summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)AuthorFilesLines
2026-05-21net: wwan: iosm: fix potential memory leaks in ipc_imem_init()Abdun Nihaal1-0/+2
The memory allocated in ipc_protocol_init() is not freed on the error paths that follow in ipc_imem_init(). Fix that by calling the corresponding release function ipc_protocol_deinit() in the error path. Fixes: 3670970dd8c6 ("net: iosm: shared memory IPC interface") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Link: https://patch.msgid.link/20260519062815.55545-1-nihaal@cse.iitm.ac.in Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-21net: dsa: netc: add support for ethtool private statisticsWei Fang4-0/+165
Implement the ethtool private statistics interface to expose additional port-level and MAC-level counters that are not covered by the standard IEEE 802.3 statistics. The pMAC counters are only reported when the port supports Frame Preemption (802.1Qbu/802.3br). Note that although rtnl_link_stats64 provides some standard statistics such as rx octets, rx frame errors, rx dropped packets, and tx packets, these are overall port statistics. The NETC switch supports preemption on each port, and each port has two MACs (eMAC and pMAC). The driver private statistics are used to obtain statistics for each MAC, allowing users to perform analysis and debugging. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260518082506.1318236-16-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net: dsa: netc: add support for the standardized countersWei Fang5-1/+327
Each user port of the NETC switch supports 802.3 basic and mandatory managed objects statistic counters and IETF Management Information Database (MIB) package (RFC2665) and Remote Network Monitoring (RMON) counters. And all of these counters are 64-bit registers. In addition, some user ports support preemption, so these ports have two MACs, MAC 0 is the express MAC (eMAC), MAC 1 is the preemptible MAC (pMAC). So for ports that support preemption, the statistics are the sum of the pMAC and eMAC statistics. Note that the current switch driver does not support preemption, all frames are sent and received via the eMAC by default. The statistics read from the pMAC should be zero. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260518082506.1318236-15-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net: dsa: netc: initialize buffer pool table and implement flow-controlWei Fang4-1/+160
The buffer pool is a quantity of memory available for buffering a group of flows (e.g. frames having the same priority, frames received from the same port), while waiting to be transmitted on a port. The buffer pool tracks internal memory consumption with upper bound limits and optionally a non-shared portion when associated with a shared buffer pool. Currently the shared buffer pool is not supported, it will be added in the future. For i.MX94, the switch has 4 ports and 8 buffer pools, so each port is allocated two buffer pools. For frames with priorities of 0 to 3, they will be mapped to the first buffer pool; For frames with priorities of 4 to 7, they will be mapped to the second buffer pool. Each buffer pool has a flow control on threshold and a flow control off threshold. By setting these threshold, add the flow control support to each port. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260518082506.1318236-14-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net: dsa: netc: add FDB, STP, MTU, port setup and host flooding supportWei Fang3-0/+663
Expand the NETC switch driver with several foundational features: - FDB and MDB management - STP state handling - MTU configuration - Port setup/teardown - Host flooding support At this stage, the driver operates only in standalone port mode. Each port uses VLAN 0 as its PVID, meaning ingress frames are internally assigned VID 0 regardless of whether they arrive tagged or untagged. Note that this does not inject a VLAN 0 header into the frame, the VID is used purely for subsequent VLAN processing within the switch. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260518082506.1318236-13-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net: dsa: netc: add phylink MAC operationsWei Fang4-0/+315
Different versions of NETC switches have different numbers of ports and MAC capabilities. Add .phylink_get_caps() to struct netc_switch_info, allowing each NETC switch version to implement its own callback for obtaining MAC capabilities. Implement the phylink_mac_ops callbacks: .mac_config(), .mac_link_up(), and .mac_link_down(). Note that flow-control configuration is not yet supported in .mac_link_up(), but will be implemented in a subsequent patch. Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260518082506.1318236-12-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net: dsa: netc: introduce NXP NETC switch driver for i.MX94Wei Fang8-0/+895
For i.MX94 series, the NETC IP provides full 802.1Q Ethernet switch functionality, advanced QoS with 8 traffic classes, and a full range of TSN standards capabilities. The switch has 3 user ports and 1 CPU port, the CPU port is connected to an internal ENETC. Since the switch and the internal ENETC are fully integrated within the NETC IP, no back-to-back MAC connection is required. Instead, a light-weight "pseudo MAC" is used between the switch and the ENETC. This translates to lower power (less logic and memory) and lower delay (as there is no serialization delay across this link). Introduce the initial NETC switch driver with basic probe and remove functionality. More features will be added in subsequent patches. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260518082506.1318236-11-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net: enetc: add multiple command BD rings supportWei Fang1-4/+9
All the tables of NETC switch are managed through the command BD ring, but unlike ENETC, the switch has two command BD rings, if the current ring is busy, the switch driver can switch to another ring to manage the table. Currently, the NTMP driver does not support multiple rings. Therefore, update ntmp_select_and_lock_cbdr() to select a appropriate ring to execute the command for the switch. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260518082506.1318236-9-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net: enetc: add support for "Add" and "Delete" operations to IPFTWei Fang2-0/+116
The ingress port filter table (IPFT )contains a set of filters each capable of classifying incoming traffic using a mix of L2, L3, and L4 parsed and arbitrary field data. As a result of a filter match, several actions can be specified such as on whether to deny or allow a frame, overriding internal QoS attributes associated with the frame and setting parameters for the subsequent frame processing functions, such as stream identification, policing, ingress mirroring. Each entry corresponds to a filter. The ingress port filter entries are added using a precedence value. If a frame matches multiple entries, the entry with the higher precedence is used. Currently, this patch only adds "Add" and "Delete" operations to the ingress port filter table. These two interfaces will be used by both ENETC driver and NETC switch driver. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260518082506.1318236-8-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net: enetc: add support for the "Update" operation to buffer pool tableWei Fang2-0/+49
The buffer pool table contains buffer pool configuration and operational information. Each entry corresponds to a buffer pool. The Entry ID value represents the buffer pool ID to access. The buffer pool table is a static bounded index table, buffer pools are always present and enabled. It only supports Update and Query operations, This patch only adds ntmp_bpt_update_entry() helper to support updating the specified entry of the buffer pool table. Query action to the table will be added in the future. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260518082506.1318236-7-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net: enetc: add support for the "Add" operation to VLAN filter tableWei Fang2-0/+69
The VLAN filter table contains configuration and control information for each VLAN configured on the switch. Each VLAN entry includes the VLAN port membership, which FID to use in the FDB lookup, which spanning tree group to use, the egress frame modification actions to apply to a frame exiting form this VLAN, and various configuration and control parameters for this VLAN. The VLAN filter table can only be managed by the command BD ring using table management protocol version 2.0. The table supports Add, Delete, Update and Query operations. And the table supports 3 access methods: Entry ID, Exact Match Key Element and Search. But currently we only add the ntmp_vft_add_entry() helper to support the upcoming switch driver to add an entry to the VLAN filter table. Other interfaces will be added in the future. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260518082506.1318236-6-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net: enetc: add basic operations to the FDB tableWei Fang2-2/+264
The FDB table is used for MAC learning lookups and MAC forwarding lookups. Each table entry includes information such as a FID and MAC address that may be unicast or multicast and a forwarding destination field containing a port bitmap identifying the associated port(s) with the MAC address. FDB table entries can be static or dynamic. Static entries are added from software whereby dynamic entries are added either by software or by the hardware as MAC addresses are learned in the datapath. The FDB table can only be managed by the command BD ring using table management protocol version 2.0. Table management command operations Add, Delete, Update and Query are supported. And the FDB table supports three access methods: Entry ID, Exact Match Key Element and Search. This patch adds the following basic supports to the FDB table. ntmp_fdbt_update_entry() - update the configuration element data of a specified FDB entry ntmp_fdbt_delete_entry() - delete a specified FDB entry ntmp_fdbt_add_entry() - add an entry into the FDB table ntmp_fdbt_search_port_entry() - Search the FDB entry on the specified port based on RESUME_ENTRY_ID. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260518082506.1318236-5-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net: enetc: add pre-boot initialization for i.MX94 switchWei Fang1-22/+163
Before probing the NETC switch driver, some pre-initialization needs to be set in NETCMIX and IERB to ensure that the switch can work properly. For example, i.MX94 NETC switch has three external ports and each port is bound to a link. And each link needs to be configured so that it can work properly, such as I/O variant and MII protocol. In addition, the switch port 2 (MAC 2) and ENETC 0 (MAC 3) share the same parallel interface, they cannot be used at the same time due to the SoC constraint. And the MAC selection is controlled by the mac2_mac3_sel bit of EXT_PIN_CONTROL register. Currently, the interface is set for ENETC 0 by default unless the switch port 2 is enabled in the DT node. Like ENETC, each external port of the NETC switch can manage its external PHY through its port MDIO registers. And the port can only access its own external PHY by setting the PHY address to the LaBCR[MDIO_PHYAD_PRTAD]. If the accessed PHY address is not equal to LaBCR[MDIO_PHYAD_PRTAD], then the MDIO access initiated by port MDIO will be invalid. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260518082506.1318236-4-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net/mlx5: Generalize enable/disable HCA for any PF vportMoshe Shemesh5-20/+42
Refactor the host-PF-specific mlx5_cmd_host_pf_enable/disable_hca() into generic mlx5_cmd_pf_enable/disable_hca() that accept a vport number. The new functions use vhca_id as function_id when supported. Similarly, refactor the eswitch layer into generic static helpers mlx5_esw_pf_enable/disable_hca() with thin wrappers for the host PF case, in preparation for enable_hca on satellite PF vports. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260518071356.345723-9-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net/mlx5: Use vport helper for IPsec eswitch set capsMoshe Shemesh1-58/+23
Use mlx5_vport_set_other_func_cap() and mlx5_vport_set_other_func_general_cap() in the IPsec eswitch functions instead of open-coding the SET_HCA_CAP command. This removes redundant buffer allocation and boilerplate, and also enables vhca_id based addressing when supported. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260518071356.345723-8-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net/mlx5: Refactor mlx5_set_msix_vec_count() SET_HCA_CAPMoshe Shemesh1-20/+7
Use mlx5_vport_set_other_func_general_cap() instead of open-coding the SET_HCA_CAP command. This removes redundant buffer allocation and ensures consistent use of vport-based function addressing. mlx5_vport_set_other_func_general_cap() supports both function_id and vhca_id based addressing, so this also enables SET_HCA_CAP for vhca_id indexed functions which was not supported before. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260518071356.345723-7-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net/mlx5: Add mlx5_vport_set_other_func_general_cap macroMoshe Shemesh2-2/+6
Add mlx5_vport_set_other_func_general_cap() convenience macro, symmetric to the existing mlx5_vport_get_other_func_general_cap(), and use it in mlx5_devlink_port_fn_roce_set(). No functional change in this patch. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260518071356.345723-6-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net/mlx5: Switch vport HCA cap helpers to kvzallocMoshe Shemesh1-4/+4
mlx5_vport_set_other_func_cap() and mlx5_vport_get_vhca_id() allocate command buffers that embed the HCA capability union, exceeding 4KiB. Use kvzalloc/kvfree so the allocation can fall back to vmalloc when contiguous memory is scarce. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260518071356.345723-5-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net/mlx5: Use mlx5_eswitch_is_vf_vport() for IPsec VF checksMoshe Shemesh2-3/+3
IPsec eswitch offload operations and the enabled_ipsec_vf_count counter are intended for VF vports only. Replace the MLX5_VPORT_HOST_PF checks with mlx5_eswitch_is_vf_vport() to properly identify VF vports, as preparation for adding another type of PF vports. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260518071356.345723-4-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net/mlx5: Use v1 response layout for query_esw_functionsMoshe Shemesh4-12/+89
Use the v1 response layout for the query_esw_functions command when supported by the device. When query_host_net_function_v1 capability is set, use MLX5_QUERY_ESW_FUNC_OP_MOD_LAYOUT_V1 to retrieve parameters for multiple network functions, allocating the output buffer according to query_host_net_function_num_max. Validate that firmware does not return more entries than the allocated buffer. The v1 layout reports vhca_state instead of the legacy host_pf_disabled bit. PFs transition through ALLOCATED, ACTIVE, and IN_USE states (they do not use TEARDOWN_REQUEST as SFs do). When the ECPF calls disable_hca, firmware resets the PF and moves it to ALLOCATED. When the ECPF calls enable_hca, the PF moves to ACTIVE, and once the PF driver enables it, it reaches IN_USE. The PF is only fully operational in IN_USE, so pf_disabled is derived as vhca_state != IN_USE, equivalent to the legacy host_pf_disabled bit. The mlx5_esw_get_host_pf_info() helper abstracts parsing the command output in both legacy and new formats, so callers do not need to handle the different layouts. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260518071356.345723-3-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net/mlx5: Use helper to parse host PF infoMoshe Shemesh4-38/+62
Add a helper mlx5_esw_get_host_pf_info() to retrieve host PF data from the query_esw_functions command output, so callers no longer need to parse the layout to obtain the required information. Convert all callers of mlx5_esw_query_functions() to use the new helper, preparing for upcoming support of the new op_mod that returns data in the network_function_params layout. Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260518071356.345723-2-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net: stmmac: eswin: validate RGMII delay valuesZhi Li1-4/+25
Validate rx-internal-delay-ps and tx-internal-delay-ps against the hardware capabilities of the EIC7700 MAC. The programmable RGMII delay supports 20 ps steps and a maximum value of 2540 ps. The driver previously accepted arbitrary values and silently truncated unsupported settings when converting them to hardware units. As a result, invalid device tree values could lead to unexpected delay programming and incorrect RGMII timing. Reject delay values that are not multiples of 20 ps or exceed the supported hardware range. Fixes: ea77dbbdbc4e ("net: stmmac: add Eswin EIC7700 glue driver") Signed-off-by: Zhi Li <lizhi2@eswincomputing.com> Link: https://patch.msgid.link/20260518022214.507-1-lizhi2@eswincomputing.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net: stmmac: eswin: correct RGMII delay granularity to 20 psZhi Li1-4/+4
The EIC7700 MAC implements programmable RGMII delay adjustment with a granularity of 20 ps per hardware step. The driver previously converted rx-internal-delay-ps and tx-internal-delay-ps values using a 100 ps step size, resulting in incorrect delay programming. Update the conversion to use the correct 20 ps granularity so the programmed delay matches the values described in the device tree. Fixes: ea77dbbdbc4e ("net: stmmac: add Eswin EIC7700 glue driver") Signed-off-by: Zhi Li <lizhi2@eswincomputing.com> Link: https://patch.msgid.link/20260518022156.484-1-lizhi2@eswincomputing.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net: stmmac: eswin: clear TXD and RXD delay registers during initializationZhi Li1-0/+22
Clear the TXD and RXD delay control registers during EIC7700 DWMAC initialization. These registers may retain values programmed by the bootloader. If left unchanged, residual delays can alter the effective RGMII timing seen by the MAC and override the configuration described by the device tree. This may violate the expected RGMII timing model and can cause link instability or prevent the Ethernet controller from operating correctly. Explicitly clearing these registers ensures that the MAC delay settings are determined solely by the kernel configuration. The corresponding register offsets are optional, and the registers are only cleared when the offsets are provided in the device tree. Fixes: ea77dbbdbc4e ("net: stmmac: add Eswin EIC7700 glue driver") Signed-off-by: Zhi Li <lizhi2@eswincomputing.com> Link: https://patch.msgid.link/20260518022137.464-1-lizhi2@eswincomputing.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-21net: stmmac: eswin: fix HSP CSR init ordering after clock enableZhi Li1-32/+41
Fix the initialization ordering of the HSP CSR configuration in the EIC7700 DWMAC glue driver. The HSP CSR registers control MAC-side RGMII delay behavior and must only be accessed after the corresponding clocks are enabled. The previous implementation could trigger register access before clock enablement, leading to undefined behavior depending on boot state. Move the HSP CSR configuration into the post-clock-enable initialization path to ensure all register accesses occur under valid clock domains. This change ensures deterministic initialization and prevents clock-dependent register access failures during probe or resume. Fixes: ea77dbbdbc4e ("net: stmmac: add Eswin EIC7700 glue driver") Signed-off-by: Zhi Li <lizhi2@eswincomputing.com> Link: https://patch.msgid.link/20260518022055.444-1-lizhi2@eswincomputing.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-20bareudp: Use rtnl_dereference() in bareudp_sock_release().Kuniyuki Iwashima1-1/+1
kernel test robot reported sparse warning in bareudp_sock_release(): drivers/net/bareudp.c:288:12: warning: incorrect type in assignment (different address spaces) drivers/net/bareudp.c:288:12: expected struct sock *sk drivers/net/bareudp.c:288:12: got struct sock [noderef] __rcu *sk The warning is not new and exists since the initial bareudp commit 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc."). Let's use rtnl_dereference(). Note that bareudp_sock_release() is called from bareudp_stop() under RTNL, so there is no real issue even without the helper. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202605062359.e3gOfZCr-lkp@intel.com/ Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260518050726.318824-6-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20bareudp: Remove synchronize_net() in bareudp_sock_release().Kuniyuki Iwashima1-1/+0
synchronize_net() in bareudp_sock_release() has existed since day 1, commit 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc."). It was most likely copied from a similar tunneling device like vxlan or geneve. bareudp_sock_release() is called from dev->netdev_ops->ndo_stop(), and synchronize_net() in unregister_netdevice_many_notify() ensures that inflight bareudp fast paths finish before bareudp_dev is freed. Let's remove the redundant synchronize_net() in bareudp_sock_release(). Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260518050726.318824-5-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20geneve: Remove synchronize_net() in geneve_unquiesce().Kuniyuki Iwashima1-1/+0
When changing the geneve config, geneve_changelink() sandwiches the config memcpy() between geneve_quiesce() and geneve_unquiesce(). geneve_quiesce() temporarily clears geneve->sock[46] and their sk_user_data, and then calls synchronize_net() to wait for inflight fast paths to finish. geneve_unquiesce() then restores the cleared pointers, but it also superfluously calls synchronize_net(). The latter synchronize_net() provides no benefit; with or without it, inflight fast paths can see either the NULL pointers or the original pointers alongside the new configuration. Let's remove the redundant synchronize_net() in geneve_unquiesce(). Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260518050726.318824-4-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20geneve: Remove synchronize_net() in geneve_sock_release().Kuniyuki Iwashima1-1/+0
vxlan previously had an issue where the fast path could access stale pointers, which was fixed by commit c6fcc4fc5f8b ("vxlan: avoid using stale vxlan socket."). geneve later followed the same pattern, and commit fceb9c3e3825 ("geneve: avoid using stale geneve socket.") copied synchronize_net() from vxlan_sock_release() into geneve_sock_release(). However, that change occurred after commit ca065d0cf80f ("udp: no longer use SLAB_DESTROY_BY_RCU"), and geneve had already been using kfree_rcu() to free geneve_sock. Therefore, the synchronize_net() was never actually needed there. Let's remove the redundant synchronize_net() in geneve_sock_release(). Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260518050726.318824-3-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20vxlan: Remove synchronize_net() in vxlan_sock_release().Kuniyuki Iwashima1-1/+0
Initially, a dedicated workqueue was used to defer calling udp_tunnel_sock_release(vxlan_sock->sock) and kfree(vxlan_sock). Later, commit 0412bd931f5f ("vxlan: synchronously and race-free destruction of vxlan sockets") removed the workqueue and instead invoked these two functions immediately after synchronize_net(). This was intended to prevent UAF of the UDP socket in the fast path. ( Note that the "nondeterministic behaviour" mentioned in that commit was not addressed, as another thread not waiting RCU gp still sees the same behaviour. ) However, a week prior to that change, commit ca065d0cf80f ("udp: no longer use SLAB_DESTROY_BY_RCU") had already moved UDP socket freeing to after the RCU grace period. This made the synchronize_net() in vxlan_sock_release() completely redundant. Since vxlan_sock now uses kfree_rcu() and is invoked after udp_tunnel_sock_release(), vxlan_sock is guaranteed to be freed either at the same time or after the UDP socket is released, following the RCU grace period. Let's remove the redundant synchronize_net() in vxlan_sock_release(). Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260518050726.318824-2-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20net: pse-pd: Use named initializers for arrays of i2c_device_dataUwe Kleine-König (The Capable Hub)3-5/+5
While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. The mentioned robustness is relevant for a planned change to struct i2c_device_id that replaces .driver_data by an anonymous union. While touching all these arrays, unify usage of whitespace in the list terminator. This patch doesn't modify the compiled arrays, only their representation in source form benefits. The former was confirmed with x86 and arm64 builds. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Acked-by: Oleksij Rempel <o.rempel@pengutronix.de> Link: https://patch.msgid.link/20260519140101.1584946-2-u.kleine-koenig@baylibre.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20net: dsa: Use named initializers for struct i2c_device_idUwe Kleine-König (The Capable Hub)3-5/+5
While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. This patch doesn't modify the compiled arrays, only their representation in source form benefits. The former was confirmed with x86 and arm64 builds. While touching these arrays, unify usage of whitespace in the list terminator. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260519145722.1590298-2-u.kleine-koenig@baylibre.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20mctp: i2c: Use named initializers for struct i2c_device_idUwe Kleine-König (The Capable Hub)1-2/+2
While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. This patch doesn't modify the compiled arrays, only their representation in source form benefits. The former was confirmed with x86 and arm64 builds. While touching this array, unify usage of whitespace in the list terminator to what most other arrays are using. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Acked-by: Jeremy Kerr <jk@codeconstruct.com.au> Link: https://patch.msgid.link/20260519153613.1594429-2-u.kleine-koenig@baylibre.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20mlxsw: minimal: Use named initializers for struct i2c_device_idUwe Kleine-König (The Capable Hub)1-1/+1
While being less compact, using named initializers allows to more easily see which members of the structs are assigned which value without having to lookup the declaration of the struct. And it's also more robust against changes to the struct definition. This patch doesn't modify the compiled array, only its representation in source form benefits. The former was confirmed with x86 and arm64 builds. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260519160721.1597568-2-u.kleine-koenig@baylibre.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20mlxsw: spectrum_ethtool: expose per-PG rx_discardsKeno Fischer2-0/+12
PPCNT group 0x10 (per-priority counters) carries an rx_discards field at offset 0x78. These counters aggregate up into if_in_discards, but don't show up anywhere else. Since there are many things that aggregate into `if_in_discards`, having these counters helps distinguish what caused those discards (in my case they were caused by headroom buffer overruns due to inappropriately configured buffer sizes). Of note, from emperical testing, these counter are per-"priority group" (PG) not per-"switch priority". It's a bit confusing, because the rest of these counter are per-"switch priority" and the header file calls these "Per Priority Group Counters". However, that should be read as "(Per Priority) Group Counters", not "Per (Priority Group) Counters". I attempted to distinguish this in the counter naming by calling these `rx_discards_pg_N` rather than `rx_discards_prio_N` (which is the naming scheme of the other counters in this PPCNT group). I will also note that the mlx5 driver (which already has this counter) uses the schme `rx_prioN_discards` (and same for the other counters in this group). However, I was unable to determine whether the mlx5 counters behave the same as the mlxsw counters with respect to PG mapping. An attempt to remap to a different PG there did not change which counter incremented, but the mlx5 configuration code is quite different, so it's possible the remapping needs to be done differently. Signed-off-by: Keno Fischer <keno@juliahub.com> Reviewed-by: Petr Machata <petrm@nvidia.com> Link: https://patch.msgid.link/agqkMwgM1PdkyMUR@juliahub.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20net: ethernet: ti: am65-cpsw-nuss: remove dead vid check in slave_add_vid()Alexander Vassilevski1-4/+2
am65_cpsw_nuss_ndo_slave_add_vid() returns early at the top with: if (!netif_running(ndev) || !vid) return 0; so vid is guaranteed to be non-zero in the rest of the function. The subsequent if (!vid) unreg_mcast = port_mask; is therefore unreachable. Drop the dead branch. With that branch gone, unreg_mcast is only ever its initializer value of zero, so drop the variable and pass 0 directly to cpsw_ale_vlan_add_modify(). No functional change. Found by Smatch. Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/aS_lhMwppbDHoEcX@stanley.mountain Signed-off-by: Alexander Vassilevski <oss@vassilevski.com> Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com> Link: https://patch.msgid.link/20260517220757.2679458-1-oss@vassilevski.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20net: usb: qmi_wwan: add MeiG SRM813QJan Volckaert1-0/+2
Add support for the Qualcomm Technology Snapdragon X35-based MeiG SRM813Q module. The module can be put in different modes via AT commands to enable/disable GPS functionality: MODEM - PPP mode(2dee:4d63): AT+SER=1,1 If#= 0: RMNET If#= 1: DIAG/ADB If#= 2: MODEM If#= 3: AT P: Vendor=2dee ProdID=4d63 Rev=05.15 S: Manufacturer=MEIG S: Product=LTE-A Module S: SerialNumber=1bd51f0e C: #Ifs= 4 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms NMEA mode(2dee:4d64): AT+SER=51,1 If#= 0: RMNET If#= 1: DIAG/ADB If#= 2: NMEA If#= 3: AT P: Vendor=2dee ProdID=4d64 Rev=05.15 S: Manufacturer=MEIG S: Product=LTE-A Module S: SerialNumber=1bd51f0e C: #Ifs= 4 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms Signed-off-by: Jan Volckaert <janvolck@gmail.com> Link: https://patch.msgid.link/20260517153237.55995-2-janvolck@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20net: ag71xx: check error for platform_get_irqRosen Penev1-0/+3
Complete error handling for a failed platform_get_irq() call Fixes: d51b6ce441d3 ("net: ethernet: add ag71xx driver") Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de> Link: https://patch.msgid.link/20260516212616.11758-1-rosenp@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20net: phy: realtek: support MDI swapping for RTL8226-CGJan Hoffmann1-0/+154
Add support for configuring swapping of MDI pairs (ABCD->DCBA) when the property "enet-phy-pair-order" is specified. Unfortunately, no documentation about this feature is available, but this implementation still tries to avoid magic numbers and raw register numbers where it seems clear what is going on. As it is unknown whether the patching step can be safely reversed, only enabling MDI swapping is fully supported. A value of "0" for the "enet- phy-pair-order" property is not accepted if the PHY has already been patched for MDI swapping (however, this should not occur in practice). Some other Realtek PHYs also support similar mechanisms: - RTL8221B-VB-CG allows to configure MDI swapping via the same register, but does not need the additional patching step. However, it is unclear whether a driver implementation for that PHY is necessary, as it is known to support configuration via strapping pins (which is working fine at least in Zyxel XGS1210-12 rev B1). - The patching step seems to match the one for the integrated PHYs of some Realtek PCIe/USB NICs (see for example the r8152 driver). For now, only implement this for the RTL8226-CG PHY, where it is needed for the switches Zyxel XGS1010-12 rev A1 and XGS1210-12 rev A1. Signed-off-by: Jan Hoffmann <jan@3e8.eu> Link: https://patch.msgid.link/20260516190456.387768-1-jan@3e8.eu Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SAPrathamesh Deshpande1-3/+4
mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. That path jumps to the common success label before taking the eswitch mode block. After tunnel-mode validation was moved earlier, the common success label unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs, this decrements esw->offloads.num_block_mode without a matching increment. Return directly after installing the acquire SA offload handle, so only the paths that successfully called mlx5_eswitch_block_mode() call the matching unblock. Fixes: 22239eb258bc ("net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed") Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260510225903.13184-1-prathameshdeshpande7@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20Revert "Merge branch 'gve-add-support-for-ptp-gettimex64'"Jakub Kicinski5-344/+96
This reverts commit 9587ed8137fb83d93f84b858337412f4500b21e9, reversing changes made to bcdfd9fb109e0c9d76c345b2346b6b75ed1f476d. Per tglx's objections: https://lore.kernel.org/87mrxtwzz9.ffs@tglx Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20wifi: ath10k: update outdated comment for renamed ieee80211_tx_status()Kexin Sun1-1/+1
The function ieee80211_tx_status() was renamed to ieee80211_tx_status_skb() by commit 2703bc851399 ("wifi: mac80211: rename ieee80211_tx_status() to ieee80211_tx_status_skb()"). Update the stale reference in ath10k_htt_tx_hl(). Assisted-by: unnamed:deepseek-v3.2 coccinelle Signed-off-by: Kexin Sun <kexinsun@smail.nju.edu.cn> Link: https://patch.msgid.link/20260321110011.8556-1-kexinsun@smail.nju.edu.cn Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-05-20wifi: ath11k: fix warning when unbindingJose Ignacio Tornos Martinez1-0/+1
If there is an error during some initialization related to firmware, the buffers dp->tx_ring[i].tx_status are released. However this is released again when the device is unbinded (ath11k_pci), and we get: WARNING: CPU: 0 PID: 6231 at mm/slub.c:4368 free_large_kmalloc+0x57/0x90 Call Trace: free_large_kmalloc ath11k_dp_free ath11k_core_deinit ath11k_pci_remove ... The issue is always reproducible from a VM because the MSI addressing initialization is failing. In order to fix the issue, just set the buffers to NULL after releasing in order to avoid the double free. Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Cc: stable@vger.kernel.org Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Link: https://patch.msgid.link/20260420110130.509670-1-jtornosm@redhat.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-05-20wifi: rtw89: switch to using FIELD_GET_SIGNED()Yury Norov4-8/+8
Switch from sign_extend32(FIELD_GET()) to the dedicated FIELD_GET_SIGNED() and don't calculate the fields length explicitly. Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Yury Norov <ynorov@nvidia.com>
2026-05-20p54spi: convert to devicetreeArnd Bergmann2-44/+26
The Prism54 SPI driver hardcodes GPIO numbers and expects users to pass them as module parameters, apparently a relic from its life as a staging driver. This works because there is only one user, the Nokia N8x0 tablet. Convert this to the gpio descriptor interface and DT based probing to improve this and simplify the code at the same time. Acked-by: Christian Lamparter <chunkeey@gmail.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://patch.msgid.link/20260507212451.3333185-3-arnd@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-20wifi: mac80211_hwsim: Do not declare NAN support for Extended Key IDIlan Peer1-2/+0
Do not declare support for Extended Key ID for NAN, as defined in section 7.4 in the WiFi Aware specification v4.0 (in order to support security association upgrade). Fixes: eaa7ce66c3e2 ("wifi: mac80211_hwsim: Fix possible NULL dereference") Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260515141442.365ca3ab29f9.Ib435168dcc1d7d8719a5612109035ca1950967ed@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-20wifi: mac80211_hwsim: advertise NPCA capabilityJohannes Berg1-0/+21
This doesn't really do anything, but we can advertise it and then check that the AP can be configured and client can connect, etc. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260512224724.abfd51f480b7.I2024d7fc8067a0fca26234f312937cc764b660f4@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-20wifi: mac80211_hwsim: reject NAN on multi-radio wiphysDeepanshu Kartikey1-1/+7
When userspace creates a new hwsim radio with both HWSIM_ATTR_MULTI_RADIO and HWSIM_ATTR_SUPPORT_NAN_DEVICE, hwsim_new_radio_nl() sets BIT(NL80211_IFTYPE_NAN_DATA) in wiphy->interface_modes while configuring the wiphy with n_radio > 1. This violates the invariant checked in wiphy_register(): (interface_modes & BIT(NL80211_IFTYPE_NAN_DATA)) && (!nan_capa.phy.ht.ht_supported || n_radio > 1) triggering a WARN reachable from userspace via genetlink. With panic_on_warn this becomes a denial of service. Refuse the combination at parse time with -EINVAL and an extack message, matching the cfg80211 constraint that NAN is not supported on multi-radio wiphys. Reported-by: syzbot+2002864e6c6895cb0ac3@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2002864e6c6895cb0ac3 Fixes: 2c7c70ee7cee ("wifi: mac80211_hwsim: enable NAN_DATA interface simulation support") Tested-by: syzbot+2002864e6c6895cb0ac3@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com> Link: https://patch.msgid.link/20260509004628.79446-1-kartikey406@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-20wifi: plfxlc: use module_usb_driver() macroRosen Penev1-23/+2
init and exit do nothing interesting that module_usb_driver doesn't already handle. Just use module_usb_driver to simplify the code. Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260507015457.239807-1-rosenp@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-20wifi: rt2x00: allocate anchor with rt2x00devRosen Penev2-11/+3
Instead of being creative with devm, allocate with rt2x00dev by using a flexible array member. Simplifies code slightly. It's worth noting that in 25369b22223d1c56e42a0cd4ac9137349d5a898e , the proper device was set to the devm call as it seems there was confusion there. Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Stanislaw Gruszka <stf_xl@wp.pl> Link: https://patch.msgid.link/20260430232206.141461-1-rosenp@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>