summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)AuthorFilesLines
2026-03-25wifi: iwlwifi: mld: remove SCAN_TIMEOUT_MSECEmmanuel Grumbach1-2/+0
It has no users Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319204647.ea8d4a381474.I82c1d17faa6de6f16f08573ebb180de8db837bee@changeid
2026-03-25wifi: iwlwifi: remove IWL_MAX_WD_TIMEOUTEmmanuel Grumbach1-1/+0
This define is not used, remove it. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319204647.15341c4081ed.I639a1d65799ce5502e5c83e8889bcc5eda5ec4dc@changeid
2026-03-25wifi: iwlwifi: uefi: mode the comments valid kerneldoc commentsEmmanuel Grumbach1-10/+17
This will allow to get warnings if we make mistakes while documenting the uefi structures Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319204647.e9ad48c2cf4a.I867e3eb9581ac2a87772fd2534502c008543bafb@changeid
2026-03-25wifi: iwlwifi: support PER_CHAIN_LIMIT_OFFSET_CMD v6Emmanuel Grumbach5-6/+44
This includes support for UNII-9. Store the source of the WGDS table in the firmware runtime object to be able to pass the information to the firmware. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319204647.eaff31760dd7.Ic7f56fbbe310833723094f965e7ba3f8624d0ef9@changeid
2026-03-25wifi: iwlwifi: acpi: add support for WGDS revision 4Emmanuel Grumbach2-0/+7
This adds support for UNII-9. WGDS tables will now have 4 subbands. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319204647.721e9fbabfc9.Ie8bd641cf84aa659d93893438c172c172b67214b@changeid
2026-03-25wifi: iwlwifi: acpi: validate the WGDS tableEmmanuel Grumbach1-11/+27
Prefer to use ARRAY_SIZE when we check array-length. Make sure num_profile isn't bigger than the number of profiles we can actually store in the firmware runtime object. Same of the number of bands. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319204647.a398511514ed.Ie4e62e2008f7e117ae7e305967ffadf1a30fc2b1@changeid
2026-03-25wifi: iwlwifi: uefi: add support for WGDS rev4Emmanuel Grumbach3-11/+34
This new revision includes support for UNII-9. It adds a subband. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319204647.ad8e49c3a9e1.I51170ba78a706f976e93918d6473185d41e4306d@changeid
2026-03-25wifi: iwlwifi: uefi: open code the parsing of the WGDS tableEmmanuel Grumbach2-7/+44
We will soon add support for UNII-9 band in the WGDS table. We need to decouple the UEFI code from the firmware runtime code. The firmware runtime is just a software object which will need to grow and UEFI objects need a new revision to grow. Existing systems will keep the same UEFI objects. Just like PPAG and SAR, stop using structures to parse the UEFI tables since the layout depends on the revision. The support for the new revision will be added in the next patch, for now, just do the ground work. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319204647.140706e6e91f.I83ca04932bc21aa358119890001e876ced1e1bda@changeid
2026-03-25wifi: iwlwifi: mld: support version 11 of REDUCE_TX_POWER_CMDEmmanuel Grumbach3-8/+44
This introduces support for UNII-9. After we increased the size of the arrays of the subbands in SAR structure, we now support the new firmware command. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319204647.9cea60b78a1b.Ia91c59829af0dc4d6c351c5b09ce33800c1f9e44@changeid
2026-03-25wifi: iwlwifi: acpi: add support for EWRD rev 3 tableEmmanuel Grumbach2-1/+33
This table includes another sub-band for UNII-9. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319204647.9182284f007e.Ibbe7c1f8442933d29695b9bf56b8e775394c71f8@changeid
2026-03-25wifi: iwlwifi: acpi: add support for WRDS rev 3 tableEmmanuel Grumbach2-1/+27
This table includes another sub-band for UNII-9. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319204647.06543ec65e00.I73135c7d61bff9b46ad9862d93f4faf923983fd4@changeid
2026-03-25wifi: iwlwifi: uefi: support the new WRDS and EWRD tablesEmmanuel Grumbach3-40/+116
Those tables now have support for UNII-9 subband. Refactor iwl_uefi_set_sar_profile to get an array of values that makes it easier to use when the number of subbands can vary. Revamp a bit the code that fetches the tables to ask for the smaller table, then we can check the size of the object that we got and compare to the expected sizes to determine what revision to expect. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319204647.6948f69e6ae4.Icf990e13de6905c35a8de69f1445f8eb4aa43ee4@changeid
2026-03-25wifi: iwlwifi: mvm: zero iwl_geo_tx_power_profiles_cmd before sendingEmmanuel Grumbach1-2/+2
Otherwise we may send garbage. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319204647.2d494b0f4692.I9afd0fa6b2ea5a27118144ac4e3bbbedc2089c10@changeid
2026-03-25wifi: iwlwifi: restrict TOP reset to some devicesJohannes Berg3-6/+24
Due to the Bluetooth implementation needing to match, not all devices can actually do TOP reset. Restrict it to Sc2/Sc2f or later, with Wh RF or later. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319204647.6c4479f4e49d.I5023d70cb33f1e18f7cb15981fc3acfbb00862b7@changeid
2026-03-25wifi: iwlwifi: uefi: add support for PPAG table rev5Emmanuel Grumbach2-25/+56
This table has another subband for UNII-9. Add defines for the sizes of rev4 and rev5 to easily know how much data to ask from iwl_uefi_get_verified_variable. In case rev5 doesn't exist, fallback to rev4. Check that the revision advertised by the fetched table matches the size that we got. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319204647.b9ebcff37599.I1e8bb9cee5a028ed416b6094c0fdbf9f859c6dd8@changeid
2026-03-25wifi: iwlwifi: acpi: add support for PPAG rev5Emmanuel Grumbach2-7/+25
This adds support for UNII9 which requires to add a subband. Just increase the number of subbands that we need to read. Replace the usage of the IWL_NUM_SUB_BANDS_VX macros in acpi.h since those macros are defined in the firmware API and ACPI declarations have nothing to do the firmware API. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.a5e7f805d0f2.I0e3ee3258b77b339234692ceccf0d25d1e6dd67e@changeid
2026-03-25wifi: iwlwifi: acpi: check the size of the ACPI PPAG tablesEmmanuel Grumbach2-3/+13
We need to make sure we don't have a buffer overflow while reading the PPAG tables from ACPI into the firmware runtime object. Add an ACPI specific define for the number of chains in order to decouple the ACPI layout from the other objects. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.451808698662.I91234c8a662608674679ce490b51be792332cd43@changeid
2026-03-25wifi: iwlwifi: regulatory: support a new command for PPAGEmmanuel Grumbach6-12/+91
Per Platform Antenna Gain is getting support for UNII-9. Add a new version of PER_PLATFORM_ANT_GAIN_CMD. This requires to increase the number of subbands in the firmware runtime object. Pass the number of subbands to iwl_bios_print_ppag to avoid printing invalid values. Introduce BIOS_PPAG_MAX_SUB_BANDS_NUM to avoid impacting BIOS_SAR_MAX_SUB_BANDS_NUM which was used until now for PPAG as well. SAR will get support for the new subband in future patches. While at it, print the PPAG table as it was read from BIOS. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.2e577236d3c9.I042697a73893d79ef761796354b5d1dd8522f734@changeid
2026-03-25wifi: iwlwifi: mld: add support for sta command version 3Miri Korenblit3-14/+132
In this version, the link_id becomes a link_mask to support multiple links that are used to communicate with the station in question. This is needed for NAN, in which we can communicate on multiple channels with the same station. Also add a new STA type - NAN peer. Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.382a30bd1b70.Id6271e7eba233a11dc214ed2e07c2b186b167c66@changeid
2026-03-25wifi: iwlwifi: bring iwl_fill_ppag_table to the iwlmvmEmmanuel Grumbach3-131/+128
iwl_fill_ppag_table fills a command that is sent to the firmware. This command has several versions and handling those different versions is the responsibility of the op_mode. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.1f9b38ff7d22.I5c7482c074d63cd18533ac83289cc0b26c1be3d2@changeid
2026-03-25wifi: iwlwifi: uefi: open code the PPAG table store operationEmmanuel Grumbach2-14/+25
The structure in firmware runtime will need to grow because we're adding a subband for UNII-9. This means that we will soon no longer be able to just memcpy the data from the UEFI table. The layout of the array will change. Tediously copy the data byte-byte to make sure things get to the right place even when we'll increase the number of subbands. Make it easier for the uefi_cnv_var_ppag structure to grow by simpiflying the layout it becomes an array of s8. The layout of the structure becomes less obvious from the structure's declaration, but then the code is more flexible. Don't use UEFI_SAR_MAX_SUB_BANDS_NUM for the number of bands for PPAG. Of course, SAR related structures will grow in future patches, but decouple SAR and PPAG to make the work easier. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.61e729ea2bde.I9d9cda29f576290bf966f780bf7ad5af34970e6f@changeid
2026-03-25wifi: iwlwifi: mld: Introduce scan command version 18Ilan Peer2-17/+115
The FW scan logic was extended to support new channels in the 7 GHz band, as such, the scan command was modified to support scanning more PSC channels. Introduce scan command version 18 handling, which is different from scan command version 17 only in the number of supported channel configurations. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.c995b4e8bbc5.Ie401d9cf02daaa5e6adf2b3c309643589e3ead71@changeid
2026-03-25wifi: iwlwifi: mld: Refactor scan command handlingIlan Peer2-47/+114
As a preparation for a new scan command version, refactor the scan command building such that it would allow introducing new scan command structures in a simpler way. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.a3e9589769f0.If458023e234ed79db7474107d98f0b6e28e565e5@changeid
2026-03-25wifi: iwlwifi: mld: remove unused scan expire time constantsPagadala Yesu Anjaneyulu2-2/+0
Remove the unused IWL_MLD_SCAN_EXPIRE_TIME_SEC constant from constants.h and its corresponding IWL_MLD_SCAN_EXPIRE_TIME macro definition from mlo.c. These definitions are no longer referenced. Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com> Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.4be7221113cf.I13e32d575bb854709af374519332b998bc1fed4a@changeid
2026-03-25wifi: iwlwifi: mvm: cleanup some more MLO codeNidhish A N5-472/+0
iwlmld is now the op mode that is used for EHT devices, so iwlmvm code can never run in MLO. Clean up some more MLO code. Signed-off-by: Nidhish A N <nidhish.a.n@intel.com> Reviewed-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.8efcec472e91.Icaf4f4d6b9008e12310f408cfef7f35643f27ca5@changeid
2026-03-25wifi: iwlwifi: acpi: better use ARRAY_SIZE than a defineEmmanuel Grumbach1-1/+2
Since we'll have to change things in this area, use the safer option to define the size of an array. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.1acfc3b6f2b8.I2185e7850146e15628f8ec2c579d93f536c83d83@changeid
2026-03-25wifi: iwlwifi: uefi: decouple UEFI and firmware APIsEmmanuel Grumbach1-2/+21
The APIs in uefi.h are not firmware API files nor are they pure software objects. They really reflect a specific layout we expect to see in the UEFI tables. Since the UEFI objects are encoded into the BIOS, we can't use the same values for the declaration of the UEFI objects and for the pure software object like iwl_sar_profile in the firmware runtime object. Decouple the two types. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.db39a64073db.I21486dedb7357570151437cb0211b697e0efb61d@changeid
2026-03-25wifi: iwlwifi: ensure we don't read SAR values past the limitEmmanuel Grumbach1-0/+4
When we fill the SAR values, we read values from the BIOS store in the firmware runtime object and write them into the command that we send to the firmware. We assumed that the size of the firmware command is not longer than the BIOS tables. This has been true until now, but this is not really safe. We will soon have an firmware API change that will increase the size of the table in the command and we want to make sure that we don't have a buffer overrun when we read the firmware runtime object. Add this safety measure. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.99aaf2df072a.I5942590b81324b17e2a369f0c354cafee0f70ef5@changeid
2026-03-25wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2Emmanuel Grumbach8-27/+102
There is a new version of this command to indicate which AP type in UNII-9 is supported per country. This adds support for a new UEFI table that will include that data to be filled in the new AP type table. Rename the uats_table field in firmware_runtime structure since it includes now the UATS and the new UNEB table coming from UEFI. For the same reason, rename iwl_mld_init_uats. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260319110722.b839655712c5.I3dfca54bd19d6bd5f7ca385ea63be086ece9c1d0@changeid
2026-03-25wifi: iwlwifi: mvm: replace use of system_wq with system_percpu_wqMarco Crivellari1-3/+3
This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Link: https://patch.msgid.link/20260210143332.206146-4-marco.crivellari@suse.com Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-03-25wifi: iwlwifi: fw: replace use of system_unbound_wq with system_dfl_wqMarco Crivellari1-2/+2
This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Link: https://patch.msgid.link/20251120100850.66192-3-marco.crivellari@suse.com Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-03-25wifi: iwlwifi: replace use of system_unbound_wq with system_dfl_wqMarco Crivellari1-1/+1
This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Link: https://patch.msgid.link/20251120100850.66192-2-marco.crivellari@suse.com Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-03-24net: mana: fix use-after-free in add_adev() error pathGuangshuo Li1-2/+4
If auxiliary_device_add() fails, add_adev() jumps to add_fail and calls auxiliary_device_uninit(adev). The auxiliary device has its release callback set to adev_release(), which frees the containing struct mana_adev. Since adev is embedded in struct mana_adev, the subsequent fall-through to init_fail and access to adev->id may result in a use-after-free. Fix this by saving the allocated auxiliary device id in a local variable before calling auxiliary_device_add(), and use that saved id in the cleanup path after auxiliary_device_uninit(). Fixes: a69839d4327d ("net: mana: Add support for auxiliary device") Cc: stable@vger.kernel.org Reviewed-by: Long Li <longli@microsoft.com> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Link: https://patch.msgid.link/20260323165730.945365-1-lgs201920130244@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-24net: lan743x: fix duplex configuration in mac_link_upThangaraj Samynathan1-0/+5
The driver does not explicitly configure the MAC duplex mode when bringing the link up. As a result, the MAC may retain a stale duplex setting from a previous link state, leading to duplex mismatches with the link partner and degraded network performance. Update lan743x_phylink_mac_link_up() to set or clear the MAC_CR_DPX_ bit according to the negotiated duplex mode. This ensures the MAC configuration is consistent with the phylink resolved state. Fixes: a5f199a8d8a03 ("net: lan743x: Migrate phylib to phylink") Signed-off-by: Thangaraj Samynathan <thangaraj.s@microchip.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20260323065345.144915-1-thangaraj.s@microchip.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-24net: dsa: mxl862xx: use RST_DATA to skip writing zero wordsDaniel Golle1-0/+38
Issue the firmware's RST_DATA command before writing data payloads that contain many zero words. RST_DATA zeroes both the firmware's internal buffer and the MMD data registers in a single command, allowing the driver to skip individual MDIO writes for zero-valued words. This reduces bus traffic for the common case where API structs have many unused or default-zero fields. The optimization is applied when at least 5 zero words are found in the payload, roughly the break-even point against the cost of the extra RST_DATA command round-trip. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/d10bd6ad5df062d0da342c3e0d330550b3d2432b.1774185953.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-24net: dsa: mxl862xx: add CRC for MDIO communicationDaniel Golle5-65/+296
Enable the firmware's opt-in CRC validation on the MDIO/MMD command interface to detect bit errors on the bus. The firmware bundles CRC-6 and CRC-16 under a single enable flag, so both are implemented together. CRC-6 protects the ctrl and len_ret command registers using a table- driven 3GPP algorithm. It is applied to every command exchange including SET_DATA/GET_DATA batch transfers. With CRC enabled, the firmware encodes its return value as a signed 11-bit integer within the CRC- protected register fields, replacing the previous 16-bit interpretation. CRC-16 protects the data payload using the kernel's crc16() library. The driver appends a CRC-16 checksum to outgoing data and verifies the firmware-appended checksum on responses. The checksum is placed at the exact byte offset where the struct data ends, correctly handling packed structs with odd sizes by splitting the checksum across word boundaries. SET_DATA/GET_DATA sub-commands carry only CRC-6. Upon detection of a CRC error on either side all conduit interfaces are taken down, triggering all user ports to go down as well. This is the most feasible option: CRC errors are likely caused either by broken hardware, or are symptom of overheating. In either case, trying to resume normal operation isn't reasonable. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/620453b9a150bbe5b7ea4224331cb5dc5e57263b.1774185953.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-24virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and ↵xietangxin1-0/+1
napi_tx is false A UAF issue occurs when the virtio_net driver is configured with napi_tx=N and the device's IFF_XMIT_DST_RELEASE flag is cleared (e.g., during the configuration of tc route filter rules). When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack expects the driver to hold the reference to skb->dst until the packet is fully transmitted and freed. In virtio_net with napi_tx=N, skbs may remain in the virtio transmit ring for an extended period. If the network namespace is destroyed while these skbs are still pending, the corresponding dst_ops structure has freed. When a subsequent packet is transmitted, free_old_xmit() is triggered to clean up old skbs. It then calls dst_release() on the skb associated with the stale dst_entry. Since the dst_ops (referenced by the dst_entry) has already been freed, a UAF kernel paging request occurs. fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release the dst reference before the skb is queued in virtio_net. Call Trace: Unable to handle kernel paging request at virtual address ffff80007e150000 CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT ... percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P) dst_release+0xe0/0x110 net/core/dst.c:177 skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177 sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255 dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469 napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527 __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net] free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net] start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net] ... Reproduction Steps: NETDEV="enp3s0" config_qdisc_route_filter() { tc qdisc del dev $NETDEV root tc qdisc add dev $NETDEV root handle 1: prio tc filter add dev $NETDEV parent 1:0 \ protocol ip prio 100 route to 100 flowid 1:1 ip route add 192.168.1.100/32 dev $NETDEV realm 100 } test_ns() { ip netns add testns ip link set $NETDEV netns testns ip netns exec testns ifconfig $NETDEV 10.0.32.46/24 ip netns exec testns ping -c 1 10.0.32.1 ip netns del testns } config_qdisc_route_filter test_ns sleep 2 test_ns Fixes: f2fc6a54585a ("[NETNS][IPV6] route6 - move ip6_dst_ops inside the network namespace") Cc: stable@vger.kernel.org Signed-off-by: xietangxin <xietangxin@yeah.net> Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com> Fixes: 0287587884b1 ("net: better IFF_XMIT_DST_RELEASE support") Link: https://patch.msgid.link/20260312025406.15641-1-xietangxin@yeah.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-24Merge tag 'mt76-next-2026-03-23' of https://github.com/nbd168/wirelessJohannes Berg60-952/+3330
Felix Fietkau says: =================== mt76 patches for 7.1 - fixes - mt7996/mt7925 MLO fixes/improvements - mt7996 NPU support - mt7996 external EEPROM support =================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-03-24wifi: mt76: mt7996: Destroy active sta links in mt7996_mac_sta_remove()Lorenzo Bianconi3-49/+45
Similar to vif link management, postpone sta link destuction in mt7996_mac_sta_remove() introducing mt7996_mac_sta_remove_link utility routine and just disable sta link running mt7996_mac_sta_remove_links routine. This is a preliminary patch in order to support MLO link reconfiguration in MT7996 driver. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260315-mt7996-mlo-link-reconf-v1-6-a8a634fbc927@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: Add mcu APIs to enable/disable vif links.Shayne Chen5-18/+138
Introduce mt7996_mcu_mld_reconf_stop_link and mt7996_mcu_mld_link_oper utility routines in order to communicate to the mcu fw to disable/enable a specific vif link. Please note these APIs are currently supported by the MT7996 firmware only in AP mode. Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260315-mt7996-mlo-link-reconf-v1-5-a8a634fbc927@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: Destroy vif active links in mt7996_remove_interface()Lorenzo Bianconi1-36/+72
MT7996 hw requires to remove active links from the mcu BSSINFO table destroying the interface. For this reason introduce mt7996_vif_link_destroy routine and remove active (non-offchannel) vif links running mt7996_remove_interface routine. This is a preliminary patch in order to support MLO link reconfiguration in MT7996 driver. Co-developed-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260315-mt7996-mlo-link-reconf-v1-4-a8a634fbc927@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: Move mlink deallocation in mt7996_vif_link_remove()Shayne Chen2-9/+6
Destroy mt76_vif_link struct in mt7996_vif_link_remove routine and not in mt76_unassign_vif_chanctx(). This is necessary since, in order to properly support MLO link reconfiguration, we will destroy mt76_vif_link struct during AP tear-down process and not running unassign_vif_chanctx mac80211 callback. This patch does not introduce any regression since mt76_assign_vif_chanctx/mt76_unassign_vif_chanctx APIs are currently used just by MT7996 driver. Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260315-mt7996-mlo-link-reconf-v1-3-a8a634fbc927@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: Account active links in valid_links fieldsShayne Chen1-22/+28
Track active vif links in mt7996_vif_link_add and mt7996_vif_link_remove routines. This is a preliminary patch in order to remove AP MLD links from MCU configuration during AP tear-down process and to support MLO link reconfiguration in MT7996 driver. Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260315-mt7996-mlo-link-reconf-v1-2-a8a634fbc927@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: Rely on msta_link link_id in mt7996_vif_link_remove()Lorenzo Bianconi1-4/+7
Rely on msta_link link_id value in mt7996_vif_link_remove routine instead of using link_conf pointer. This assumption is correct since msta_link link_id is set to link_conf link_id value in mt7996_vif_link_add routine. Moreover, fallback to default ieee80211_bss_conf struct if the link_conf pointer in mt7996_vif_link_remove() is NULL. MT7996 hw requires to remove AP MLD links from MCU configuration during AP tear-down process (e.g. running mt7996_remove_interface()). Doing so, we can't assume link_conf pointer is always non-NULL running mt7996_vif_link_remove routine. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260315-mt7996-mlo-link-reconf-v1-1-a8a634fbc927@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7996: fix frequency separation for station STR modePeter Chiu1-0/+1
Fix frequency separation field for STR in MLD capabilities to get the correct chip capability. Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260316-mt7996-sta-str-v1-1-666814e6ab2d@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7925: host-only unwind published links on add failureSean Wang1-0/+45
Release host link resources when mt7925_mac_sta_add_links() fails after partial success. msta->link[] and dev->mt76.wcid[] may already be published, so unwind the host state to avoid leaving stale links behind. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260306232238.2039675-20-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7925: publish msta->link after successful link addSean Wang1-4/+14
Move the msta->link[link_id] publication until after mt7925_mac_link_sta_add() succeeds. msta->link[] is RCU-visible, so publishing it before setup completes can expose a link whose add path later fails. Publish it only after success to avoid partially initialized link state becoming visible. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260306232238.2039675-19-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7925: switch link STA allocation to RCU lifetimeSean Wang2-3/+8
Allocate mt792x_link_sta with kzalloc() and free it with kfree_rcu() instead of devm-managed memory. msta->link[] is published via RCU, so the link STA must remain valid until readers have quiesced after teardown. Manage the object lifetime with kfree_rcu() to match its RCU-visible publication. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260306232238.2039675-18-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7925: move WCID teardown into link_sta_remove()Sean Wang1-8/+8
Move WCID teardown into mt7925_mac_link_sta_remove() to mirror the dev->mt76.wcid[] publish done during link add. This clears the published WCID before the rest of teardown, so WCID lookups no longer expose a link that is being removed. No functional change intended. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260306232238.2039675-17-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-24wifi: mt76: mt7925: drop WCID reinit after publishSean Wang1-1/+0
Remove the redundant mt76_wcid_init() call after publishing the WCID in mt7925_mac_link_sta_add(). WCID is already initialized before publication, so reinitializing it afterward is unnecessary and makes the setup ordering less clear. No functional change intended. Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20260306232238.2039675-16-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
generated by cgit (git 2.54.0.dirty) at 2026-10-01 06:10:22 +0000