summaryrefslogtreecommitdiff
path: root/drivers/net/ethernet/marvell
AgeCommit message (Collapse)Author
27 hoursocteontx2-af: fix inner LC ltype match for RSS flowkeyKiran Kumar K
Inner LC ltypes differ from outer LC ltypes, but RSS flowkey programming was using outer LC IP/IP6 ltype masks for inner IP keys. For inner IPv4/IPv6, match only the base IP ltype and do not include extension-header matches. Keep existing outer LC masks unchanged. This fixes inner-tunnel RSS key calculation and prevents mismatches in inner IP flow classification. Signed-off-by: kmahammadraf <kmahammadraf@marvell.com> Signed-off-by: Kiran Kumar K <kirankumark@marvell.com> Signed-off-by: Dave Miller <davem@davem-thinkpadp1gen8.ibmlond.csb>
7 daysMerge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netPaolo Abeni
Merge in late fixes in preparation for the net-next PR. Conflicts: net/netfilter/nf_conntrack_netlink.c cd37ab22a74e0 ("netfilter: nf_conntrack_netlink: fix inverted IPv6 tuple filter") 1ae2d094b0200 ("netfilter: ctnetlink: fix inverted IPv6 address match in dump filter") Adjacent changes: drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c 8830e65ed46de ("net: use assign_bit() where applicable") 07bd391eb957 ("octeontx2-af: Fix CQ enable state tracking after AQ writes") net/core/sock.c 31c5ea8a3296 ("ipv6: Remove IPV6_ADDRFORM.") 31b564f70d88 ("net: use the full socket in sk_mc_loop()") net/mptcp/protocol.h 0cb6910130a3 ("mptcp: remove thmac from subflow ctx") 7538fa33bb2f ("mptcp: fix subflow bitfield misuse") Signed-off-by: Paolo Abeni <pabeni@redhat.com>
9 daysocteontx2: Fix use-after-free of qos node in delete pathBinbin Deng
hash_del_rcu() only unlinks the node; a reader that already holds the bucket iterator still uses the node. The immediate kfree() has no grace period, so a concurrent transmit on a socket whose skb priority carries the deleted classid reads node->classid / node->qid from freed memory (use-after-free in the softirq transmit path). Fix this by calling synchronize_net() before the node is freed, as mlx5e does. Found during a static-analysis-assisted audit: candidate sites were surfaced by a Coccinelle rule, and the reader/writer paths were confirmed by LLM-assisted (GLM-5.3) code inspection. The issue was not observed at runtime; it is identified by code inspection only. Fixes: 5e6808b4c68d ("octeontx2-pf: Add support for HTB offload") Signed-off-by: Binbin Deng <18983559317@163.com> Reviewed-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20261014064204.291688-1-18983559317@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
9 daysnet: rename skb_unshare() to skb_unclone_full()Nicolai Buchwitz
skb_unshare() only copies cloned skbs. A shared skb that is not a clone comes back unchanged, which the name doesn't suggest. The loopback selftest hooks got caught by this and hit BUG_ON(skb_shared()). Rename it to skb_unclone_full(). Like skb_unclone() it only acts on clones, but it copies the whole skb, not just the head. Suggested-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de> Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com> # dpaa2 Link: https://patch.msgid.link/20261015-nb-skb-unclone-full-v1-1-0dfbf01f60f2@tipi-net.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
9 daysnet: skbuff: replace skb_page_unref() and __skb_frag_unref() with ↵Mina Almasry
skb_netmem_unref() Unreferencing a page_pool fragment with recycle=false decrements the non-pp backing refcount instead of pp_ref_count, underflowing the page refcount when the fragment was owned via page_pool (as on mlx4's RX error path). Having both skb_page_unref() and __skb_frag_unref(frag, recycle) made it easy for callers to pass hardcoded recycle=false on SKB-owned fragments. Replace skb_page_unref() and __skb_frag_unref() with skb_netmem_unref(netmem, recycle), which dispatches to napi_pp_put_page() when recycle is true and put_netmem() otherwise: - Use skb_frag_unref(skb, ...) on SKB-owned fragments in mlx4, sky2, tls_strp, and skb_shift() so unrefs always match skb->pp_recycle. - Use put_netmem() directly in tls_device's destroy_record(), which releases raw non-pp page references outside an SKB. Found by code inspection and confirmed with the KUnit tests added later in this series; not observed in production. The mlx4, sky2, and TLS call-site changes are compile-tested only. Assisted-by: LLM Signed-off-by: Mina Almasry <almasrymina@google.com> Link: https://patch.msgid.link/20261014173945.373295-4-almasrymina@google.com Acked-by: Stanislav Fomichev <sdf@fomichev.me> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
10 daysocteontx2-af: Fix CQ enable state tracking after AQ writesAlok Tiwari
Use the CQ context's ena field when updating the CQ enable bitmap. The current code reads rq.ena, which overlaps bit 0 of the CQ base address and can leave the bitmap out of sync with the hardware context. This can cause enabled CQs to be skipped during teardown. Use sq.ena for the SQ bitmap update as well, so each queue type reads its own context. Fixes: 557dd485eaeb ("octeontx2-af: Support for disabling NIX RQ/SQ/CQ contexts") Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Reviewed-by: Ratheesh Kannoth <rkannoth@marvell.com> Reviewed-by: Sunil Goutham <sgoutham@marvell.com> Link: https://patch.msgid.link/20261011125508.534618-1-alok.a.tiwari@oracle.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
14 daysMerge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc8). No conflicts. Adjacent changes: drivers/net/ethernet/microchip/lan865x/lan865x.c 2a3f6d2a9ac3 ("microchip: lan865x: move setting of netops to fix crash") 15358c2c3dca ("net: ethernet: oa_tc6: return ERR_PTR from oa_tc6_init()") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-15net: mv643xx: move setting of netops to fix crashDavid Yang
mv643xx_eth_probe() connects the PHY before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops through netdev_need_ops_lock() since the commit in question, so probing crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled. Assign netdev_ops before the PHY attach, as was done for emac in commit 7c9f391ec89c ("net: emac: move setting of netops to fix crash"). Fixes: ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev() locking assertion") Signed-off-by: David Yang <mmyangfl@gmail.com> Reviewed-by: Daniel Machon <daniel.machon@microchip.com> Link: https://patch.msgid.link/20261008022656.3592191-6-mmyangfl@gmail.com Reviewed-by: Jijie Shao <shaojijie@huawei.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-10-08octeontx2: use arch_extension to enable LSEEmanuele Rocca
Instead of using ".cpu generic+lse", use ".arch_extension lse" to enable LSE. The ".cpu generic+lse" directive replaces the assembler's current feature set with generic+lse, dropping other previously enabled features. In contrast, ".arch_extension lse" enables LSE while preserving the current feature set. For example, the following code is rejected with "selected processor does not support retaa", because ".cpu generic+lse" drops PAuth even though it was enabled by armv9-a: .arch armv9-a .text .cpu generic+lse retaa We encountered this issue while building the kernel with GCC configured using --with-arch=armv9-a. Since Armv9-A includes pointer authentication, GCC can assume that PAuth instructions are available and may use retaa when generating PAuth-protected returns. Signed-off-by: Emanuele Rocca <emanuele.rocca@arm.com> Link: https://patch.msgid.link/20261005162137.71397-1-emanuele.rocca@arm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-07ipv4: Use ipv4_neigh_lookup() and friends.Kuniyuki Iwashima
It is error-prone to require callers to fetch netns and neigh_table and pass it with dev to neigh_lookup(), etc. Let's replace neigh_lookup() and friends with IPv4 helpers. Note that __neigh_lookup(create=false) is replaced with ipv4_neigh_lookup() and __neigh_lookup(create=true) and __neigh_lookup_errno() are split into ipv4_neigh_lookup() and ipv4_neigh_create(). Fixes: 2430df635a59 ("ipv4: Replace &arp_tbl with arp_table(net).") Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20261003212336.1304988-8-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-01net: octeontx2-af: quiesce devlink health work on teardownHongyan Xu
NPA and NIX interrupt handlers queue health-reporting work whose containers are freed by rvu_health_reporters_destroy(). Interrupt unregistration does not drain queued work. In addition, each reporter setup creates a workqueue in the same field, leaking the NPA queue and leaving no teardown handle for work queued on it. Initialize work before later allocations can fail, share one workqueue, unregister each set of interrupts, and cancel its work before freeing the reporters. Destroy the shared workqueue once both reporter sets are gone. Cc: stable+noautosel@kernel.org # untested fix for a driver (de)init path race Signed-off-by: Hongyan Xu <getshell@seu.edu.cn> Link: https://patch.msgid.link/20260928134129.145-1-getshell@seu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-01Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc6). Conflicts: net/mac80211/tx.c net/mac80211/ieee80211_i.h 8effab902fa34 ("wifi: mac80211: prevent AP VLAN tx from other interfaces") 78b843974fb83 ("wifi: mac80211: report multicast transmission from lookup_ra_sta()") https://lore.kernel.org/arJmcuhpJ69wAvYK@sirena.co.uk drivers/net/ethernet/realtek/r8169_main.c 3cdeaef1754ab ("r8169: disable EEE on RTL8168h/8111h") 8a3c76523e449 ("r8169: add support for phylink") https://lore.kernel.org/ar5vAxEqS8tO8aVT@sirena.org.uk Adjacent changes: rust/kernel/net/netlink.rs 5e5916923759 ("rust: net: netlink: Migrate to zerocopy's IntoBytes") 0923198be4ae ("rust: net: netlink: validate attribute length before casting to `c_int`") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-30net: mvneta: clear XDP pfmemalloc flag between framesLorenzo Bianconi
mvneta_swbm_add_rx_fragment() sets XDP_FLAGS_FRAGS_PF_MEMALLOC on the xdp_buff when a fragment page is a pfmemalloc one (page under memory pressure). The xdp_buff is reused for the next frame, but only the XDP_FLAGS_HAS_FRAGS bit was cleared at frame start, so the pfmemalloc bit leaked from one frame into the following ones. mvneta_swbm_build_skb() propagates the flag to skb->pfmemalloc through xdp_update_skb_frags_info(), so the skb of a subsequent fragmented frame could be wrongly marked as pfmemalloc even if none of its pages are under pressure. Clear all the xdp_buff flags in mvneta_swbm_rx_frame(), which is invoked for each new frame, instead of just the XDP_FLAGS_HAS_FRAGS bit. Fixes: ed7a58cb40bd ("net: marvell: rely on xdp_update_skb_shared_info utility routine") Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com> Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com> Link: https://patch.msgid.link/20260929-mvneta-xdp-clear-frag-fix-v4-1-1e63b25eeed8@oss.qualcomm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-30octeontx2-pf: Fix RSS indirection table sizeJari Seppälä
The conversion to the dedicated RSS context operations replaced the pointer to struct otx2_rss_ctx with an inline u32 ind_tbl[] array. However, otx2_rss_init() still uses sizeof(*rss->ind_tbl) to set rss_size. This now yields the size of one u32 (4), rather than the 256 entries in the indirection table. The RSS initialization and hardware programming loops use rss_size, so only four entries are initialized and programmed despite the NIX LF being allocated a 256-entry table. On an OCTEON CN102 with eight RX queues, the table contained 0, 1, 2, 3 followed by zeros. Traffic was concentrated on queue 0 and ethtool -X equal 8 did not correct the table. Use ARRAY_SIZE() to count the indirection table entries. On the same hardware, this restores the full table repeating queue numbers 0 through 7, and bidirectional multi-flow traffic increments multiple RX queues. Runtime testing on an Asterfusion ET2500 (OCTEON CN102 A0). Fixes: 62e01d8c4170 ("eth: otx2: migrate to the *_rxfh_context ops") Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/netdev/361df563-e29e-43bf-8806-24bdfefed33d@nocloud.org/ Signed-off-by: Jari Seppälä <jase@nocloud.org> Reviewed-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260928084711.2462571-1-jase@nocloud.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-29octeontx2: remove unneeded symbol exportsJakub Kicinski
octeontx2 has a bunch of symbols not used outside the module which defines them. Worse, still the macro which defines otx2_mbox_up_handler_* adds exports for all the functions. Remove all the explicit exports and the auto-export from that macro. otx2_mbox_up_handler_cgx_link_event was exported by the macro and is genuienly called from the VF driver, so add an export. Link: https://lore.kernel.org/arYYTw8l90VNnKal@infradead.org Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260925201042.1174488-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-28octeontx2-af: mcs: Fix SC resource cleanup loopBaha Mesleh
The SC resource cleanup and statistics loops were incorrectly iterating over secy.max instead of sc.max, so the highest SC id could be left allocated across teardown or FLR. Use sc.max as the loop bound. Fixes: cfc14181d497 ("octeontx2-af: cn10k: mcs: Manage the MCS block hardware resources") Signed-off-by: Baha Mesleh <baha.mesleh@nokia.com> Signed-off-by: Subrat Pandey <subratp@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260922102149.2078168-3-subratp@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-28octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabledGeetha sowjanya
Previously, BPID assignment under CONFIG_DCB assumed `queue_to_pfc_map` was always initialized. For SDP VFs this leads to invalid memory access as it was not initialized. This patch adds a NULL check for `queue_to_pfc_map` before dereferencing it. Also, simplifies the logic by always assigning a default BPID first, then conditionally overriding it if CONFIG_DCB is enabled and the map exists. Fixes: 184fb40f731b ("octeontx2-pf: Avoid adding dcbnl_ops for LBK and SDP vf") Signed-off-by: Geetha sowjanya <gakula@marvell.com> Signed-off-by: Subrat Pandey <subratp@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260922102149.2078168-2-subratp@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-25octeontx2-af: nix: Log TX scheduler queue validation failuresSubbaraya Sundeep
Emit logs when is_valid_txschq() rejects a scheduler queue mapping so misconfigured TX scheduler allocations are easier to diagnose. Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com> Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260923033500.1752732-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-24Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc5). Conflicts: drivers/net/mdio/mdio-realtek-rtl9300.c 89a8a1eef2d44 ("net: mdio: realtek-rtl9300: fix RTL931x C22 extended page selection") cc3cb8db1eef9 ("net: mdio: realtek-rtl9300: Add page tracking") https://lore.kernel.org/arUZOqy73bE2pp0w@sirena.org.uk net/8021q/vlan_dev.c cd5dd68267c4 ("vlan: ensure sufficient headroom in vlan_dev_hard_header()") ca6ff8dd70eb ("vlan: annotate data-races in vlan_dev_priv fields") Adjacent changes: net/ipv6/ip6_gre.c dd47bcf279f1 ("ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().") cce829e2aa1d ("ip6_gre: Protect ip6gre_net.tunnels[][] with mutex.") drivers/net/ethernet/meta/fbnic/fbnic_txrx.c b5d9e9d4d0c1 ("eth: fbnic: use the Rx queue napi pointer to find the napi vector") c0aca269ec07 ("eth: fbnic: Make Rx completion coalescing configurable") drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c d68acbf93531 ("net: stmmac: selftests: Support running selftests on DSA conduits") 85ca3292d7a3 ("net: stmmac: Remove ARP offload code") drivers/net/ethernet/wangxun/libwx/wx_hw.c 3173cba11701 ("net: libwx: fix races in Tx timestamp handling") 7042c8c193e5 ("net: libwx: rename wx_pf_flags to wx_flags") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-23octeontx2-af: remove duplicate SCTP port flagsAryan Sinha
proto_flags ORs BIT_ULL(NPC_SPORT_SCTP) and BIT_ULL(NPC_DPORT_SCTP) twice. The second pair is redundant and does not change the mask. Drop it. Signed-off-by: Aryan Sinha <sinha.aryan03@gmail.com> Reviewed-by: Geetha sowjanya <gakula@marvell.com> Link: https://patch.msgid.link/20260920122803.6277-1-sinha.aryan03@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-21octeontx2-af: Allocate ikpu2 with ARRAY_SIZE()Kees Cook
In preparation for making the devm_kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.) This is allocating room for a copy of ikpu_action_entries, which is an array of struct npc_kpu_profile_action, but it asked for a single object the size of the whole array, which would make the allocation type a pointer to the array rather than the "struct npc_kpu_profile_action *" being assigned. Allocate ARRAY_SIZE-many entries instead. The resulting allocation size is the same. Build tested ARCH=x86_64 allmodconfig with GCC 16.2.0: drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.o Signed-off-by: Kees Cook <kees+treewide@kernel.org> Reviewed-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260917211409.i.425-kees@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-21net: mvneta: rely on napi_build_skb() in mvneta_swbm_build_skb()Lorenzo Bianconi
mvneta_swbm_build_skb() is only invoked from mvneta_poll(), the NAPI poll routine, so it always runs in NAPI context. Use napi_build_skb() instead of build_skb() to source the skb head from the per-CPU NAPI cache, avoiding a per-packet kmem_cache_alloc() of the skb head. Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260917-mvneta-napi-poll-v1-1-fb57604932d3@oss.qualcomm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-21octeontx2-af: Fix memory scaling limitation in SR-IOV modeRatheesh Kannoth
The original code used DMA_ATTR_FORCE_CONTIGUOUS, which could exhaust the CMA pool when a large number of VFs were requested. Fix this by switching to the DMA streaming API. This is equivalent on Octeon platforms, which provide full I/O coherency via the SMMU. Cc: Leon Romanovsky <leon@kernel.org> Fixes: 73d33dbc0723 ("octeontx2-af: Use DMA_ATTR_FORCE_CONTIGUOUS attribute in DMA alloc") Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Reviewed-by: Leon Romanovsky <leon@kernel.org> Link: https://patch.msgid.link/20260916022111.1083017-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-19net: use assign_bit() where applicablePeng Fan
Convert open-coded if/else with set_bit/clear_bit and their non-atomic __set_bit/__clear_bit variants to the assign_bit/__assign_bit API. Done with Coccinelle semantic patch: // set_bit -> clear_bit => assign_bit @@ expression cond, bit, addr; @@ -if (cond) - set_bit(bit, addr); -else - clear_bit(bit, addr); +assign_bit(bit, addr, cond); // clear_bit -> set_bit => assign_bit @@ expression cond, bit, addr; @@ -if (cond) - clear_bit(bit, addr); -else - set_bit(bit, addr); +assign_bit(bit, addr, !cond); // __set_bit -> __clear_bit => __assign_bit @@ expression cond, bit, addr; @@ -if (cond) - __set_bit(bit, addr); -else - __clear_bit(bit, addr); +__assign_bit(bit, addr, cond); // __clear_bit -> __set_bit => __assign_bit @@ expression cond, bit, addr; @@ -if (cond) - __clear_bit(bit, addr); -else - __set_bit(bit, addr); +__assign_bit(bit, addr, !cond); Signed-off-by: Peng Fan <peng.fan@nxp.com> Reviewed-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260917-net-assign-bit-v1-1-e9c97965e080@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-17octeontx2-af: use seq_file for rsrc_alloc debugfsHeyang Tan
The rsrc_alloc debugfs reader writes rows directly to userspace without respecting the caller's read count. It also uses the current row length as the userspace stride, which can corrupt output when rows have different widths. Use seq_file to handle userspace buffer sizes, offsets, and partial reads, and write output columns directly to the seq_file buffer. Fixes: 23205e6d06d4 ("octeontx2-af: Dump current resource provisioning status") Signed-off-by: Heyang Tan <thy15333007817@163.com> Reviewed-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260914020521.146-1-thy15333007817@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-17Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc4). Conflicts: net/core/neighbour.c 979aabdad8dd0 ("neighbour: Skip default parms when resumed in neightbl_dump_info().") 7b430fcfc972f ("neighbour: Don't render blackhole_netdev via RTM_GETNEIGHTBL.") fae1c59810b86 ("neighbour: Remove unnecessary net_eq().") https://lore.kernel.org/20260911173056.44ec06e0@kernel.org https://lore.kernel.org/aqfbJi7nAX4IbmnR@sirena.co.uk Adjacent changes: net/netlink/af_netlink.c ceac0de741bf ("netlink: do not free nlk->groups while lockless readers can use it") 7c0ec6288b49 ("net: Replace %pK output with 0") net/bridge/br_vlan.c 2842ce397dd0 ("net: bridge: vlan: fix bugs caused by switchdev deletion errors") 5bec8f861114 ("net: bridge: vlan: annotate lockless use of num_vlans") 2b1f8fd3118c ("net: bridge: vlan: annotate lockless vlan flags use") net/bridge/br_mst.c 18a6fe05fb6e ("net: bridge: mst: move switchdev call outside rcu") 120207a08fc0 ("net: bridge: vlan: annotate lockless use of msti") drivers/net/ethernet/stmicro/stmmac/hwif.h 90e4b849dfa6 ("net: stmmac: propagate FPE preemption-class mapping errors") 85ca3292d7a3 ("net: stmmac: Remove ARP offload code") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-17net: mvpp2: prevent buffer overflow in page_pool allocationDmitriy Okunev
The per‑processor buffering scheme is supported only if the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS (8). This is already checked in mvpp2_probe() during the initial activation of percpu_pools. However, mvpp2_change_mtu() may later call mvpp2_bm_switch_buffers(priv, true) without this check, which can lead to an out-of-bounds access in the priv->page_pool array in mvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ entries, and mvpp2_get_nrxqs() may return exactly that value. The per-CPU scheme then doubles it to nrxqs * 2, exceeding the array bounds. Check that the hardware version is MVPP22 or newer and that the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS before switching to per-CPU mode. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 7d04b0b13b11 ("mvpp2: percpu buffers") Signed-off-by: Dmitriy Okunev <dokunevdmitriy@gmail.com> Link: https://patch.msgid.link/20260914091557.71769-1-dokunevdmitriy@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-14octeontx2-af: consolidate RVU AFVF device id definitionsJiangshan Yi
commit f695390ea639 ("octeontx2-af: Fix limiting SRIOV VF count logic") added a local PCI_DEVID_OCTEONTX2_RVU_AFVF define in rvu.c, although the same value was already defined twice elsewhere: as RVU_LBK_VF_DEVID in af/rvu.h and as PCI_DEVID_OCTEONTX2_RVU_AFVF in nic/otx2_common.h. Move the definition into the "PCI device IDs" block in af/rvu.h, rename RVU_LBK_VF_DEVID to match the PCI_DEVID_* naming convention of its peers, and drop the redundant copies in rvu.c and nic/otx2_common.h, the latter already including <rvu.h> through the af include path. No functional change. Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn> Acked-by: Ratheesh Kannoth <rkannoth@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260910104102.590989-1-yijiangshan@kylinos.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-14octeontx2-pf: report port connector type in ethtool link ksettingsHariprasad Kelam
otx2_get_link_ksettings() already reports speed, duplex, autoneg, link modes and FEC from CGX firmware shared data, but never fills cmd->base.port. As a result, ethtool does not show the physical connector type even though firmware provides it in fwdata.port. Read the connector type from shared firmware data and expose it via ethtool. Extract only the low 8 bits of the firmware field and validate the value against the standard ethtool PORT_* definitions before publishing it to userspace. Signed-off-by: Hariprasad Kelam <hkelam@marvell.com> Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260909040621.397255-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-11octeontx2: collapse consecutive blank lines in source filesRatheesh Kannoth
Remove extra blank lines across the octeontx2 driver source. Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2026-09-10Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc3). Conflicts: drivers/net/dsa/mt7530.c 3c18e3c9a54e ("net: dsa: mt7530: populate lpi_interfaces to fix EEE support") 10d9d8328e8a ("net: dsa: mt7530: replace mt7530_read with regmap_read") Adjacent changes: drivers/net/bonding/bond_alb.c 1746ef2e2df2 ("bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()") 4cef95f72bbd ("bonding: fix u32 overflow in compute_gap()") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-10Merge tag 'net-7.3-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Nothing too exciting, usual stream of fixes. Including fixes from Netfilter, Bluetooth and WPAN. Current release - new code bugs: - Bluetooth: hci_sync: fix not setting CE length properly - eth: enic: match mailbox replies to request numbers Previous releases - regressions: - tunnels: drop stale dst when building an ICMP error for PMTUD - ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings() (bug in the rtnl_lock -> RCU conversion) - eth: bnxt_en: - fix crashes on Thor2 due to OOB coalescing buffer accesses - prevent queue stop with deferred completions Previous releases - always broken: - eth: - ice: don't dereference pointers from TP_printk() - fix OOB writes on ethtool flow rule dump in 3 drivers - mlx5: fix FEC configuration with RS_544_514_INTERLEAVED_QUAD - dsa: tag_brcm: legacy FCS: request needed tailroom Misc: - net: cap tx_queue_len at S16_MAX to prevent oversized ring alloc - ipv6: flowlabel: cap duplicate leases per socket" * tag 'net-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (164 commits) selftests: tc-testing: test action batch failure cleanup net/sched: act_api: release all action references on NEWACTION failure openvswitch: fix wrong flag value in get_ipv6_ext_hdrs() ipmr: account multicast table and route memory net: phy: dp83td510: handle the active-high LED polarity mode net: macb: initialize PTP state before registering clock net: hsr: enable promiscuous mode on interlink port with fwd offload ipv6: fix fib6 walker UAF on seq stop net: stmmac: fix TX descriptor availability check for TSO traffic net/rds: fix tcp stream corruption with large pages net: mana: restore the XDP program pointer when pre-allocation fails net: phy: dp83867: handle the active-high LED polarity mode octeontx2-af: fix PF/CGX debugfs PCI bus lookup net: net_failover: Fix the deadlock in net_failover_slave_name_change() net: phy: mediatek-ge: disable EEE on the MT7530 PHY tcp: reject non zerocopy devmem tx net: ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support net: dsa: mt7530: populate lpi_interfaces to fix EEE support net: hinic: fix mailbox segment buffer overflow net: sun4i-emac: fix missing of_node_put() for phy_node ...
2026-09-10net: marvell: fix typos in commentsHemanth Selam
Fix misspellings in comments, found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Comments only, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Ratheesh Kannoth <rkannoth@marvell.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260908052602.27497-8-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-10octeontx2-af: fix PF/CGX debugfs PCI bus lookupRatheesh Kannoth
rvu_dbg_rvu_pf_cgx_map_display() locates each RVU PF PCI device via pci_get_domain_bus_and_slot() when printing the PF-to-CGX map. It assumed PF0 always sits on PCI bus 1 and derived other PF bus numbers as pf + 1, but the AF device can be enumerated on a different bus. Use rvu->pdev->bus->number as the base bus instead, so each PF lookup uses pf + start on systems where RVU functions are on contiguous buses but do not start at bus 1. Fixes: e2fb373038654 ("octeontx2-af: Display CGX, NIX and PF map in debugfs.") Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com> Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260904085114.3385530-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-10Octeontx2-af: Add WQ_PERCPU to alloc_workqueue usersMarco Crivellari
This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. This is also enforced by: commit 21c05ca88a548 ("workqueue: Add warnings and ensure one among WQ_PERCPU or WQ_UNBOUND is present") In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Link: https://patch.msgid.link/20260907094822.121457-1-marco.crivellari@suse.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-09octeontx2-pf: reset HTB scheduler topology before freeing queuesRatheesh Kannoth
HTB offload programs NIX_AF_TLxX_TOPOLOGY on QoS-allocated scheduler queues via otx2_qos_txschq_set_parent_topology(), but teardown freed those queues without clearing TOPOLOGY. The AF only restores PARENT and SCHEDULE on free, so PRIO_ANCHOR/RR_PRIO settings can survive in the shared scheduler pool and affect later allocations. Add otx2_qos_reset_schq_topology() and otx2_qos_free_hw_schq() to zero TL4 through TL2 TOPOLOGY before each schq is returned to the AF during hierarchy teardown and cfg rollback. Skip the aggregation level (TL1): it is a per-tx-link queue shared by the PF, default Tx hierarchy and VFs, and is not freed back to the AF by nix_txschq_free_one(). Fixes: 5e6808b4c68d ("octeontx2-pf: Add support for HTB offload") Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260903020533.3068041-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-08net: mvpp2: simplify IRQ validity checkbui duc phuc
irq_of_parse_and_map() returns 0 when parsing or mapping an IRQ fails. The current condition also checks for negative values, even though irq_of_parse_and_map() does not return negative error codes. Check only for a zero return value to match the semantics of irq_of_parse_and_map(). Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260903075753.346647-1-phucduc.bui@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-08net: marvell: mvmdio: Handle errors from optional IRQ lookupbui duc phuc
platform_get_irq_optional() returns a positive IRQ number on success or a negative error code on failure. For an optional IRQ, -ENXIO indicates that no optional IRQ is available. Other errors should be propagated so that the caller can handle them appropriately. The existing code propagates -EPROBE_DEFER, but ignores other negative errors. Propagate negative errors other than -ENXIO. Found by manual code inspection. Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260903074638.345952-1-phucduc.bui@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-04treewide: refresh kmalloc_obj() conversionsKees Cook
This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook <kees+treewide@kernel.org>
2026-09-04octeontx2-af: Show DMAC filter drop countHariprasad Kelam
Show the number of packets dropped by DMAC filters in the CGX/RPM debugfs mac_filter entry. CGX uses RX_STAT4 for this counter, while RPM/RPM2 use RX_STAT2. Signed-off-by: Hariprasad Kelam <hkelam@marvell.com> Signed-off-by: Nitin Shetty J <nshettyj@marvell.com> Link: https://patch.msgid.link/20260901042503.1182121-1-nshettyj@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-04octeontx2-af: mcs: Clear stale X2P calibration state before calibrationViswajith Murali
Some firmware versions leave MCSX_MIL_GLOBAL bit 5 set on boot. If the bit is already set when the driver attempts X2P calibration, the hardware sees no rising edge and calibration never triggers. Clear the bit and wait briefly before starting calibration to ensure a clean rising edge. Fixes: ca7f49ff8846 ("octeontx2-af: cn10k: Introduce driver for macsec block.") Signed-off-by: Nitin Shetty J <nshettyj@marvell.com> Signed-off-by: Viswajith Murali <viswajithm@marvell.com> Link: https://patch.msgid.link/20260901094318.1395356-1-nshettyj@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-04ipv4: Replace &arp_tbl with arp_table(net).Kuniyuki Iwashima
We will allocate per-netns neigh_table in net->neigh_tables[]. Let's replace &arp_tbl with arp_table(net) and remove extern definition for arp_tbl. Three notes: 1. mlx5e_rep_netevent_event() and nfp_tun_neigh_event_handler() have code assuming neigh_table other than &arp_tbl and &nb_tbl, and the part is removed as it will be false once per-netns table is allocated. 2. prestera and rocker uses init_net because they set dev->netns_immutable to true. 3. mlx5e_tc_update_neigh_used_value() dereferences nhe->neigh_dev in trace_mlx5e_tc_update_neigh_used_value(). Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260902203722.926528-9-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-03Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc2). No conflicts, or adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-03octeon_ep: remove redundant memset in octep_setup_pfvf_mbox()Sang-Heon Jeon
vzalloc() returns zeroed memory, so the memset after the allocation is redundant. No functional change. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn> Link: https://patch.msgid.link/20260901110913.977745-1-ekffu200098@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-03octeontx2-pf: Add NIXLF error and poison interrupt handlersNaveen Mamindlapalli
Register and handle the NIX LF error (NIX_LF_ERR_INT) and poison/RAS (NIX_LF_RAS) interrupt vectors, The handlers acknowledge the interrupt and log the status (ratelimited) to help debug NIX LF faults. Signed-off-by: Nitin Shetty J <nshettyj@marvell.com> Signed-off-by: Naveen Mamindlapalli <naveenm@marvell.com> Link: https://patch.msgid.link/20260831062600.839203-1-nshettyj@marvell.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-03octeontx2: use dev_err_probe() for deferred probeJuuso Rinta
The PF and VF drivers warn and return -EPROBE_DEFER when the AF has not programmed the RVUM revision or does not answer the mailbox READY message. That is expected until rvu_af has finished initializing, so the warning is repeated on every deferred retry. Use dev_err_probe() instead of dev_warn() so the expected deferral is not printed at warning level. -EPROBE_DEFER is logged at debug level and the reason is recorded in devices_deferred. Signed-off-by: Juuso Rinta <juuso.rinta@nokia.com> Acked-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260901-octeontx2-dev-err-probe-v1-1-1b5e1affb994@nokia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-02octeontx2-af: Fix limiting SRIOV VF count logicSunil Goutham
When RVU PF0/AF's VFs are SDP instead of LBK, limiting the VF count based on the LBK channel count is incorrect. Apply LBK channel-based VF limits only when the VF device ID matches the LBK RVU AFVF device. Fixes: 9bd6caf33567 ("octeontx2-af: Enable sriov on AF to create VFs") Signed-off-by: Sunil Goutham <sgoutham@marvell.com> Signed-off-by: Nitin Shetty J <nshettyj@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2026-08-31octeontx2-af: fix CN20K default MCAM rule removal on port cleanupKiran Kumar K
npc_mcam_free_all_entries() disables every MCAM entry mapped to a port before freeing it. On CN20K, that also disables the default broadcast, multicast, promiscuous, and unicast rules, which causes packet drops when all rules are removed per port. Only disable and free non-default entries. Leave CN20K default rules enabled when freeing the remaining port entries. Fixes: 013717353c03 ("octeontx2-af: npc: cn20k: Tear down default MCAM rules explicitly on free") Signed-off-by: Kiran Kumar K <kirankumark@marvell.com> Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2026-08-24octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()Sai Krishna
rvu_mbox_init() is called separately for AF-PF mailboxes during probe and for AF-VF mailboxes when SR-IOV is enabled. Each call used to allocate a new ng_rvu object, leaking the first allocation when the pointer was overwritten on the second call. Sharing one ng_rvu across both paths exposed several teardown bugs: the error path freed all cn20k mailbox DMA and kfree()d ng_rvu even when only the failing init type should be unwound, leaving live AF-PF mailbox memory in use after an AF-VF init failure. mutex_init() was also re-run on the AF-VF path while AF-PF mailbox handlers could still hold rvu->mbox_lock. Probe and SR-IOV failure paths did not release cn20k mailbox DMA either, since cleanup only happened in rvu_remove(). Allocate ng_rvu once with devm_kzalloc(), initialize mbox_lock in the same block, unwind only the mailbox memory for the failing init type, and free cn20k mailbox DMA from the probe and pci_enable_sriov() error paths. Fixes: e53ee4acb220 ("octeontx2-af: CN20k basic mbox operations and structures") Signed-off-by: Sai Krishna <saikrishnag@marvell.com> Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260821102337.2989169-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-24octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setupSuman Ghosh
af_xdp_zc_qidx tracks receive queues using AF_XDP zero-copy and is allocated during PF/VF probe. Representors and other non-AF_XDP paths leave the pointer NULL, but several call sites used test_bit() on it unconditionally. Switching to devlink eswitch mode creates representors and runs otx2_init_hw_resources(), which reaches otx2_pool_aq_init() and oopses when dereferencing the NULL bitmap. Add NULL checks before every af_xdp_zc_qidx test_bit() use in the RSS, ethtool, XSK, and pool init paths. Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support") Signed-off-by: Suman Ghosh <sumang@marvell.com> Signed-off-by: Geetha sowjanya <gakula@marvell.com> Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260821105536.2998765-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>