference a pointer before NULL checking it\n wifi: iwlwifi: mld: stop TX during firmware restart\n wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled\n wifi: ath10k: skip WMI and beacon transmission when device is wedged\n ...\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260521152903.374070-3-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "758c807bb943138f887d42d986b645e12446ba9c", "tree": "8df52c99c7bd9ba3f388bb3c756481ce8bb7abab", "parents": [ "dd3802fc4f6b52201a93330d44981a66bd6ef883", "d8809f6931065cbbf3554647a50a65a471ab5983" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 08:59:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 08:59:52 2026 -0700" }, "message": "Merge tag \u0027efi-fixes-for-v7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi\n\nPull EFI fixes from Ard Biesheuvel:\n\n - Permit ACPI PRM runtime firmware calls when acpi_init() runs\n\n - Add another Lenovo Ideapad framebuffer quirk\n\n - Cosmetic tweak\n\n* tag \u0027efi-fixes-for-v7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:\n efi: sysfb_efi: Extend quirk to cover IdeaPad Duet 3 10IGL5-LTE\n efi: efi.h: Remove extra semicolon\n efi: Allocate runtime workqueue before ACPI init\n" }, { "commit": "c33f944a33d63c65f3506eee6f2ca3771b68454f", "tree": "45f75637efc0d2f32ce4835636c7e9f0f1af236a", "parents": [ "bdd39576bf50a50bdafe3da968fd271bc674a48f", "9e68817f12d5935dbf73f2fe6e6299644f6de1b6" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:49:01 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:49:02 2026 -0700" }, "message": "Merge branch \u0027net-enetc-sr-iov-robustness-and-security-fixes\u0027\n\nWei Fang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: enetc: SR-IOV robustness and security fixes\n\nThis patch series addresses a number of robustness, security, and\ncorrectness issues in the ENETC driver\u0027s SR-IOV subsystem, focusing\nprimarily on the VF-to-PF mailbox communication path.\n\nThe series can be grouped into the following categories:\n\n1. DoS and security fixes:\n - Prevent an unbounded loop DoS in the VF-to-PF message handler,\n which could be triggered by a malicious or misbehaving VF.\n - Fix a TOCTOU (Time-of-Check-Time-of-Use) race and add proper\n validation of VF MAC addresses to prevent spoofing or invalid\n configuration from being applied.\n\n2. Race condition fixes:\n - Fix a race condition in VF MAC address configuration that could\n lead to inconsistent state between the VF request and PF\n application.\n - Fix a race condition during SR-IOV teardown that could cause\n VF-\u003ePF mailbox operations to time out, resulting in unnecessary\n errors during shutdown.\n\n3. Memory safety fixes:\n - Fix a DMA write to freed memory in enetc_msg_free_mbx(), which\n could cause silent memory corruption or system instability.\n\n4. Error handling and initialization fixes:\n - Fix missing error code propagation when pf-\u003evf_state allocation\n fails, ensuring callers receive a proper errno instead of\n succeeding silently.\n - Fix incorrect mailbox message status values returned to VFs,\n which could cause VFs to misinterpret PF responses.\n - Fix initialization order to prevent the use of uninitialized\n resources during driver probe, which could cause undefined\n behavior on certain configurations.\n\n5. Diagnostics improvement:\n - Add rate limiting to VF mailbox error messages to prevent log\n flooding in the presence of a misbehaving VF.\n\nThese fixes improve the overall stability and security of the ENETC\nSR-IOV implementation, particularly in multi-tenant environments where\nVFs may be assigned to untrusted guests.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260520064421.91569-1-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9e68817f12d5935dbf73f2fe6e6299644f6de1b6", "tree": "45f75637efc0d2f32ce4835636c7e9f0f1af236a", "parents": [ "54362b0176080b905dbd0651ee3dbb295da41541" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:21 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:49:00 2026 -0700" }, "message": "net: enetc: avoid VF-\u003ePF mailbox timeout during SR-IOV teardown\n\nDuring SR-IOV teardown, enetc_msg_psi_free() disables the MR interrupt\nbefore pci_disable_sriov() removes the VFs. If a VF sends a mailbox\nmessage during this window, the PF cannot receive it, causing the VF to\ntimeout waiting for a reply.\n\nSince the timeout occurs during SR-IOV teardown when the VF is about to\nbe removed anyway, it has no functional impact on operation. However,\nmore messages will be added in the future, some visible error logs may\nconfuse users. So fix it by calling pci_disable_sriov() first to remove\nall VFs, then safely clean up the mailbox resources. This eliminates the\nrace window where VFs could send messages to an unresponsive PF.\n\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-10-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "54362b0176080b905dbd0651ee3dbb295da41541", "tree": "c289870991105875375e53fccc4bc2b294cbd8b8", "parents": [ "f8ae63de2a872fa3b68c287c35379f6d73d38a5d" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:20 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:59 2026 -0700" }, "message": "net: enetc: fix init and teardown order to prevent use of unsafe resources\n\nSashiko reported a potential issue in enetc_msg_psi_init() where the IRQ\nhandler is registered before DMA resources are fully initialized [1].\n\nThe current initialization sequence is:\n\n 1. request_irq(enetc_msg_psi_msix) \u003c- IRQ handler registered\n 2. INIT_WORK(\u0026pf-\u003emsg_task, ...) \u003c- work_struct initialized\n 3. enetc_msg_alloc_mbx() \u003c- mailbox DMA allocated\n\nThis ordering is unsafe because if a spurious interrupt or pending\ninterrupt from a previous device state fires immediately after\nrequest_irq() returns, the registered ISR enetc_msg_psi_msix() will\nexecute and unconditionally call:\n\n schedule_work(\u0026pf-\u003emsg_task)\n\nAt this point, pf-\u003emsg_task has not been initialized by INIT_WORK(), so\nthe work_struct contains garbage values in its internal linked list\npointers (work_struct-\u003eentry). Passing an uninitialized work_struct to\nschedule_work() could corrupt the kernel\u0027s workqueue linked lists,\npotentially leading to:\n\n - Kernel panic in __queue_work()\n - Memory corruption in workqueue data structures\n - System deadlock or undefined behavior\n\nAdditionally, even if the work_struct was initialized, the mailbox DMA\nbuffers (pf-\u003erxmsg[]) may not yet be allocated when the work handler\nenetc_msg_task() runs, resulting in NULL pointer dereference.\n\nFix by reordering the initialization sequence to ensure all resources are\nproperly initialized before the interrupt handler can execute:\n\n 1. enetc_msg_alloc_mbx() \u003c- Allocate all mailboxes\n 2. INIT_WORK(\u0026pf-\u003emsg_task, ...) \u003c- Initialize work first\n 3. request_irq(enetc_msg_psi_msix) \u003c- Register IRQ last\n 4. Configure hardware \u0026 enable MR interrupts\n\nThis guarantees that when enetc_msg_psi_msix() runs:\n - pf-\u003emsg_task is properly initialized (safe for schedule_work)\n - pf-\u003erxmsg[] buffers are allocated (safe for work handler access)\n - Hardware is configured appropriately\n\nAs the inverse of enetc_msg_psi_init(), enetc_msg_psi_free() also has\nsimilar problems. For example, if a pending interrupt fires between\nenetc_msg_free_mbx() and free_irq(), the ISR enetc_msg_psi_msix() may\nschedule the work handler again via schedule_work(), which could then\naccess already-freed DMA buffers (pf-\u003erxmsg[]), leading to use-after-free\nand potential memory corruption.\n\nTherefore, the order of enetc_msg_psi_free() is adjusted:\n 1. enetc_msg_disable_mr_int() \u003c- Stop new interrupts first\n 2. free_irq() \u003c- Ensure no IRQ handler can run\n 3. cancel_work_sync() \u003c- Wait for any pending work\n 4. enetc_msg_disable_mr_int() \u003c- Re-disable in case work\n\t\t\t\t\t re-enabled it\n 5. enetc_msg_free_mbx() \u003c- Safe to free DMA buffers now\n\nLink: https://sashiko.dev/#/patchset/20260511080805.2052495-1-wei.fang%40nxp.com #1\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-9-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f8ae63de2a872fa3b68c287c35379f6d73d38a5d", "tree": "3ebc1539b28452d3078eaff84d81e65453b02c76", "parents": [ "adb4599979cd00d5d426f26cf78b65264217e35b" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:19 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:59 2026 -0700" }, "message": "net: enetc: fix unbounded loop and interrupt handling in VF-to-PF messaging\n\nThe enetc_msg_task() function has several issues that need to be addressed:\n\n1. Unbounded loop causing potential DoS:\n\nenetc_msg_task() processes VF-to-PF mailbox messages in an unbounded\nfor(;;) loop that keeps polling ENETC_PSIMSGRR until no MR bits are set.\nA malicious guest VM can exploit this by continuously sending messages at\na high rate - immediately sending a new message as soon as the PF\nacknowledges the previous one. Since the worker thread never yields or\nenforces a processing budget, the mr_mask check frequently evaluates to\nnon-zero, causing the PF to spin indefinitely and starving other tasks.\n\nFix this by replacing the unbounded loop with a single snapshot read at\ntask entry. The task processes only the VFs whose MR bits were set at\nthat point, then re-enables message interrupts before returning. This\nbounds work per invocation to at most num_vfs iterations. No messages are\nlost because the message interrupt is disabled in enetc_msg_psi_msix()\nbefore scheduling enetc_msg_task(), so any new messages arriving during\nprocessing will trigger a fresh interrupt once re-enabled, scheduling\nanother task invocation.\n\n2. Write order of ENETC_PSIIDR and ENETC_PSIMSGRR:\n\nBoth ENETC_PSIIDR and ENETC_PSIMSGRR contain MR bits indicating messages\nhave been received from VSIs, but only ENETC_PSIIDR trigger the CPU\ninterrupt. Previously, ENETC_PSIMSGRR was written before ENETC_PSIIDR.\nWriting ENETC_PSIMSGRR returns the message code to the VSI in its upper\n16 bits, signaling to the VF that message processing is complete and it\nmay send the next message. If the VF sends a new message before\nENETC_PSIIDR is written, the subsequent w1c write to ENETC_PSIIDR would\ninadvertently clear the MR bit set by the new message, causing the\ninterrupt to be lost and the new message to go unprocessed.\n\nTherefore, write ENETC_PSIIDR first to clear the interrupt source, then\nwrite ENETC_PSIMSGRR to acknowledge the message to the VSI.\n\n3. Check both ENETC_PSIMSGRR and ENETC_PSIIDR for mr_status:\n\nThe write order change above introduces a potential race: if a VF sends\na new message in the window between the ENETC_PSIIDR w1c and the\nENETC_PSIMSGRR w1c, the ENETC_PSIMSGRR MR bit for the new message may\nnot be set. If mr_status was derived solely from ENETC_PSIMSGRR, this\nmessage would never be detected despite ENETC_PSIIDR retaining its MR\nbit, leading to an unacknowledged interrupt storm.\n\nFix this by computing mr_status as the union of both ENETC_PSIMSGRR and\nENETC_PSIIDR MR bits, ensuring all pending messages are detected\nregardless of which register reflects the new message state.\n\nAdditionally, rename the per-register MR macros (ENETC_PSI*_MR_MASK,\nENETC_PSI*_MR) to register-agnostic names (ENETC_PSIMR_MASK,\nENETC_PSIMR_BIT) since the MR bit layout is shared across ENETC_PSIMSGRR,\nENETC_PSIIER, and ENETC_PSIIDR. Make the mask macro dynamic based on\nthe actual number of active VFs rather than hardcoded.\n\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-8-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "adb4599979cd00d5d426f26cf78b65264217e35b", "tree": "b9abb7c1efafb17867c267b8acf8371c51d43f9c", "parents": [ "f262f5d893327a7131ed25ac8dd01ed7024bcc18" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:18 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:59 2026 -0700" }, "message": "net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx()\n\nThe teardown sequence in enetc_msg_psi_free() frees the DMA buffer before\nclearing the device\u0027s DMA address registers. If a VF sends a message or a\npending DMA transfer completes within this window, the hardware will\nperform a DMA write into the kernel memory that has already been returned\nto the allocator.\n\nThe result is silent memory corruption that can affect arbitrary kernel\ndata structures. Therefore, clear the DMA address registers before the\nDMA buffer is freed.\n\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-7-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f262f5d893327a7131ed25ac8dd01ed7024bcc18", "tree": "3670d5a0b5a914d5cc7913b6c052afe925a6aedf", "parents": [ "c666fa632fe628c34904bcd59aeb96bf08e40d31" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:17 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:59 2026 -0700" }, "message": "net: enetc: fix race condition in VF MAC address configuration\n\nSashiko reported a potential race condition between the VF message\nhandler and administrative VF MAC configuration from the host [1].\n\nThe VF message handler (enetc_msg_pf_set_vf_primary_mac_addr) runs\nasynchronously in a workqueue context and accesses vf_state-\u003eflags\nwithout any locking. Concurrently, the host can administratively\nchange the VF MAC address via enetc_pf_set_vf_mac(), which executes\nunder RTNL lock and modifies both vf_state-\u003eflags and hardware\nregisters.\n\nThis creates two race windows:\n\n1) TOCTOU race on vf_state-\u003eflags: The check of ENETC_VF_FLAG_PF_SET_MAC\n and subsequent MAC programming are not atomic, allowing the flag state\n to change between check and use.\n\n2) Torn MAC address writes: Hardware MAC programming requires multiple\n non-atomic register writes (__raw_writel for lower 32 bits and\n __raw_writew for upper 16 bits). Concurrent updates from VF mailbox\n and PF admin paths can interleave these operations, resulting in a\n corrupted MAC address being programmed into the hardware.\n\nFix by introducing a per-VF mutex to serialize access to vf_state and\nhardware MAC register updates. Both enetc_pf_set_vf_mac() and\nenetc_msg_pf_set_vf_primary_mac_addr() now acquire this lock before\naccessing vf_state-\u003eflags or programming the MAC address, ensuring\natomic read-modify-write sequences and preventing register write\ninterleaving.\n\nLink: https://sashiko.dev/#/patchset/20260511080805.2052495-1-wei.fang%40nxp.com #1\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-6-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c666fa632fe628c34904bcd59aeb96bf08e40d31", "tree": "2e5e09b8f63d5b711fcf38d07ea13a6975f7b0b0", "parents": [ "4a995d37b537f437daa01752d39cf44c6ba9ee2c" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:16 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:59 2026 -0700" }, "message": "net: enetc: fix TOCTOU race and validate VF MAC address\n\nSashiko reported that the PF driver accepts arbitrary MAC address from\nfrom VF mailbox messages without proper validation, creating a security\nvulnerability [1].\n\nIn enetc_msg_pf_set_vf_primary_mac_addr(), the MAC address is extracted\ndirectly from the message buffer (cmd-\u003emac.sa_data) and programmed into\nhardware via pf-\u003eops-\u003eset_si_primary_mac() without any validity checks.\nA malicious VF can configure a multicast, broadcast, or all-zero MAC\naddress. Therefore, a validation to check the MAC address provided by VF\nis required.\n\nHowever, simply checking the MAC address is not enough, because it also\nhas the potential TOCTOU race [2]: The code reads the MAC address from\nthe DMA buffer to validate it via is_valid_ether_addr(), if validation\npasses, reads the same DMA buffer a second time when calling\nenetc_pf_set_primary_mac_addr() to program the hardware. A malicious VF\ncan exploit this window by overwriting the MAC address in the DMA buffer\nbetween the validation check and the hardware programming, bypassing the\nvalidation entirely.\n\nTherefore, allocate a local buffer in enetc_msg_handle_rxmsg() and copy\nthe message content from the DMA buffer via memcpy() before processing.\nThis ensures the PF operates on a stable snapshot that the VF cannot\nmodify.\n\nLink: https://sashiko.dev/#/patchset/20260511080805.2052495-1-wei.fang%40nxp.com #1\nLink: https://sashiko.dev/#/patchset/20260513103021.2190593-1-wei.fang%40nxp.com #2\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-5-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4a995d37b537f437daa01752d39cf44c6ba9ee2c", "tree": "9fbd57e8c9e11512cb2626ce150fd4895e6b455d", "parents": [ "5027266dea471e140f93dd534845c9c4f43219a3" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:15 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:59 2026 -0700" }, "message": "net: enetc: add ratelimiting to VF mailbox error messages\n\nSashiko reported that a buggy or malicious guest VM can flood the host\nkernel log by repeatedly sending VF-to-PF messages at a high rate,\ndegrading host performance and hiding important system logs [1].\n\nFix by replacing dev_err()/dev_warn() with dev_err_ratelimited(),\nlimiting output to the default kernel ratelimit. This ensures errors are\nstill logged for debugging while preventing log flooding attacks.\n\nLink: https://sashiko.dev/#/patchset/20260511080805.2052495-1-wei.fang%40nxp.com #1\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-4-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5027266dea471e140f93dd534845c9c4f43219a3", "tree": "1b9263e38aea052ce3720af1795551f006ba487a", "parents": [ "8c84c5ec4aaff6ad7aac49935e050fed6b360a28" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:14 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:58 2026 -0700" }, "message": "net: enetc: fix missing error code when pf-\u003evf_state allocation fails\n\nIn enetc_pf_probe(), when the memory allocation for pf-\u003evf_state fails,\nthe code jumps to the error handling label but the variable \u0027err\u0027 is not\nassigned an appropriate error code beforehand. This causes the function\nto return 0 (success) on an allocation failure path, misleading the\ncaller into thinking the probe succeeded. So set err to -ENOMEM before\njumping to the error handling label when the allocation for pf-\u003evf_state\nreturns NULL.\n\nFixes: e15c5506dd39 (\"net: enetc: allocate vf_state during PF probes\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-3-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8c84c5ec4aaff6ad7aac49935e050fed6b360a28", "tree": "32f98ff89d7176302a3f2a8c088e4276c011e430", "parents": [ "bdd39576bf50a50bdafe3da968fd271bc674a48f" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:13 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:58 2026 -0700" }, "message": "net: enetc: fix incorrect mailbox message status returned to VFs\n\nThere are two cases where VFs receive an incorrect success status from\nthe PF mailbox message handler, misleading them into believing their\nrequests have been fulfilled:\n\nIn enetc_msg_handle_rxmsg(), *status is pre-initialized to\nENETC_MSG_CMD_STATUS_OK. When an unsupported command type is received,\nthe default case only logs an error without updating *status, so it\nremains as ENETC_MSG_CMD_STATUS_OK.\n\nIn enetc_msg_pf_set_vf_primary_mac_addr(), when the PF has already\nassigned a MAC address for the VF (ENETC_VF_FLAG_PF_SET_MAC is set),\nthe function rejects the request but returns ENETC_MSG_CMD_STATUS_OK\ninstead of ENETC_MSG_CMD_STATUS_FAIL.\n\nTherefore, correct the status value for the two cases mentioned above.\n\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-2-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bdd39576bf50a50bdafe3da968fd271bc674a48f", "tree": "954a8af35f5ba12cd463ea3e46f9e7942050930d", "parents": [ "979c017803c40829b03acd9e5236e354b7622360" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed May 20 11:42:07 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:47:36 2026 -0700" }, "message": "net: bridge: prevent too big nested attributes in br_fill_linkxstats()\n\nAfter commit ff205bf8c554 (\"netlink: add one debug check in nla_nest_end()\")\nsyzbot found that br_fill_linkxstats() can send corrupted netlink packets.\n\nMake sure the nested attribute size is bounded.\n\nFixes: a60c090361ea (\"bridge: netlink: export per-vlan stats\")\nReported-by: syzbot+a35f9259d08f907c06e6@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/6a0b0da3.050a0220.175f0c.0000.GAE@google.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nAcked-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260520114207.1394241-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "979c017803c40829b03acd9e5236e354b7622360", "tree": "c7ee203983f82a11b494c012c2b06f22369e911e", "parents": [ "9a1730245e416d11ad5c0f2c100061d61cc43f60" ], "author": { "name": "Michael Bommarito", "email": "michael.bommarito@gmail.com", "time": "Mon May 18 14:34:47 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:47:20 2026 -0700" }, "message": "l2tp: use list_del_rcu in l2tp_session_unhash\n\nAn unprivileged local user can pin a host CPU indefinitely in\nl2tp_session_get_by_ifname() by issuing L2TP_CMD_SESSION_GET on\nL2TP_ATTR_IFNAME concurrently with L2TP_CMD_SESSION_CREATE and\nL2TP_CMD_SESSION_DELETE on the same tunnel. All three commands take\nGENL_UNS_ADMIN_PERM, so CAP_NET_ADMIN in the netns user namespace\nsuffices; on any host that has l2tp_core loaded the trigger is\nreachable from a standard `unshare -Urn` sandbox.\n\nl2tp_session_unhash() removes a session from tunnel-\u003esession_list\nwith list_del_init(), but that list is walked by\nl2tp_session_get_by_ifname() with list_for_each_entry_rcu() under\nrcu_read_lock_bh(). list_del_init() leaves the deleted entry\u0027s\nnext/prev self-pointing; a reader that has loaded the entry and\nthen advances pos-\u003elist.next reads \u0026session-\u003elist, container_of()s\nback to the same session, and list_for_each_entry_rcu() never\nreaches the list head. The CPU stays in strcmp() inside the\nwalker, with BH and preemption disabled, so RCU grace periods on\nthe host stall behind it and the wedged thread cannot be killed\n(SIGKILL is delivered on syscall return).\n\nUse list_del_rcu() to match the existing list_add_rcu() in\nl2tp_session_register(); the deleted session remains visible to\nin-flight walkers with consistent next/prev pointers until\nkfree_rcu() in l2tp_session_free() releases it. tunnel-\u003esession_list\nhas exactly one list_del_init() call site; the list_del_init\n(\u0026session-\u003eclist) at l2tp_core.c:533 operates on the per-collision\nlist, which is not walked under RCU. list_empty(\u0026session-\u003elist) is\nnot used anywhere in net/l2tp/ after the unhash point, so dropping\nthe post-delete self-init is safe; the fix has no userspace-visible\nbehavior change.\n\nFixes: 89b768ec2dfef (\"l2tp: use rcu list add/del when updating lists\")\nCc: stable@vger.kernel.org # 6.11+\nSigned-off-by: Michael Bommarito \u003cmichael.bommarito@gmail.com\u003e\nLink: https://patch.msgid.link/20260518183447.64078-1-michael.bommarito@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dd3802fc4f6b52201a93330d44981a66bd6ef883", "tree": "a254ca775ca8f6b82527a911817aeb8c04ebea24", "parents": [ "8bc67e4db64aa72732c474b44ea8622062c903f0", "1fcf4149418e7a8f8253dd74059d56340795503f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 08:43:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 08:43:26 2026 -0700" }, "message": "Merge tag \u0027soc-fixes-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC fixes from Arnd Bergmann:\n\n - The ff-a firmware driver gets 11 individual bugfixes for a number of\n issues with robustness to buggy firmware or client implementations.\n Another firmware fix address suspend to RAM via PSCI firmware.\n\n - The final code change is for the old Arm Integrator reference\n platform that recently started exposing an old NULL pointer\n dereference bug.\n\n - The MAINTAINERS file gets two updates, notably James Tai and Yu-Chun\n Lin are stepping up as co-maintainers for the Realtek platform.\n\n - The remaining patches are all for devicetree files. Two of these are\n for riscv boards, the rest are all for enesas Arm platforms,\n addressing build time checking issues as well as minor configuration\n problems.\n\n* tag \u0027soc-fixes-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (30 commits)\n firmware: psci: Set pm_set_resume/suspend_via_firmware() for SYSTEM_SUSPEND\n ARM: realtek: MAINTAINERS: Include pin controller drivers\n MAINTAINERS: Add maintainers for ARM/REALTEK ARCHITECTURE\n ARM: integrator: Fix early initialization\n firmware: arm_ffa: Fix sched-recv callback partition lookup\n firmware: arm_ffa: Snapshot notifier callbacks under lock\n firmware: arm_ffa: Align RxTx buffer size before mapping\n firmware: arm_ffa: Validate framework notification message layout\n firmware: arm_ffa: Keep framework RX release under lock\n firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies\n firmware: arm_ffa: Unregister bus notifier on teardown for FF-A v1.0\n firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue\n firmware: arm_ffa: Avoid collapsing NPI work from different CPUs\n firmware: arm_ffa: Skip free_pages on RX buffer alloc failure\n firmware: arm_ffa: Check for NULL FF-A ID table while driver registration\n riscv: dts: microchip: fix icicle i2c pinctrl configuration\n riscv: dts: starfive: jh7110: Drop CAMSS node\n arm64: dts: renesas: r9a09g056: Add #mux-state-cells to usb20phyrst\n arm64: dts: renesas: r9a09g057: Add #mux-state-cells to usb2{0,1}phyrst\n ARM: dts: renesas: rskrza1: Drop superfluous cells\n ...\n" }, { "commit": "9a1730245e416d11ad5c0f2c100061d61cc43f60", "tree": "8c14e30a02749c83d24d6bfec87c3d6b15716f34", "parents": [ "c5fcca7f662f0c0918eac60ea193bf65a36863e3" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Wed May 20 20:43:20 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:37:56 2026 -0700" }, "message": "net: bcmgenet: keep RBUF EEE/PM disabled\n\nSetting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_CTRL breaks the RX\npath on GENET hardware once MAC EEE becomes active. RX traffic stops\nflowing while the link stays up and the usual descriptor/RX error\ncounters remain quiet. In that state the MAC still accepts frames\n(rbuf_ovflow_cnt keeps climbing) but RBUF no longer forwards them to\nDMA, so rx_packets is no longer incremented at the netdev level. On\nsome boards the corruption ends up as a paging fault in\nskb_release_data via bcmgenet_rx_poll on an LPI exit.\n\nReproduced on Pi 4B (BCM2711 + BCM54213PE) and confirmed by Florian\nFainelli on an internal Broadcom 4908-family board with the same crash\nsignature. RBUF_PM_EN is not publicly documented.\n\nThis shows up more often now that phy_support_eee() enables EEE by\ndefault, but it also affects older kernels as soon as TX LPI is\nturned on via ethtool, so it is not specific to recent changes.\n\nAlways clear RBUF_EEE_EN | RBUF_PM_EN in bcmgenet_eee_enable_set so\nthe bits stay off across resets. UMAC and TBUF setup is left alone so\nTX-side EEE keeps working.\n\nLink: https://github.com/raspberrypi/linux/issues/7304\nFixes: 6ef398ea60d9 (\"net: bcmgenet: add EEE support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nLink: https://patch.msgid.link/20260520184320.652053-1-nb@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c5fcca7f662f0c0918eac60ea193bf65a36863e3", "tree": "8ff09d71f5f859948adea9940ed72b8164bb27e5", "parents": [ "3287e81292f49dca2f253113c458e8f3d4ea091b", "014767c709a44b4e0a0bf70ee9101fb73f4e288b" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:28:58 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:28:59 2026 -0700" }, "message": "Merge branch \u0027ethernet-3c509-bring-driver-back-and-make-some-fixes\u0027\n\nMaciej W. Rozycki says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nethernet: 3c509: Bring driver back and make some fixes\n\n As per the previous discussions[1][2] this patch series brings the 3c509\ndriver back. Picking up net rather than net-next as I consider it a fix\nto accidental removal and so that any downstream users do not suffer from\ndisruption when using released kernels.\n\n In the course of making the coding style changes requested I have come\nacross an actual bug in transceiver type selection code, where the old\nsetting is not masked out before ORing in the new one, causing no change\nto be actually made in a requested transition from BNC to AUI. I guess\nthis code must have been executed exceedingly rarely, as it\u0027s always been\nwrong ever since it was added in 2.5.42 back in 2002.\n\n Therefore I find it not worth backporting to stable branches, however for\nthe sake of appropriateness, in case someone downstream does want to have\nthe fix, I chose to apply it second in the series, right after the actual\nrevert and before code clean-ups.\n\n The remaining patches of the series should be obvious; see the respective\ncommit descriptions for details.\n\n[1] \"drivers: net: 3com: 3c509: Remove this driver\",\n \u003chttps://lore.kernel.org/r/alpine.DEB.2.21.2604240004280.28583@angie.orcam.me.uk/\u003e.\n\n[2] \"MAINTAINERS: Add self for the 3c509 network driver\",\n \u003chttps://lore.kernel.org/r/alpine.DEB.2.21.2604271056460.28583@angie.orcam.me.uk/\u003e.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/alpine.DEB.2.21.2605201115010.1450@angie.orcam.me.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "014767c709a44b4e0a0bf70ee9101fb73f4e288b", "tree": "8ff09d71f5f859948adea9940ed72b8164bb27e5", "parents": [ "75756cb4b2aa148816b32d7d40c1f79f9a11eef6" ], "author": { "name": "Maciej W. Rozycki", "email": "macro@orcam.me.uk", "time": "Wed May 20 12:19:06 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:28:56 2026 -0700" }, "message": "ethernet: 3c509: Fix most coding style issues\n\nUpdate the driver for our current coding style according to output from\n`checkpatch.pl\u0027 and manual code review, where no change to binary code\nresults, as indicated by `objdump -dr\u0027. Exceptions are as follows:\n\n- incomplete reverse xmas tree in set_multicast_list(), as that would\n change binary output,\n\n- referring el3_start_xmit() verbatim rather than via `__func__\u0027 with\n pr_debug(), likewise,\n\n- a bunch of pr_cont() calls, likewise,\n\n- a long udelay() call in el3_netdev_set_ecmd() made under a spinlock,\n likewise plus it\u0027s not eligible for conversion to a sleep in the first\n place,\n\n- a blank line at the start of a block in el3_interrupt(), to improve\n readability where the first statement would otherwise visually merge\n with the controlling expression of the enclosing `while\u0027 statement.\n\nThese issues are benign and depending on circumstances may be adressed\nwith suitable code refactoring later on.\n\nSigned-off-by: Maciej W. Rozycki \u003cmacro@orcam.me.uk\u003e\nLink: https://patch.msgid.link/alpine.DEB.2.21.2605201208280.1450@angie.orcam.me.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "75756cb4b2aa148816b32d7d40c1f79f9a11eef6", "tree": "9295d805d0468dfdc8a591e0a79b026b1a668d3e", "parents": [ "240117bb51b95ce93ec28c7c9439c9a87d7b120c" ], "author": { "name": "Maciej W. Rozycki", "email": "macro@orcam.me.uk", "time": "Wed May 20 12:19:02 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:28:56 2026 -0700" }, "message": "ethernet: 3c509: Update documentation to match MAINTAINERS\n\nThere has been apparently a single message only ever publicly posted by\nDavid Ruggiero, back in 2002, which added this documentation piece among\nothers, and MAINTAINERS was never updated accordingly. It is therefore\ndoubtful that his maintainer status has actually come into effect. Just\nreplace the reference then so as not to confuse people.\n\nSigned-off-by: Maciej W. Rozycki \u003cmacro@orcam.me.uk\u003e\nLink: https://patch.msgid.link/alpine.DEB.2.21.2605201207380.1450@angie.orcam.me.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "240117bb51b95ce93ec28c7c9439c9a87d7b120c", "tree": "3dd91be335236c0904405e5de545940e5114a84f", "parents": [ "029a6b3a14bf02e6f59ce6ecd10f9d003334c612" ], "author": { "name": "Maciej W. Rozycki", "email": "macro@orcam.me.uk", "time": "Wed May 20 12:18:57 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:28:56 2026 -0700" }, "message": "ethernet: 3c509: Add GPL 2.0 SPDX license identifier\n\nThis driver has landed with Linux 0.99.13k, which was covered by the GNU\nGeneral Public License version 2, and no further conditions as to\nlicensing terms have been specified within the copyright notice included\nwith the driver itself.\n\nSigned-off-by: Maciej W. Rozycki \u003cmacro@orcam.me.uk\u003e\nLink: https://patch.msgid.link/alpine.DEB.2.21.2605201206370.1450@angie.orcam.me.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "029a6b3a14bf02e6f59ce6ecd10f9d003334c612", "tree": "7961a9b5526e4dfa5938dcc88accdf4c4d376cb6", "parents": [ "28db0338db61ec75d146192463907351907a0dbc" ], "author": { "name": "Maciej W. Rozycki", "email": "macro@orcam.me.uk", "time": "Wed May 20 12:18:53 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:28:56 2026 -0700" }, "message": "ethernet: 3c509: Fix AUI transceiver type selection\n\nThe transceiver type is held in bits 15:14 of the Address Configuration\nRegister, with the values of 0b00, 0b01, and 0b11 denoting TP, AUI, and\nBNC types respectively. Therefore switching from BNC to AUI requires\nbits to be cleared before setting bit 14 or the setting won\u0027t change.\n\nNB this has always been wrong ever since this code was added in 2.5.42.\n\nSigned-off-by: Maciej W. Rozycki \u003cmacro@orcam.me.uk\u003e\nLink: https://patch.msgid.link/alpine.DEB.2.21.2605201205160.1450@angie.orcam.me.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "28db0338db61ec75d146192463907351907a0dbc", "tree": "b93cf19fc339b2f397e4a637a4e86fef7e0a77e0", "parents": [ "3287e81292f49dca2f253113c458e8f3d4ea091b" ], "author": { "name": "Maciej W. Rozycki", "email": "macro@orcam.me.uk", "time": "Wed May 20 12:18:49 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:28:56 2026 -0700" }, "message": "Revert \"drivers: net: 3com: 3c509: Remove this driver\"\n\nThis reverts commit 91f3a27ae9f66d81a5906461762c37c8a2bcab06.\n\nContrary to the assumption stated with the original commit description\nthis driver is in use and I\u0027m going to maintain it for the foreseeable\nfuture.\n\nSigned-off-by: Maciej W. Rozycki \u003cmacro@orcam.me.uk\u003e\nLink: https://patch.msgid.link/alpine.DEB.2.21.2605201204260.1450@angie.orcam.me.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3287e81292f49dca2f253113c458e8f3d4ea091b", "tree": "9e10d6e881364d9b1f2b714207e7d243196efec8", "parents": [ "4db79a322db8c97f7b73b8a347395ef4d685eb40" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Wed May 20 19:22:37 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:23:50 2026 -0700" }, "message": "tools: ynl: support listening on all nsids\n\nA new method ntf_listen_all_nsid() to enable listening on events from\nall namespaces. Useful for testing cross-namespace functionality.\n\nrecv() replaced with recvmsg() to be able to receive NSID through the\nancillary data.\n\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nLink: https://patch.msgid.link/20260520172317.175168-4-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4db79a322db8c97f7b73b8a347395ef4d685eb40", "tree": "d50b56ff50c4989fbbf316afcd32ab7d11edec2b", "parents": [ "3d4432d34c1992701289cbe12df9fd024f315998" ], "author": { "name": "Sabrina Dubroca", "email": "sd@queasysnail.net", "time": "Wed May 20 22:44:42 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:21:33 2026 -0700" }, "message": "net: gro: don\u0027t merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn\u0027t hold a reference\non the pages in shinfo-\u003efrags. Appending those frags to another skb\u0027s\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don\u0027t merge the skbs.\n\nFixes: 753f1ca4e1e5 (\"net: introduce managed frags infrastructure\")\nReported-by: Huzaifa Sidhpurwala \u003chuzaifas@redhat.com\u003e\nSigned-off-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/c3b7f906bbfcbdfd7b4fa9d6c18a438870df85be.1779307748.git.sd@queasysnail.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3d4432d34c1992701289cbe12df9fd024f315998", "tree": "b521687feed6837a7218394c32f1863141ca1c9f", "parents": [ "985d4a55e64e43bd86eeb896b81ceba453301989" ], "author": { "name": "Nikhil P. Rao", "email": "nikhil.rao@amd.com", "time": "Wed May 20 20:58:42 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:21:11 2026 -0700" }, "message": "pds_core: ensure null-termination for firmware version strings\n\nThe driver passes fw_version directly to devlink_info_version_stored_put()\nwithout ensuring null-termination. While current firmware null-terminates\nthese strings, the driver should not rely on this behavior. Add explicit\nnull-termination to prevent potential issues if firmware behavior changes.\n\nFixes: 45d76f492938 (\"pds_core: set up device and adminq\")\nSigned-off-by: Nikhil P. Rao \u003cnikhil.rao@amd.com\u003e\nLink: https://patch.msgid.link/20260520205842.1486718-1-nikhil.rao@amd.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "985d4a55e64e43bd86eeb896b81ceba453301989", "tree": "3e0110854d6810c9a473e7cecee9f4ec5e8a0dee", "parents": [ "e46e6bc97fb1f339730ff1ba74267fbf48e7a422" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Wed May 20 15:12:02 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:19:54 2026 -0700" }, "message": "net: airoha: Disable GDM2 forwarding before configuring GDM2 loopback\n\nHw design requires to disable GDM2 forwarding before configuring GDM2\nloopback in airoha_set_gdm2_loopback routine.\n\nFixes: 9cd451d414f6e (\"net: airoha: Add loopback support for GDM2\")\nTested-by: Madhur Agrawal \u003cmadhur.agrawal@airoha.com\u003e\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260520-airoha-disable-gdm2-fwd-v1-1-1eeea5dffc2f@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e46e6bc97fb1f339730ff1ba74267fbf48e7a422", "tree": "035de3c2808c6acae9c2bdc39e9e87464b0713ec", "parents": [ "bddc09212c24934643bd44fc794748d2bbb3b6cd" ], "author": { "name": "Justin Iurman", "email": "justin.iurman@gmail.com", "time": "Wed May 20 14:42:42 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:19:25 2026 -0700" }, "message": "ipv6: ioam: refresh hdr pointer before ioam6_event()\n\nReported by Sashiko:\n\nIn ipv6_hop_ioam(), the hdr pointer is initialized to point into the\nskb\u0027s linear data buffer. Later, the code calls skb_ensure_writable(),\nwhich might reallocate the buffer:\n\n\tif (skb_ensure_writable(skb, optoff + 2 + hdr-\u003eopt_len))\n\t\tgoto drop;\n\n\t/* Trace pointer may have changed */\n\ttrace \u003d (struct ioam6_trace_hdr *)(skb_network_header(skb)\n\t\t\t\t\t + optoff + sizeof(*hdr));\n\n\tioam6_fill_trace_data(skb, ns, trace, true);\n\n\tioam6_event(IOAM6_EVENT_TRACE, dev_net(skb-\u003edev),\n\t\t GFP_ATOMIC, (void *)trace, hdr-\u003eopt_len - 2);\n\nIf the skb is cloned or lacks sufficient linear headroom,\nskb_ensure_writable() will invoke pskb_expand_head(), which reallocates\nthe skb\u0027s data buffer and frees the old one, invalidating pointers to\nit. While the code recalculates the trace pointer immediately after the\ncall to skb_ensure_writable(), it fails to recalculate the hdr pointer.\n\nThis patch fixes the above by recalculating the hdr pointer before\npassing hdr-\u003eopt_len to ioam6_event(), so that we avoid any UaF.\n\nFixes: f655c78d6225 (\"net: exthdrs: ioam6: send trace event\")\nCc: stable@vger.kernel.org\nSigned-off-by: Justin Iurman \u003cjustin.iurman@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260520124242.32320-1-justin.iurman@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bddc09212c24934643bd44fc794748d2bbb3b6cd", "tree": "ebb2d3b6fd806f9ecfef464eabf539ade7a3a3f0", "parents": [ "2bccfb8476ca5f3548afbd623dc7a6980d4e77de" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Wed May 20 00:57:38 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:16:12 2026 -0700" }, "message": "tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR\n\nIn the SIOCGIFHWADDR path, tap_ioctl() copies 16 bytes of an\nuninitialised on-stack struct sockaddr_storage to userspace via\nifr_hwaddr, but netif_get_mac_address() only writes sa_family and\ndev-\u003eaddr_len (6 for Ethernet) bytes, leaving sa_data[6..13] uninitialised.\n\nThose 8 trailing bytes leak kernel stack contents; SIOCGIFHWADDR on a\nmacvtap chardev returns kernel .text and direct-map pointers, defeating\nKASLR.\n\nInitialise ss at declaration.\n\nFixes: 3b23a32a6321 (\"net: fix dev_ifsioc_locked() race condition\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260520075736.3415676-3-bestswngs@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2bccfb8476ca5f3548afbd623dc7a6980d4e77de", "tree": "c64e54801d1a5233336de02a480795147c35ae06", "parents": [ "b809d0409991b75a6cff846a5ac27c3062953f84" ], "author": { "name": "Dawei Feng", "email": "dawei.feng@seu.edu.cn", "time": "Wed May 20 15:03:23 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:15:00 2026 -0700" }, "message": "qed: fix double free in qed_cxt_tables_alloc()\n\nIf one of the later PF or VF CID bitmap allocations fails,\nqed_cid_map_alloc() jumps to cid_map_fail and frees the previously\nallocated CID bitmaps before returning an error. qed_cxt_tables_alloc()\nthen calls qed_cxt_mngr_free(), which invokes qed_cid_map_free()\nagain.\n\nFix this by setting each CID bitmap pointer to NULL after bitmap_free()\nto avoid double free.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1-rc3.\n\nRuntime reproduction was not attempted because exercising the failing\nallocation path requires device-specific setup.\n\nFixes: fe56b9e6a8d9 (\"qed: Add module with basic common support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Zilin Guan \u003czilin@seu.edu.cn\u003e\nSigned-off-by: Dawei Feng \u003cdawei.feng@seu.edu.cn\u003e\nLink: https://patch.msgid.link/20260520070323.2762379-1-dawei.feng@seu.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b809d0409991b75a6cff846a5ac27c3062953f84", "tree": "c2805438cf187f213804b4ca3b415d6c4c1a72a1", "parents": [ "9eddc819f00b5b74bb4ac91396f80bd35f5f3561" ], "author": { "name": "Aditya Garg", "email": "gargaditya@linux.microsoft.com", "time": "Tue May 19 22:15:53 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:14:11 2026 -0700" }, "message": "net: mana: validate rx_req_idx to prevent out-of-bounds array access\n\nIn mana_hwc_rx_event_handler(), rx_req_idx is derived from\nsge-\u003eaddress in DMA-coherent memory. In Confidential VMs\n(SEV-SNP/TDX), this memory is shared unencrypted and HW can modify\nWQE contents at any time. No bounds check exists on rx_req_idx,\nwhich can lead to an out-of-bounds access into reqs[].\n\nAdd bounds check on rx_req_idx in mana_hwc_rx_event_handler() before\nusing it to index the reqs[] array.\n\nFixes: ca9c54d2d6a5 (\"net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)\")\nSigned-off-by: Aditya Garg \u003cgargaditya@linux.microsoft.com\u003e\nReviewed-by: Haiyang Zhang \u003chaiyangz@microsoft.com\u003e\nLink: https://patch.msgid.link/20260520051553.857120-1-gargaditya@linux.microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9eddc819f00b5b74bb4ac91396f80bd35f5f3561", "tree": "08265b402f8fff19f2cb0a960eea34a40f7a0cad", "parents": [ "c367b9082194d01cb38bdefac6e887ebf1ab017d" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Wed May 20 10:00:36 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:12:59 2026 -0700" }, "message": "octeontx2-af: npc: Fix allmulticast skip logic for LBK and SDP VFs\n\nWhen installing the allmulticast NPC rule, rvu_npc_install_allmulti_entry()\nshould skip LBK and SDP VFs (only CGX PF/VF may add the entry). The\ncode combined is_lbk_vf() and is_sdp_vf() with logical AND, which is\nnever true for a single pcifunc, so the intended early return never ran.\n\nUse logical OR instead.\n\nCc: Geetha sowjanya \u003cgakula@marvell.com\u003e\nFixes: ae703539f49d2 (\"octeontx2-af: Cleanup loopback device checks\")\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260520043036.1523798-1-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c367b9082194d01cb38bdefac6e887ebf1ab017d", "tree": "8fb12e2fb5ea0a38a26d31dba7f97d4b890cfca6", "parents": [ "c5d93b2c40355e999715262a824965aac025a427" ], "author": { "name": "Zhang Cen", "email": "rollkingzzc@gmail.com", "time": "Tue May 19 18:46:47 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:10:18 2026 -0700" }, "message": "netpoll: normalize skb-\u003edev to the netpoll device\n\n__netpoll_send_skb() always transmits through np-\u003edev and queues busy\npackets on np-\u003edev-\u003enpinfo-\u003etxq, but it leaves skb-\u003edev unchanged.\nStacked callers such as DSA and macvlan can reach netpoll with skb-\u003edev\nstill naming the upper device while np-\u003edev is the lower device that\nowns the netpoll state.\n\nIf the skb has to be deferred, queue_process() later dequeues it from\nthe lower device\u0027s txq but retries it through skb-\u003edev. That can\nre-enter the upper ndo_start_xmit path on an already transformed skb,\nand if the upper device disappears before the lower txq drains the\nworkqueue can dereference a stale skb-\u003edev pointer.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\npath A label: netpoll enqueue path path B label: upper-device teardown\n1. Stacked xmit calls netpoll 1. Teardown unregisters the upper\n with lower np-\u003edev and upper net_device while lower npinfo\n skb-\u003edev. stays alive.\n2. __netpoll_send_skb() uses 2. netdev_release() runs for the\n np-\u003edev-\u003enpinfo as the txq upper net_device.\n owner.\n3. Busy transmit queues the skb 3. The lower txq still owns the\n on that lower txq with upper deferred skb.\n skb-\u003edev.\n4. queue_process() drains the 4. queue_process() dereferences\n lower txq and reads skb-\u003edev. that stale upper skb-\u003edev.\n\nNormalize skb-\u003edev to np-\u003edev after loading np-\u003edev from the netpoll\ninstance, before either the direct transmit path or the fallback enqueue.\nThis keeps the queued skb in the same device and txq domain as the\nnetpoll state that owns it.\n\nKASAN report as below:\n\nKASAN slab-use-after-free in queue_process+0x7c/0x480\nWorkqueue: events queue_process\nThe buggy address belongs to the object at ffff88810906c000 which belongs\nto the cache kmalloc-4k of size 4096\nThe buggy address is located 168 bytes inside of freed 4096-byte region\n[ffff88810906c000, ffff88810906d000)\nRead of size 8\nCall trace:\n dump_stack_lvl+0x73/0xb0 (?:?)\n print_report+0xd1/0x620 (?:?)\n srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n __virt_addr_valid+0x215/0x420 (?:?)\n kasan_complete_mode_report_info+0x64/0x200 (?:?)\n kasan_report+0xf7/0x130 (?:?)\n queue_process+0x7c/0x480 (net/core/netpoll.c:88)\n kasan_check_range+0x10c/0x1c0 (?:?)\n __kasan_check_read+0x15/0x20 (?:?)\n process_one_work+0x8b7/0x1af0 (kernel/workqueue.c:3200)\n assign_work+0x170/0x3f0 (?:?)\n worker_thread+0x574/0xf10 (?:?)\n _raw_spin_unlock_irqrestore+0x4b/0x60 (?:?)\n trace_hardirqs_on+0x2a/0x180 (?:?)\n kthread+0x2fc/0x3f0 (?:?)\n ret_from_fork+0x58b/0x830 (?:?)\n __switch_to+0x58e/0xe90 (?:?)\n __switch_to_asm+0x39/0x70 (?:?)\n ret_from_fork_asm+0x1a/0x30 (?:?)\nFreed by task stack:\n kasan_save_stack+0x3d/0x60 (?:?)\n kasan_save_track+0x18/0x40 (?:?)\n kasan_save_free_info+0x3f/0x60 (?:?)\n __kasan_slab_free+0x48/0x70 (?:?)\n kfree+0x20e/0x4e0 (?:?)\n kvfree+0x31/0x40 (?:?)\n netdev_release+0x71/0x90 (net/core/net-sysfs.c:2227)\n device_release+0xd2/0x250 (?:?)\n kobject_put+0x181/0x4c0 (lib/kobject.c:730)\n netdev_run_todo+0x700/0x1000 (net/core/dev.c:11666)\n rtnl_dellink+0x396/0xc00 (net/core/rtnetlink.c:3558)\n rtnetlink_rcv_msg+0x740/0xc20 (net/core/rtnetlink.c:6897)\n netlink_rcv_skb+0x147/0x3a0 (?:?)\n rtnetlink_rcv+0x19/0x20 (net/core/rtnetlink.c:7021)\n netlink_unicast+0x4d1/0x830 (net/netlink/af_netlink.c:1327)\n netlink_sendmsg+0x840/0xe10 (net/netlink/af_netlink.c:1812)\n ____sys_sendmsg+0x8a7/0xb50 (?:?)\n ___sys_sendmsg+0x104/0x190 (?:?)\n __sys_sendmsg+0x135/0x1d0 (?:?)\n __x64_sys_sendmsg+0x7b/0xc0 (?:?)\n x64_sys_call+0x205c/0x2130 (?:?)\n do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)\n entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)\n\nFixes: 5de4a473bda4 (\"netpoll queue cleanup\")\nSigned-off-by: Zhang Cen \u003crollkingzzc@gmail.com\u003e\nLink: https://patch.msgid.link/20260519104647.3517990-1-rollkingzzc@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c5d93b2c40355e999715262a824965aac025a427", "tree": "b7dd32039fd2c9d11285e22e7b7565b4ca696851", "parents": [ "85fac50b58ca0e96dc8bfa649705cb901400877f" ], "author": { "name": "Abdun Nihaal", "email": "nihaal@cse.iitm.ac.in", "time": "Tue May 19 11:57:39 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:06:02 2026 -0700" }, "message": "net: wwan: iosm: fix potential memory leaks in ipc_imem_init()\n\nThe memory allocated in ipc_protocol_init() is not freed on the error\npaths that follow in ipc_imem_init(). Fix that by calling the\ncorresponding release function ipc_protocol_deinit() in the error path.\n\nFixes: 3670970dd8c6 (\"net: iosm: shared memory IPC interface\")\nCc: stable@vger.kernel.org\nSigned-off-by: Abdun Nihaal \u003cnihaal@cse.iitm.ac.in\u003e\nLink: https://patch.msgid.link/20260519062815.55545-1-nihaal@cse.iitm.ac.in\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "85fac50b58ca0e96dc8bfa649705cb901400877f", "tree": "03a0159801e7296674cd7b12822bfd7e73efa94b", "parents": [ "099258bde1c94d8c8d0988b543436192f9d7438b" ], "author": { "name": "Michael Grzeschik", "email": "mgr@kernel.org", "time": "Thu May 21 15:49:29 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 07:47:49 2026 -0700" }, "message": "MAINTAINERS: Update address for Michael Grzeschik\n\nSince I am moving from Pengutronix update my email address for the\nARCNET subsystems to point to my kernel.org address.\n\nAlso update .mailmap.\n\nSigned-off-by: Michael Grzeschik \u003cmgr@kernel.org\u003e\nAcked-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nAcked-by: Markus Schneider-Pargmann \u003cmail@markussp.com\u003e\nLink: https://patch.msgid.link/20260521-maintainer-v1-1-29b5e106682d@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "099258bde1c94d8c8d0988b543436192f9d7438b", "tree": "b8201088b9f2a00fbc67ce851a3c9d6a5abb2a9e", "parents": [ "dfc077043351a81887d1e4c9ac244e9243f3cbf2" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 20 17:41:51 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 07:47:40 2026 -0700" }, "message": "MAINTAINERS: add missing entry for Bluetooth include files\n\nWe X-out net/bluetooth/ from \"NETWORKING [GENERAL]\" so that only\nthe dedicated list is CCed on patches, and networking gets them\nonce already processed by Luiz. We missed include/net/bluetooth.\n\nLink: https://patch.msgid.link/20260521004151.625049-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dfc077043351a81887d1e4c9ac244e9243f3cbf2", "tree": "3060d8d01abe0766c0ed81c988a01bab7124191b", "parents": [ "1341db322417266fb5845df81d28305b83a37324" ], "author": { "name": "Nimrod Oren", "email": "noren@nvidia.com", "time": "Wed May 20 18:39:28 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 07:47:00 2026 -0700" }, "message": "selftests: net: Fix checksums in xdp_native\n\nData adjustment cases failed with \"Data exchange failed\" when using IPv4\nbecause the program did not update the IP and UDP checksums in the IPv4\nbranch. The issue was masked when both IPv4 and IPv6 were configured,\nsince the test harness prefers IPv6.\n\nWhile here, generalize csum_fold_helper() to fold twice so it works for\nany 32-bit input.\n\nFixes: 0b65cfcef9c5 (\"selftests: drv-net: Test tail-adjustment support\")\nReviewed-by: Carolina Jubran \u003ccjubran@nvidia.com\u003e\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nSigned-off-by: Nimrod Oren \u003cnoren@nvidia.com\u003e\nLink: https://patch.msgid.link/20260520153928.3371765-1-noren@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1341db322417266fb5845df81d28305b83a37324", "tree": "f706b50b7081771b7a60dde293fdce2cb0bc8ed0", "parents": [ "92cc6708f4a2ce15433b8355f363d446429ba88c" ], "author": { "name": "Yuho Choi", "email": "dbgh9129@gmail.com", "time": "Tue May 19 23:03:28 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 07:43:15 2026 -0700" }, "message": "ipv6: route: Unregister netdevice notifier on BPF init failure\n\nip6_route_init() registers ip6_route_dev_notifier before registering the\nIPv6 route BPF iterator target. If bpf_iter_register() fails after the\nnotifier has been registered, the error path currently jumps to\nout_register_late_subsys and unwinds the RTNL handlers and pernet route\nstate without removing the notifier from the netdevice notifier chain.\n\nThis leaves ip6_route_dev_notify() callable after the IPv6 route state it\nuses has been torn down. Add a separate unwind label for the BPF iterator\nfailure path and unregister the netdevice notifier before continuing with\nthe existing cleanup.\n\nFixes: 138d0be35b14 (\"net: bpf: Add netlink and ipv6_route bpf_iter targets\")\nSigned-off-by: Yuho Choi \u003cdbgh9129@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260520030329.1061183-1-dbgh9129@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "92cc6708f4a2ce15433b8355f363d446429ba88c", "tree": "c00b8e18dc3907de0c154c1201de0d62de2e9150", "parents": [ "dbc81608e3a653dea6cf403f20cae35468b8ab9c" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Wed May 20 11:34:43 2026 +1000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 07:39:20 2026 -0700" }, "message": "selftests: rds: config: disable modules\n\nThe run.sh script explicitly checks that CONFIG_MODULES is disabled.\n\nBy default, this config option is enabled. Explicitly disable it to be\nable to run the RDS tests.\n\nNote that writing \u0027# CONFIG_(...) is not set\u0027 is usually recommended to\ndisable an option in the .config, but it looks like selftests usually\nset \u0027CONFIG_(...)\u003dn\u0027, which looks clearer.\n\nFixes: 0f5d68004780 (\"selftests: rds: add tools/testing/selftests/net/rds/config\")\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nReviewed-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260520-net-rds-config-modules-v1-1-2100df02fe9a@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dbc81608e3a653dea6cf403f20cae35468b8ab9c", "tree": "6912de8133d0050f9487766c411002ed2a847be9", "parents": [ "42734af6632ebebf90552f0e2dce4d8e72dbb9be" ], "author": { "name": "Zijing Yin", "email": "yzjaurora@gmail.com", "time": "Tue May 19 10:26:33 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 07:38:21 2026 -0700" }, "message": "phonet/pep: disable BH around forwarded sk_receive_skb()\n\nThe networking receive path is usually run from softirq context, but\nprotocols that take the socket lock may have packets stored in the\nbacklog and processed later from process context. In that case\nrelease_sock() -\u003e __release_sock() drops the slock with spin_unlock_bh()\nand then calls sk-\u003esk_backlog_rcv() with bottom halves enabled.\n\nTypical sk_backlog_rcv handlers process the socket whose backlog is\nbeing drained, so the BH state at entry is irrelevant for the slocks\nthey touch. pep_do_rcv() is different: when the inbound skb targets an\nexisting PEP pipe, it forwards the skb to a different *child* socket\nvia sk_receive_skb(). That helper takes the child slock with\nbh_lock_sock_nested(), which is just spin_lock_nested() and assumes BH\nis already off. The same child slock therefore ends up acquired with\nBH on (process path) and with BH off (softirq path):\n\n process context softirq context\n --------------- ---------------\n release_sock(listener) __netif_receive_skb()\n __release_sock() phonet_rcv()\n spin_unlock_bh() __sk_receive_skb(listener)\n [BH now ENABLED] [BH already disabled]\n sk_backlog_rcv: sk_backlog_rcv:\n pep_do_rcv() pep_do_rcv()\n sk_receive_skb(child) sk_receive_skb(child)\n bh_lock_sock_nested(child) bh_lock_sock_nested(child)\n \u003d\u003e SOFTIRQ-ON-W \u003d\u003e IN-SOFTIRQ-W\n\nLockdep flags this as inconsistent lock state, and it can become a real\nself-deadlock if a softirq on the same CPU tries to receive to the same\nchild socket while its slock is held in the BH-enabled path:\n\n WARNING: inconsistent lock state\n inconsistent {SOFTIRQ-ON-W} -\u003e {IN-SOFTIRQ-W} usage.\n (slock-AF_PHONET/1){+.?.}-{3:3}, at: __sk_receive_skb+0x1cf/0x900\n __sk_receive_skb net/core/sock.c:563\n sk_receive_skb include/net/sock.h:2022 [inline]\n pep_do_rcv net/phonet/pep.c:675\n sk_backlog_rcv include/net/sock.h:1190\n __release_sock net/core/sock.c:3216\n release_sock net/core/sock.c:3815\n pep_sock_accept net/phonet/pep.c:879\n\nWrap the forwarded sk_receive_skb() in local_bh_disable() /\nlocal_bh_enable() so the child slock is always acquired with BH off.\nlocal_bh_disable() nests safely on the softirq path.\n\nDiscovered via in-house syzkaller fuzzing; the same root cause also\non the linux-6.1.y syzbot dashboard as extid 44f0626dd6284f02663c.\nReproduced under KASAN + LOCKDEP + PROVE_LOCKING, reproducer:\nhttps://pastebin.com/A3t8xzCR\n\nFixes: 9641458d3ec4 (\"Phonet: Pipe End Point for Phonet Pipes protocol\")\nLink: https://syzkaller.appspot.com/bug?extid\u003d44f0626dd6284f02663c\nCc: stable@vger.kernel.org\nSigned-off-by: Zijing Yin \u003cyzjaurora@gmail.com\u003e\nAcked-by: Rémi Denis-Courmont \u003cremi@remlab.net\u003e\nReported-by: syzbot+9f4a135646b66c509935@syzkaller.appspotmail.com\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260519172635.86304-1-yzjaurora@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "42734af6632ebebf90552f0e2dce4d8e72dbb9be", "tree": "363a60041f7575012948574af01a607b8bc9103d", "parents": [ "94e3dd6874bf04d5939bc8431b9f7852f3a4a121", "f80d3d98d2ff78d9e2fe5d68b1f45948c4f7bd24" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 15:59:10 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 15:59:11 2026 +0200" }, "message": "Merge tag \u0027batadv-net-pullrequest-20260520\u0027 of https://git.open-mesh.org/batadv\n\nSimon Wunderlich says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nHere are batman-adv bugfixes, all by by Sven Eckelmann.\n\n - fix batadv_skb_is_frag() kernel-doc\n\n - BATMAN V: stop OGMv2 on disabled interface\n\n - BATMAN IV: abort OGM send on tvlv append failure\n\n - BATMAN IV: reject oversized TVLV packets\n\n - tp_meter: fix race condition in send error reporting\n\n - tp_meter: avoid role confusion in tp_list\n\n - mcast: fix use-after-free in orig_node RCU release\n\n - BATMAN IV: recover OGM scheduling after forward packet error\n\n - bla: fix report_work leak on backbone_gw purge\n\n - bla: avoid double decrement of bla.num_requests\n\n - bla: avoid NULL-ptr deref for claim via dropped interface\n\n* tag \u0027batadv-net-pullrequest-20260520\u0027 of https://git.open-mesh.org/batadv:\n batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface\n batman-adv: bla: avoid double decrement of bla.num_requests\n batman-adv: bla: fix report_work leak on backbone_gw purge\n batman-adv: iv: recover OGM scheduling after forward packet error\n batman-adv: mcast: fix use-after-free in orig_node RCU release\n batman-adv: tp_meter: avoid role confusion in tp_list\n batman-adv: tp_meter: fix race condition in send error reporting\n batman-adv: tvlv: reject oversized TVLV packets\n batman-adv: tvlv: abort OGM send on tvlv append failure\n batman-adv: v: stop OGMv2 on disabled interface\n batman-adv: fix batadv_skb_is_frag() kernel-doc\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260520115422.53552-1-sw@simonwunderlich.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "057caace5214da3b457bbd295e1a2ad34d3685ea", "tree": "0e356c422e731ffb7f05d98eabeb6b6cf50557b4", "parents": [ "a0a2f42a37f90b29d8c43374dd9c8bd2f3e7bdcc" ], "author": { "name": "Thomas Weißschuh", "email": "linux@weissschuh.net", "time": "Wed May 20 20:01:55 2026 +0200" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu May 21 08:31:55 2026 -0400" }, "message": "tracing: Create output file from cmd_check_undefined\n\nAs the output file is currently never created, the check will run every\ntime, even if the inputs have not changed.\n\nCreate an empty output file which allows make to skip the execution when\nit is not necessary.\n\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nCc: Marc Zyngier \u003cmaz@kernel.org\u003e\nCc: Arnd Bergmann \u003carnd@arndb.de\u003e\nLink: https://patch.msgid.link/20260520-tracing-ringbuffer-check-v1-1-d979cfab1338@weissschuh.net\nFixes: 1211907ac0b5 (\"tracing: Generate undef symbols allowlist for simple_ring_buffer\")\nFixes: 58b4bd18390e (\"tracing: Adjust cmd_check_undefined to show unexpected undefined symbols\")\nReviewed-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nTested-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nSigned-off-by: Thomas Weißschuh \u003clinux@weissschuh.net\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "a0a2f42a37f90b29d8c43374dd9c8bd2f3e7bdcc", "tree": "9cabc7d35151bcc43e356ed6718f873111268b63", "parents": [ "c2d2856cf6c9efccdf5e0d2564162ec616ce58cf" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Tue May 12 15:16:14 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu May 21 08:26:22 2026 -0400" }, "message": "tracing: Fix unload_page for simple_ring_buffer init rollback\n\nThe unload_page callback expects the return value of load_page() as its\nargument: ret \u003d load_page(va); unload(ret). Fix the rollback code in\nsimple_ring_buffer_init_mm() where the descriptor\u0027s VA is used instead\nof the loaded page address.\n\nLink: https://patch.msgid.link/20260512141614.1759430-1-vdonnefort@google.com\nFixes: 635923081c79 (\"tracing: load/unload page callbacks for simple_ring_buffer\")\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "c2d2856cf6c9efccdf5e0d2564162ec616ce58cf", "tree": "c38a96e39cd6e2a039350e6170e8ee11b48bce36", "parents": [ "a494d3c8d5392bcdff83c2a593df0c160ff9f322" ], "author": { "name": "David Carlier", "email": "devnexen@gmail.com", "time": "Tue May 12 14:54:20 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu May 21 08:24:59 2026 -0400" }, "message": "tracing: Fix nr_subbufs initialization in simple_ring_buffer_init_mm()\n\nnr_subbufs in the ring buffer metadata is always initialized to zero\nbecause it is assigned from cpu_buffer-\u003enr_pages before the page\ninitialization loop has run. While nr_subbufs is not currently read\nby the kernel, it should reflect the actual buffer geometry in the\nmeta page for correctness.\n\nMove the assignment after the page loop so that cpu_buffer-\u003enr_pages\nholds the final count.\n\nLink: https://patch.msgid.link/20260512135420.99194-1-devnexen@gmail.com\nFixes: 34e5b958bdad (\"tracing: Introduce simple_ring_buffer\")\nReviewed-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nAssisted-by: Claude:claude-opus-4-7\nSigned-off-by: David Carlier \u003cdevnexen@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "a494d3c8d5392bcdff83c2a593df0c160ff9f322", "tree": "7ab498e9963e62f26cf1b0abda460b250ed5691b", "parents": [ "a254b6d13b0edd6272926674d2afc46d46e496b7" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Thu Apr 30 12:28:16 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu May 21 08:20:58 2026 -0400" }, "message": "ring-buffer: Flush and stop persistent ring buffer on panic\n\nOn real hardware, panic and machine reboot may not flush hardware cache\nto memory. This means the persistent ring buffer, which relies on a\ncoherent state of memory, may not have its events written to the buffer\nand they may be lost. Moreover, there may be inconsistency with the\ncounters which are used for validation of the integrity of the\npersistent ring buffer which may cause all data to be discarded.\n\nTo avoid this issue, stop recording of the ring buffer on panic and\nflush the cache of the ring buffer\u0027s memory.\n\nFixes: e645535a954a (\"tracing: Add option to use memmapped memory for trace boot instance\")\nCc: stable@vger.kernel.org\nCc: Will Deacon \u003cwill@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Ian Rogers \u003cirogers@google.com\u003e\nLink: https://patch.msgid.link/177751969602.2136606.12031934362587643488.stgit@mhiramat.tok.corp.google.com\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nAcked-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nAcked-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "a254b6d13b0edd6272926674d2afc46d46e496b7", "tree": "bd016cedee60ee7e0514227c46e5360868d4d960", "parents": [ "5200f5f493f79f14bbdc349e402a40dfb32f23c8" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Wed May 20 22:08:01 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu May 21 08:20:29 2026 -0400" }, "message": "ring-buffer: Fix reporting of missed events in iterator\n\nWhen tracing is active while reading the trace file, if the iterator\nreading the buffer detects that the writer has passed the iterator head,\nit will reset and set a \"missed events\" flag. This flag is passed to the\noutput processing to show the user that events were missed:\n\n CPU:4 [LOST EVENTS]\n\nThe problem is that the flag is reset after it is checked in\nring_buffer_iter_dropped(). But the \"trace\" file iterates over all the CPU\nring buffers and it will check if they are dropped when figuring out which\nbuffer to print next. This prematurely clears the missed_events flag if\nthe CPU buffer with the missed events is not the one that is printed next.\n\nOn the iteration where the CPU buffer with the missed events is printed,\nthe check if it had missed events would return false and the output does\nnot show that events were missed.\n\nDo not reset the missed_events flag when checking if there were missed\nevents, but instead clear it when moving the iterator head to the next\nevent.\n\nCc: stable@vger.kernel.org\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nLink: https://patch.msgid.link/20260520220801.4fd09d13@fedora\nFixes: c9b7a4a72ff64 (\"ring-buffer/tracing: Have iterator acknowledge dropped events\")\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "94e3dd6874bf04d5939bc8431b9f7852f3a4a121", "tree": "76b5f9b8ef84ca3225cc992d2a647342554d9e4f", "parents": [ "0377bd2722c1891754cde2bc41de21bc34c50d6c", "c6087c5aaad6d1b8be1a1a641e0a422218ade911" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:14:04 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:14:04 2026 +0200" }, "message": "Merge branch \u0027vsock-virtio-fix-skb-overhead-accounting-to-preserve-full-buf_alloc\u0027\n\nStefano Garzarella says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nvsock/virtio: fix skb overhead accounting to preserve full buf_alloc\n\nPatch 1 resets the connection when we can no longer queue packets,\nthis prevents silent data loss, and both peers are notified.\n\nPatch 2 increases the total budget to `buf_alloc * 2` for payload\nplus skb overhead similar to how SO_RCVBUF is doubled to reserve\nspace for sk_buff metadata. This preserves the full buf_alloc for\npayload under normal operation, while still bounding the skb queue\ngrowth.\n\nIn the future, we plan to improve how we handle the merging of packets\nto minimize overhead and avoid closing connections.\n\nv3: https://lore.kernel.org/netdev/20260513105417.56761-1-sgarzare@redhat.com/\nv2: https://lore.kernel.org/netdev/20260512080737.36787-1-sgarzare@redhat.com/\nv1: https://lore.kernel.org/netdev/20260508092330.69690-1-sgarzare@redhat.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260518090656.134588-1-sgarzare@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c6087c5aaad6d1b8be1a1a641e0a422218ade911", "tree": "76b5f9b8ef84ca3225cc992d2a647342554d9e4f", "parents": [ "a4f0b001782b21663d10df983b4b208195bec66c" ], "author": { "name": "Stefano Garzarella", "email": "sgarzare@redhat.com", "time": "Mon May 18 11:06:56 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:14:01 2026 +0200" }, "message": "vsock/virtio: fix skb overhead accounting to preserve full buf_alloc\n\nAfter commit 059b7dbd20a6 (\"vsock/virtio: fix potential unbounded skb\nqueue\"), virtio_transport_inc_rx_pkt() subtracts per-skb overhead from\nbuf_alloc when checking whether a new packet fits. This reduces the\neffective receive buffer below what the user configured via\nSO_VM_SOCKETS_BUFFER_SIZE, causing legitimate data packets to be\nsilently dropped and applications that rely on the full buffer size\nto deadlock.\n\nAlso, the reduced space is not communicated to the remote peer, so\nits credit calculation accounts more credit than the receiver will\nactually accept, causing data loss (there is no retransmission).\n\nWith this approach we currently have failures in\ntools/testing/vsock/vsock_test.c. Test 18 sometimes fails, while\ntest 22 always fails in this way:\n 18 - SOCK_STREAM MSG_ZEROCOPY...hash mismatch\n\n 22 - SOCK_STREAM virtio credit update + SO_RCVLOWAT...send failed:\n Resource temporarily unavailable\n\nFix by allowing at most `buf_alloc * 2` as the total budget for payload\nplus skb overhead in virtio_transport_inc_rx_pkt(), similar to how\nSO_RCVBUF is doubled to reserve space for sk_buff metadata.\nThis preserves the full buf_alloc for payload under normal operation,\nwhile still bounding the skb queue growth.\n\nWith this patch, all tests in tools/testing/vsock/vsock_test.c are\nnow passing again.\n\nFixes: 059b7dbd20a6 (\"vsock/virtio: fix potential unbounded skb queue\")\nCc: stable@vger.kernel.org\nSigned-off-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nLink: https://patch.msgid.link/20260518090656.134588-3-sgarzare@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "a4f0b001782b21663d10df983b4b208195bec66c", "tree": "3afb04bd6efd90546eb00a55e77a88f4f5961838", "parents": [ "0377bd2722c1891754cde2bc41de21bc34c50d6c" ], "author": { "name": "Stefano Garzarella", "email": "sgarzare@redhat.com", "time": "Mon May 18 11:06:55 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:14:01 2026 +0200" }, "message": "vsock/virtio: reset connection on receiving queue overflow\n\nWhen there is no more space to queue an incoming packet, the packet is\nsilently dropped. This causes data loss without any notification to\neither peer, since there is no retransmission.\n\nUnder normal circumstances, this should never happen. However, it could\nhappen if the other peer doesn\u0027t respect the credit, or if the skb\noverhead, which we recently began to take into account with commit\n059b7dbd20a6 (\"vsock/virtio: fix potential unbounded skb queue\"),\nis too high.\n\nFix this by resetting the connection and setting the local socket error\nto ENOBUFS when virtio_transport_recv_enqueue() can no longer queue a\npacket, so both peers are explicitly notified of the failure rather than\nsilently losing data.\n\nFixes: ae6fcfbf5f03 (\"vsock/virtio: discard packets if credit is not respected\")\nCc: stable@vger.kernel.org\nSigned-off-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nLink: https://patch.msgid.link/20260518090656.134588-2-sgarzare@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "73366893d1d58d247bef70406280f71030495424", "tree": "b9c76edd11ffad64c74edb05a444643a40022473", "parents": [ "33fb2e2bc7a43c79f02dad79c39ff04ae6dc224f", "beb0e54f3806cf01a24740b23ec01c4fab186b5c" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:04:44 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:04:45 2026 +0200" }, "message": "Merge branch \u0027add-preliminary-netc-switch-support-for-i-mx94\u0027\n\nWei Fang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nAdd preliminary NETC switch support for i.MX94\n\ni.MX94 NETC (v4.3) integrates 802.1Q Ethernet switch functionality, the\nswitch provides advanced QoS with 8 traffic classes and a full range of\nTSN standards capabilities. It has 3 user ports and 1 CPU port, and the\nCPU port is connected to an internal ENETC through the pseduo link, so\ninstead of a back-to-back MAC, the lightweight \"pseudo MAC\" is used at\nboth ends of the pseudo link to transfer Ethernet frames. The pseudo\nlink provides a zero-copy interface (no serialization delay) and lower\npower (less logic and memory).\n\nLike most Ethernet switches, the NETC switch also supports a proprietary\nswitch tag, is used to carry in-band metadata information about frames.\nThis in-band metadata information can include the source port from which\nthe frame was received, what was the reason why this frame got forwarded\nto the entity, and for the entity to indicate the precise destination\nport of a frame. The NETC switch tag is added to frames after the source\nMAC address. There are three types of switch tags, and each type has 1\nto 4 subtypes, more details are as follows.\n\nForward switch tag (Type \u003d 0): Represents forwarded frames.\n - SubType \u003d 0 - Normal frame processing.\n\nTo_Port switch tag (Type \u003d 1): Represents frames that are to be sent to\na specific switch port.\n - SubType \u003d 0. No request to perform timestamping.\n - SubType \u003d 1. Request to perform one-step timestamping.\n - SubType \u003d 2. Request to perform two-step timestamping.\n - SubType \u003d 3. Request to perform both one-step timestamping and\n two-step timestamping.\n\nTo_Host switch tag (Type \u003d 2): Represents frames redirected or copied to\nthe switch management port.\n - SubType \u003d 0. Received frames redirected or copied to the switch\n management port.\n - SubType \u003d 1. Received frames redirected or copied to the switch\n management port with captured timestamp at the switch port where\n the frame was received.\n - SubType \u003d 2. Transmit timestamp response (two-step timestamping).\n\nCurrently, this patch set supports Forward tag, SubType 0 of To_Port tag\nand SubType 0 of To_Host tag. More tags will be supported in the future.\n\nIn addition, the switch supports NETC Table Management Protocol (NTMP),\nsome switch functionality is controlled using control messages sent to\nthe hardware using BD ring interface with 32B descriptors similar to the\npacket Transmit BD ring used on ENETC. This interface is referred to as\nthe command BD ring. This is used to configure functionality where the\nunderlying resources may be shared between different entities or being\ntoo large to configure using direct registers.\n\nFor this patch set, we have supported the following tables through the\ncommand BD ring interface.\n\nFDB Table: It contains forwarding and/or filtering information about MAC\naddresses. The FDB table is used for MAC learning lookups and MAC\nforwarding lookups.\n\nVLAN Filter Table: It contains configuration and control information for\neach VLAN configured on the switch.\n\nBuffer Pool Table: It contains buffer pool configuration and operational\ninformation. Each entry corresponds to a buffer pool. Currently, we use\nthis table to implement flow control feature on each port.\n\nIngress Port Filter Table: It contains a set of filters each capable of\nclassifying incoming traffic using a mix of L2, L3, and L4 parsed and\narbitrary field data. We use this table to implement host flood support\nto the switch port.\n\nThe switch also supports other tables, and we will add more advanced\nfeatures through them in the future.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260518082506.1318236-1-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "beb0e54f3806cf01a24740b23ec01c4fab186b5c", "tree": "b9c76edd11ffad64c74edb05a444643a40022473", "parents": [ "25049d8b6e6b87f7ffcf53ce5ea1b51528b8677f" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon May 18 16:25:06 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:04:42 2026 +0200" }, "message": "net: dsa: netc: add support for ethtool private statistics\n\nImplement the ethtool private statistics interface to expose additional\nport-level and MAC-level counters that are not covered by the standard\nIEEE 802.3 statistics. The pMAC counters are only reported when the port\nsupports Frame Preemption (802.1Qbu/802.3br).\n\nNote that although rtnl_link_stats64 provides some standard statistics\nsuch as rx octets, rx frame errors, rx dropped packets, and tx packets,\nthese are overall port statistics. The NETC switch supports preemption\non each port, and each port has two MACs (eMAC and pMAC). The driver\nprivate statistics are used to obtain statistics for each MAC, allowing\nusers to perform analysis and debugging.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260518082506.1318236-16-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "25049d8b6e6b87f7ffcf53ce5ea1b51528b8677f", "tree": "74db2bcbc654858d4c2fb81ff7b721529444104e", "parents": [ "a5ccb7f5e067eae23707a61e4fc5d6214b0e4777" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon May 18 16:25:05 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:04:42 2026 +0200" }, "message": "net: dsa: netc: add support for the standardized counters\n\nEach user port of the NETC switch supports 802.3 basic and mandatory\nmanaged objects statistic counters and IETF Management Information\nDatabase (MIB) package (RFC2665) and Remote Network Monitoring (RMON)\ncounters. And all of these counters are 64-bit registers. In addition,\nsome user ports support preemption, so these ports have two MACs, MAC\n0 is the express MAC (eMAC), MAC 1 is the preemptible MAC (pMAC). So\nfor ports that support preemption, the statistics are the sum of the\npMAC and eMAC statistics.\n\nNote that the current switch driver does not support preemption, all\nframes are sent and received via the eMAC by default. The statistics\nread from the pMAC should be zero.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260518082506.1318236-15-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "a5ccb7f5e067eae23707a61e4fc5d6214b0e4777", "tree": "392e59e12e91e7555a48578ace677b376ef03e3f", "parents": [ "46d6407692c80b258ecba3af831130a6f6e2feea" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon May 18 16:25:04 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:04:42 2026 +0200" }, "message": "net: dsa: netc: initialize buffer pool table and implement flow-control\n\nThe buffer pool is a quantity of memory available for buffering a group\nof flows (e.g. frames having the same priority, frames received from the\nsame port), while waiting to be transmitted on a port. The buffer pool\ntracks internal memory consumption with upper bound limits and optionally\na non-shared portion when associated with a shared buffer pool. Currently\nthe shared buffer pool is not supported, it will be added in the future.\n\nFor i.MX94, the switch has 4 ports and 8 buffer pools, so each port is\nallocated two buffer pools. For frames with priorities of 0 to 3, they\nwill be mapped to the first buffer pool; For frames with priorities of\n4 to 7, they will be mapped to the second buffer pool. Each buffer pool\nhas a flow control on threshold and a flow control off threshold. By\nsetting these threshold, add the flow control support to each port.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260518082506.1318236-14-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "46d6407692c80b258ecba3af831130a6f6e2feea", "tree": "3fb58f69ef915b5699ccb2304bcf121dfa940498", "parents": [ "bbe97e34721984b5d58ad343f0e6c3441d9c8c4a" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon May 18 16:25:03 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:04:42 2026 +0200" }, "message": "net: dsa: netc: add FDB, STP, MTU, port setup and host flooding support\n\nExpand the NETC switch driver with several foundational features:\n- FDB and MDB management\n- STP state handling\n- MTU configuration\n- Port setup/teardown\n- Host flooding support\n\nAt this stage, the driver operates only in standalone port mode. Each\nport uses VLAN 0 as its PVID, meaning ingress frames are internally\nassigned VID 0 regardless of whether they arrive tagged or untagged.\nNote that this does not inject a VLAN 0 header into the frame, the VID\nis used purely for subsequent VLAN processing within the switch.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260518082506.1318236-13-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "bbe97e34721984b5d58ad343f0e6c3441d9c8c4a", "tree": "fa463dc47494975528010a05cf20405ba252ae19", "parents": [ "187fbae024c8439533d7f075f4ab4b594dc19992" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon May 18 16:25:02 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:04:42 2026 +0200" }, "message": "net: dsa: netc: add phylink MAC operations\n\nDifferent versions of NETC switches have different numbers of ports and\nMAC capabilities. Add .phylink_get_caps() to struct netc_switch_info,\nallowing each NETC switch version to implement its own callback for\nobtaining MAC capabilities.\n\nImplement the phylink_mac_ops callbacks: .mac_config(), .mac_link_up(),\nand .mac_link_down(). Note that flow-control configuration is not yet\nsupported in .mac_link_up(), but will be implemented in a subsequent\npatch.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260518082506.1318236-12-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "187fbae024c8439533d7f075f4ab4b594dc19992", "tree": "e321ac024bddb5ae155be439cdbf1b10a705ffb0", "parents": [ "0850005c26d2623f3d77489cf27d342191a97b5c" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon May 18 16:25:01 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:04:42 2026 +0200" }, "message": "net: dsa: netc: introduce NXP NETC switch driver for i.MX94\n\nFor i.MX94 series, the NETC IP provides full 802.1Q Ethernet switch\nfunctionality, advanced QoS with 8 traffic classes, and a full range of\nTSN standards capabilities. The switch has 3 user ports and 1 CPU port,\nthe CPU port is connected to an internal ENETC. Since the switch and the\ninternal ENETC are fully integrated within the NETC IP, no back-to-back\nMAC connection is required. Instead, a light-weight \"pseudo MAC\" is used\nbetween the switch and the ENETC. This translates to lower power (less\nlogic and memory) and lower delay (as there is no serialization delay\nacross this link).\n\nIntroduce the initial NETC switch driver with basic probe and remove\nfunctionality. More features will be added in subsequent patches.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260518082506.1318236-11-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "0850005c26d2623f3d77489cf27d342191a97b5c", "tree": "56f859c6663b205f06afa20ba40c067f20fca6ad", "parents": [ "c5aed83ddc5328b55eabeee7568bbcf40985d5ed" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon May 18 16:25:00 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:04:42 2026 +0200" }, "message": "net: dsa: add NETC switch tag support\n\nThe NXP NETC switch tag is a proprietary header added to frames after the\nsource MAC address. The switch tag has 3 types, and each type has 1 ~ 4\nsubtypes, the details are as follows.\n\nForward NXP switch tag (Type\u003d0): Represents forwarded frames.\n - SubType \u003d 0 - Normal frame processing.\n\nTo_Port NXP switch tag (Type\u003d1): Represents frames that are to be sent\nto a specific switch port.\n - SubType \u003d 0. No request to perform timestamping.\n - SubType \u003d 1. Request to perform one-step timestamping.\n - SubType \u003d 2. Request to perform two-step timestamping.\n - SubType \u003d 3. Request to perform both one-step timestamping and\n two-step timestamping.\n\nTo_Host NXP switch tag (Type\u003d2): Represents frames redirected or copied\nto the switch management port.\n - SubType \u003d 0. Received frames redirected or copied to the switch\n management port.\n - SubType \u003d 1. Received frames redirected or copied to the switch\n management port with captured timestamp at the switch port where\n the frame was received.\n - SubType \u003d 2. Transmit timestamp response (two-step timestamping).\n\nIn addition, the length of different type switch tag is different, the\nminimum length is 6 bytes, the maximum length is 14 bytes. Currently,\nForward tag, SubType 0 of To_Port tag and Subtype 0 of To_Host tag are\nsupported. More tags will be supported in the future.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260518082506.1318236-10-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c5aed83ddc5328b55eabeee7568bbcf40985d5ed", "tree": "a06b1b32c82edf0126a257cf8cdd5e5cb378c64e", "parents": [ "123db6a2751144f3e86cb029ebac4ef4777a5507" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon May 18 16:24:59 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:04:42 2026 +0200" }, "message": "net: enetc: add multiple command BD rings support\n\nAll the tables of NETC switch are managed through the command BD ring,\nbut unlike ENETC, the switch has two command BD rings, if the current\nring is busy, the switch driver can switch to another ring to manage\nthe table. Currently, the NTMP driver does not support multiple rings.\nTherefore, update ntmp_select_and_lock_cbdr() to select a appropriate\nring to execute the command for the switch.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260518082506.1318236-9-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "123db6a2751144f3e86cb029ebac4ef4777a5507", "tree": "b0766880237b2df84f51003b2016da0cb650427d", "parents": [ "cb4d95d79d85e9614a701041100b5012bf595b44" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon May 18 16:24:58 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:04:42 2026 +0200" }, "message": "net: enetc: add support for \"Add\" and \"Delete\" operations to IPFT\n\nThe ingress port filter table (IPFT )contains a set of filters each\ncapable of classifying incoming traffic using a mix of L2, L3, and L4\nparsed and arbitrary field data. As a result of a filter match, several\nactions can be specified such as on whether to deny or allow a frame,\noverriding internal QoS attributes associated with the frame and setting\nparameters for the subsequent frame processing functions, such as stream\nidentification, policing, ingress mirroring. Each entry corresponds to a\nfilter. The ingress port filter entries are added using a precedence\nvalue. If a frame matches multiple entries, the entry with the higher\nprecedence is used. Currently, this patch only adds \"Add\" and \"Delete\"\noperations to the ingress port filter table. These two interfaces will\nbe used by both ENETC driver and NETC switch driver.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260518082506.1318236-8-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "cb4d95d79d85e9614a701041100b5012bf595b44", "tree": "9e71a59b7d0c3cc49c3bbb50206b0206a760e6f9", "parents": [ "d0ac4d4bd299f5948be6a0a65e5f1b360fdfb686" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon May 18 16:24:57 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:04:41 2026 +0200" }, "message": "net: enetc: add support for the \"Update\" operation to buffer pool table\n\nThe buffer pool table contains buffer pool configuration and operational\ninformation. Each entry corresponds to a buffer pool. The Entry ID value\nrepresents the buffer pool ID to access.\n\nThe buffer pool table is a static bounded index table, buffer pools are\nalways present and enabled. It only supports Update and Query operations,\nThis patch only adds ntmp_bpt_update_entry() helper to support updating\nthe specified entry of the buffer pool table. Query action to the table\nwill be added in the future.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260518082506.1318236-7-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d0ac4d4bd299f5948be6a0a65e5f1b360fdfb686", "tree": "aa7bfcc8bc3796649c636f26e8fb001a5353b66d", "parents": [ "4566269803ff284010550263299647f1bf9b01d5" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon May 18 16:24:56 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 21 13:04:41 2026 +0200" }, "message": "net: enetc: add support for the \"Add\" operation to VLAN filter table\n\nThe VLAN filter table contains configuration and control information for\neach VLAN configured on the switch. Each VLAN entry includes the VLAN\nport membership, which FID to use in the FDB lookup, which spanning tree\ngroup to use, the egress frame modification actions to apply to a frame\nexiting form this VLAN, and various configuration and control parameters\nfor this VLAN.\n\nThe VLAN filter table can only be managed by the command BD ring using\ntable management protocol version 2.0. The table supports Add, Delete,\nUpdate and Query operations. And the table supports 3 access methods:\nEntry ID, Exact Match Key Element and Search. But currently we only add\nthe ntmp_vft_add_entry() helper to support the upcoming switch driver to\nadd an entry to the VLAN filter table. Other interfaces will be added in\nthe future.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260518082506.1318236-6-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" } ], "next": "4566269803ff284010550263299647f1bf9b01d5" }