summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)AuthorFilesLines
2026-03-23wifi: mt7601u: check multiple firmware pathsChristian Hewitt2-1/+15
The linux-firmware repo moved mt7601u.bin from its root folder to the mediatek sub-folder some time ago, but the driver still tries to load firmware from the old location. Users might have firmware in either location so update the driver to check both. Signed-off-by: Christian Hewitt <christianshewitt@gmail.com> Link: https://patch.msgid.link/20251227112219.2768439-1-christianshewitt@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt792x: Fix a potential deadlock in high-load situationsLeon Yen1-1/+1
A deadlock may occur between two works, ps_work and mac_work, if their work functions run simultaneously as they attempt to cancel each other by calling cancel_delayed_work_sync(). mt792x_mac_work() -> ... -> cancel_delayed_work_sync(&pm->ps_work); mt792x_pm_power_save_work() -> cancel_delayed_work_sync(&mphy->mac_work); In high-load situations, they are queued but may not have chance to be executed until the CPUs are released. Once the CPUs are available, there is a high possibility that the ps_work function and mac_work function will be executed simultaneously, resulting in a possible deadlock. This patch replaces cancel_delayed_work_sync() with cancel_delayed_work() in ps_work to eliminate the deadlock and make the code easier to maintain. Signed-off-by: Leon Yen <leon.yen@mediatek.com> Tested-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com> Link: https://patch.msgid.link/20251215122231.3180648-1-leon.yen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7925: Fix incorrect MLO mode in firmware controlLeon Yen3-6/+9
The selection of MLO mode should depend on the capabilities of the STA rather than those of the peer AP to avoid compatibility issues with certain APs, such as Xiaomi BE5000 WiFi7 router. Fixes: 69acd6d910b0c ("wifi: mt76: mt7925: add mt7925_change_vif_links") Signed-off-by: Leon Yen <leon.yen@mediatek.com> Link: https://patch.msgid.link/20251211123836.4169436-1-leon.yen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7921: Reset ampdu_state state in case of failure in ↵Sean Wang1-2/+4
mt76_connac2_tx_check_aggr() Reset ampdu_state if ieee80211_start_tx_ba_session() fails in mt76_connac2_tx_check_aggr(), otherwise the driver may incorrectly assume aggregation is active and skip future BA setup attempts. Fixes: 163f4d22c118 ("mt76: mt7921: add MAC support") Signed-off-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/20251216005930.9412-1-sean.wang@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Reset ampdu_state state in case of failure in ↵Lorenzo Bianconi1-2/+3
mt7996_tx_check_aggr() Reset the ampdu_state configured state if ieee80211_start_tx_ba_session routine fails in mt7996_tx_check_aggr() Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20251214-mt7996-aggr-check-fix-v1-1-33a8b62ec0fc@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()Lorenzo Bianconi1-0/+1
Clear WCID pointer removing the sta link in mt7996_mac_sta_deinit_link routine. Fixes: dd82a9e02c054 ("wifi: mt76: mt7996: Rely on mt7996_sta_link in sta_add/sta_remove callbacks") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20251205-mt76-txq-wicd-fix-v2-4-f19ba48af7c1@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Switch to the secondary link if the default one is removedLorenzo Bianconi2-22/+41
Switch to the secondary link if available in mt7996_mac_sta_remove_links routine if the primary one is removed. Moreover reset secondary link index for single link scenario. Fixes: 85cd5534a3f2e ("wifi: mt76: mt7996: use correct link_id when filling TXD and TXP") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20251205-mt76-txq-wicd-fix-v2-3-f19ba48af7c1@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Reset mtxq->idx if primary link is removed in ↵Lorenzo Bianconi1-5/+16
mt7996_vif_link_remove() Reset WCID index in mt76_txq struct if primary link is removed in mt7996_vif_link_remove routine. Fixes: a3316d2fc669f ("wifi: mt76: mt7996: set vif default link_id adding/removing vif links") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20251205-mt76-txq-wicd-fix-v2-2-f19ba48af7c1@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Set mtxq->wcid just for primary linkLorenzo Bianconi1-8/+6
Set WCID index in mt76_txq struct just for the primary link in mt7996_vif_link_add routine. Fixes: 69d54ce7491d0 ("wifi: mt76: mt7996: switch to single multi-radio wiphy") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20251205-mt76-txq-wicd-fix-v2-1-f19ba48af7c1@kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: Fix spelling mistake "retriving" -> "retrieving"Colin Ian King1-4/+4
There are a handful of spelling mistakes in various warning messages. Fix them. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://patch.msgid.link/20251128174430.318838-1-colin.i.king@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7925: introduce CSA support in non-MLO modeLeon Yen3-3/+142
Add CSA (Channel Switch Announcement) related implementation in collaboration with mac80211 to deal with dynamic channel switching. Signed-off-by: Leon Yen <leon.yen@mediatek.com> Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com> Link: https://patch.msgid.link/20250926053447.4036650-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt76x02: wake queues after reconfigDavid Bauer1-0/+1
The shared reset procedure of MT7610 and MT7612 stop all queues before starting the reset sequence. They however never restart these like other supported mt76 chips do in the reconfig_complete call. This leads to TX not continuing after the reset. Restart queues in the reconfig_complete callback to restore functionality after the reset. Signed-off-by: David Bauer <mail@david-bauer.net> Link: https://patch.msgid.link/20251129023904.288484-1-mail@david-bauer.net Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggrQuan Zhou1-2/+4
Previously, the AMPDU state bit for a given TID was set before attempting to start a BA session, which could result in the AMPDU state being marked active even if ieee80211_start_tx_ba_session() failed. This patch changes the logic to only set the AMPDU state bit after successfully starting a BA session, ensuring proper synchronization between AMPDU state and BA session status. This fixes potential issues with aggregation state tracking and improves compatibility with mac80211 BA session management. Fixes: 44eb173bdd4f ("wifi: mt76: mt7925: add link handling in mt7925_txwi_free") Cc: stable@vger.kernel.org Signed-off-by: Quan Zhou <quan.zhou@mediatek.com> Reviewed-by: Sean Wang <sean.wang@mediatek.com> Link: https://patch.msgid.link/d5960fbced0beaf33c30203f7f8fb91d0899c87b.1764228973.git.quan.zhou@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: fix iface combination for different chipsetsShayne Chen1-1/+16
MT7992 and MT7990 support up to 19 interfaces per band and 32 in total. Fixes: 8df63a4bbe3d ("wifi: mt76: mt7996: adjust interface num and wtbl size for mt7992") Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20251215063728.3013365-7-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: add duplicated WTBL commandShayne Chen4-2/+32
This is a firmware mechanism to improve packet loss issues for mt7996 and mt7992 chipsets. Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20251215063728.3013365-6-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: offload radar threshold initializationStanleyYP Wang2-82/+0
Since some radar specifications maintained by the driver are incorrect and are now also maintained by the firmware, offload the initialization procedure to the firmware. This fixes issues for radar detection rate testings. Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20251215063728.3013365-5-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: abort CCA when CSA is startingStanleyYP Wang2-1/+20
When CSA countdown is going to start, carry UNI_BSS_INFO_BCN_BCC tag to abort any CCA countdown. Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20251215063728.3013365-4-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: set specific BSSINFO and STAREC commands after channel ↵StanleyYP Wang3-1/+75
switch After channel switch, some tags of BSSINFO (rfch) and STAREC (bfer, rate_ctrl) commands should also be updated. Otherwise, a BSS might not be able to transmit with its peer using correct bandwidth. Co-developed-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Link: https://patch.msgid.link/20251215063728.3013365-3-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: fix the behavior of radar detectionStanleyYP Wang5-12/+68
RDD_DET_MODE is a firmware command intended for testing and does not pause TX after radar detection, so remove it from the normal flow; instead, use the MAC_ENABLE_CTRL firmware command to resume TX after the radar-triggered channel switch completes. Fixes: 1529e335f93d ("wifi: mt76: mt7996: rework radar HWRDD idx") Co-developed-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Link: https://patch.msgid.link/20251215063728.3013365-2-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-23wifi: mt76: mt7996: extend CSA and CCA support for MLOShayne Chen3-59/+131
Use correct link_id to report CSA and CCA countdown events, and also modify mt7996_channel_switch_beacon() to set beacon with the correct link_id. Co-developed-by: Peter Chiu <chui-hao.chiu@mediatek.com> Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com> Co-developed-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20251215063728.3013365-1-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-03-22Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.0-rc5Alexei Starovoitov70-339/+657
Cross-merge BPF and other fixes after downstream PR. Minor conflicts in: tools/testing/selftests/bpf/progs/exceptions_fail.c tools/testing/selftests/bpf/progs/verifier_bounds.c Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-03-22mlx5: Remove redundant iseg baseParav Pandit2-4/+2
iseg_base and base_addr both point to BAR0, making iseg_base redundant. Remove iseg_base and rely on base_addr instead, reducing the size of struct mlx5_core_dev. Signed-off-by: Parav Pandit <parav@nvidia.com> Reviewed-by: Shay Drori <shayd@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260319122211.27384-2-tariqt@nvidia.com Reviewed-by: Joe Damato <joe@dama.to> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-03-20netdevsim: support tc-ets offloadDavide Caratti1-0/+22
Extend netdevsim to accept ndo_setup_tc(TC_SETUP_QDISC_ETS) calls, so that it's possible to run tdc on ETS offload code path. Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Davide Caratti <dcaratti@redhat.com> Link: https://patch.msgid.link/d04086cd0204d4aaf6524e972198faa1a4e5d657.1773945414.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-20netdevsim: move TC offload code to a dedicated fileDavide Caratti4-52/+61
This commit has no functional change. Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Davide Caratti <dcaratti@redhat.com> Link: https://patch.msgid.link/b7881fd53f8a5d8eff4eae8121576c3cd60c2ed7.1773945414.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-20net: netdevsim: correct typo in new_device_store error messageAlok Tiwari1-1/+1
Fix the format hint by replacing "unit" with "uint" in the pr_err() string. Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Reviewed-by: Joe Damato <joe@dama.to> Link: https://patch.msgid.link/20260319060812.495488-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-20net/mlx5e: Allow set_rx_mode on uplink representorSaeed Mahameed3-3/+12
set_rx_mode handler was skipped on uplink representor, since uplink relies on FDB to forward all traffic to it by default, which works perfectly on a single PF per physical port configuration, as explicit mac request isn't required, but In case of multi-host and DPU environments, uplink can only use own mac address, as set_rx_mode wasn't honored in uplink rep. Since MPFs (Multi PF switch) requires PFs to request explicit mac forwarding, this patch enables set_rx_mode on uplink representor to allow PF mac programming into MPFs table in switchdev mode, allowing use-cases such as arbitrary mac address forwarding via linux bridge. Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260319005456.82745-1-saeed@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-20net: dsa: microchip: Don't embed struct phy_device to maintain the port stateMaxime Chevallier3-11/+12
The KSZ9477 maintains the SGMII port's state for speed, duplex and link status to be able to fixup the accesses to its internal older version of the Designware XPCS. However, it does so by embedding a full instance of struct phy_device, only to use the 'speed', 'link' and 'duplex' fields. This is also only used for the SGMII port, it's otherwise unused for all other regular ports. Replace that with simple int/bool values. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260319181705.1576679-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-20net: phy: realtek: add RTL8224 polarity supportDamien Dejean1-1/+33
The RTL8224 has a register to configure the polarity of every pair of each port. It provides device designers more flexbility when wiring the chip. Unfortunately, the register is left in an unknown state after a reset. Thus on devices where the bootloader don't initialize it, the driver has to do it to detect and use a link. The MDI polarity swap can be set in the device tree using the property enet-phy-pair-polarity. The u32 value is a bitfield where bit[0..3] control the polarity of pairs A..D. Signed-off-by: Damien Dejean <dam.dejean@gmail.com> Link: https://patch.msgid.link/20260318215502.106528-5-dam.dejean@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-20net: phy: realtek: add RTL8224 pair order supportDamien Dejean2-0/+65
The RTL8224 has a register to configure a pair swap (from ABCD order to DCBA) providing PCB designers more flexbility when wiring the chip. The swap parameter has to be set correctly for each of the 4 ports before the chip can detect a link. After a reset, this register is (unfortunately) left in a random state, thus it has to be initialized. On most of the devices the bootloader does it once for all and we can rely on the value set, on some other it is not and the kernel has to do it. The MDI pair swap can be set in the device tree using the property enet-phy-pair-order. The property is set to 0 to keep the default order (ABCD), or 1 to reverse the pairs (DCBA). Signed-off-by: Damien Dejean <dam.dejean@gmail.com> Link: https://patch.msgid.link/20260318215502.106528-3-dam.dejean@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-20net: bcmasp: fix double disable of clkJustin Chen1-10/+23
Switch to devm_clk_get_optional() so we can manage the clock ourselves. We dynamically control the clocks depending on the state of the interface for power savings. The default state is clock disabled, so unbinding the driver causes a double disable. Fixes: 490cb412007d ("net: bcmasp: Add support for ASP2.0 Ethernet controller") Signed-off-by: Justin Chen <justin.chen@broadcom.com> Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Link: https://patch.msgid.link/20260319234813.1937315-3-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-20net: bcmasp: fix double free of WoL irqJustin Chen1-8/+0
We do not need to free wol_irq since it was instantiated with devm_request_irq(). So devres will free for us. Fixes: a2f0751206b0 ("net: bcmasp: Add support for WoL magic packet") Signed-off-by: Justin Chen <justin.chen@broadcom.com> Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Link: https://patch.msgid.link/20260319234813.1937315-2-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-20net: lan743x: fix SGMII detection on PCI1xxxx B0+ during warm resetThangaraj Samynathan2-4/+12
A warm reset on boards using an EEPROM-only strap configuration (where no MAC address is set in the image) can cause the driver to incorrectly revert to RGMII mode. This occurs because the ENET_CONFIG_LOAD_STARTED bit may not persist or behave as expected. Update pci11x1x_strap_get_status() to use revision-specific validation: - For PCI11x1x A0: Continue using the legacy check (config load started or reset protection) to validate the SGMII strap. - For PCI11x1x B0 and later: Use the newly available STRAP_READ_USE_SGMII_EN_ bit in the upper strap register to validate the lower SGMII_EN bit. This ensures the SGMII interface is correctly identified even after a warm reboot. Signed-off-by: Thangaraj Samynathan <thangaraj.s@microchip.com> Link: https://patch.msgid.link/20260318063228.17110-1-thangaraj.s@microchip.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-20bonding: remove bonding_priv.hBreno Leitao3-31/+8
bonding_priv.h only defined DRV_NAME and DRV_DESCRIPTION, but caused unnecessary recompilation: it included <generated/utsrelease.h> to define bond_version, which is used solely in bond_procfs.c. With CONFIG_LOCALVERSION_AUTO=y, utsrelease.h is regenerated on every git commit, so any git operation triggered recompilation of bond_main.c which also included bonding_priv.h. Remove the header entirely, as suggested by Jakub, given the macros on this file can be integrated into the C files directly. Signed-off-by: Breno Leitao <leitao@debian.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260318-bond_uts-v2-1-033fe0d4e903@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-20net: phylink: add debug for phy_config_inband()Russell King (Oracle)1-0/+7
Add debug for the phy_config_inband() call so we can see which inband modes are being configured at the PHY. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/E1w2mFk-0000000DXW2-2PR9@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-20net: airoha: Reset PPE cpu port configuration in airoha_ppe_hw_init()Lorenzo Bianconi4-27/+33
Before this patch, the PPE cpu port configuration used for a specific GDM device was set just running ndo_init() callback during the device initialization. The selected PPE cpu port configuration depends on the QDMA block assigned to the GDM port. The QDMA block is selected according to the GDM port LAN/WAN configuration as specified in the commit '8737d7194d6d ("net: airoha: select QDMA block according LAN/WAN configuration"). However, the user selected PPE cpu port configuration can be different with respect to the one hardcoded in the NPU firmware binary. The hardcoded NPU PPE cpu port configuration is loaded initializing the PPE engine running the NPU ops ppe_init() callback in airoha_ppe_offload_setup routine (this is executed at runtime by the netfilter flowtable infrastructure during flow offloading). Reset the PPE cpu port configuration in airoha_ppe_hw_init routine in order to apply the user requested setup according to the device DTS. Please note this patch is fixing an issue not visible to the user (so we do not need to backport it) since airoha_eth driver currently supports just the internal phy available via the MT7530 DSA switch and there are no WAN interfaces officially supported since PCS/external phy is not merged mainline yet (it will be posted with following patches). Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260317-airoha-fix-ppe-def-cpu-v1-1-338533d8e234@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-20net: dsa: mxl862xx: don't read out-of-boundsDaniel Golle1-2/+8
The write loop in mxl862xx_api_wrap() computes the word count as (size + 1) / 2, rounding up for odd-sized structs. On the last iteration of an odd-sized buffer it reads a full __le16 from data[i], accessing one byte past the end of the caller's struct. KASAN catches this as a stack-out-of-bounds read during probe (e.g. from mxl862xx_bridge_config_fwd() because of the odd length of sizeof(struct mxl862xx_bridge_config) == 49). The read-back loop already handles this case, it writes only a single byte when (i * 2 + 1) == size. The write loop lacked the same guard. In practice the over-read is harmless: the extra stack byte is sent to the firmware which ignores trailing data beyond the command's declared payload size. Apply the same odd-size last-byte handling to the write path: when the final word contains only one valid byte, send *(u8 *)&data[i] instead of le16_to_cpu(data[i]). This is endian-safe because data is __le16-encoded and the low byte is always at the lowest address regardless of host byte order. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/83356ad9c9a4470dd49b6b3d661c2a8dd85cc6a1.1773803190.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-20net: macb: Protect access to net_device::ip_ptr with RCU lockKevin Hao1-9/+16
Access to net_device::ip_ptr and its associated members must be protected by an RCU lock. Since we are modifying this piece of code, let's also move it to execute only when WAKE_ARP is enabled. To minimize the duration of the RCU lock, a local variable is used to temporarily store the IP address. This change resolves the following RCU check warning: WARNING: suspicious RCU usage 7.0.0-rc3-next-20260310-yocto-standard+ #122 Not tainted ----------------------------- drivers/net/ethernet/cadence/macb_main.c:5944 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 5 locks held by rtcwake/518: #0: ffff000803ab1408 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0xf8/0x368 #1: ffff0008090bf088 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_fop_write_iter+0xbc/0x1c8 #2: ffff00080098d588 (kn->active#70){.+.+}-{0:0}, at: kernfs_fop_write_iter+0xcc/0x1c8 #3: ffff800081c84888 (system_transition_mutex){+.+.}-{4:4}, at: pm_suspend+0x1ec/0x290 #4: ffff0008009ba0f8 (&dev->mutex){....}-{4:4}, at: device_suspend+0x118/0x4f0 stack backtrace: CPU: 3 UID: 0 PID: 518 Comm: rtcwake Not tainted 7.0.0-rc3-next-20260310-yocto-standard+ #122 PREEMPT Hardware name: ZynqMP ZCU102 Rev1.1 (DT) Call trace: show_stack+0x24/0x38 (C) __dump_stack+0x28/0x38 dump_stack_lvl+0x64/0x88 dump_stack+0x18/0x24 lockdep_rcu_suspicious+0x134/0x1d8 macb_suspend+0xd8/0x4c0 device_suspend+0x218/0x4f0 dpm_suspend+0x244/0x3a0 dpm_suspend_start+0x50/0x78 suspend_devices_and_enter+0xec/0x560 pm_suspend+0x194/0x290 state_store+0x110/0x158 kobj_attr_store+0x1c/0x30 sysfs_kf_write+0xa8/0xd0 kernfs_fop_write_iter+0x11c/0x1c8 vfs_write+0x248/0x368 ksys_write+0x7c/0xf8 __arm64_sys_write+0x28/0x40 invoke_syscall+0x4c/0xe8 el0_svc_common+0x98/0xf0 do_el0_svc+0x28/0x40 el0_svc+0x54/0x1e0 el0t_64_sync_handler+0x84/0x130 el0t_64_sync+0x198/0x1a0 Fixes: 0cb8de39a776 ("net: macb: Add ARP support to WOL") Signed-off-by: Kevin Hao <haokexin@gmail.com> Cc: stable@vger.kernel.org Reviewed-by: Théo Lebrun <theo.lebrun@bootlin.com> Link: https://patch.msgid.link/20260318-macb-irq-v2-2-f1179768ab24@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-20net: macb: Move devm_{free,request}_irq() out of spin lock areaKevin Hao1-5/+7
The devm_free_irq() and devm_request_irq() functions should not be executed in an atomic context. During device suspend, all userspace processes and most kernel threads are frozen. Additionally, we flush all tx/rx status, disable all macb interrupts, and halt rx operations. Therefore, it is safe to split the region protected by bp->lock into two independent sections, allowing devm_free_irq() and devm_request_irq() to run in a non-atomic context. This modification resolves the following lockdep warning: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 501, name: rtcwake preempt_count: 1, expected: 0 RCU nest depth: 1, expected: 0 7 locks held by rtcwake/501: #0: ffff0008038c3408 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0xf8/0x368 #1: ffff0008049a5e88 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_fop_write_iter+0xbc/0x1c8 #2: ffff00080098d588 (kn->active#70){.+.+}-{0:0}, at: kernfs_fop_write_iter+0xcc/0x1c8 #3: ffff800081c84888 (system_transition_mutex){+.+.}-{4:4}, at: pm_suspend+0x1ec/0x290 #4: ffff0008009ba0f8 (&dev->mutex){....}-{4:4}, at: device_suspend+0x118/0x4f0 #5: ffff800081d00458 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire+0x4/0x48 #6: ffff0008031fb9e0 (&bp->lock){-.-.}-{3:3}, at: macb_suspend+0x144/0x558 irq event stamp: 8682 hardirqs last enabled at (8681): [<ffff8000813c7d7c>] _raw_spin_unlock_irqrestore+0x44/0x88 hardirqs last disabled at (8682): [<ffff8000813c7b58>] _raw_spin_lock_irqsave+0x38/0x98 softirqs last enabled at (7322): [<ffff8000800f1b4c>] handle_softirqs+0x52c/0x588 softirqs last disabled at (7317): [<ffff800080010310>] __do_softirq+0x20/0x2c CPU: 1 UID: 0 PID: 501 Comm: rtcwake Not tainted 7.0.0-rc3-next-20260310-yocto-standard+ #125 PREEMPT Hardware name: ZynqMP ZCU102 Rev1.1 (DT) Call trace: show_stack+0x24/0x38 (C) __dump_stack+0x28/0x38 dump_stack_lvl+0x64/0x88 dump_stack+0x18/0x24 __might_resched+0x200/0x218 __might_sleep+0x38/0x98 __mutex_lock_common+0x7c/0x1378 mutex_lock_nested+0x38/0x50 free_irq+0x68/0x2b0 devm_irq_release+0x24/0x38 devres_release+0x40/0x80 devm_free_irq+0x48/0x88 macb_suspend+0x298/0x558 device_suspend+0x218/0x4f0 dpm_suspend+0x244/0x3a0 dpm_suspend_start+0x50/0x78 suspend_devices_and_enter+0xec/0x560 pm_suspend+0x194/0x290 state_store+0x110/0x158 kobj_attr_store+0x1c/0x30 sysfs_kf_write+0xa8/0xd0 kernfs_fop_write_iter+0x11c/0x1c8 vfs_write+0x248/0x368 ksys_write+0x7c/0xf8 __arm64_sys_write+0x28/0x40 invoke_syscall+0x4c/0xe8 el0_svc_common+0x98/0xf0 do_el0_svc+0x28/0x40 el0_svc+0x54/0x1e0 el0t_64_sync_handler+0x84/0x130 el0t_64_sync+0x198/0x1a0 Fixes: 558e35ccfe95 ("net: macb: WoL support for GEM type of Ethernet controller") Cc: stable@vger.kernel.org Reviewed-by: Théo Lebrun <theo.lebrun@bootlin.com> Signed-off-by: Kevin Hao <haokexin@gmail.com> Link: https://patch.msgid.link/20260318-macb-irq-v2-1-f1179768ab24@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-19net: fjes: Drop fjes_acpi_driver and rework initializationRafael J. Wysocki1-70/+50
The ACPI driver interface used by the Fujitsu Extended Socket (fjes) Network Device driver is redundant because its only role is to create a platform device the fjes platform driver can bind to, which can be done already at the module initialization time. Namely, acpi_find_extended_socket_device() looks for the requisite ACPI device object anyway and it may as well check its resources, and the platform device can be created when the ACPI object in question has been found (and it can be freed when the module is unloaded). Moreover, as a rule, it is better to avoid binding drivers directly to ACPI device objects [1]. Accordingly, drop fjes_acpi_driver, adjust the module initialization and exit code as per the above and set the fwnode for the fjes platform device to point to the corresponding ACPI device object as its ACPI companion. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/12857407.O9o76ZdvQC@rafael.j.wysocki Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-19net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()Russell King (Oracle)4-16/+16
STMMAC_GET_ENTRY() doesn't describe what this macro is doing - it is incrementing the provided index for the circular array of descriptors. Replace "GET" with "NEXT" as this better describes the action here. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1w2vba-0000000DbWo-1oL5@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-19net: stmmac: use more descriptive names in stmmac_xmit()Russell King (Oracle)1-22/+23
Use "frag_size" rather than "len", correcting its type to be unsigned int. Rename "des" to "dma_addr" since that's what it is. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1w2vbV-0000000DbWi-1O80@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-19net: stmmac: simplify DMA descriptor allocation/init/freeingRussell King (Oracle)1-30/+27
Rather than having separate branches to handle the different types of descriptors, use the helper functions to calculate the total size of the DMA descriptors. Use this to allocate or free the descriptor array, and use a local variable to hold the address of the descriptor array, so we only need one dma_alloc_coherent() or dma_free_coherent() call in these paths. Also do the same for the receive ring initialisation. The transmit ring can't be converted as there is a case where stmmac_mode_init() is not called. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1w2vbQ-0000000DbWc-0ty5@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-19net: stmmac: more mode -> descriptor_mode renamesRussell King (Oracle)5-35/+42
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1w2vbL-0000000DbWW-0PON@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-19net: stmmac: rename "mode" to "descriptor_mode"Russell King (Oracle)3-14/+19
priv->mode doesn't describe what it refers to, it is whether we operate the DMA descriptors as a ring or chain. It is also difficult to grep for as there are several "mode" struct members. Add "descriptor_" prefix. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1w2vbF-0000000DbWQ-4674@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-19net: ntb_netdev: add SPDX tag and remove boilerplate license textOskar Ray-Frayssinet1-46/+1
Add SPDX-License-Identifier tag to reflect the dual GPL-2.0-only/BSD-3-Clause license, remove the redundant boilerplate license text and contact information, keeping only the driver description. Signed-off-by: Oskar Ray-Frayssinet <rayfraytech@gmail.com> Acked-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/20260318211153.9460-1-rayfraytech@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-19ionic: fix persistent MAC address override on PFMohammad Heib1-6/+11
The use of IONIC_CMD_LIF_SETATTR in the MAC address update path causes the ionic firmware to update the LIF's identity in its persistent state. Since the firmware state is maintained across host warm boots and driver reloads, any MAC change on the Physical Function (PF) becomes "sticky. This is problematic because it causes ethtool -P to report the user-configured MAC as the permanent factory address, which breaks system management tools that rely on a stable hardware identity. While Virtual Functions (VFs) need this hardware-level programming to properly handle MAC assignments in guest environments, the PF should maintain standard transient behavior. This patch gates the ionic_program_mac call using is_virtfn so that PF MAC changes remain local to the netdev filters and do not overwrite the firmware's permanent identity block. Fixes: 19058be7c48c ("ionic: VF initial random MAC address if no assigned mac") Signed-off-by: Mohammad Heib <mheib@redhat.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Brett Creeley <brett.creeley@amd.com> Link: https://patch.msgid.link/20260317170806.35390-1-mheib@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-19Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski28-107/+211
Cross-merge networking fixes after downstream PR (net-7.0-rc5). net/netfilter/nft_set_rbtree.c 598adea720b97 ("netfilter: revert nft_set_rbtree: validate open interval overlap") 3aea466a43998 ("netfilter: nft_set_rbtree: don't disable bh when acquiring tree lock") https://lore.kernel.org/abgaQBpeGstdN4oq@sirena.org.uk No adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-19net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error pathsAnas Iqbal1-2/+6
Smatch reports: drivers/net/dsa/bcm_sf2.c:997 bcm_sf2_sw_resume() warn: 'priv->clk' from clk_prepare_enable() not released on lines: 983,990. The clock enabled by clk_prepare_enable() in bcm_sf2_sw_resume() is not released if bcm_sf2_sw_rst() or bcm_sf2_cfp_resume() fails. Add the missing clk_disable_unprepare() calls in the error paths to properly release the clock resource. Fixes: e9ec5c3bd238 ("net: dsa: bcm_sf2: request and handle clocks") Reviewed-by: Jonas Gorski <jonas.gorski@gmail.com> Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Signed-off-by: Anas Iqbal <mohd.abd.6602@gmail.com> Link: https://patch.msgid.link/20260318084212.1287-1-mohd.abd.6602@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-19Merge tag 'wireless-next-2026-03-19' of ↵Paolo Abeni27-111/+180
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Aside from various small improvements/cleanups, not much: - cfg80211/mac80211: S1G and UHR improvements - hwsim: incumbent signal report test support * tag 'wireless-next-2026-03-19' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (31 commits) qtnfmac: use alloc_netdev macro for single queue devices wifi: libertas: don't kill URBs in interrupt context wifi: libertas: use USB anchors for tracking in-flight URBs wifi: nl80211: use int for band coming from netlink wifi: rsi_91x_usb: do not pause rfkill polling when stopping mac80211 wifi: mac80211: fix STA link removal during link removal wifi: nl80211: reject S1G/60G with HT chantype wifi: ieee80211: fix definition of EHT-MCS 15 in MRU wifi: cfg80211: check non-S1G width with S1G chandef wifi: cfg80211: restrict cfg80211_chandef_create() to only HT-based bands wifi: mac80211: don't use cfg80211_chandef_create() for default chandef wifi: mac80211: Remove deleted sta links in ieee80211_ml_reconf_work() wifi: b43: use register definitions in nphy_op_software_rfkill wifi: cfg80211: split control freq check from chandef check wifi: mac80211: always use full chanctx compatible check wifi: mac80211: refactor chandef tracing macros wifi: mac80211: validate HE 6 GHz operation when EHT is used wifi: nl80211: split out UHR operation information wifi: mwifiex: drop redundant device reference wifi: rt2x00: drop redundant device reference ... ==================== Link: https://patch.msgid.link/20260319082439.79875-3-johannes@sipsolutions.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-19can: mcp251x: add error handling for power enable in open and resumeWenyuan Li1-5/+24
Add missing error handling for mcp251x_power_enable() calls in both mcp251x_open() and mcp251x_can_resume() functions. In mcp251x_open(), if power enable fails, jump to error path to close candev without attempting to disable power again. In mcp251x_can_resume(), properly check return values of power enable calls for both power and transceiver regulators. If any fails, return the error code to the PM framework and log the failure. This ensures the driver properly handles power control failures and maintains correct device state. Signed-off-by: Wenyuan Li <2063309626@qq.com> Link: https://patch.msgid.link/tencent_F3EFC5D7738AC548857B91657715E2D3AA06@qq.com [mkl: fix patch description] [mkl: mcp251x_can_resume(): replace goto by return] Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>