summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)AuthorFilesLines
2026-06-04Merge tag 'ath-next-20260602' of ↵Johannes Berg27-115/+642
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v7.2 (PR #3) In ath12k, add driver support for WDS mode. In ath11k and ath12k, a number of cleanups and minor bug fixes. ================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-04wifi: wlcore: enable the right set of ciphersAndreas Kemnade1-10/+13
The firmware version number check for IGTK introduced in commit c34dbc5900b0 ("wifi: wlcore: Add support for IGTK key") lets the amount of ciphers decrease on every boot of a too old firmware and that is practically happening. It also does not take into account other chips than the wl18xx. On some wl128x, the following can be observed when connecting via nm to a common ap: [ 484.113311] wlcore: WARNING could not set keys [ 484.117828] wlcore: ERROR Could not add or replace key [ 484.123016] wlan0: failed to set key (5, ff:ff:ff:ff:ff:ff) to hardware (-5) [ 484.123046] wlcore: Hardware recovery in progress. FW ver: Rev 7.3.10.0.142 [ 484.139923] wlcore: pc: 0x0, hint_sts: 0x00000048 count: 1 [ 484.145721] wlcore: down [ 484.148986] ieee80211 phy0: Hardware restart was requested [ 484.610473] wlcore: firmware booted (Rev 7.3.10.0.142) [ 484.633758] wlcore: Association completed. [ 484.690490] wlcore: ERROR command execute failure 14 [ 484.690490] ------------[ cut here ]------------ [ 484.700195] WARNING: drivers/net/wireless/ti/wlcore/main.c:872 at wl12xx_queue_recovery_work+0x64/0x74 [wlcore], CPU#0: kworker/0:0/892 This repeats endlessly. Always disable IGTK on wl12xx and fix the decrementing mess. Fixes: c34dbc5900b0 ("wifi: wlcore: Add support for IGTK key") Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Link: https://patch.msgid.link/20260604103316.377251-1-andreas@kemnade.info Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-04net: bonding: fix NULL pointer dereference in bond_do_ioctl()ZhaoJinming1-2/+2
In bond_do_ioctl(), slave_dev is obtained via __dev_get_by_name() which can return NULL if the requested interface name does not exist. However, the subsequent slave_dbg() call is placed before the NULL check: slave_dev = __dev_get_by_name(net, ifr->ifr_slave); slave_dbg(bond_dev, slave_dev, "slave_dev=%p:\n", slave_dev); //here if (!slave_dev) return -ENODEV; The slave_dbg() macro expands to netdev_dbg(bond_dev, "(slave %s): " fmt, (slave_dev)->name, ...) which unconditionally dereferences slave_dev->name before the NULL check is performed. This results in a NULL pointer dereference kernel oops when a user calls bonding ioctl (e.g. SIOCBONDENSLAVE, SIOCBONDRELEASE, etc.) with a non-existent slave interface name. This is reachable from userspace via the bonding ioctl interface with CAP_NET_ADMIN capability, making it a potential local denial-of-service vector. Fix by moving the slave_dbg() call after the NULL check. Fixes: e2a7420df2e0 ("bonding/main: convert to using slave printk macros") Cc: stable@vger.kernel.org # v5.2+ Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com> Link: https://patch.msgid.link/20260601085649.4029067-1-zhaojinming@uniontech.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-04ptp: Switch to ktime_get_snapshot_id() for pre/post timestampsThomas Gleixner1-4/+4
To prepare for a new PTP IOCTL, which exposes the raw counter value along with the requested system time snapshot, switch the pre/post time stamp sampling over to use ktime_get_snapshot_id() and fix up all usage sites. No functional change intended. The ptp_vmclock conversion was simplified by David Woodhouse. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: David Woodhouse <dwmw@amazon.co.uk> Tested-by: Arthur Kiyanovski <akiyano@amazon.com> Reviewed-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Acked-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20260529195558.149589566@kernel.org
2026-06-04wifi: iwlwifi: Use system_device_crosststamp::sys_systimeThomas Gleixner2-2/+2
sys_systime is an alias for sys_realtime. The latter will be removed so switch the code over to the new naming scheme. No functional change. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Arthur Kiyanovski <akiyano@amazon.com> Reviewed-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260529195557.946612509@kernel.org
2026-06-04net/mlx5: Use provided clock ID for history snapshotThomas Gleixner1-2/+2
The PTP core indicates in system_device_crosststamp::clock_id the clock ID for which the system time stamp should be taken. That allows to utilize hardware timestamps with e.g. AUX clocks. Use ktime_get_snapshot_id() and hand the provided clock ID in. No functional change. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Arthur Kiyanovski <akiyano@amazon.com> Reviewed-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260529195557.689836531@kernel.org
2026-06-04igc: Use provided clock ID for history snapshotThomas Gleixner2-1/+4
The PTP core indicates in system_device_crosststamp::clock_id the clock ID for which the system time stamp should be taken. That allows to utilize hardware timestamps with e.g. AUX clocks. Save the provided clock ID and use it in igc_phc_get_syncdevicetime() for taking the history snapshot. No functional change. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Arthur Kiyanovski <akiyano@amazon.com> Reviewed-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260529195557.637381831@kernel.org
2026-06-04ice/ptp: Use provided clock ID for history snapshotThomas Gleixner1-1/+4
The PTP core indicates in system_device_crosststamp::clock_id the clock ID for which then system time stamp should be taken. That allows to utilize hardware timestamps with e.g. AUX clocks. Save the provided clock ID and use it in ice_capture_crosststamp() for taking the history snapshot. No functional change. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Arthur Kiyanovski <akiyano@amazon.com> Reviewed-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260529195557.587226681@kernel.org
2026-06-04wifi: iwlwifi: Adopt PTP cross timestamps to core changesThomas Gleixner2-3/+5
iwlwifi only supports CLOCK_REALTIME timestamps and provides an incomplete result without system counter values etc. It also zeros struct system_device_crosststamp, which is already zeroed in the core and initialized with the clock ID. Remove the zeroing and reject any request for a clock ID other than REALTIME. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Arthur Kiyanovski <akiyano@amazon.com> Reviewed-by: David Woodhouse <dwmw@amazon.co.uk> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260529195557.535447186@kernel.org
2026-06-04geneve: fix length used in GRO hint UDP checksum adjustmentAntoine Tenart1-1/+1
In geneve_post_decap_hint the length used for adjusting the UDP checksum should be 'skb->len - gro_hint->nested_tp_offset' (UDP length) instead of 'skb->len - gro_hint->nested_nh_offset' (IP length). Fixes: fd0dd796576e ("geneve: use GRO hint option in the RX path") Cc: Paolo Abeni <pabeni@redhat.com> Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260521131436.748832-1-jhs%40mojatatu.com Signed-off-by: Antoine Tenart <atenart@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260529144713.780938-1-atenart@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-03net: axienet: Use dedicated ethtool_ops for the dmaengine pathSuraj Gupta1-3/+24
The dmaengine path shares ethtool_ops with the legacy AXI DMA path, including .get_coalesce/.set_coalesce that poke XAXIDMA_*_CR_OFFSET directly. In dmaengine mode lp->dma_regs is not mapped by axienet, so those ethtool calls touch unmapped/unrelated memory and report values unrelated to the channel actually in use. .get_ringparam/.set_ringparam only touch lp->rx_bd_num/lp->tx_bd_num, fields used only by the legacy path for BD ring sizing. In dmaengine mode the descriptor ring is owned by the dmaengine provider and these fields are not consulted, so reporting them is misleading. No dmaengine API exists today to query or program either coalescing or ring size on behalf of the client, so neither can be exposed meaningfully in dmaengine mode. Add axienet_ethtool_dmaengine_ops without the coalesce and ringparam hooks. Also move the ethtool_ops assignment from early probe into the if/else alongside netdev_ops, so the legacy and dmaengine paths pick their respective ops in one place. No functional change for the legacy DMA path. Signed-off-by: Suraj Gupta <suraj.gupta2@amd.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260601124454.3384601-1-suraj.gupta2@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net/sun: Fix multiple typos in commentsJakub Raczynski6-18/+18
There are some typos in comments and while they are harmless and not visible, there is no reason not to fix them. Fix the ones that are not register related, which might have intentional naming convention. Signed-off-by: Jakub Raczynski <j.raczynski@samsung.com> Link: https://patch.msgid.link/20260601163727.554364-1-j.raczynski@samsung.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03eth: bnxt: disable rx-copybreak by defaultJakub Kicinski3-7/+7
rx-copybreak requires an extra slab allocation. Since bnxt uses page pool frags and HDS by default, the rx-copybreak doesn't buy us anything. The extra pressure on slab causes overload on pre-sheaves kernels on modern AMD platforms. In synthetic testing on net-next this patch shows little difference but I think copybreak is "obvious waste" at this point. Default rx-copybreak threshold to 0 / disabled. The "copybreak" defines are really the size bounds for the Rx header buffer. Rename them. Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Link: https://patch.msgid.link/20260602003759.1545645-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardownLorenzo Bianconi1-1/+1
mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed. Fixes: 2d7605a72906 ("net: ethernet: mtk_eth_soc: enable hardware DSA untagging") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260602-airoha-mtk-metadata-uaf-fix-v1-2-3aaa99d83351@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net: airoha: Fix use-after-free in metadata dst teardownLorenzo Bianconi1-1/+1
airoha_metadata_dst_free() runs metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, an use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed. Fixes: af3cf757d5c9 ("net: airoha: Move DSA tag in DMA descriptor") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260602-airoha-mtk-metadata-uaf-fix-v1-1-3aaa99d83351@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net: ibm: emac: fix unchecked platform_get_irq return valueRosen Penev1-0/+5
platform_get_irq() returns a negative errno on failure. Commit a598f66d9169 replaced irq_of_parse_and_map() (which returns 0 on failure) with platform_get_irq() but dropped the error check. Without it, a negative IRQ number is passed to devm_request_irq(), which fails with -EINVAL instead of propagating the real error from platform_get_irq(). Add the missing error check and goto err_gone. Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20260601040201.103481-1-rosenp@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03Merge tag 'wireless-2026-06-03' of ↵Jakub Kicinski6-34/+67
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Things are finally quieting down: - iwlwifi: - FW reset handshake removal for older devices - NIC access fix in fast resume - avoid too large command for some BIOSes - fix TX power constraints in AP mode - cfg80211: - fix netlink parse overflow - fix potential 6 GHz scan memory leak - enforce HE/EHT consistency to avoid mac80211 crash - mac80211: guard radiotap antenna parsing * tag 'wireless-2026-06-03' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: cfg80211: enforce HE/EHT cap/oper consistency wifi: fix leak if split 6 GHz scanning fails wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap wifi: nl80211: reject oversized EMA RNR lists wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used wifi: iwlwifi: mvm: avoid oversized UATS command copy wifi: iwlwifi: mld: send tx power constraints before link activation wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares ==================== Link: https://patch.msgid.link/20260603113208.171874-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03octeontx2-af: Fix initialization of mcam's entry2target_pffunc fieldSuman Ghosh1-2/+2
NPC mcam entry stores a mapping between mcam entry and target pcifunc. During initialization of this field, API kmalloc_array has been used which caused some junk values to array. Whereas, the array is expected to be initialized by 0. This patch fixes the same by using kcalloc instead of kmalloc_array. Fixes: 55307fcb9258 ("octeontx2-af: Add mbox messages to install and delete MCAM rules") Signed-off-by: Suman Ghosh <sumang@marvell.com> Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/1780054625-17090-1-git-send-email-sbhatta@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03octeontx2-pf: Fix NDC sync operation errorsGeetha sowjanya1-1/+1
On system reboot "rvu_nicpf 0002:03:00.0: NDC sync operation failed" error messages are shown, even if the operations is successful. This is due to wrong if error check in ndc_syc() function. Fixes: 42c45ac1419c ("octeontx2-af: Sync NIX and NPA contexts from NDC to LLC/DRAM") Signed-off-by: Geetha sowjanya <gakula@marvell.com> Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/1780054677-17249-1-git-send-email-sbhatta@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03geneve: Introduce IFLA_GENEVE_LOCAL and IFLA_GENEVE_LOCAL6.Kuniyuki Iwashima1-9/+158
By default, a GENEVE device bind()s its underlying UDP socket(s) to the IPv4 or IPv6 wildcard address because there is no way to specify a specific local IP address to bind() to. This prevents deploying multiple GENEVE devices on a multi-homed host where each device should be isolated and bound to a different local IP address on the same UDP port. Let's introduce new options, IFLA_GENEVE_LOCAL and IFLA_GENEVE_LOCAL6, to allow specifying a local IPv4/IPv6 address for the backend UDP socket. By default, when collect metadata mode (IFLA_GENEVE_COLLECT_METADATA) is enabled, both IPv4 and IPv6 sockets are created. However, if a source address is specified via the new attributes, only a single socket corresponding to that specific address family is created. Accordingly, geneve_find_sock() and geneve_find_dev() are updated to take the source address into account, ensuring that multiple devices and sockets configured with different source addresses can coexist without conflict. In addition, the source address is validated in geneve_xmit_skb() and geneve6_xmit_skb(), so the BPF prog must set it in bpf_tunnel_key. With this change, multiple GENEVE devices can be successfully created and bound to their respective local IP addresses: (*) "local" is the keyword for IFLA_GENEVE_LOCAL / IFLA_GENEVE_LOCAL6 # for i in $(seq 1 2); do ip link add geneve4_${i} type geneve local 192.168.0.${i} external ip addr add 192.168.0.${i}/24 dev geneve4_${i} ip link set geneve4_${i} up ip link add geneve6_${i} type geneve local 2001:9292::${i} external ip addr add 2001:9292::${i}/64 dev geneve6_${i} nodad ip link set geneve6_${i} up done # ip -d l | grep geneve 9: geneve4_1: <BROADCAST,MULTICAST,UP,LOWER_UP> ... geneve external id 0 local 192.168.0.1 ... 10: geneve6_1: <BROADCAST,MULTICAST,UP,LOWER_UP> ... geneve external id 0 local 2001:9292::1 ... 11: geneve4_2: <BROADCAST,MULTICAST,UP,LOWER_UP> ... geneve external id 0 local 192.168.0.2 ... 12: geneve6_2: <BROADCAST,MULTICAST,UP,LOWER_UP> ... geneve external id 0 local 2001:9292::2 ... # ss -ua | grep geneve UNCONN 0 0 192.168.0.2:geneve 0.0.0.0:* UNCONN 0 0 192.168.0.1:geneve 0.0.0.0:* UNCONN 0 0 [2001:9292::2]:geneve *:* UNCONN 0 0 [2001:9292::1]:geneve *:* Note that even if the local address is explicitly configured with the wildcard address, kernel does not dump it except for devices with IFLA_GENEVE_COLLECT_METADATA. This is consistent with the behaviour of is_tnl_info_zero(), which treats the wildcard remote address as not configured. ## ynl example. # ./tools/net/ynl/pyynl/cli.py \ --spec ./Documentation/netlink/specs/rt-link.yaml \ --do newlink --create \ --json '{"ifname": "geneve0", "linkinfo": {"kind":"geneve", "data": {"local": "0.0.0.0", "collect-metadata": true}}}' # ./tools/net/ynl/pyynl/cli.py \ --spec ./Documentation/netlink/specs/rt-link.yaml \ --do getlink \ --json '{"ifname": "geneve0"}' --output-json | \ jq .linkinfo.data.local "0.0.0.0" Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260602190436.139591-6-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03geneve: Add dualstack flag to struct geneve_config.Kuniyuki Iwashima1-11/+16
When collect metadata mode (IFLA_GENEVE_COLLECT_METADATA) is enabled, the GENEVE device creates both IPv4 and IPv6 sockets and bind()s them to wildcard addresses. The next patch allows creating only one socket bound to a specific address even when the collect metadata mode is enabled. Then, we need a flag to distinguish dualstack GENEVE devices to detect local address conflict. Let's add the dualstack flag to struct geneve_config. IFLA_GENEVE_COLLECT_METADATA processing is moved up in geneve_nl2info() for the next patch to overwrite dualstack to false while keeping collect_md true. Note that IFLA_GENEVE_REMOTE and IFLA_GENEVE_REMOTE6 does not set cfg->dualstack to false since is_tnl_info_zero() ignores the wildcard remote address: # ip link add geneve0 type geneve external remote 0.0.0.1 Error: Device is externally controlled, so attributes (VNI, Port, and so on) must not be specified. # ip link add geneve0 type geneve external remote 0.0.0.0 # ss -ua | grep geneve UNCONN 0 0 0.0.0.0:geneve 0.0.0.0:* UNCONN 0 0 *:geneve *:* Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260602190436.139591-5-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03geneve: Pass struct geneve_dev to geneve_find_sock().Kuniyuki Iwashima1-14/+20
This is a prep patch to make a subsequent patch clean. We will need to access geneve_dev->cfg.info.key.u.{ipv4,ipv6}.src in geneve_find_sock() later and extend conditions there. Let's pass down struct geneve from geneve_sock_add() to geneve_find_sock() and flatten the conditional logic. Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260602190436.139591-4-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03geneve: Pass struct geneve_dev to geneve_create_sock().Kuniyuki Iwashima1-9/+9
This is a prep patch to make a subsequent patch clean. We will need to access geneve_dev->cfg.info.key.u.{ipv4,ipv6}.src in geneve_create_sock() later. Let's pass down struct geneve_dev from geneve_sock_add() to geneve_create_sock() instead of individual config fields. Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260602190436.139591-3-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03geneve: Reuse ipv6_addr_type() result in geneve_nl2info().Kuniyuki Iwashima1-3/+5
geneve_nl2info() calls ipv6_addr_type() to check if the remote IPv6 address is link-local. Then, it also calls ipv6_addr_is_multicast() for the same address. Let's not call ipv6_addr_is_multicast() and reuse ipv6_addr_type(). Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260602190436.139591-2-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net: sfp: initialize i2c_block_size at adapter configure timeJonas Jelonek1-0/+1
sfp->i2c_block_size is only assigned in sfp_sm_mod_probe(), which runs from the state machine timer after SFP_F_PRESENT has been set. Between those two points, sfp_module_eeprom() (the ethtool -m callback) gates only on SFP_F_PRESENT and can be entered with i2c_block_size still at its kzalloc'd value of 0. On a pure-I2C adapter, sfp_i2c_read() then issues an i2c_transfer() with msgs[1].len = 0 inside a loop that subtracts this_len from len each iteration; on adapters that succeed a zero-length read the loop never advances, spinning while holding rtnl_lock. This was previously addressed by initializing i2c_block_size in sfp_alloc() (commit 813c2dd78618), but the initialization was dropped when i2c_block_size was split from i2c_max_block_size. Initialize sfp->i2c_block_size from sfp->i2c_max_block_size in sfp_i2c_configure(), so the field is valid as soon as the adapter is known. sfp_sm_mod_probe() still reassigns it on each module insertion to recover from a per-module clamp to 1 (sfp_id_needs_byte_io). Fixes: 7662abf4db94 ("net: phy: sfp: Add support for SMBus module access") Cc: stable@vger.kernel.org Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com> Link: https://patch.msgid.link/20260528205242.971410-2-jelonek.jonas@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net: b44: use ethtool_putsRosen Penev1-5/+5
There's a subtle error with the memcpy here, where b44_gstrings should not be dereferenced. Dereferening causes the following error with W=1: In file included from drivers/net/ethernet/broadcom/b44.c:17: In file included from ./include/linux/module.h:18: In file included from ./include/linux/kmod.h:9: In file included from ./include/linux/umh.h:4: In file included from ./include/linux/gfp.h:7: In file included from ./include/linux/mmzone.h:8: In file included from ./include/linux/spinlock.h:56: In file included from ./include/linux/preempt.h:79: In file included from ./arch/powerpc/include/asm/preempt.h:5: In file included from ./include/asm-generic/preempt.h:5: In file included from ./include/linux/thread_info.h:23: In file included from ./arch/powerpc/include/asm/current.h:13: In file included from ./arch/powerpc/include/asm/paca.h:16: In file included from ./include/linux/string.h:386: ./include/linux/fortify-string.h:578:4: error: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use> 578 | __read_overflow2_field(q_size_field, size); | ^ Instead of fixing the memcpy, use ethtool_puts, which is the proper helper for printing ethtool gstrings. Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260531000334.388351-1-rosenp@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net/mlx5e: Verify unique vhca_id count instead of rangeShay Drory1-6/+21
Change verify_num_vhca_ids() to count the number of unique vhca_ids and verify this count doesn't exceed max_num_vhca_id, rather than validating individual vhca_id values are within a specific range. The previous implementation checked if each vhca_id was in the range [0, max_num_vhca_id - 1], which is overly restrictive. The hardware capability max_rqt_vhca_id represents the maximum number of unique vhca_ids that can be used, not a range constraint on individual IDs. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260531113954.395443-14-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net/mlx5e: TC, enable steering for SD LAGShay Drory7-5/+92
Enable TC flow steering for SD LAG mode by extending multiport eligibility checks and peer flow handling. SD LAG operates similarly to MPESW for TC offloads - flows on secondary devices need peer flow creation on the primary, and multiport forwarding rules are eligible when either MPESW or SD LAG is active. Add mlx5_lag_is_sd() helper to query SD LAG mode, and mlx5_sd_is_primary() to identify the primary device. Redirect uplink priv/proto_dev queries to the primary device's eswitch in SD configurations. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260531113954.395443-13-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net/mlx5e: TC, track peer flow slots with bitmapShay Drory2-7/+6
With SD devices joining the LAG, peer flows are not created for all devcom peers - SD devices skip peers that belong to a different SD group. However, the delete path iterated all devcom peers unconditionally, attempting to delete from slots that were never populated. Track which peer slots are populated using a bitmap in mlx5e_tc_flow. The delete path now iterates only set bits, matching exactly the slots that were set up during flow creation. Signed-off-by: Shay Drory <shayd@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260531113954.395443-12-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net/mlx5: SD, keep netdev resources on same PF in switchdev modeShay Drory1-0/+7
In SD switchdev mode, network device resources such as channels and completion vectors must remain on the same PF rather than being distributed across SD group members. Modify mlx5_sd_ch_ix_get_dev_ix() to return 0 and mlx5_sd_ch_ix_get_vec_ix() to return the channel index directly when in switchdev mode, keeping resources local to the requesting PF. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260531113954.395443-11-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net/mlx5: LAG, block multipath LAG for SD devicesShay Drory1-0/+4
SD devices are not compatible with multipath LAG since they use dedicated SD LAG for cross-socket connectivity. Add an SD check to the multipath prereq validation to prevent multipath LAG activation on SD-configured ports. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260531113954.395443-10-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net/mlx5: LAG, block RoCE and VF LAG for SD devicesShay Drory3-21/+63
Socket Direct devices manage their own LAG via SD LAG infrastructure. Block the standard netdev-event-driven LAG path (RoCE LAG and VF LAG) for SD devices to prevent conflicting LAG configurations. Expose mlx5_sd_is_supported() as a public helper that encapsulates all SD eligibility checks. Use it in mlx5_lag_dev_alloc() to skip netdev notifier registration for SD-capable devices at alloc time. Some sd code is reordered to expose the new function, no logic is changed. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260531113954.395443-9-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net/mlx5: SD, introduce Socket Direct LAGShay Drory1-14/+121
Register SD secondary devices with the existing LAG structure by adding them to the primary's ldev xarray with a shared group_id. This ties the SD LAG lifecycle to the SD group lifecycle. Add sd_lag_state debugfs entry for LAG state visibility. To avoid race between this entry and LAG deletion, have debugfs creation and deletion done last on SD init and first on SD cleanup. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260531113954.395443-8-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net/mlx5: LAG, extend shared FDB API with group_id filterShay Drory6-82/+323
Add a group_id parameter to mlx5_lag_shared_fdb_create() and mlx5_lag_shared_fdb_destroy() to scope shared FDB operations to a specific SD group. When group_id is U32_MAX, the functions operate on all LAG devices. When group_id is non-zero, they operate only on devices in that SD group without issuing FW LAG commands, since SD LAG is a pure software construct. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260531113954.395443-7-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net/mlx5: LAG, prepare for SD device integrationShay Drory2-22/+90
Socket Direct (SD) secondaries devices will participate in LAG, even though they are silent. SD secondary devices share the same physical port as their primary but are separate PCI functions that need to be tracked alongside regular LAG ports. Extend lag_func with a group_id field to identify SD group membership and introduce a unified iterator that can filter by group. Add APIs for registering SD secondary devices in an existing LAG. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260531113954.395443-6-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net/mlx5: LAG, replace peer count check with direct peer lookupShay Drory3-19/+21
Replace mlx5_eswitch_get_npeers() count-based check with a new mlx5_eswitch_is_peer() function that directly verifies the peer relationship between two eswitches. This change prepares for SD LAG support, which is a virtual LAG that does not have num_lag_ports capability and cannot use the count-based peer validation. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260531113954.395443-5-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net/mlx5: E-Switch, move devcom init from TC to eswitch layerShay Drory2-20/+6
Move the E-swtich devcom component management from TC layer to ESW layer. This refactoring places devcom lifecycle management at the appropriate layer and prepares for SD LAG which needs devcom registration independent of the TC/representor initialization. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260531113954.395443-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net/mlx5: E-Switch, align disable sequence with switchdev-to-legacy transitionShay Drory1-1/+2
This patch align the eswitch disable sequence with the switchdev-to-legacy mode transition, where eswitch must be disabled before device detachment. The consistent ordering is required for proper SD LAG cleanup which depends on eswitch state during teardown. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260531113954.395443-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03net/mlx5: LAG, factor out shared FDB code into dedicated fileShay Drory5-142/+210
Refactor shared FDB LAG logic into a new lag/shared_fdb.c file to improve code organization and enable reuse. Move shared FDB specific functions from lag.c and introduce consolidated APIs: - mlx5_lag_shared_fdb_create() handles LAG activation with shared FDB - mlx5_lag_shared_fdb_destroy() handles LAG deactivation with shared FDB Update mlx5_do_bond(), mlx5_disable_lag() and mpesw.c to use the new APIs, which simplifies the shared FDB code paths. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260531113954.395443-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-03wifi: iwlwifi: bump maximum core version for BZ/SC/DR to 106Emmanuel Grumbach3-3/+3
Start supporting Core 106 FW on these devices. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260531135036.4ec96e57a17b.I1eea0a221656b2f03839964734d9a3624530b964@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-06-03wifi: iwlwifi: mld: add KUnit tests for link gradingAvinash Bhatt2-34/+254
Add tests for the link grading algorithm covering per-bandwidth grading tables, channel load calculation, 6 GHz RSSI adjustments including duplicated beacon and PSD/EIRP compensation, and puncturing penalty. Signed-off-by: Avinash Bhatt <avinash.bhatt@intel.com> Link: https://patch.msgid.link/20260531135036.a4251e5665a0.I811b35680115e7de0ffd75b6b7a1c91ad361c97c@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-06-03wifi: iwlwifi: mld: add KUnit tests for PSD/EIRP RSSI adjustmentAvinash Bhatt4-1/+378
Add tests for PSD/EIRP RSSI adjustment which compensates measurements when APs use PSD-based power scaling with bandwidth. Tests cover all power types, bandwidths, and limiting scenarios. Signed-off-by: Avinash Bhatt <avinash.bhatt@intel.com> Link: https://patch.msgid.link/20260531135036.a18b8d0acd62.I68dfcc17359ab8a5abdc84e1e21db4ad1671af41@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-06-03wifi: iwlwifi: mld: drop TLC config cmd v4/v5 compat codeShahar Tzarfati3-106/+1
FW core102 bumped TLC_MNG_CONFIG_CMD_API_S from version 5 to version 6. The v4 and v5 compatibility paths in iwl_mld_send_tlc_cmd() are no longer reachable on any supported firmware. Signed-off-by: Shahar Tzarfati <shahar.tzarfati@intel.com> Link: https://patch.msgid.link/20260531135036.c0e2dbfd0569.I44f8eb4d985bb9590b65b77e9a3dd157e4bd5e79@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-06-03wifi: iwlwifi: mvm: remove __must_check annotation from command sendingMiri Korenblit1-10/+10
We don't acually need to always check the return value. For example, if we send a command to remove an object - we can assume success (if it fails it is probably because the fw is dead, and then it doesn't have the object anyway). Remove the annotations. Link: https://patch.msgid.link/20260531135036.434473c7b29a.I455e0c3f93c25635df708da7d3216c183dbdbbbb@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-06-03wifi: iwlwifi: trans: export the maximum supported hcmd sizeMiri Korenblit1-0/+4
Export the maximum allowed host command payload size to the op-modes. Note that this information was available to the op-modes also before this change, this just adds a clear macro. Reviewed-by: Johannes Berg <johannes.berg@intel.com> Link: https://patch.msgid.link/20260531135036.2e6b15bcaf50.I027e150e5f25ef2431ab4e212175dc00ca5e8abd@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-06-03wifi: iwlwifi: stop supporting core101Shahar Tzarfati3-3/+3
BZ, DR and SC no longer need to accept core101 firmware. Raise the minimum supported firmware core from 101 to 102 so these families only match supported core102 and newer images. Signed-off-by: Shahar Tzarfati <shahar.tzarfati@intel.com> Link: https://patch.msgid.link/20260531135036.4ece89be11a9.If00f9c7e011ec75219d28a38ca2077a926afc70e@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-06-03wifi: iwlwifi: remove orphaned DC2DC config enumShahar Tzarfati1-10/+1
FW core102 removed both DC2DC_CONFIG_CMD_API_S and DC2DC_CONFIG_CMD_RSP_API_S. The only driver-side artifact is enum iwl_dc2dc_config_id in fw/api/config.h, which has no callers in any .c file across all driver paths (mld/mvm/xvt). Remove the dead definition. Signed-off-by: Shahar Tzarfati <shahar.tzarfati@intel.com> Link: https://patch.msgid.link/20260531135036.487ceed62714.I13cf8cc214c68899379112e8e52f0cd38dc7b6f8@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-06-03wifi: iwlwifi: fix a typoMiri Korenblit1-1/+1
We use 512 A-MSDUs in an A-MPDU, not 612. Fix the typo. Link: https://patch.msgid.link/20260531135036.62a394741a04.I2fd9e1d5dc4d467426c9061df2796ff8ba0129d4@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-06-03wifi: iwlwifi: pcie: fix write pointer move detectionJohannes Berg1-2/+2
Ever since the TFD queue size is no longer limited to 256 entries, this code has been wrong, and might erroneously not detect a move if it was by a multiple of 256. Not a big deal, but fix it while I see it. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Link: https://patch.msgid.link/20260531135036.87ffbeab298e.I4fae41383b6756bccbed250985e0521b68a40d0c@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-06-03wifi: iwlwifi: mld: Require HT support for NANIlan Peer1-1/+2
NAN cannot be supported if HT is not supported, so check that HT is supported before declaring that NAN is supported. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Link: https://patch.msgid.link/20260527230313.6274b222e849.If215f00f0cdb5eefb2507f8d0fb5734a65ce945f@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
generated by cgit (git 2.54.0.dirty) at 2026-09-27 03:14:27 +0000