summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-06perf c2c: Fix use-after-free in he__get_c2c_hists() error pathArnaldo Carvalho de Melo
he__get_c2c_hists() assigns c2c_he->hists before calling c2c_hists__init(). If init fails, the error path calls free(hists) but leaves c2c_he->hists pointing to freed memory. On teardown, c2c_he_free() finds the non-NULL pointer and calls hists__delete_entries() on it, causing a use-after-free. Set c2c_he->hists to NULL before freeing so teardown skips the already-freed allocation. Fixes: b2252ae67b687d2b ("perf c2c report: Decode c2c_stats for hist entries") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Cc: Jiri Olsa <jolsa@kernel.org> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-06perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpuArnaldo Carvalho de Melo
process_cpu_topology() in header.c frees env->cpu on old-format perf.data files that predate topology information, but leaves nr_cpus_avail set. The six perf_env__get_*_aggr_by_cpu() functions in builtin-stat.c pass the bounds check but dereference a NULL env->cpu pointer, crashing on old recordings. Introduce perf_env__get_cpu_topology() as a safe accessor that validates env->cpu, cpu.cpu >= 0, and cpu.cpu < nr_cpus_avail in one place, returning a struct cpu_topology_map pointer or NULL. Convert all six topology aggregation callbacks to use it. Fixes: 88031a0de7d68d13 ("perf stat: Switch to cpu version of cpu_map__get()") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Cc: Ian Rogers <irogers@google.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-06Merge tag 'rust-fixes-7.1-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull Rust fixes from Miguel Ojeda: "Toolchain and infrastructure: - Fix 'rustc-option' (the Makefile one) when cross-compiling that leads to build or boot failures in certain configs - Work around a Rust compiler bug (already fixed for Rust 1.98.0) thats lead to boot failures in certain configs due to missing 'uwtable' LLVM module flags - Support a Rust compiler change (starting with Rust 1.98.0) in the unstable target specification JSON files - Forbid Rust + arm + KASAN configs, which do not build 'kernel' crate: - Fix NOMMU build by adding a missing helper" * tag 'rust-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: x86: support Rust >= 1.98.0 target spec rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES rust: helpers: add is_vmalloc_addr wrapper for NOMMU builds rust: kasan/kbuild: fix rustc-option when cross-compiling ARM: Do not select HAVE_RUST when KASAN is enabled
2026-06-06ALSA: pcm: Fix unlocked runtime state reads in xfer ioctlsCássio Gabriel
The recent runtime state locking cleanup converted several PCM ioctl state checks to snd_pcm_get_state(), including snd_pcm_pre_prepare(), snd_pcm_drain() and snd_pcm_kernel_ioctl(). The native and compat xfer ioctl paths still sample runtime->state directly before dispatching to the PCM transfer helpers, and snd_pcm_common_ioctl() still samples the DISCONNECTED state directly in its common precheck. Use snd_pcm_get_state() for those ioctl-side prechecks as well. This keeps the externally visible ioctl entry checks consistent with the stream-locked state access used by the recent PCM state-read cleanup. Fixes: 032322b44c02 ("ALSA: pcm: oss: use proper stream lock for runtime->state access") Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260605-alsa-pcm-xfer-state-helper-v1-1-eba97cecf820@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-06-06ALSA: seq: Fix partial userptr event expansionHyeongJun An
snd_seq_expand_var_event_at() clamps the number of bytes to copy to the remaining variable-event length, but passes the original buffer size to expand_var_event(). For SNDRV_SEQ_EXT_USRPTR events, expand_var_event() copies exactly the size argument from userspace. On the final chunk, when the remaining event data is shorter than the caller's buffer, this can read past the declared event data and can spuriously fail with -EFAULT if the extra bytes cross an unmapped page. Pass the clamped length instead. The chained and kernel-backed paths already reclamp in dump_var_event(), but the user-pointer path handles the size directly. Fixes: ea46f79709b6 ("ALSA: seq: Add snd_seq_expand_var_event_at() helper") Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Link: https://patch.msgid.link/20260606040913.230213-1-sammiee5311@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-06-06wifi: ath9k_htc: allocate tx_buf and buf togetherRosen Penev
Use a flexible array member to combine allocations. No need to have them separate as they are always together. Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Link: https://patch.msgid.link/20260521232020.261405-1-rosenp@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-06-06wifi: ath9k: remove disabling of bandsRosen Penev
The old platform data code that used this is gone and this serves no purpose. The modern way to disable bands is ieee80211-freq-limit, which is already implemented. Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Link: https://patch.msgid.link/20260521231806.261220-1-rosenp@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-06-06wifi: ath9k: remove TX99 power array zero initRosen Penev
This array is fully initialized in the loop itself. No need to zero initialize and then overwrite. Remove static from the array. This was a holdover from when the array was a static global variable. It no longer confers any benefit. Also add a min() call to avoid the manual if/ternary operation. Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Link: https://patch.msgid.link/20260517222136.1660347-1-rosenp@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-06-06wifi: ath9k: Clear DMA descriptors without memsetRosen Penev
Clear ath9k DMA descriptors with explicit status word stores instead of memset(). The descriptor rings are coherent DMA memory, which may be mapped uncached on 32-bit powerpc. The optimized memset() path can use dcbz there and trigger an alignment warning. Use WRITE_ONCE() for the descriptor status words so the compiler keeps the clears as ordinary stores instead of folding them back into bulk memset(). This covers AR9003 TX status descriptors as well as the RX status area cleared when setting up RX descriptors. Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Link: https://patch.msgid.link/20260517042716.2218386-1-rosenp@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-06-06wifi: ath9k_htc: use module_usb_driverRosen Penev
This follows the pattern with other USB Wifi drivers. There is nothing special being done in the _init and _exit functions here. Simplifies and saves some lines of code. Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Link: https://patch.msgid.link/20260506234848.189840-1-rosenp@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-06-06wifi: wcn36xx: allocate chan_surveys with main structRosen Penev
Avoid allocating separately with a flexible array member. Simplifies allocation slightly. Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Link: https://patch.msgid.link/20260519020317.635011-1-rosenp@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-06-06wifi: wcn36xx: fix spelling mistakes in dxe header commentStepan Ionichev
Fix three spelling mistakes in the DMA Transfer Engine (DXE) description comment at the top of dxe.c. No functional change. Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com> Link: https://patch.msgid.link/20260503165832.1675-1-sozdayvek@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-06-06wifi: wcn36xx: fix OOB read from short trigger BA firmware responseTristan Madani
The firmware response length is only checked against sizeof(*rsp) (20 bytes), but when candidate_cnt >= 1, a 22-byte candidate struct is read at buf + 20 without verifying the response contains it. This causes an out-of-bounds read of stale heap data, corrupting the BA session state. Add validation that the response includes the candidate data. Fixes: 16be1ac55944 ("wcn36xx: Parse trigger_ba response properly") Signed-off-by: Tristan Madani <tristan@talencesecurity.com> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Link: https://patch.msgid.link/20260421135018.352774-4-tristmd@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-06-06wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indicationTristan Madani
The firmware-controlled rsp->count field is used as the loop bound for indexing into the flexible rsp->regs[] array without validation against the message length. A count exceeding the actual data causes out-of- bounds reads from the heap-allocated message buffer. Add a check that count fits within the received message. Fixes: 43efa3c0f241 ("wcn36xx: Implement print_reg indication") Signed-off-by: Tristan Madani <tristan@talencesecurity.com> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Link: https://patch.msgid.link/20260421135018.352774-3-tristmd@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-06-06wifi: wcn36xx: fix heap overflow from oversized firmware HAL responseTristan Madani
The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte hal_buf without validating the response length. A response exceeding WCN36XX_HAL_BUF_SIZE causes a heap buffer overflow with firmware-controlled content. Add a bounds check on the response length. Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware") Signed-off-by: Tristan Madani <tristan@talencesecurity.com> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Link: https://patch.msgid.link/20260421135018.352774-2-tristmd@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-06-06Merge tag 'vfs-7.1-rc7.fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix error handling in ovl_cache_get() - Tighten access checks for exited tasks in pidfd_getfd() - Fix selftests leak in __wait_for_test() - Limit FUSE_NOTIFY_RETRIEVE to uptodate folios - Reject fuse_notify() pagecache ops on directories - Clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - Fix failure to unlock in nfsd4_create_file() - Fix pointer arithmetic in qnx6 directory iteration - Fix UAF due to unlocked ->mnt_ns read in may_decode_fh() - Avoid potential null folio->mapping deref during iomap error reporting * tag 'vfs-7.1-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: iomap: avoid potential null folio->mapping deref during error reporting fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() fs/qnx6: fix pointer arithmetic in directory iteration VFS: fix possible failure to unlock in nfsd4_create_file() signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() fuse: reject fuse_notify() pagecache ops on directories fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios selftests: harness: fix pidfd leak in __wait_for_test pidfd: refuse access to tasks that have started exiting harder ovl: keep err zero after successful ovl_cache_get()
2026-06-06rust: i2c: fix I2cAdapter refcounts double incrementNicolás Antinori
When `I2cAdapter::get` executes, it first calls `bindings::i2c_get_adapter()` which increments the device and module reference counts. It then takes a reference to the raw pointer and converts it to an `ARef` via `.into()`. The implementation of `From<&T> for ARef<T>` where `T: AlwaysRefCounted` unconditionally calls `T::inc_ref()`. This leads to a second increment to the reference counts. Since the returned `ARef` will only release a single reference when dropped via `dec_ref()`, this leaks one device and module reference count on every call. This fix was suggested by sashiko.dev. Link: https://sashiko.dev/#/patchset/20260521190937.248904-1-nico.antinori.7@gmail.com Signed-off-by: Nicolás Antinori <nico.antinori.7@gmail.com> Reviewed-by: Igor Korotin <igor.korotin@linux.dev> Signed-off-by: Igor Korotin <igor.korotin@linux.dev>
2026-06-06perf mmap: Fix NULL deref in aio cleanup on alloc failureArnaldo Carvalho de Melo
perf_mmap__aio_mmap() sets map->aio.nr_cblocks before allocating the data array. If calloc() for aiocb or cblocks fails before the data array is allocated, the return -1 path leads to perf_mmap__aio_munmap() which loops nr_cblocks times calling perf_mmap__aio_free(). Both versions of perf_mmap__aio_free() (NUMA and non-NUMA) dereference map->aio.data[idx] without checking if data is NULL, causing a NULL pointer dereference. Add NULL checks for map->aio.data at the top of both perf_mmap__aio_free() variants so the cleanup path is safe when allocation fails partway through perf_mmap__aio_mmap(). Fixes: d3d1af6f011a553a ("perf record: Enable asynchronous trace writing") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Cc: Alexey Budankov <alexey.budankov@linux.intel.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-06vfs: uapi: retire octal and hex numbers in favor of (1 << n) for O_ flagsJori Koolstra
A recent build failure[1] exposed the diffculty of working with the current octal and hex definitions of O_ flags when trying to find a gap for a new flag. This difficulty is compounded by the fact that O_ flags may have architectural specific values. Replace the hex/octal #defines, which are hard to parse when looking for free bits, with explicit bit shifts like (1 << 11). Also, add comments that identify which architectures redefine some of the seemingly free ("cursed") bits in uapi/asm-generic/fcntl.h. These should not be used to define new O_ flags (for now, at least). The translastion was done with Claude Opus 4.8, and verified with a (non-AI) gawk script. The accounting of which architectures claim which bit-gaps in uapi/asm-generic/fcntl.h is also done by hand. [1]: https://lore.kernel.org/all/agruPPybCx8q2XcJ@sirena.org.uk/ Assisted-by: Claude:Opus 4.8 Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl> Link: https://patch.msgid.link/20260604222405.5382-1-jkoolstra@xs4all.nl Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-06-06bpf: add bpf_real_inode() kfuncChristian Brauner
Add a sleepable BPF kfunc that resolves the real inode backing a dentry via d_real_inode(). On overlay/union filesystems the inode attached to the dentry is the overlay inode which does not carry the underlying device information. d_real_inode() resolves through the overlay and returns the inode from the lower, real filesystem. This is used in the RestrictFilesytemAccess bpf program that has been merged into systemd a little while ago. Link: https://github.com/systemd/systemd/pull/41340 [1] Link: https://patch.msgid.link/20260526-work-bpf-verity-v2-1-cd0b1850d31b@kernel.org Reviewed-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-06-06bpf: Add simple xattr support to bpffsDaniel Borkmann
Add support for extended attributes on bpffs inodes so that user space and BPF LSM programs can attach metadata, for example, a content hash or a security label - to a pinned object or directory. BPF LSM or user space tooling can then uniformly look at this (e.g. security.bpf.*) in similar way to other fs'es. The store is in-memory and non-persistent: it lives only for the lifetime of the mount, like everything else in bpffs. The modelling is similar to tmpfs. bpffs serves the trusted.* and security.* namespaces; user.* is left unsupported. As bpffs is FS_USERNS_MOUNT, security.* is reachable by the unprivileged mounter in a user namespace, and thus we are using the simple_xattr_set_limited infra there (trusted.* needs global CAP_SYS_ADMIN). bpf_fill_super() is open-coded instead of using simple_fill_super(), because the root inode must now be allocated through bpf_fs_alloc_inode() i.e. carry the bpf_fs_inode wrapper and come from the right cache - which requires s_op (and s_xattr) to be installed before the first inode is created. While at it, also harden s_iflags with SB_I_NOEXEC and SB_I_NODEV. bpf_fs_listxattr() is only reachable through the filesystem via i_op->listxattr, so the BPF token inode is left untouched. Name-based fsetxattr()/fgetxattr() on a token fd still work since the get/set handlers are installed at the superblock. For security.* namespace, we use simple_xattr_set_limited() but there was no simple_xattr_add_limited() API yet which was needed in bpf_fs_initxattrs() to avoid underflows in the accounting. The symlink target is freed in bpf_free_inode() rather than in bpf_destroy_inode() so that it is released only after an RCU grace period, as an RCU path walk following the symlink may still dereference inode->i_link in security_inode_follow_link(). Lastly, the bpf_symlink() allocated the symlink target is switched to GFP_KERNEL_ACCOUNT, so the string is charged to the caller's memcg. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://patch.msgid.link/20260602074012.416289-1-daniel@iogearbox.net Cc: Christian Brauner <brauner@kernel.org> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-06-06kernfs: link kn to its parent before the LSM init hookChristian Brauner
After commit 12e9e3cd03b5 ("simpe_xattr: use per-sb cache"), kernfs_xattr_set() and kernfs_xattr_get() compute the cache via kernfs_root(kn) before any other check. kernfs_root(kn) walks kn->__parent first and falls back to kn->dir.root, both of which are NULL on a freshly kmem_cache_zalloc()'d kn. kn->__parent was being set in kernfs_new_node() after __kernfs_new_node() returned, and kn->dir.root is set even later by kernfs_create_dir_ns() / kernfs_create_empty_dir(). The LSM kernfs_init_security hook is invoked from inside __kernfs_new_node(), before either field has been initialized. selinux_kernfs_init_security() ends with kernfs_xattr_set(kn, XATTR_NAME_SELINUX, ...). kernfs_root(kn) then returns NULL, and &((struct kernfs_root *)NULL)->xa_cache evaluates to offsetof(struct kernfs_root, xa_cache) which faults: BUG: kernel NULL pointer dereference, address: 00000000000000e0 RIP: 0010:simple_xattr_set+0x27/0x8b0 Call Trace: kernfs_xattr_set+0x63/0xb0 selinux_kernfs_init_security+0x13b/0x270 security_kernfs_init_security+0x36/0xc0 __kernfs_new_node+0x182/0x290 kernfs_new_node+0x80/0xc0 kernfs_create_dir_ns+0x2b/0xa0 cgroup_create+0x116/0x380 cgroup_mkdir+0x7c/0x1a0 Reproduces deterministically at PID 1 (systemd) on an SELinux-enabled distro. The first cgroup mkdir under /sys/fs/cgroup with a labelled parent panics the kernel. The LSM hook's contract is that the kn_dir argument is the parent of the new kn, so kn->__parent should already point at kn_dir when the hook runs. Move kernfs_get(parent) and rcu_assign_pointer of kn->__parent from kernfs_new_node() into __kernfs_new_node() right before the security hook, and unwind the parent reference on the err_out4 path. kernfs_root(kn) then takes its parent branch during the hook and returns parent->dir.root, which is the correct root. This also closes the same-shape latent bug in kernfs_xattr_get() (which today is hidden only by kernfs_iattrs_noalloc() returning NULL on a fresh kn). Fixes: 12e9e3cd03b5 ("simpe_xattr: use per-sb cache") Reported-by: Calum Mackay <calum.mackay@oracle.com> Closes: https://lore.kernel.org/all/5386153f-9112-4971-98fc-de90d7aae2c6@oracle.com/ Link: https://patch.msgid.link/20260526-ablief-demut-wehen-aef8446ef5c9@brauner Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-06-06Merge patch series "Rework simple xattrs"Christian Brauner
Christian Brauner (Amutable) <brauner@kernel.org> says: Rework the simple xattrs api to make it more efficient and easier to use for all consumers. * patches from https://patch.msgid.link/20260605135322.2632068-1-mszeredi@redhat.com: simpe_xattr: use per-sb cache simple_xattr: change interface to pass struct simple_xattrs ** tmpfs: simplify constructing "security.foo" xattr names kernfs: fix xattr race condition with multiple superblocks Link: https://patch.msgid.link/20260605135322.2632068-1-mszeredi@redhat.com Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-06-06simpe_xattr: use per-sb cacheMiklos Szeredi
Move the hash table to the super block to remove excessive overhead in case of small number of xattrs per inode. Add linked list to the inode, used for listxattr and eviction. Listxattr uses rcu protection to iterate the list of xattrs. Before being made per-sb, lazy allocation was protected by inode lock. Now inode lock no longer provides sufficient exclusion, so use cmpxchg() to ensure atomicity. Though I haven't found a description of this pattern, after some research it seems that cmpxchg_release() and READ_ONCE() should provide the necessary memory barriers. Use simple_xattr_free_rcu() in simple_xattrs_free(). This is needed because the hash table is now shared between inodes and lookup on a different inode might be running the compare function on the just freed element within the RCU grace period. Following stats are based on slabinfo diff, after creating 100k empty files, then adding a "user.test=foo" xattr to each: v7.0 (no rhashtable): File creation: 993.40 bytes/file Xattr addition: 79.99 bytes/file v7.1-rc2 (per-inode rhashtable): File creation: 939.73 bytes/file Xattr addition: 1296.08 bytes/file v7.1-rc2 + this patch (per-sb rhashtable) File creation: 946.84 bytes/file Xattr addition: 111.86 bytes/file The overhead of a single xattr is reduced to nearly v7.0 levels. The per xattr overhead is slightly larger due to the addition of three pointers to struct simple_xattr. Fixes: b32c4a213698 ("xattr: add rhashtable-based simple_xattr infrastructure") Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Link: https://patch.msgid.link/20260605135322.2632068-5-mszeredi@redhat.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-06-06simple_xattr: change interface to pass struct simple_xattrs **Miklos Szeredi
Change the simple_xattr API to accept pointer-to-pointer (struct simple_xattrs **) instead of pointer. This allows the functions to handle lazy allocation internally without requiring callers to use simple_xattrs_lazy_alloc(). The simple_xattr_set(), simple_xattr_set_limited() and simple_xattr_add() functions now handle allocation when xattrs is NULL. simple_xattrs_free() now also frees the xattrs structure itself and sets the pointer to NULL. This simplifies callers and removes the need for most callers to explicitly manage xattrs allocation and lifetime. In shmem_initxattrs(), the total required space for all initial xattrs (ispace) is pre-calculated and deducted from sbinfo->free_ispace. Since this patch modifies the function to add new xattrs directly to the inode's &info->xattrs list rather than using a local temporary variable, a failure means that the partially populated info->xattrs list remains attached to the inode. When the VFS caller handles the -ENOMEM error, it drops the newly created inode via iput(), shmem_free_inode() adds freed to sbinfo->free_ispace a second time, permanently inflating the tmpfs free space quota. Fix by substracting already added xattrs from ispace. Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Link: https://patch.msgid.link/20260605135322.2632068-4-mszeredi@redhat.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-06-06tmpfs: simplify constructing "security.foo" xattr namesMiklos Szeredi
Use kasprintf() instead of doing it with kmalloc() + 2 x memcpy(). Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Link: https://patch.msgid.link/20260605135322.2632068-3-mszeredi@redhat.com Tested-by: Calum Mackay <calum.mackay@oracle.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-06-06kernfs: fix xattr race condition with multiple superblocksMiklos Szeredi
Multiple superblocks with different namespaces can share the same kernfs_node when kernfs_test_super() finds a matching root but different namespace. This means multiple inodes from different superblocks can reference the same kernfs_node->iattr->xattrs structure. The VFS layer only holds per-inode locks during xattr operations, which is insufficient to serialize concurrent xattr modifications on the shared kernfs_node. This can lead to race conditions in simple_xattr_set() where the lookup->replace/remove sequence is not atomic with respect to operations from other superblocks. Fix this by protecting xattr operations with the existing hashed kernfs_locks->open_file_mutex[] array, which is already used to protect per-node open file data. The hashed mutex array provides scalable per-node serialization (scaled by CPU count, up to 1024 locks on 32+ CPU systems) with zero memory overhead. Changes: - Rename open_file_mutex[] to node_mutex[] to reflect dual purpose - Add kernfs_node_lock_ptr() and kernfs_node_lock() helpers - Protect simple_xattr_set() calls in kernfs_xattr_set() and kernfs_vfs_user_xattr_set() with the hashed mutex - Update file.c to use new helpers via compatibility wrappers - Update documentation to explain the extended lock usage Fixes: b32c4a213698 ("xattr: add rhashtable-based simple_xattr infrastructure") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260601162454.2116375-1-mszeredi%40redhat.com Assisted-by: Claude:claude-sonnet-4-5 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Link: https://patch.msgid.link/20260605135322.2632068-2-mszeredi@redhat.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-06-06debugobjects: Don't call fill_pool() in early boot hardirq contextWaiman Long
When booting a debug PREEMPT_RT kernel on an ARM64 system, a "inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage" lockdep warning message was reported to the console. During early boot, interrupts are enabled before the scheduler is enabled. In this window (before SYSTEM_SCHEDULING is set) interrupts can fire and in the hard interrupt context handler attempt to fill the pool This can lead to a deadlock when the interrupt occurred when the interrupt hits a region which holds a lock that is required to be taken in the allocation path. Add a new can_fill_pool() helper and reorder the exception rule and forbid this scenario by excluding allocations from hard interrupt context. Fixes: 06e0ae988f6e ("debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING") Suggested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Suggested-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Waiman Long <longman@redhat.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260605173038.495075-1-longman@redhat.com
2026-06-06Merge tag 'pin-init-v7.2' of https://github.com/Rust-for-Linux/linux into ↵Miguel Ojeda
rust-next Pull pin-init updates from Gary Guo: "User visible changes: - Do not generate 'non_snake_case' warnings for identifiers that are syntactically just users of a field name. This would allow all '#[allow(non_snake_case)]' in nova-core to be removed, which I will send to the nova tree next cycle. - Filter non-cfg attributes out properly in derived structs. This improves pin-init compatibility with other derive macros. - Insert projection types' where clause properly. Other changes: - Bump MSRV to 1.82, plus associated cleanups. - Overhaul how init slots are projected. The new approach is easier to justify with safety comments. - Mark more functions as inline, which should help mitigate the super-long symbol name issue due to lack of inlining. - Various small code quality cleanups." * tag 'pin-init-v7.2' of https://github.com/Rust-for-Linux/linux: (27 commits) rust: pin_init: internal: use `loop {}` to produce never value rust: pin-init: remove `E` from `InitClosure` rust: pin-init: move `InitClosure` out from `__internal` rust: pin-init: docs: fix typos in MaybeZeroable documentation rust: pin-init: internal: suppress `non_snake_case` lint in `[pin_]init!` rust: pin-init: internal: suppress `non_snake_case` lint in `#[pin_data]` rust: pin-init: internal: pin_data: filter non-`#[cfg]` attr in generated code rust: pin-init: internal: project using full slot rust: pin-init: internal: project slots instead of references rust: pin-init: internal: make `make_closure` inherent methods rust: pin-init: internal: use marker on drop guard type for pinned fields rust: pin-init: internal: init: handle code blocks early rust: pin-init: internal: add `PhantomInvariant` and `PhantomInvariantLifetime` rust: pin-init: internal: pin_data: add struct to record field info rust: pin-init: internal: pin_data: use closure for `handle_field` rust: pin-init: examples: fix `useless_borrows_in_formatting` clippy warning rust: pin-init: internal: remove `collect_tuple` polyfill after MSRV bump rust: pin-init: internal: turn `PhantomPinned` error into warnings rust: pin-init: cleanup workaround for old Rust compiler rust: pin-init: fix badge URL in README ...
2026-06-05kconfig: Remove the architecture specific config for PropellerRong Xu
The CONFIG_PROPELLER_CLANG option currently depends on ARCH_SUPPORTS_PROPELLER_CLANG, but this dependency seems unnecessary. Remove ARCH_SUPPORTS_PROPELLER_CLANG and allow users to control Propeller builds solely through CONFIG_PROPELLER_CLANG. This simplifies the kconfig and avoids potential confusion. Move the .llvm_bb_addr_map sections grouping to include/asm-generic/vmlinux.lds.h. The Propeller documentation has been updated to reflect the most recent tool location and now includes instructions for arm64. Contributor Acknowledgments: * SPE instructions: Daniel Hoekwater <hoekwater@google.com> Signed-off-by: Rong Xu <xur@google.com> Suggested-by: Will Deacon <will@kernel.org> Suggested-by: Nathan Chancellor <nathan@kernel.org> Tested-by: Yabin Cui <yabinc@google.com> Reviewed-by: Kees Cook <kees@kernel.org> Link: https://patch.msgid.link/20260604195612.3757860-3-xur@google.com Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2026-06-05kconfig: Remove the architecture specific config for AutoFDORong Xu
The CONFIG_AUTOFDO_CLANG option currently depends on ARCH_SUPPORTS_AUTOFDO_CLANG, but this dependency seems unnecessary. Remove ARCH_SUPPORTS_AUTOFDO_CLANG and allow users to control AutoFDO builds solely through CONFIG_AUTOFDO_CLANG. This simplifies the kconfig and avoids potential confusion. Expand the AutoFDO documentation to include instructions for arm64. Contributor acknowledgments: * SPE instructions: Daniel Hoekwater <hoekwater@google.com> * ETM instructions: Yabin Cui <yabinc@google.com> Signed-off-by: Rong Xu <xur@google.com> Suggested-by: Will Deacon <will@kernel.org> Tested-by: Yabin Cui <yabinc@google.com> Reviewed-by: Kees Cook <kees@kernel.org> Link: https://patch.msgid.link/20260604195612.3757860-2-xur@google.com Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2026-06-05modpost: Add __llvm_covfun and __llvm_covmap to section_white_listJames Lee
Modpost emits hundreds of warnings when using Clang to build for ARCH=um and CONFIG_GCOV=y. e.g.: vmlinux (__llvm_covfun): unexpected non-allocatable section. Did you forget to use "ax"/"aw" in a .S file? Note that for example <linux/init.h> contains section definitions for use in .S files. For example, when we use LLVM for a kunit user mode build with coverage: python3 tools/testing/kunit/kunit.py build --make_options LLVM=1 \ --kunitconfig=tools/testing/kunit/configs/default.config \ --kunitconfig=tools/testing/kunit/configs/coverage_uml.config The behaviour occurs when building the kernel for ARCH=um with code coverage enabled. The warnings come from modpost's check_sec_ref function, which ensures no sections reference others that will be discarded. covfun and covmap sections must reference __init and __exit sections to collect coverage data, triggering the modpost warning. To suppress these warnings, these section names have been added to modpost's whitelist. This is unlikely to suppress legitimate warnings as Clang will only insert these sections when building with coverage, and can be assumed to manage these references safely. Signed-off-by: James Lee <james@codeconstruct.com.au> Link: https://patch.msgid.link/20260604-dev-coverage-patch-v1-1-9f9368253cb4@codeconstruct.com.au Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2026-06-05selftests/bpf: Inspect the signature verdict exposed to BPF LSMDaniel Borkmann
Add a minimal BPF LSM program on lsm/bpf_prog_load that, for loads on the monitored thread, reads back prog->aux->sig.{verdict,keyring_type, keyring_serial}, and a signed_loader subtest that drives the same gen_loader loader through the hook twice: i) /unsigned/ where the LSM must observe UNSIGNED, no keyring and serial 0; ii) /signed/ where the very same insns signed against the session keyring must be observed as VERIFIED with a user keyring, and the recorded keyring_serial must be equal to the resolved session keyring serial. Loading (not running) the loader is sufficient since the verdict is attached at load time. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t signed_loader [ 1.970530] clocksource: Switched to clocksource tsc #405/1 signed_loader/metadata_check_shape:OK #405/2 signed_loader/metadata_match:OK #405/3 signed_loader/metadata_sha_mismatch:OK #405/4 signed_loader/metadata_not_exclusive:OK #405/5 signed_loader/metadata_hash_not_computed:OK #405/6 signed_loader/signature_enforced:OK #405/7 signed_loader/signature_too_large:OK #405/8 signed_loader/signature_bad_keyring:OK #405/9 signed_loader/metadata_ctx_max_entries_ignored:OK #405/10 signed_loader/metadata_ctx_initial_value_ignored:OK #405/11 signed_loader/signature_authenticates_insns:OK #405/12 signed_loader/hash_requires_frozen:OK #405/13 signed_loader/no_update_after_freeze:OK #405/14 signed_loader/freeze_writable_mmap:OK #405/15 signed_loader/no_writable_mmap_frozen:OK #405/16 signed_loader/map_hash_matches_libbpf:OK #405/17 signed_loader/map_hash_multi_element:OK #405/18 signed_loader/map_hash_bad_size:OK #405/19 signed_loader/map_hash_unsupported_type:OK #405/20 signed_loader/lsm_signature_verdict:OK #405 signed_loader:OK Summary: 1/20 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260605213518.544262-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05bpf: Expose signature verdict via bpf_prog_auxKP Singh
BPF_PROG_LOAD verifies the loader signature but does not record the outcome on the BPF program. [BPF] LSMs and audit can read attr->signature and attr->keyring_id to infer "was this signed, and if so, against which keyring". Add prog->aux->sig (verdict + keyring_{type,serial}), populated by bpf_prog_load before the LSM hook. keyring_type classifies the keyring the load referenced (builtin, secondary, platform or user), while keyring_serial records the serial of the keyring the signature was actually validated against. System keyrings carry a pseudo key pointer with no user-visible serial and are reported as 0, as are unsigned loads. Failed verifications reject the load before the hook runs, so it observes only either UNSIGNED or VERIFIED. Signed-off-by: KP Singh <kpsingh@kernel.org> Co-developed-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260605213518.544262-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05Merge branch 'selftests-bpf-libarena-add-initial-data-structures'Alexei Starovoitov
Emil Tsalapatis says: ==================== selftests/bpf: libarena: Add initial data structures Add two new data structures to libarena. These data structures initially resided in the sched-ext repo (https://github.com/sched-ext/scx) and have been adapted to the internal libarena build system. The data structures are: - Red black tree: Fundamental tree data structure that can also serve as a base for more domain-specific data structures. - Lev-Chase deque: Queue data structure that allows efficient work stealing, useful in scheduling scenarios. The data structures are accompanied by selftests that are automatically discovered by the existing libarena test_progs selftest and incorporated in the CI. CHANGELOG ========= v3 -> v4 (https://lore.kernel.org/bpf/20260604235016.20856-1-emil@etsalapatis.com/) - Turn off load_acquire/store_relesase - dependent selftests for s390 (CI) - Various style/non-functional nits (AI) v2 -> v3 (https://lore.kernel.org/bpf/20260603182727.3922-1-emil@etsalapatis.com/) - Add workaround to handle LLVM 21 and GCC 15 assignment-to-memset promotions that are causing verification failures for arena programs (CI) - Incorporate Sashiko feedback for cleanup edge cases (Sashiko) - Simplify some of the ordering semantics in spmc v1 -> v2 (https://lore.kernel.org/bpf/20260511214100.9487-1-emil@etsalapatis.com/): - Rename tests from st_ to test_ (Alexei) - Removed the freelist caches from the rbtrees, previously used to defer freeing (Alexei) - Moved the type and function definitions to use the __arena identifier - Removed the typecasts during function return and directly return __arena pointers (Alexei) - Renamed queues to spmc queues to abstract away the algorithm (Alexei) - Adjusted the memory barriers in the spmc queue - Added multithreaded testing harness for libarena programs (Alexei) - Added parallel selftest for queues (Alexei) - Split least upper bound and exact find operations back into separate functions to prevent RB_DUPLICATE-related bug (AI) ==================== Link: https://patch.msgid.link/20260605222020.5231-1-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05selftests/bpf: libarena: parallel test harness and spmc parallel selftestEmil Tsalapatis
Add a parallel test for the SPMC Lev-Chase workstealing queue. The queue is built to be wait-free even when there are multiple consumers, and the parallel selftest provides a signal on whether the queue behaves correctly when stress tested. To support the test, this patch includes a test harness for parallel selftests. The spmc selftest acts as an example of the naming and other conventions expected by the harness. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/r/20260605222020.5231-4-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05selftests/bpf: libarena: Add spmc queue data structureEmil Tsalapatis
Expand libarena with a single producer multiple consumer deque data structure. This is a single producer, multiple consumer lockless structure that permits efficient work stealing. The structure is a Lev-Chase queue, so it is lock-free and wait-free. The data structure exposes three main calls. two of them are available to the thread owning the queue and one available to all threads in the program: spmc_owner_push(): Push an item to the top of the queue. spmc_owner_pop(): Pop an item from the top of the queue. spmc_steal(): Steal a thread from the bottom of the queue from any thread. Note that the queue is not really FIFO for all consumers, since non-owners of the queue can only work steal from the bottom. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/r/20260605222020.5231-3-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05selftests/bpf: libarena: Add rbtree data structureEmil Tsalapatis
Add a native red-black tree data structure to libarena. The data structure supports multiple APIs (key-value based, node based) with which users can query and modify it. The tree uses the libarena memory allocator to manage its data. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/r/20260605222020.5231-2-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-05net: stmmac: xgmac: report L3/L4 filter match count in ethtool statsNazim Amirul
Read the L3FM and L4FM bits from the RX descriptor status word (RDES2) and increment the corresponding ethtool statistics counters. This allows users to observe L3/L4 filter hit rates via ethtool -S. Signed-off-by: Rohan G Thomas <rohan.g.thomas@altera.com> Signed-off-by: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260604083037.24407-1-muhammad.nazim.amirul.nazle.asmade@altera.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: microchip: sparx5: clean up PSFP resources on flower setup failureHaoxiang Li
sparx5_tc_flower_psfp_setup() allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP actions. If a later step fails, the resources allocated earlier in the function are not unwound. Add error paths to release the stream filter, flow meter and stream gate when setup fails after they have been acquired. Also make sparx5_psfp_fm_add() return the acquired flow-meter id before the existing-flow-meter early return. When an existing flow meter is reused, sparx5_psfp_fm_get() increments its pool reference count, but the caller previously kept psfp_fmid as 0. If a later setup step failed, the error path could try to delete flow-meter id 0 instead of the reused flow meter, leaving the incremented reference behind. Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> Link: https://patch.msgid.link/20260603061716.747282-1-lihaoxiang@isrc.iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05netlabel: validate unlabeled address and mask attribute lengthsChenguang Zhao
netlbl_unlabel_addrinfo_get() used the address attribute length to determine whether the attribute data could be read as an IPv4 or IPv6 address, but did not independently validate the corresponding mask attribute length. A crafted Generic Netlink request could therefore provide a valid IPv4/IPv6 address attribute with a shorter mask attribute, which would later be read as a full struct in_addr or struct in6_addr. NLA_BINARY policy lengths are maximum lengths by default, so use NLA_POLICY_EXACT_LEN() for the unlabeled IPv4/IPv6 address and mask attributes. This rejects short attributes during policy validation and also exposes the exact length requirements through policy introspection. Fixes: 8cc44579d1bd ("NetLabel: Introduce static network labels for unlabeled connections") Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05Merge branch ↵Jakub Kicinski
'net-airoha-support-multiple-net_devices-connected-to-the-same-gdm-port' Lorenzo Bianconi says: ==================== net: airoha: Support multiple net_devices connected to the same GDM port EN7581 or AN7583 SoCs support connecting multiple external SerDes (e.g. Ethernet or USB SerDes) to GDM3 or GDM4 ports via a hw arbiter that manages the traffic in a TDM manner. As a result multiple net_devices can connect to the same GDM{3,4} port and there is a theoretical "1:n" relation between GDM ports and net_devices. ┌─────────────────────────────────┐ │ │ ┌──────┐ │ P1 GDM1 ├────►MT7530│ │ │ └──────┘ │ │ ETH0 (DSA conduit) │ │ │ PSE/FE │ │ │ │ │ │ │ ┌─────┐ │ P0 CDM1 ├────►QDMA0│ │ P4 P9 GDM4 │ └─────┘ └──┬─────────────────────────┬────┘ │ │ ┌──▼──┐ ┌────▼────┐ │ PPE │ │ ARB │ └─────┘ └─┬─────┬─┘ │ │ ┌──▼──┐┌─▼───┐ │ ETH ││ USB │ └─────┘└─────┘ ETH1 ETH2 This series introduces support for multiple net_devices connected to the same Frame Engine (FE) GDM port (GDM3 or GDM4) via an external hw arbiter. Please note GDM1 or GDM2 does not support the connection with the external arbiter. ==================== Link: https://patch.msgid.link/20260603-airoha-eth-multi-serdes-v9-0-5d476bc2f426@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: airoha: Support multiple LAN/WAN interfaces for hw MAC address ↵Lorenzo Bianconi
configuration The EN7581 and AN7583 SoCs provide registers to configure hardware LAN/WAN MAC addresses. These registers are used during FE hw acceleration to determine whether received traffic is destined to this host (L3 traffic) or should be switched to another device (L2 traffic). The SoC hardware design assumes all interfaces configured as LAN (or WAN) share the MAC address MSBs, which are programmed into the REG_FE_{LAN,WAN}_MAC_H register. The LSBs of 'local' mac addresses can be expressed as a range via the REG_FE_MAC_LMIN and REG_FE_MAC_LMAX registers. In order to properly accelerate the traffic, FE module requires the user to configure the REG_FE_{LAN,WAN}_MAC_H register respecting this limitation. Please note a misconfiguration in REG_FE_{LAN,WAN}_MAC_H will still allow the user to log into the device for debugging. Previously, only a single interface was considered when programming these registers. Extend the logic to derive the correct minimum and maximum values for REG_FE_MAC_LMIN/REG_FE_MAC_LMAX when two or more interfaces are configured as LAN or WAN. Since this functionality was not available before this series, no regression is introduced. Tested-by: Madhur Agrawal <madhur.agrawal@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260603-airoha-eth-multi-serdes-v9-6-5d476bc2f426@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: airoha: Introduce WAN device flagLorenzo Bianconi
Introduce WAN flag to specify if a given device is used to transmit/receive WAN or LAN traffic. Current codebase supports specifying LAN/WAN device configuration in ndo_init() callback during device bootstrap. In order to consider setups where LAN configuration is used even for GDM3/GDM4 devices, check airoha_is_lan_gdm_dev() to select pse_port in airoha_ppe_foe_entry_prepare(). Please note after this patch, it will be possible to specify multiple LAN devices but just a single WAN one. Please note this change is not visible to the user since airoha_eth driver currently supports just the internal phy available via the MT7530 DSA switch and there are no WAN interfaces officially supported since PCS/external phy is not merged mainline yet (it will be posted with following patches). Tested-by: Xuegang Lu <xuegang.lu@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260603-airoha-eth-multi-serdes-v9-5-5d476bc2f426@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: airoha: Do not stop GDM port if it is sharedLorenzo Bianconi
Theoretically, in the current codebase, two independent net_devices can be connected to the same GDM port so we need to check the GDM port is not used by any other running net_device before setting the forward configuration to FE_PSE_PORT_DROP. Moreover, always set in GDM_LONG_LEN_MASK field of REG_GDM_LEN_CFG register the maximum MTU of all running net_devices connected to the same GDM port. Tested-by: Xuegang Lu <xuegang.lu@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260603-airoha-eth-multi-serdes-v9-4-5d476bc2f426@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: airoha: Support multiple net_devices for a single FE GDM portLorenzo Bianconi
EN7581 or AN7583 SoCs support connecting multiple external SerDes (e.g. Ethernet or USB SerDes) to GDM3 or GDM4 ports via a hw arbiter that manages the traffic in a TDM manner. As a result multiple net_devices can connect to the same GDM{3,4} port and there is a theoretical "1:n" relation between GDM ports and net_devices. ┌─────────────────────────────────┐ │ │ ┌──────┐ │ P1 GDM1 ├────►MT7530│ │ │ └──────┘ │ │ ETH0 (DSA conduit) │ │ │ PSE/FE │ │ │ │ │ │ │ ┌─────┐ │ P0 CDM1 ├────►QDMA0│ │ P4 P9 GDM4 │ └─────┘ └──┬─────────────────────────┬────┘ │ │ ┌──▼──┐ ┌────▼────┐ │ PPE │ │ ARB │ └─────┘ └─┬─────┬─┘ │ │ ┌──▼──┐┌─▼───┐ │ ETH ││ USB │ └─────┘└─────┘ ETH1 ETH2 Introduce support for multiple net_devices connected to the same Frame Engine (FE) GDM port (GDM3 or GDM4) via an external hw arbiter. Please note GDM1 or GDM2 does not support the connection with the external arbiter. Add get_dev_from_sport callback since EN7581 and AN7583 have different logics for the net_device type connected to GDM3 or GDM4. Tested-by: Xuegang Lu <xuegang.lu@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260603-airoha-eth-multi-serdes-v9-3-5d476bc2f426@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: airoha: Remove private net_device pointer in airoha_gdm_dev structLorenzo Bianconi
Remove redundant net_device pointer inside airoha_gdm_dev struct and rely on netdev_from_priv routine instead. Please note this patch does not introduce any logical change, just code refactoring. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260603-airoha-eth-multi-serdes-v9-2-5d476bc2f426@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05dt-bindings: net: airoha: Add GDM port ethernet child nodeLorenzo Bianconi
EN7581 and AN7583 SoCs support connecting multiple external SerDes to GDM3 or GDM4 ports via a hw arbiter that manages the traffic in a TDM manner. As a result multiple net_devices can connect to the same GDM{3,4} port and there is a theoretical "1:n" relation between GDM ports and net_devices. Introduce the ethernet node child of a specific GDM port in order to model a given net_device that is connected via the external arbiter to the GDM{3,4} port. This new ethernet node is defined by the "airoha,eth-port" compatible string. Please note GDM1 and GDM2 does not support the connection with the external arbiter and they are represented by an ethernet node defined by the "airoha,eth-mac" compatible string. Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260603-airoha-eth-multi-serdes-v9-1-5d476bc2f426@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05Merge branch 'net-mdio-realtek-rtl9300-refactor-initialization-and-port-lookup'Jakub Kicinski
Markus Stockhausen says: ==================== net: mdio: realtek-rtl9300: Refactor initialization and port lookup The Realtek Otto switch platform consists of four different series - RTL838x aka maple : 28 port 1G Switches - RTL839x aka cypress : 52 port 1G Switches - RTL930x aka longan : 28 port 1G/2.5G/10G Switches - RTL931x aka mango : 56 port 1G/2.5G/10G Switches A lot has been done to enhance the ethernet MDIO driver for simple integration of more SoCs. Now it is time to solve inconveniences that were discovered during daily operation. That includes - Consistent "of" API usage - Tightening error handling and improving overall robustness. - Adding support for PHY packages. - Fixing setup order issues. These currently hinder the driver from properly enabling the hardware on devices where U-Boot skips the setup and leaves the controller registers untouched. ==================== Link: https://patch.msgid.link/20260603175924.123019-1-markus.stockhausen@gmx.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-05net: mdio: realtek-rtl9300: Correctly handle ethernet-phy-packageManuel Stocker
Realtek Otto switches usually make use of multiport PHYs (e.g. 8 port 1G RTL8218D or 4 port 2.5G RTL8224). The device tree can describe this fact via an "ethernet-phy-package" node that resides between the bus and the PHY node. When looking up the device tree bus node via the chain port->phy->parent the driver totally ignores the existence of a PHY package. Enhance the lookup to take care of this feature. Link: https://github.com/openwrt/openwrt/pull/23591 Signed-off-by: Manuel Stocker <mensi@mensi.ch> Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://patch.msgid.link/20260603175924.123019-8-markus.stockhausen@gmx.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-13 03:33:11 +0000