summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)AuthorFilesLines
2026-08-05pds_core: add host backed memory support for firmwareNikhil P. Rao3-0/+184
Some newer AMD/Pensando cards have minimal memory and there are cases where components, specifically in the control plane, need more memory. This series adds support for host backed DMA memory that can be used by the firmware for the previously mentioned cases. Host memory allocation is best-effort: if some allocations fail, the driver continues with whatever succeeded. Firmware gracefully degrades when less memory is available than requested. Signed-off-by: Vamsi Atluri <Vamsi.Atluri@amd.com> Signed-off-by: Nikhil P. Rao <nikhil.rao@amd.com> Link: https://patch.msgid.link/20260730-upstream_v8-v12-5-136cd174ee85@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05pds_core: add PLDM component info displayBrett Creeley2-5/+142
Add detailed component information display via devlink info. This allows users to see individual firmware components and their versions. Components are reported as fixed, running, or stored based on their firmware-provided flags. Example output: $ devlink dev info pci/0000:00:05.0 versions: fixed: asic.id 0x0 asic.rev 0x0 running: fw.bootloader 1.2.3 fw.uboot 1.60.0-73 fw 1.60.0-73 fw.cpld 3.18 stored: fw.bootloader 1.2.3 fw.uboot 1.60.0-73 fw.uboot.gold 1.50.0-22 fw.gold 1.50.0-22 fw 1.60.0-73 fw.cpld 3.18 Signed-off-by: Brett Creeley <brett.creeley@amd.com> Link: https://patch.msgid.link/20260730-upstream_v8-v12-4-136cd174ee85@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05pds_core: add PLDM firmware update support via devlink flashBrett Creeley7-11/+921
Implement PLDM FW Update in the pds_core driver using the upstream pldmfw API. This allows updating an entire PLDM FW package at once or updating specific firmware components by name. Flash the entire image: devlink dev flash pci/0000:b5:00.0 file firmware.pldmfw Flash a specific component from the PLDM FW package: devlink dev flash pci/0000:b5:00.0 \ file firmware.pldmfw component fw.cpld Per-component update uses driver-defined component names (fw, fw.cpld, etc.). Not all components support per-component update - devlink will reject the request if the specified component cannot be updated. Signed-off-by: Brett Creeley <brett.creeley@amd.com> Signed-off-by: Nikhil P. Rao <nikhil.rao@amd.com> Link: https://patch.msgid.link/20260730-upstream_v8-v12-3-136cd174ee85@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05pds_core: add support for identity version 2Brett Creeley1-9/+35
Add a new capabilities field in struct pds_core_dev_identity, which requires bumping the identity version to 2, i.e. PDS_CORE_IDENTITY_VERSION_2. If version 2 negotiation fails, then quietly fall back to version 1. If version 1 negotiation fails, then driver load will fail. Another patch in the series will make use of the capabilities field. Signed-off-by: Brett Creeley <brett.creeley@amd.com> Link: https://patch.msgid.link/20260730-upstream_v8-v12-2-136cd174ee85@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05pds_core: add support for quiet devcmd failuresBrett Creeley1-5/+13
Currently there aren't any use-cases that require special handling on whether or not to print devcmd failures. Specifically non-generic failures, i.e. not supported failures. Add support to allow these messages to be suppressed. This will be used when adding support to negotiate PDS_CORE_IDENTITY_VERSION_2. Signed-off-by: Brett Creeley <brett.creeley@amd.com> Link: https://patch.msgid.link/20260730-upstream_v8-v12-1-136cd174ee85@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05net: phy: nxp-tja11xx: cancel registration work on removeHongyan Xu1-0/+9
tja1102_p0_probe() schedules work to register the second port. That work uses the Port 0 private data and phydev. The private data is devm-allocated, but the driver does not wait for the pending work on remove. Store the Port 0 private data in phydev->priv and add a remove callback. The callback cancels the registration work before devres teardown frees the state. This issue was found by a static analysis tool. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn> Link: https://patch.msgid.link/20260801140643.1871-1-getshell@seu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05pfcp: Support per-netns netdev unregistration.Kuniyuki Iwashima1-5/+7
pfcp_net_exit_rtnl() iterates pfcp devices whose sockets are in the dying netns and queues them for destruction. So the devices may reside in different netns. Let's use unregister_netdevice_queue_net() to support per-netns device unregistration. list_del() is changed to list_del_init() to avoid queueing the same device twice. Even after pfcp_net_exit_rtnl() queues a cross-netns pfcp device, pfcp_dellink() could be called concurrently for it (once RTNL is removed). In such a case, __rtnl_net_unlock() will perform the unregistration. We can see pfcp0 below is unregistered by the per-netns work instead of cleanup_net(). # bpftrace -e '#include <linux/netdevice.h> kprobe:pfcp_dev_uninit { $dev = (struct net_device *)arg0; printf("PID: %d | DEV: %s%s\n", pid, $dev->name, kstack()); } kprobe:pfcp_net_exit_rtnl { printf("PID: %d%s\n", pid, kstack()); }' & # ip netns add ns1 # ip netns add ns2 # ip -n ns1 link add pfcp0 link-netns ns2 type pfcp # ip netns del ns2 PID: 12 pfcp_net_exit_rtnl+5 ops_undo_list+702 cleanup_net+1122 process_scheduled_works+2538 ... PID: 462 | DEV: pfcp0 pfcp_dev_uninit+5 unregister_netdevice_many_notify+7129 unregister_netdevice_many_net+1050 rtnl_net_work_func+136 process_scheduled_works+2538 Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260731224406.2444121-3-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05pfcp: Protect pfcp_net.pfcp_dev_list with mutex.Kuniyuki Iwashima1-2/+24
struct pfcp_dev.net is the netns where the backend pfcp socket resides. struct pfcp_dev is linked to the pfcp_net.pfcp_dev_list of the socket's netns. During netns dismantle or module unload, pfcp_net_exit_rtnl() iterates the list and queues devices for destruction regardless of the devices' netns. Thus, once RTNL is removed, the list can be modified concurrently from different netns due to device removal. Let's protect it with per-netns mutex. Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260731224406.2444121-2-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05net: prestera: validate firmware header lengthPengpeng Hou1-0/+3
prestera_fw_hdr_parse() reads the firmware header before checking that the firmware image contains that header. Reject images shorter than struct prestera_fw_header before decoding the magic and version fields. Fixes: 4c2703dfd7fabb ("net: marvell: prestera: Add PCI interface support") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Acked-by: Elad Nachman <enachman@marvell.com> Link: https://patch.msgid.link/20260731141500.1-prestera-v2-pengpeng@iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()Dongli Zhang1-10/+14
The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") fixed a crash in tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb(). This is required because virtio_net_hdr_to_skb() may invoke dev_parse_header_protocol(), which dereferences skb->dev. Without the assignment, a NULL pointer dereference can occur. However, tap_get_user_xdp() still parses the virtio-net header before assigning skb->dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header but the protocol is set to zero on purpose, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev is still NULL, resulting in a crash. Fix this by looking up the tap device and assigning skb->dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). Preserve the existing RCU read-side critical section across dev_queue_xmit(). Fixes: 924a9bc362a5 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct") Cc: stable@vger.kernel.org Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Link: https://patch.msgid.link/20260802224612.264563-1-dongli.zhang@oracle.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05qlcnic: drop unneeded semicolonJulia Lawall1-1/+1
When a function-like macro expands to an expression, that expression doesn't need a semicolon after it. All uses have been verified to have their own semicolons. This was found using the following Coccinelle semantic patch: @r@ identifier i : script:ocaml() { String.lowercase_ascii i = i }; expression e; @@ *#define i(...) e; Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr> Link: https://patch.msgid.link/20260801191002.1383835-5-Julia.Lawall@inria.fr Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05net: macb: remove unused ENST Q0/Q1 time register definesVineeth Karumanchi1-6/+0
The ENST start/on/off time register definitions for Q0 and Q1 are not referenced anywhere in the driver. The driver calculates these register addresses from the ENST base offset and the queue index instead of using fixed defines, removing the unused macros. Signed-off-by: Vineeth Karumanchi <vineeth.karumanchi@amd.com> Reviewed-by: Théo Lebrun <theo.lebrun@bootlin.com> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Reviewed-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260803062834.3865755-1-vineeth.karumanchi@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05Merge tag 'nf-next-26-07-31' of ↵Jakub Kicinski2-6/+14
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for net-next: 1) Update conncount to use the original tuple after ct lookup to ensure consistent counting, from Fernando F. Mancera. 2) Remove redundant net_device field in info structure that helps parse the flowtable path discovery. 3) Move net_device to flowtable check to the flowtable discovery path parser. This is preparation work to pass the tunnel dst_entry via .fill_forward_path. 4) Update DSA .fill_forward_path to break at the user DSA, since the conduit DSA is not used in the datapath. This slighly simplifies the flowtable path discovery parser. 5) Do not advance index in the path stack prematurely, otherwise it points to uninitialized slots on error. Not an issue currently but it could be once tunnel dst_entry is passed via .fill_forward_path. 6) Pass the tunnel dst_entry via dev_fill_forward_path(). 7) Update ipip and ip6ip6 tunnels to pass the dst_entry through dev_fill_forward_path(). 8) Call skb_valid_dst() before accessing skb_dst() to ensure dst_entry is not a template. 9) Use UNACK timeout when RST packet does not match the expected window while in ESTABLISHED state, the existing approach the CLOSE state timeout which is only 10 seconds. Adopt a more conservative timeout by default for this case. * tag 'nf-next-26-07-31' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets netfilter: nf_tables: call skb_valid_dst() before skb_dst() netfilter: flowtable: release tunnel route on error when building forward path net: pass dst via net_device_path in dev_fill_forward_path() net: do not advance stack index from dev_fwd_path() net: dsa: stop at the user device in .fill_forward_path netfilter: flowtable: consolidate flowtable device check netfilter: flowtable: consolidate net_device field in nft_forward_info struct netfilter: conncount: normalize tuple and zone on successful ct lookup ==================== Link: https://patch.msgid.link/20260731153402.851224-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04bnge: send hwrm for interface down/up transitionsVikas Gupta1-2/+30
Firmware expects HWRM_FUNC_DRV_IF_CHANGE on interface down/up transitions to coordinate resource management. Add bnge_hwrm_if_change() to send this notification. Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com> Reviewed-by: Dharmender Garg <dharmender.garg@broadcom.com> Reviewed-by: Rahul Gupta <rahul-rg.gupta@broadcom.com> Link: https://patch.msgid.link/20260731163712.3463362-4-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04bnge: add ndo_set_rx_mode_async supportVikas Gupta2-11/+62
Register bnge_set_rx_mode() as ndo_set_rx_mode_async to handle unicast, multicast, broadcast, and promiscuous filter updates via CFA_L2_SET_RX_MASK. The async variant receives pre-snapshotted address lists from the kernel, allowing the driver to issue sleepable HWRM firmware commands without holding the addr lock. Move uc_update detection to the caller so the async path can compute it directly from the snapshotted UC list before calling bnge_cfg_rx_mode(). Handle -EAGAIN from bnge_hwrm_set_vnic_filter() and bnge_hwrm_cfa_l2_set_rx_mask() on the open path by scheduling a retry via netif_rx_mode_schedule_retry() rather than failing the open. Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com> Reviewed-by: Dharmender Garg <dharmender.garg@broadcom.com> Reviewed-by: Rahul Gupta <rahul-rg.gupta@broadcom.com> Link: https://patch.msgid.link/20260731163712.3463362-3-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04bnge: refactor rx mode helpers to accept explicit address listsVikas Gupta1-16/+23
Rename bnge_cfg_def_vnic() to bnge_cfg_rx_mode() and update bnge_mc_list_updated() and bnge_uc_list_updated() to accept explicit netdev_hw_addr_list pointers rather than deriving them from the netdev. Add a snapshot parameter to bnge_cfg_rx_mode() to skip netif_addr_lock_bh() when the caller provides a pre-snapshotted list. On the open path (snapshot=false), the live netdev UC list is passed and the addr lock is taken as before. Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com> Reviewed-by: Dharmender Garg <dharmender.garg@broadcom.com> Reviewed-by: Rahul Gupta <rahul-rg.gupta@broadcom.com> Link: https://patch.msgid.link/20260731163712.3463362-2-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04bnxt_en: Fix PTP PPS setting bugKeegan Freyhof1-2/+5
The existing driver logic is always turning on PTP_CLK_REQ_PPS regardless of the "on" parameter passed to bnxt_ptp_enable(). During shutdown, PTP_CLK_REQ_PPS may be turned off and this bug will do the opposite and may trigger a PCIe PTM request TLP. On some systems this can trigger a PCIe AER. Fix it by properly configuring PTP_CLK_REQ_PPS based on the "on" parameter. Fixes: 9e518f25802c ("bnxt_en: 1PPS functions to configure TSIO pins") Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Signed-off-by: Keegan Freyhof <keegan.freyhof@broadcom.com> Signed-off-by: Michael Chan <michael.chan@broadcom.com> Link: https://patch.msgid.link/20260731190937.807270-6-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04bnxt_en: Disable EOP for TPA on all chips to prevent data corruptionMichael Chan1-4/+7
EOP (End of frame padding) on the AGG ring may cause overlapping of zero padding at the end of one segment with the next segment's data. If Relaxed Ordering (RO) is enabled, the zero padding may overwrite valid data in the next segment and corrupt the data. Older chips (P5 and older) do not automatically disable RO when EOP is enabled. On some ARM systems, data corruption was reported on 57508 (P5) chips with RO enabled. Always disable EOP on all chips on the AGG rings when TPA is enabled to fix the data corruption. Fixes: bfcd8d791ec1 ("bnxt_en: Add fast path logic for TPA on 57500 chips.") Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Signed-off-by: Michael Chan <michael.chan@broadcom.com> Link: https://patch.msgid.link/20260731190937.807270-5-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04bnxt_en: Refresh VNIC default ring on queue restart if neededShravya KN1-0/+5
When a queue is restarted, refresh VNIC_CFG for all VNICs whose default RX ring is the restarted ring. This will eliminate this possible FW warning caused by a stale default ring in the VNIC: FW reported unknown error type 10 Fixes: 5ac066b7b062 ("bnxt_en: Fix queue start to update vnic RSS table") Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Signed-off-by: Shravya KN <shravya.k-n@broadcom.com> Signed-off-by: Michael Chan <michael.chan@broadcom.com> Link: https://patch.msgid.link/20260731190937.807270-4-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04bnxt_en: Determine and store default RX ring in vnic structureShravya KN2-11/+23
Each VNIC has a default RX ring. The purpose of the default RX ring is to provide a destination for any packets that cannot be parsed by the RSS logic. Up until now, the default RX ring is always Ring 0. We neglected to take care of this default RX ring when adding the queue restart feature. If ring 0 (default ring) is re-started, it may now have a new FW ring ID after freeing the old one and allocating a new one. The VNIC now may have a stale default ring and it may generate an internal exception. This exception may appear in dmesg: FW reported unknown error type 10 The best way to resolve this issue is to use a more appropriate ring for the default ring instead of always ring 0. Ring 0 may not even be in the RSS table, especially on a new RSS context. This patch adds the logic to determine and store the proper default RX ring for a VNIC. For an RSS VNIC, the default ring is the lowest ring number in the RSS table. The next patch will add proper logic to update the VNIC if the default ring changes after queue restart. Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Signed-off-by: Shravya KN <shravya.k-n@broadcom.com> Signed-off-by: Michael Chan <michael.chan@broadcom.com> Link: https://patch.msgid.link/20260731190937.807270-3-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss()Shravya KN1-7/+7
This is a refactor patch with no change in behavior. The caller will now fill the RSS table before calling __bnxt_hwrm_vnic_set_rss(). In the next patch, we'll add code to determine the default ring for the VNIC when we fill the RSS table. Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com> Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Signed-off-by: Shravya KN <shravya.k-n@broadcom.com> Signed-off-by: Michael Chan <michael.chan@broadcom.com> Link: https://patch.msgid.link/20260731190937.807270-2-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04net/mlx5e: fix BQL reset on SQ re-activationBobby Eshleman1-1/+3
mlx5e_queue_start() deactivates and re-activates all channels but closes only the queue being restarted. mlx5e_activate_txqsq() then unconditionally calls netdev_tx_reset_queue(), zeroing the BQL counters of channels that kept their in-flight TX WQEs. The next completion then over-charges and trips the BUG_ON() in dql_completed(): kernel BUG at lib/dynamic_queue_limits.c:99! RIP: 0010:dql_completed+0x23d/0x280 Call Trace: <IRQ> mlx5e_poll_tx_cq+0x668/0xa60 mlx5e_napi_poll+0x5b/0x7b0 net_rx_action+0x15a/0x580 Reset BQL only when the SQ has no bytes in flight (sq->cc == sq->pc). In the case that reset is skipped, the outstanding WQEs will eventually complete and rebalance the dql. The dql->limit is carried across the reset. Fixes: b2588ea40ec9 ("net/mlx5e: Implement queue mgmt ops and single channel swap") Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260803-mlx5-bql-v3-1-a30d4c66fe1d@meta.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04net: bonding: check register_netdevice_notifier() error in bonding_init()Minhong He1-1/+3
bonding_init() ignores register_netdevice_notifier() errors and still returns success, which can leave the bonding module loaded without its netdev notifier registered. Check the error and unwind prior initialization on failure. This is a future looking check, register_netdevice_notifier() only fails on double registration or if the registered notifier itself returns an error. Signed-off-by: Minhong He <heminhong@kylinos.cn> Acked-by: Jay Vosburgh <jv@jvosburgh.net> Link: https://patch.msgid.link/20260803090012.142638-1-heminhong@kylinos.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04net: vrf: check register_netdevice_notifier() error in vrf_init_module()Minhong He1-1/+3
vrf_init_module() ignores register_netdevice_notifier() errors and continues module initialization, which can leave VRF loaded without its netdev notifier registered. Check the error and fail module initialization early. This is a future looking check, register_netdevice_notifier() only fails on double registration or if the registered notifier itself returns an error. Signed-off-by: Minhong He <heminhong@kylinos.cn> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20260803090002.142453-1-heminhong@kylinos.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04net: macvlan: check register_netdevice_notifier() error in macvlan_init_module()Minhong He1-1/+3
macvlan_init_module() ignores register_netdevice_notifier() errors and continues module initialization, which can leave macvlan loaded without its netdev notifier registered. Check the error and fail module initialization early. This is a future looking check, register_netdevice_notifier() only fails on double registration or if the registered notifier itself returns an error. Signed-off-by: Minhong He <heminhong@kylinos.cn> Link: https://patch.msgid.link/20260803085950.142325-1-heminhong@kylinos.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04net: team: check register_netdevice_notifier() error in team_module_init()Minhong He1-1/+3
team_module_init() ignores register_netdevice_notifier() errors and continues module initialization, which can leave the team module loaded without its netdev notifier registered. Check the error and fail module initialization early. This is a future looking check, register_netdevice_notifier() only fails on double registration or if the registered notifier itself returns an error. Signed-off-by: Minhong He <heminhong@kylinos.cn> Link: https://patch.msgid.link/20260803085943.142261-1-heminhong@kylinos.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04net: lapbether: check register_netdevice_notifier() error in ↵Minhong He1-1/+7
lapbeth_init_driver() lapbeth_init_driver() ignores register_netdevice_notifier() errors and always returns success, which can leave the module loaded without its netdev notifier registered. Check the error and remove the packet type on failure. This is a future looking check, register_netdevice_notifier() only fails on double registration or if the registered notifier itself returns an error. Signed-off-by: Minhong He <heminhong@kylinos.cn> Link: https://patch.msgid.link/20260803085936.142160-1-heminhong@kylinos.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04usbnet: cap max_mtu for drivers without bind callbackLaurent Vivier1-1/+2
usbnet_probe() initializes max_mtu to ETH_MAX_MTU and only caps it inside the if (info->bind) block. Drivers without a bind callback never enter this block, so max_mtu stays at ETH_MAX_MTU. QEMU's usb-net device (0x0525/0xa4a2) is claimed by the cdc_subset driver which has no bind callback. The guest accepts any MTU from DHCP (e.g. 65520 from passt), leading to TCP segments that exceed the device's 2048-byte receive buffer and are silently dropped. Initialize max_mtu to net->mtu at probe time and update it inside the bind block. Fixes: f77f0aee4da4 ("net: use core MTU range checking in USB NIC drivers") Cc: jarod@redhat.com Cc: stable@vger.kernel.org Link: https://gitlab.com/qemu-project/qemu/-/issues/3268 Link: https://bugs.passt.top/show_bug.cgi?id=189 Signed-off-by: Laurent Vivier <lvivier@redhat.com> Link: https://patch.msgid.link/20260731092711.857684-1-lvivier@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04bnge: use int for bnge_fix_rings_count() return valueAlok Tiwari1-1/+2
bnge_fix_rings_count() returns 0 on success or a negative errno on failure However, bnge_adjust_rings() stores its return value in a u16 variable, causing negative error codes such as -ENOMEM to be converted to a large positive value. Use an int for the return code variable so that error values are preserved and propagated correctly. Fixes: 627c67f038d2 ("bng_en: Add resource management support") Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Reviewed-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com> Link: https://patch.msgid.link/20260801100923.1498570-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04net: atlantic: free RX pages of consumed but not refilled buffersYangyu Chen1-4/+18
aq_ring_rx_deinit() only walks [sw_head, sw_tail), the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page (and its DMA mapping) in the ring for reuse, and refill is batched: aq_ring_rx_fill() returns early until AQ_CFG_RX_REFILL_THRES slots are free. Slots that were consumed but not yet reposted therefore sit in the complementary [sw_tail, sw_head) gap with a live page, and the deinit walk never visits them: up to a refill batch worth of pages and DMA mappings leak on every interface down. Walk the whole ring instead and release whatever is still there. Also bail out if the buffer ring is already gone: a partial aq_ptp_ring_alloc() failure frees the ring but leaves aq_nic set, so aq_ptp_ring_deinit() still gets here on the unwind path. Cc: stable@vger.kernel.org # v5.2+ Fixes: 46f4c29d9de6 ("net: aquantia: optimize rx performance by page reuse strategy") Reviewed-by: Sukhdeep Singh <sukhdeeps@marvell.com> Signed-off-by: Yangyu Chen <cyy@cyyself.name> Acked-by: Mina Almasry <almasrymina@google.com> Link: https://patch.msgid.link/tencent_607CBA8237DA438E36B844318B21538DE008@qq.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04net: atlantic: free stranded TX buffers on ring deinitYangyu Chen3-1/+31
aq_vec_deinit() drains the TX rings with a single aq_ring_tx_clean() call, which frees at most AQ_CFG_TX_CLEAN_BUDGET (256) descriptors and stops at hw_head, which no longer moves once aq_vec_stop() has stopped the hardware and NAPI. Completed descriptors beyond the budget and everything still posted in [hw_head, sw_tail) keep their skb or xdp_frame when the interface goes down: aq_vec_ring_free() then frees the buffer ring and the references are lost for good. Today this is a silent memory leak on every interface down under TX/XDP_TX load. With the conversion of the RX path to page_pool posted for net-next it becomes much more visible: XDP_TX frames carry fragment references on the RX ring's page_pool, so a single stranded frame keeps the pool's inflight count above zero forever. page_pool_destroy() then never completes, the pool is leaked together with its pages, and "page_pool_release_retry() stalled pool shutdown" is warned every 60 seconds from that point on, on every ifdown, XDP detach or ring resize under XDP_TX load. Bring back aq_ring_tx_deinit() as it was before the removal and use it for teardown again, with one extension: TX rings can hold xdp_frames nowadays, so release those too. They are returned with xdp_return_frame() since this runs in process context. Fixes: eb36bedf28be ("net: aquantia: remove function aq_ring_tx_deinit") Cc: stable@vger.kernel.org # v4.11+ Reviewed-by: Sukhdeep Singh <sukhdeeps@marvell.com> Signed-off-by: Yangyu Chen <cyy@cyyself.name> Acked-by: Mina Almasry <almasrymina@google.com> Link: https://patch.msgid.link/tencent_EEDC35FAF2750A3A6A0B39BAE0E2C484860A@qq.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04net: stmmac: resume PHY before hardware setup when opening the interfaceStefan Agner1-0/+9
Since the referenced commit, changing the MTU on a running interface no longer disconnects and reconnects the PHY; __stmmac_release() merely stops phylink, which also suspends the PHY (BMCR power-down) when WoL is not enabled. __stmmac_open() then performs the DMA software reset in stmmac_hw_setup() before phylink_start() resumes the PHY again. IEEE 802.3 22.2.4.1.5 allows a PHY to stop its receive clock while powered down, and stmmac requires a running receive clock for the DMA software reset to complete (the phylink config sets mac_requires_rxc). On such setups, e.g. the RK3566-based Home Assistant Green with an RTL8211F-VD PHY in RGMII mode, any runtime MTU change now times out and leaves the interface dead: rk_gmac-dwmac fe010000.ethernet end0: Failed to reset the dma rk_gmac-dwmac fe010000.ethernet end0: stmmac_hw_setup: DMA engine initialization failed rk_gmac-dwmac fe010000.ethernet end0: __stmmac_open: Hw setup failed rk_gmac-dwmac fe010000.ethernet end0: failed reopening the interface after MTU change In the field this is triggered by NetworkManager applying an MTU while activating the connection, breaking networking entirely. The same regression has also been reported on i.MX8MP and reproduced on SoCFPGA based systems. Resume the PHY in __stmmac_open() before the hardware setup, making it the counterpart of the phylink_stop() in __stmmac_release(), like stmmac_resume() already does for the same reason. phylink_start() also resumes the PHY, but only after stmmac_hw_setup(), and it cannot be moved before the hardware setup since it may bring the link up immediately from a workqueue, racing with the initialization (see the comment in stmmac_resume()). For the regular ndo_open path the PHY has just been attached and is not suspended, in which case phylink_prepare_resume() does nothing. Fixes: db299a0c09e9 ("net: stmmac: move PHY handling out of __stmmac_open()/release()") Link: https://github.com/home-assistant/operating-system/issues/4858 Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com> Signed-off-by: Stefan Agner <stefan@agner.ch> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260803095156.132827-1-stefan@agner.ch Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04net: microchip: vcap api: Fix possible memory leak in vcap_decode_rule()Abdun Nihaal1-3/+6
The memory allocated for struct vcap_rule_internal, keyfields and actionfields inside vcap_dup_rule() are not freed in some of the error paths in vcap_decode_rule(). Fix that by calling vcap_free_rule(). Compile tested only. Issue found using a prototype static analysis tool built on top of the LLVM compiler infrastructure. Cc: stable+noautosel@kernel.org # untested fix to unlikely driver error path Reviewed-by: Joe Damato <joe@dama.to> Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Link: https://patch.msgid.link/20260801055507.47534-1-nihaal@cse.iitm.ac.in Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04Merge tag 'ovpn-net-20260730' of https://github.com/OpenVPN/ovpn-net-nextJakub Kicinski6-68/+204
Antonio Quartulli says: ==================== Included fixes: * use rcu_dereference_bh() instead of rcu_access_pointer() where the pointer is actually dereferenced * ensure TCP global variables are initialized before they can be accessed via netlink (e.g. when attaching a TCP socket) * actually disable IPv4 redirects on multipeer interfaces (the previous attempt was a no-op and did not survive netns moves) * hash a floated peer by its transport identity only, consistently with the add and lookup paths * zero the sockaddr padding before learning a floated endpoint so it does not leak into the by_transp_addr hash key * ensure the socket is owned by ovpn before dereferencing sk_user_data * rehash a peer in the by_transp_addr table when its remote endpoint is updated via CMD_PEER_SET * avoid re-adding to the hashtables a peer that was concurrently removed (use-after-free) * limit keepalive values to one day to avoid overflowing the delayed-work delay on 32-bit systems * add the missing rtnl_link_ops->get_size callback so link messages account for the nested mode attribute * tag 'ovpn-net-20260730' of https://github.com/OpenVPN/ovpn-net-next: ovpn: fix incorrect use of rcu_access_pointer() ovpn: ensure TCP vars are initialized first ovpn: disable IPv4 redirects on MP interfaces ovpn: hash floated peer by transport identity only ovpn: zero-initialize sockaddr before learning a floated endpoint ovpn: ensure socket is owned by ovpn before deref sk_user_data ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET ovpn: skip rehash for peers already removed from by_id ovpn: limit keepalive values to one day ovpn: add missing rtnl_link_ops->get_size callback ==================== Link: https://patch.msgid.link/20260730094624.4102963-1-antonio@openvpn.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04net: dsa: realtek: rtl8366rb: Fix up port isolationLinus Walleij1-5/+4
Sashiko reports that we incorrectly disable isolation in the setup loop while what we want to do is to enable it. Enable it by unconditionally setting the enable bit 0 in rtl8366rb_port_set_isolation() so a mask of 0 when passed in will enable isolation and isolate from ALL ports. Fix up the comments so it is clear what is going on, including a missing word in the helper function. Reported-by: Paolo Abeni <pabeni@redhat.com> Closes: https://sashiko.dev/#/patchset/20260630-rtl8366rb-improvements-v2-0-05eb9d6a37f5%40kernel.org Signed-off-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260731-rtl8366rb-fixes-v4-1-fbf0c95b829a@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04net: airoha: fix ARRAY_SIZE() division by zero on UP buildsLorenzo Bianconi1-1/+1
airoha_alloc_gdm_device() initializes the txq_lock[] array iterating over ARRAY_SIZE(dev->txq_lock). ARRAY_SIZE() expands to sizeof(dev->txq_lock) / sizeof((dev->txq_lock)[0]), but on UP builds (CONFIG_SMP unset, CONFIG_DEBUG_SPINLOCK unset) arch_spinlock_t is an empty struct, so sizeof(spinlock_t) is zero and the expression is a compile-time division by zero (undefined behavior), reported by clang as "division by zero is undefined [-Wdivision-by-zero]". Since the array is statically sized with AIROHA_NUM_NETDEV_TX_RINGS, use the named constant as loop bound instead of ARRAY_SIZE(). Fixes: 78a35725e533 ("net: airoha: defer GDM3/GDM4 WAN mode and GDM2 loopback to QoS offload") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607311850.6p0ZUVq4-lkp@intel.com/ Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> Link: https://patch.msgid.link/20260731-airoha-spinlock-array-fix-v1-1-863a7e239a5f@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04macvlan: require init-userns CAP_NET_ADMIN to raise bc_queue_lenXiang Mei (Microsoft)1-0/+9
IFLA_MACVLAN_BC_QUEUE_LEN accepts any u32 and becomes port->bc_queue_len_used, the only bound on port->bc_queue. rtnetlink checks CAP_NET_ADMIN against the target netns only, so a user who unshares a user+net namespace, creates a veth and puts a macvlan on it can set the backlog to 0xffffffff and flood broadcast frames until the host dies: Out of memory: Killed process 141 (su) UID:0 Kernel panic - not syncing: System is deadlocked on memory Call Trace: vpanic (kernel/panic.c:650) panic (kernel/panic.c:787) out_of_memory (mm/oom_kill.c:1166) __alloc_frozen_pages_noprof (mm/page_alloc.c:4914) alloc_pages_mpol (mm/mempolicy.c:2490) folio_alloc_noprof (mm/mempolicy.c:2591) filemap_fault (mm/filemap.c:3565) A fixed upper bound does not work. Deployments carrying 600-800 real-time audio streams run bc_queue_len=100000, and no constant serves both cases: the queue counts skbs, not bytes, and the frame size is attacker-chosen too (up to ETH_MAX_MTU on a veth the caller creates). Gate the elevated range on CAP_NET_ADMIN in the initial user namespace instead. A backlog of that size is a host-wide tuning decision, and an unprivileged owner of a namespace it created itself should not be able to make it; privileged configurations keep working unchanged.. Cc: stable+noautosel@kernel.org # local DoS by userns are a dime a dozen Reported-by: AutonomousCodeSecurity@microsoft.com Link: https://lore.kernel.org/r/20260706212556.3199234-1-xmei5@asu.edu Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu> Link: https://patch.msgid.link/20260729200621.2521588-1-xmei5@asu.edu Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04net: stmmac: remove ptpaddr/mmcaddr/estaddr "safe" initializationJisheng Zhang1-12/+0
These so called "safe" initializations aren't needed any more from sometime, but the unnecessaries are obvious after recent clean up by Russell. The code will correctly initialize them after getting the correct stmmac_hwif_entry by calling stmmac_hwif_find(). Signed-off-by: Jisheng Zhang <jszhang@kernel.org> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260803135745.12600-1-jszhang@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-04Merge tag 'qcom-drivers-for-7.3' of ↵Arnd Bergmann2-6/+9
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers Qualcomm driver updates for v7.3 Add Maili platform bindings for SCM, IMEM, AOSS, and PMIC GLINK. Add Shikra IMEM, RPM SMD, LLCC, and UBWC support, including handling for firmware-configured LLCC ECC interrupts. Add the generic Peripheral Authentication Service with SCM and OP-TEE backends, and migrate the MSM DRM and IPA drivers to it. Add SCM SMC-call tracepoints and configurable minidump delivery through always-on SRAM. Correct SCM download-mode pointer ordering and improve download-mode probe diagnostics. Rework the UBWC configuration database and add Milos and Shikra configuration. Add protection-domain mappings for SA8775P and QCS8300, support newer ICE versions, Hawi subsystem statistics, and SDM850 identification. Simplify Qualcomm SoC Kconfig selection and architecture dependencies. Use managed resources in EBI2 and RPMh RSC probe paths to correct cleanup on failures. * tag 'qcom-drivers-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (44 commits) soc: qcom: llcc: Skip ECC interrupt setup on Shikra, pre-configured by DSF dt-bindings: sram: Document qcom,shikra-imem compatible net: ipa: Switch to generic PAS TZ APIs firmware: qcom: scm: Add minidump SRAM support firmware: qcom: scm: use dev_err_probe() for dload address failure firmware: qcom: scm: Fix missing smp_load_acquire() dt-bindings: firmware: qcom,scm: Add minidump SRAM property drm/msm: Switch to generic PAS TZ APIs bus: qcom-ebi2: use managed resources for clocks and children soc: qcom: rpmh-rsc: manage PM notifiers with devres firmware: qcom: scm: Allow QSEECOM on Honor Magicbook Art 14 firmware: qcom: scm: instrument SMC call path with tracepoints firmware: qcom: scm: add trace events for the SMC call interface soc: qcom: Avoid SCM and SPM for cpuidle drivers soc: qcom: Make important drivers default soc: qcom: Restrict drivers per ARM/ARM64 soc: qcom: Hide all drivers behind selectable menu MAINTAINERS: Add maintainer entry for Qualcomm PAS TZ service firmware: qcom: Add a PAS TEE service firmware: qcom_scm: Migrate to generic PAS service ... Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-04geneve: Support per-netns netdev unregistration.Kuniyuki Iwashima1-5/+7
geneve_exit_rtnl_net() iterates geneve devices whose sockets are in the dying netns and queues them for destruction. So the devices may reside in different netns. Let's use unregister_netdevice_queue_net() to support per-netns device unregistration. list_del() is changed to list_del_init() to avoid queueing the same device twice. Even after geneve_exit_rtnl_net() queues a cross-netns geneve device, geneve_dellink() can be called concurrently for it. In such a case, __rtnl_net_unlock() will perform the unregistration. Note that geneve uses register_pernet_subsys() instead of _device(), so default_device_exit_batch() guarantees that the async per-netns works are flushed before ->exit(). Tested: 1. Create geneve device across two netns. # ip netns add ns1 # ip netns add ns2 # ip -n ns1 link add geneve0 link-netns ns2 type geneve external 2. Run bpftrace to check that geneve_uninit() is called between ->exit_rtnl() and ->exit(). # bpftrace -e '#include <linux/netdevice.h> kprobe:geneve_uninit { $dev = (struct net_device *)arg0; printf("PID: %d | DEV: %s%s\n", pid, $dev->name, kstack()); } kprobe:geneve_exit_rtnl_net, kprobe:geneve_exit_net { printf("PID: %d%s\n", pid, kstack()); }' 3. Remove the netns where the geneve socket resides # ip netns del ns2 Now, we can see geneve0 is unregistered by per-netns work instead of cleanup_net() and it finishes before ->exit() to avoid WARN_ON_ONCE(!list_empty(&gn->sock_list)) there. PID: 571 geneve_exit_rtnl_net+5 ops_undo_list+702 cleanup_net+1122 process_scheduled_works+2538 ... PID: 1047 | DEV: geneve0 geneve_uninit+5 unregister_netdevice_many_notify+7129 unregister_netdevice_many_net+1050 rtnl_net_work_func+136 process_scheduled_works+2538 ... PID: 571 geneve_exit_net+5 ops_undo_list+1064 cleanup_net+1122 process_scheduled_works+2538 ... Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260731164612.2148830-4-kuniyu@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-04geneve: Protect geneve_net and geneve_sock with per-netns mutex.Kuniyuki Iwashima1-14/+68
struct geneve_dev.net is the netns where the backend geneve socket resides. struct geneve_dev is linked to the geneve_net.geneve_list of the socket's netns. During netns dismantle or module unload, geneve_exit_rtnl_net() iterates the list and queues devices for destruction regardless of devices' netns. Moreover, a socket can be shared by multiple geneve devices in different netns, and geneve_open() and geneve_stop() modify geneve_sock.vni_list and geneve_net.sock_list. Thus, once RTNL is removed, the three lists can be modified concurrently from different netns due to device removal and link-up/down. Let's protect them with per-netns mutex. geneve_newlink() is still protected by rtnl_net_lock()s, so acquiring gn->lock twice in geneve_find_dev() and geneve_configure() is not a problem. Note that udp_tunnel_notify_add_rx_port() is moved outside of the mutex, otherwise gn->lock -> utn->lock ordering would trigger AB-BA deadlock in geneve_offload_rx_ports(), which acquires gn->lock under utn->lock. Even without gn->lock, geneve_sock_add() and geneve_offload_rx_ports() are still serialised with (per-netns) RTNL, so there is no race. Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260731164612.2148830-3-kuniyu@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-04geneve: Unlink geneve->sock[46].hlist[46].hlist in __geneve_sock_release().Kuniyuki Iwashima1-17/+25
Currently, geneve->sock[46].hlist[46] is unliked from geneve_sock.vni_list in geneve_stop() and geneve_sock.refcnt is decremented for each socket later in __geneve_sock_release(). The following patch will introduce a mutex in geneve_net to protect geneve_sock.{refcnt,vni_list}. However, udp_tunnel_notify_del_rx_port() must be outside of the lock to avoid AB-BA deadlock. To make the change cleaner, let's move hlist_del_init_rcu() from geneve_stop() to __geneve_sock_release(). Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260731164612.2148830-2-kuniyu@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-03net: mana: force full-page RX buffers via ethtool private flagDipayaan Roy2-2/+114
On some ARM64 platforms with 4K PAGE_SIZE, page_pool fragment allocation in the RX refill path can cause 15-20% throughput regression under high connection counts (>16 TCP streams). Add an ethtool private flag "full-page-rx" that allows the user to force one RX buffer per page, bypassing the page_pool fragment path. This restores line-rate (180+ Gbps) performance on affected platforms. Usage: ethtool --set-priv-flags eth0 full-page-rx on There is no behavioral change by default. The flag must be explicitly enabled by the user or udev rule. The existing single-buffer-per-page logic for XDP and jumbo frames is consolidated into a new helper mana_use_single_rxbuf_per_page() which is now the single decision point for both the automatic and user-controlled paths. Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Link: https://patch.msgid.link/20260729063347.3388035-3-dipayanroy@linux.microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switchDipayaan Roy1-29/+46
Refactor mana_get_strings() and mana_get_sset_count() from if/else to switch statements in preparation for adding ethtool private flags support which requires handling ETH_SS_PRIV_FLAGS. No functional change. Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Link: https://patch.msgid.link/20260729063347.3388035-2-dipayanroy@linux.microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03net: stmmac: ethtool: Address off-by-one when reading the coal rx-usecsMaxime Chevallier1-2/+2
When reading the rx-usecs coalescing parameters on a dwmac variant that uses the RIWT for RX interrupt coalescing, we convert the riwt value to usecs : - One riwt cycle is 256 clock ticks, we compute how many ticks in $riwt cycles - divide that by how many ticks in a microsecond, and we get the rx-usecs. The opposite computation is done when setting the rx-usecs param. Because of the 256 ratio, we're subjected to off-by-one errors in the value read-back, which can be reliably measured on i.mx8MP : $ ethtool -C eth1 rx-usecs 102 $ ethtool -c eth1 Coalesce parameters for eth1: [...] rx-usecs: 101 Let's be more explicit about the rounding for the riwt to usec computations by using DIV_ROUND_CLOSEST, which solves the off-by-one. This does change the boundaries of accepted rx-usecs parameters, as the previously accepted values were in the 16-246 us range, and now fall into the 15-245 range on imx8mp. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260802114015.214212-3-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03net: stmmac: ethtool: Comment the magic numbers in RIWT computationMaxime Chevallier1-2/+5
Receive Interrupt Watchdog Timer is an RX interrupt coalescing mechanism used by some variants of dwmac. It allows waiting a bit before triggering the rx interrupts, allowing for batch processing. The RIWT is configured with a granularity of 256 stmmac clk ticks. Let's add a comment for that and wrap the raw "1000000" into USEC_PER_SEC, as we're computing "how many clock cycles in one microsec" with that step. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260802114015.214212-2-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03bnge: Fix NULL pointer dereference in aux device releaseAlok Tiwari1-3/+6
If allocation of auxr_dev fails during auxiliary device setup, the error path calls auxiliary_device_uninit(), which eventually invokes bnge_aux_dev_release(). The release callback unconditionally dereferences aux_priv->auxr_dev->pdev to retrieve the parent bnge_dev. Since auxr_dev has not yet been allocated on this failure path, the dereference results in a NULL pointer exception Retrieve the parent bnge_dev from the auxiliary device's parent instead of auxr_dev, and free auxr_dev only when it was successfully allocated. This allows the release callback to correctly clean up partially initialized auxiliary devices. Fixes: 8ac050ec3b1c ("bng_en: Add RoCE aux device support") Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Reviewed-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com> Link: https://patch.msgid.link/20260731192301.1427645-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()Yi Cong1-1/+3
When the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb. usbnet_start_xmit() treats a NULL return from tx_fixup() as a drop (info->flags does not set FLAG_MULTI_PACKET for this driver), jumping to the "drop" label where it does `if (skb) dev_kfree_skb_any(skb)`. Because tx_fixup() returned NULL, the local skb variable in usbnet_start_xmit() is NULL, so the original skb is never freed — a memory leak on every TX frame whose linearization fails (i.e. under memory pressure). Free the skb before returning, matching the error handling already used for the pskb_expand_head() failure path in the same function. Fixes: 16b1c4e01c89 ("net: usb: ax88179_178a: add TSO feature") Cc: stable@vger.kernel.org Signed-off-by: Yi Cong <yicong@kylinos.cn> Link: https://patch.msgid.link/20260729030436.3420477-1-cong.yi@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03net: phy: motorcomm: enable the reference clock for YT8521Jiaxing Hu1-0/+6
Commit 42310a24389c ("net: phy: motorcomm: Enable optional clock for YT8531") enables the SoC-provided reference clock for the YT8531 in its probe. The YT8521 has the same need on crystal-less boards but goes through yt8521_probe(), so enable it there too. The clock is optional, so crystal-clocked boards are unaffected. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Tested-by: Gavin Gao <attinagaoxu@gmail.com> Signed-off-by: Jiaxing Hu <gahing@gahingwoo.com> Link: https://patch.msgid.link/20260731013807.1488843-1-gahing@gahingwoo.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03net: stmmac: Don't rely on the PHY for flow-control testingMaxime Chevallier1-3/+2
For flow-control testing in loopback mode, we don't need to ask what the PHY is currently using as pause/asym settings. The PHY is no longer involved in selftest, we rely strictly on MAC loopback. We therefore only need to know if the MAC supports Symmetric pause for the test, as we exercise both TX and RX pause support in the selftest. Remove phydev requirement for flowcontrol selftest as well as the AsymPause requirement. With that, we can also drop the linux/phy.h include. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de> Link: https://patch.msgid.link/20260728155728.1193169-3-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit (git 2.54.0.dirty) at 2026-09-21 23:27:02 +0000