summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)AuthorFilesLines
2026-01-10net: hns: convert to use .get_rx_ring_countBreno Leitao1-13/+3
Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260109-grxring_big_v1-v1-7-a0f77f732006@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-10net: qede: convert to use .get_rx_ring_countBreno Leitao1-3/+9
Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260109-grxring_big_v1-v1-6-a0f77f732006@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-10net: niu: convert to use .get_rx_ring_countBreno Leitao1-3/+8
Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260109-grxring_big_v1-v1-5-a0f77f732006@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-10net: funeth: convert to use .get_rx_ring_countBreno Leitao1-11/+3
Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260109-grxring_big_v1-v1-4-a0f77f732006@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-10net: enic: convert to use .get_rx_ring_countBreno Leitao1-3/+8
Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260109-grxring_big_v1-v1-3-a0f77f732006@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-10net: hinic: convert to use .get_rx_ring_countBreno Leitao1-15/+4
Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260109-grxring_big_v1-v1-2-a0f77f732006@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-10net: octeontx2: convert to use .get_rx_ring_countBreno Leitao1-4/+9
Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260109-grxring_big_v1-v1-1-a0f77f732006@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-10net: stmmac: convert to use .get_rx_ring_countBreno Leitao1-12/+3
Convert the stmmac driver to use the new .get_rx_ring_count ethtool operation instead of implementing .get_rxnfc for handling ETHTOOL_GRXRINGS command. Since stmmac_get_rxnfc() only handled ETHTOOL_GRXRINGS (returning -EOPNOTSUPP for all other commands), remove it entirely and replace it with the simpler stmmac_get_rx_ring_count() callback. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260108-gxring_stmicro-v2-1-3dcadc8ed29b@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-10net/mlx5e: Remove GSO_PARTIAL for non _CSUM GREGal Pressman1-2/+1
The hardware can do TSO for GRE packets without an outer checksum, it doesn't need GSO_PARTIAL's help. Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Mark Bloch <mbloch@nvidia.com> Link: https://patch.msgid.link/20260107091848.621884-4-mbloch@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-10net/mlx5e: TSO for UDP over GRE over vlan packetsGal Pressman1-0/+1
The hardware supports segmentation offload of UDP over GRE over vlan packets, allow it by adding NETIF_F_GSO_UDP_L4 to hw_enc_features which will make the vlan device inherit it to its own hw_enc_features. Side note: it is quite confusing that this change wasn't needed to offload encapsulated UDP packets regardless of vlan, but that's the way that the stack handles gso partial features, it assumes they're supported without caring if the feature is supported in hw_enc_features. Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Signed-off-by: Mark Bloch <mbloch@nvidia.com> Link: https://patch.msgid.link/20260107091848.621884-3-mbloch@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-10net/mlx5e: TSO for GRE over vlanGal Pressman1-0/+1
The hardware supports segmentation offload of GRE tunnel over vlan, allow it by adding it to vlan_features. Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Signed-off-by: Mark Bloch <mbloch@nvidia.com> Link: https://patch.msgid.link/20260107091848.621884-2-mbloch@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-10net: ethernet: ave: Remove unnecessary 'out of memory' messageKunihiko Hayashi1-3/+1
Follow the warning from checkpatch.pl and remove 'out of memory' message. WARNING: Possible unnecessary 'out of memory' message #590: FILE: drivers/net/ethernet/socionext/sni_ave.c:590: + if (!skb) { + netdev_err(ndev, "can't allocate skb for Rx\n"); Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260109103915.2764380-1-hayashi.kunihiko@socionext.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-10net: phy: mxl-gpy: implement SGMII in-band configurationDaniel Golle1-14/+47
SGMII in-band autonegotiation was previously kept untouched (and restored after switching back from 2500Base-X to SGMII). Now that the kernel offers a way to announce in-band capabilities and nable/disable in-band AN, implement the .inband_caps and .config_inband driver ops. This moves the responsibility to configure SGMII in-band AN from the PHY driver to phylink. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/70f07e46dd96e239a9711e6073e8c04c1d8672d4.1767800226.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-10virtio-net: clean up __virtnet_rx_pause/resumeBui Quang Minh1-20/+10
The delayed refill worker is removed which makes virtnet_rx_pause/resume quite the same as __virtnet_rx_pause/resume. So remove __virtnet_rx_pause/resume and move the code to virtnet_rx_pause/resume. Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com> Link: https://patch.msgid.link/20260106150438.7425-4-minhquangbui99@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-10virtio-net: remove unused delayed refill workerBui Quang Minh1-86/+0
Since we switched to retry refilling receive buffer in NAPI poll instead of delayed worker, remove all now unused delayed refill worker code. Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com> Link: https://patch.msgid.link/20260106150438.7425-3-minhquangbui99@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-10virtio-net: don't schedule delayed refill workerBui Quang Minh1-23/+24
When we fail to refill the receive buffers, we schedule a delayed worker to retry later. However, this worker creates some concurrency issues. For example, when the worker runs concurrently with virtnet_xdp_set, both need to temporarily disable queue's NAPI before enabling again. Without proper synchronization, a deadlock can happen when napi_disable() is called on an already disabled NAPI. That napi_disable() call will be stuck and so will the subsequent napi_enable() call. To simplify the logic and avoid further problems, we will instead retry refilling in the next NAPI poll. Fixes: 4bc12818b363 ("virtio-net: disable delayed refill when pausing rx") Reported-by: Paolo Abeni <pabeni@redhat.com> Closes: https://lore.kernel.org/526b5396-459d-4d02-8635-a222d07b46d7@redhat.com Cc: stable@vger.kernel.org Suggested-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com> Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Link: https://patch.msgid.link/20260106150438.7425-2-minhquangbui99@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-09macvlan: fix possible UAF in macvlan_forward_source()Eric Dumazet1-7/+13
Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace period starts. This allows macvlan_forward_source() to skip over entries queued for freeing. Note that macvlan_dev are already RCU protected, as they are embedded in a standard netdev (netdev_priv(ndev)). Fixes: 79cf79abce71 ("macvlan: add source mode") Reported-by: syzbot+7182fbe91e58602ec1fe@syzkaller.appspotmail.com https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE@google.com/T/#u Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260108133651.1130486-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-09idpf: Fix kernel-doc descriptions to avoid warningsAndy Shevchenko1-36/+58
In many functions the Return section is missing. Fix kernel-doc descriptions to address that and other warnings. Before the change: $ scripts/kernel-doc -none -Wreturn drivers/net/ethernet/intel/idpf/idpf_txrx.c 2>&1 | wc -l 85 Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Tested-by: Krishneil Singh <krishneil.k.singh@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-01-09idpf: update idpf_up_complete() return type to voidSreedevi Joshi1-11/+2
idpf_up_complete() function always returns 0 and no callers use this return value. Although idpf_vport_open() checks the return value, it only handles error cases which never occur. Change the return type to void to simplify the code. Signed-off-by: Sreedevi Joshi <sreedevi.joshi@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-01-09ice: use netif_get_num_default_rss_queues()Michal Swiatkowski2-6/+11
On some high-core systems (like AMD EPYC Bergamo, Intel Clearwater Forest) loading ice driver with default values can lead to queue/irq exhaustion. It will result in no additional resources for SR-IOV. In most cases there is no performance reason for more than half num_cpus(). Limit the default value to it using generic netif_get_num_default_rss_queues(). Still, using ethtool the number of queues can be changed up to num_online_cpus(). It can be done by calling: $ethtool -L ethX combined $(nproc) This change affects only the default queue amount. Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> Tested-by: Rafal Romanowski <rafal.romanowski@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-01-09ixgbe: Add 10G-BX supportBirger Koblitz5-5/+53
Add support for 10G-BX modules, i.e. 10GBit Ethernet over a single strand Single-Mode fiber. The initialization of a 10G-BX SFP+ is the same as for a 10G SX/LX module, and is identified according to SFF-8472 table 5-3, footnote 3 by the 10G Ethernet Compliance Codes field being empty, the Nominal Bit Rate being compatible with 12.5GBit, and the module being a fiber module with a Single Mode fiber link length. This was tested using a Lightron WSPXG-HS3LC-IEA 1270/1330nm 10km transceiver: $ sudo ethtool -m enp1s0f1 Identifier : 0x03 (SFP) Extended identifier : 0x04 (GBIC/SFP defined by 2-wire interface ID) Connector : 0x07 (LC) Transceiver codes : 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 Encoding : 0x01 (8B/10B) BR Nominal : 10300MBd Rate identifier : 0x00 (unspecified) Length (SMF) : 10km Length (OM2) : 0m Length (OM1) : 0m Length (Copper or Active cable) : 0m Length (OM3) : 0m Laser wavelength : 1330nm Vendor name : Lightron Inc. Vendor OUI : 00:13:c5 Vendor PN : WSPXG-HS3LC-IEA Vendor rev : 0000 Option values : 0x00 0x1a Option : TX_DISABLE implemented BR margin max : 0% BR margin min : 0% Vendor SN : S142228617 Date code : 140611 Optical diagnostics support : Yes Signed-off-by: Birger Koblitz <mail@birger-koblitz.de> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Rinitha S <sx.rinitha@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-01-09ice: unify PHY FW loading status handler for E800 devicesGrzegorz Nitka1-58/+21
Unify handling of PHY firmware load delays across all E800 family devices. There is an existing mechanism to poll GL_MNG_FWSM_FW_LOADING_M bit of GL_MNG_FWSM register in order to verify whether PHY FW loading completed or not. Previously, this logic was limited to E827 variants only. Also, inform a user of possible delay in initialization process, by dumping informational message in dmesg log ("Link initialization is blocked by PHY FW initialization. Link initialization will continue after PHY FW initialization completes."). Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-01-09wifi: ath12k: don't force radio frequency check in freq_to_idx()Baochen Qiang1-8/+1
freq_to_idx() is used to map a channel to a survey index. Commit acc152f9be20 ("wifi: ath12k: combine channel list for split-phy devices in single-wiphy") adds radio specific frequency range check in this helper to make sure an invalid index is returned if the channel falls outside that range. However, this check introduces a race, resulting in below warnings as reported in [1]. ath12k_pci 0000:08:00.0: chan info: invalid frequency 6455 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6535 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6615 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6695 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6775 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6855 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6935 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 7015 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 7095 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6435 (idx 101 out of bounds) Race scenario: 1) A regdomain covering below frequency range is uploaded to host via WMI_REG_CHAN_LIST_CC_EXT_EVENTID event: Country 00, CFG Regdomain UNSET FW Regdomain 0, num_reg_rules 6 1. (2402 - 2472 @ 40) (0, 20) (0 ms) (FLAGS 360448) (0, 0) 2. (2457 - 2477 @ 20) (0, 20) (0 ms) (FLAGS 360576) (0, 0) 3. (5170 - 5330 @ 160) (0, 20) (0 ms) (FLAGS 264320) (0, 0) 4. (5490 - 5730 @ 160) (0, 20) (0 ms) (FLAGS 264320) (0, 0) 5. (5735 - 5895 @ 160) (0, 20) (0 ms) (FLAGS 264320) (0, 0) 6. (5925 - 7125 @ 320) (0, 24) (0 ms) (FLAGS 2056) (0, 255) As a result, radio frequency range is updated as [2402, 7125] ath12k_pci 0000:08:00.0: mac pdev 0 freq limit updated. New range 2402->7125 MHz If no scan in progress or after scan finished, command WMI_SCAN_CHAN_LIST_CMDID is sent to firmware notifying that firmware is allowed to do scan on all channels within that range. The running path is: /* redomain uploaded */ 1. WMI_REG_CHAN_LIST_CC_EXT_EVENTID 2. ath12k_reg_chan_list_event() 3. ath12k_reg_handle_chan_list() 4. queue_work(..., &ar->regd_update_work) 5. ath12k_regd_update_work() 6. ath12k_regd_update() /* update radio frequency range */ 7. ath12k_mac_update_freq_range() 8. regulatory_set_wiphy_regd() 9. ath12k_reg_notifier() 10. ath12k_reg_update_chan_list() 11. queue_work(..., &ar->regd_channel_update_work) 12. ath12k_regd_update_chan_list_work() /* wait scan finishes */ 13. wait_for_completion_timeout(&ar->scan.completed, ...) /* command notifying list of valid channels */ 14. ath12k_wmi_send_scan_chan_list_cmd() 2) Hardware scan is triggered on all allowed channels. 3) Before scan completed, 11D mechanism detects a new country code ath12k_pci 0000:08:00.0: wmi 11d new cc GB With this code sent to firmware, firmware uploads a new regdomain Country GB, CFG Regdomain ETSI FW Regdomain 2, num_reg_rules 9 1. (2402 - 2482 @ 40) (0, 20) (0 ms) (FLAGS 360448) (0, 0) 2. (5170 - 5250 @ 80) (0, 23) (0 ms) (FLAGS 264192) (0, 0) 3. (5250 - 5330 @ 80) (0, 23) (0 ms) (FLAGS 264216) (0, 0) 4. (5490 - 5590 @ 80) (0, 30) (0 ms) (FLAGS 264208) 5. (5590 - 5650 @ 40) (0, 30) (600000 ms) (FLAGS 264208) 6. (5650 - 5730 @ 80) (0, 30) (0 ms) (FLAGS 264208) 7. (5735 - 5875 @ 80) (0, 14) (0 ms) (FLAGS 264192) (0, 0) 8. (5855 - 5875 @ 20) (0, 14) (0 ms) (FLAGS 264192) (0, 0) 9. (5945 - 6425 @ 320) (0, 24) (0 ms) (FLAGS 2056) (0, 11) Then radio frequency range is updated as [2402, 6425] ath12k_pci 0000:08:00.0: mac pdev 0 freq limit updated. New range 2402->6425 MHz Please note this is a smaller range than the previous one. Later host runs the same path for the purpose of notifying the new channel list. However since scan not completed, host just waits there. Meanwhile, firmware is possibly scanning channels outside the new range. As a result, WMI_CHAN_INFO_EVENTID events for those channels fail freq_to_idx() check and triggers warnings above. Fix this issue by removing radio frequency check in freq_to_idx(). This is valid because channels being scanned do not synchronize with frequency range update. Besides, this won't cause any problem, since freq_to_idx() is only used for survey data. Even out-of-range channels filled in the survey, they won't get delivered to userspace due to the range check already there in ath12k_mac_op_get_survey(). Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: acc152f9be20 ("wifi: ath12k: combine channel list for split-phy devices in single-wiphy") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220871 # 1 Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260108-ath12k-fix-freq-to-idx-v1-1-b2458cf7aa0d@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-01-09wifi: ath12k: fix dma_free_coherent() pointerThomas Fourier1-6/+6
dma_alloc_coherent() allocates a DMA mapped buffer and stores the addresses in XXX_unaligned fields. Those should be reused when freeing the buffer rather than the aligned addresses. Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Cc: stable@vger.kernel.org Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260106084905.18622-2-fourier.thomas@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-01-09wifi: ath10k: fix dma_free_coherent() pointerThomas Fourier1-8/+8
dma_alloc_coherent() allocates a DMA mapped buffer and stores the addresses in XXX_unaligned fields. Those should be reused when freeing the buffer rather than the aligned addresses. Fixes: 2a1e1ad3fd37 ("ath10k: Add support for 64 bit ce descriptor") Cc: stable@vger.kernel.org Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260105210439.20131-2-fourier.thomas@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-01-09can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.Ondrej Ille1-1/+1
The Secondary Sample Point Source field has been set to an incorrect value by some mistake in the past 0b01 - SSP_SRC_NO_SSP - SSP is not used. for data bitrates above 1 MBit/s. The correct/default value already used for lower bitrates is 0b00 - SSP_SRC_MEAS_N_OFFSET - SSP position = TRV_DELAY (Measured Transmitter delay) + SSP_OFFSET. The related configuration register structure is described in section 3.1.46 SSP_CFG of the CTU CAN FD IP CORE Datasheet. The analysis leading to the proper configuration is described in section 2.8.3 Secondary sampling point of the datasheet. The change has been tested on AMD/Xilinx Zynq with the next CTU CN FD IP core versions: - 2.6 aka master in the "integration with Zynq-7000 system" test 6.12.43-rt12+ #1 SMP PREEMPT_RT kernel with CTU CAN FD git driver (change already included in the driver repo) - older 2.5 snapshot with mainline kernels with this patch applied locally in the multiple CAN latency tester nightly runs 6.18.0-rc4-rt3-dut #1 SMP PREEMPT_RT 6.19.0-rc3-dut The logs, the datasheet and sources are available at https://canbus.pages.fel.cvut.cz/ Signed-off-by: Ondrej Ille <ondrej.ille@gmail.com> Signed-off-by: Pavel Pisa <pisa@fel.cvut.cz> Link: https://patch.msgid.link/20260105111620.16580-1-pisa@fel.cvut.cz Fixes: 2dcb8e8782d8 ("can: ctucanfd: add support for CTU CAN FD open-source IP core - bus independent part.") Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-09can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leakMarc Kleine-Budde1-0/+2
In gs_can_open(), the URBs for USB-in transfers are allocated, added to the parent->rx_submitted anchor and submitted. In the complete callback gs_usb_receive_bulk_callback(), the URB is processed and resubmitted. In gs_can_close() the URBs are freed by calling usb_kill_anchored_urbs(parent->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in gs_can_close(). Fix the memory leak by anchoring the URB in the gs_usb_receive_bulk_callback() to the parent->rx_submitted anchor. Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260105-gs_usb-fix-memory-leak-v2-1-cc6ed6438034@pengutronix.de Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-09can: etas_es58x: allow partial RX URB allocation to succeedSzymon Wilczek1-1/+1
When es58x_alloc_rx_urbs() fails to allocate the requested number of URBs but succeeds in allocating some, it returns an error code. This causes es58x_open() to return early, skipping the cleanup label 'free_urbs', which leads to the anchored URBs being leaked. As pointed out by maintainer Vincent Mailhol, the driver is designed to handle partial URB allocation gracefully. Therefore, partial allocation should not be treated as a fatal error. Modify es58x_alloc_rx_urbs() to return 0 if at least one URB has been allocated, restoring the intended behavior and preventing the leak in es58x_open(). Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces") Reported-by: syzbot+e8cb6691a7cf68256cb8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e8cb6691a7cf68256cb8 Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com> Reviewed-by: Vincent Mailhol <mailhol@kernel.org> Link: https://patch.msgid.link/20251223011732.39361-1-swilczek.lx@gmail.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-09wifi: rtw89: fw: set RACK bit every 4 H2C command for WiFi 6 chips onlyPing-Ke Shih1-1/+2
RACK is to ask firmware send received ACK to driver when a H2C command is received. This is necessary for WiFi 6 chips only. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-11-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: consider hardware AID for firmware elementsPing-Ke Shih2-15/+28
The coming chip RTL8922D has variant of hardware with different AID. Add AID field to header of firmware elements, and compare AID with the value read from hardware. Currently, apply this rule to BB and RF parameters. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-10-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add CMAC H2C command for punctured for RTL8922DPing-Ke Shih2-0/+45
CMAC H2C command is to configure CMAC such as TX retry and padding. Add to update CMAC function block while puncturing is changing. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-9-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add CMAC H2C command for TX time for RTL8922DPing-Ke Shih2-0/+56
CMAC H2C command is to configure CMAC such as TX retry and padding. Add to update CMAC function block when BT-coex want shorter TX time due to timeslot assignment, or when MCC want higher retry time to improve connection rate. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-8-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add CMAC H2C command for TX AMPDU for RTL8922DPing-Ke Shih2-0/+69
CMAC H2C command is to configure CMAC such as TX retry and padding. Add to update CMAC function block while AMPDU is established. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-7-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add CMAC H2C command for association for RTL8922DPing-Ke Shih2-0/+131
CMAC H2C command is to configure CMAC such as TX retry and padding. Add to update CMAC function block according to associated peer. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-6-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add CMAC H2C command to initialize default value for RTL8922DPing-Ke Shih3-0/+248
CMAC H2C command is to configure CMAC such as TX retry and padding. Add to reset CMAC function block to default value. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-5-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add DMAC v3 H2C command for RTL8922DPing-Ke Shih4-0/+365
Write association data including address and security key of peer to hardware. Add the command for RTL8922D accordingly. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-4-pkshih@realtek.com
2026-01-09wifi: rtw89: update query RXDESC v3 for RTL8922DPing-Ke Shih3-0/+104
Add RXDESC v3 to parse meta data of receiving packets for RTL8922D. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-3-pkshih@realtek.com
2026-01-09wifi: rtw89: update TXWD v3 for RTL8922DPing-Ke Shih3-0/+78
Add TXWD v3 to assist in transmitting for RTL8922D according to hardware design. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-2-pkshih@realtek.com
2026-01-08net: phy: microchip_rds_ptp: add HW timestamp configuration reportingVadim Fedorenko1-0/+13
The driver stores HW timestamping configuration and can technically report it. Add callback to do it. Reviewed-by: Kory Maincent <kory.maincent@bootlin.com> Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20260106160723.3925872-5-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08net: phy: microchip_rds_ptp: improve HW ts config logicVadim Fedorenko1-5/+16
The driver stores new HW timestamping configuration values unconditionally and may create inconsistency with what is actually configured in case of error. Improve the logic to store new values only once everything is configured. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Reviewed-by: Kory Maincent <kory.maincent@bootlin.com> Link: https://patch.msgid.link/20260106160723.3925872-4-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08net: phy: micrel: add HW timestamp configuration reportingVadim Fedorenko1-0/+14
The driver stores HW timestamping configuration and can technically report it. Add callback to do it. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Kory Maincent <kory.maincent@bootlin.com> Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20260106160723.3925872-3-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08net: phy: micrel: improve HW timestamping config logicVadim Fedorenko1-6/+24
The driver was adjusting stored values independently of what was actually supported and configured. Improve logic to store values once all checks are passing Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Reviewed-by: Kory Maincent <kory.maincent@bootlin.com> Link: https://patch.msgid.link/20260106160723.3925872-2-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08sfc: correct kernel-doc complaintsRandy Dunlap1-3/+4
Fix kernel-doc warnings by adding 3 missing struct member descriptions in struct efx_ef10_nic_data and removing preprocessor directives (which are not handled by kernel-doc). Fixes these 5 warnings: Warning: drivers/net/ethernet/sfc/nic.h:158 bad line: #ifdef CONFIG_SFC_SRIOV Warning: drivers/net/ethernet/sfc/nic.h:160 bad line: #endif Warning: drivers/net/ethernet/sfc/nic.h:204 struct member 'port_id' not described in 'efx_ef10_nic_data' Warning: drivers/net/ethernet/sfc/nic.h:204 struct member 'vf_index' not described in 'efx_ef10_nic_data' Warning: drivers/net/ethernet/sfc/nic.h:204 struct member 'licensed_features' not described in 'efx_ef10_nic_data' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Edward Cree <ecree.xilinx@gmail.com> Link: https://patch.msgid.link/20260106173224.2010703-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski32-306/+351
Cross-merge networking fixes after downstream PR (net-6.19-rc5). No conflicts, or adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08Merge tag 'net-6.19-rc5' of ↵Linus Torvalds31-298/+347
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter and wireless. Current release - fix to a fix: - net: do not write to msg_get_inq in callee - arp: do not assume dev_hard_header() does not change skb->head Current release - regressions: - wifi: mac80211: don't iterate not running interfaces - eth: mlx5: fix NULL pointer dereference in ioctl module EEPROM Current release - new code bugs: - eth: bnge: add AUXILIARY_BUS to Kconfig dependencies Previous releases - regressions: - eth: mlx5: dealloc forgotten PSP RX modify header Previous releases - always broken: - ping: fix ICMP out SNMP stats double-counting with ICMP sockets - bonding: preserve NETIF_F_ALL_FOR_ALL across TSO updates - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress - eth: bnxt: fix potential data corruption with HW GRO/LRO" * tag 'net-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (70 commits) arp: do not assume dev_hard_header() does not change skb->head net: enetc: fix build warning when PAGE_SIZE is greater than 128K atm: Fix dma_free_coherent() size tools: ynl: don't install tests net: do not write to msg_get_inq in callee bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup net: usb: pegasus: fix memory leak in update_eth_regs_async() net: 3com: 3c59x: fix possible null dereference in vortex_probe1() net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset wifi: mac80211: collect station statistics earlier when disconnect wifi: mac80211: restore non-chanctx injection behaviour wifi: mac80211_hwsim: disable BHs for hwsim_radio_lock wifi: mac80211: don't iterate not running interfaces wifi: mac80211_hwsim: fix typo in frequency notification wifi: avoid kernel-infoleak from struct iw_point net: airoha: Fix schedule while atomic in airoha_ppe_deinit() selftests: netdevsim: add carrier state consistency test net: netdevsim: fix inconsistent carrier state after link/unlink selftests: drv-net: Bring back tool() to driver __init__s net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy ...
2026-01-08Merge branch '200GbE' of ↵Jakub Kicinski7-184/+256
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-01-06 (idpf) This series contains updates to idpf driver only. Emil fixes issues related to resets; among them timeouts, NULL pointer dereferences, and memory leaks. Sreedevi resolves issues around RSS; mainly involving operations when the interface is down and resets. She also addresses some incomplete cleanups for ntuple filters and interrupts. Erik fixes incomplete output of ntuple filters. Josh sets restriction of Rx buffer size to follow hardware restrictions. Larysa adds check to prevent NULL pointer dereference when RDMA is not enabled. * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: idpf: fix aux device unplugging when rdma is not supported by vport idpf: cap maximum Rx buffer size idpf: Fix error handling in idpf_vport_open() idpf: Fix RSS LUT NULL ptr issue after soft reset idpf: Fix RSS LUT configuration on down interfaces idpf: Fix RSS LUT NULL pointer crash on early ethtool operations idpf: fix issue with ethtool -n command display idpf: fix memory leak of flow steer list on rmmod idpf: fix error handling in the init_task on load idpf: fix memory leak in idpf_vc_core_deinit() idpf: fix memory leak in idpf_vport_rel() idpf: detach and close netdevs while handling a reset idpf: keep the netdev when a reset fails ==================== Link: https://patch.msgid.link/20260107000648.1861994-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08net: enetc: fix build warning when PAGE_SIZE is greater than 128KWei Fang1-2/+2
The max buffer size of ENETC RX BD is 0xFFFF bytes, so if the PAGE_SIZE is greater than 128K, ENETC_RXB_DMA_SIZE and ENETC_RXB_DMA_SIZE_XDP will be greater than 0xFFFF, thus causing a build warning. This will not cause any practical issues because ENETC is currently only used on the ARM64 platform, and the max PAGE_SIZE is 64K. So this patch is only for fixing the build warning that occurs when compiling ENETC drivers for other platforms. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202601050637.kHEKKOG7-lkp@intel.com/ Fixes: e59bc32df2e9 ("net: enetc: correct the value of ENETC_RXB_TRUESIZE") Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260107091204.1980222-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08Merge tag 'wireless-2026-01-08' of ↵Jakub Kicinski1-3/+3
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Couple of fixes: - mac80211: - long-standing injection bug due to chanctx rework - more recent interface iteration issue - collect statistics before removing stations - hwsim: - fix NAN frequency typo (potential NULL ptr deref) - fix locking of radio lock (needs softirqs disabled) - wext: - ancient issue with compat and events copying some uninitialized stack data to userspace * tag 'wireless-2026-01-08' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211: collect station statistics earlier when disconnect wifi: mac80211: restore non-chanctx injection behaviour wifi: mac80211_hwsim: disable BHs for hwsim_radio_lock wifi: mac80211: don't iterate not running interfaces wifi: mac80211_hwsim: fix typo in frequency notification wifi: avoid kernel-infoleak from struct iw_point ==================== Link: https://patch.msgid.link/20260108140141.139687-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanupBreno Leitao1-3/+3
When bnxt_init_one() fails during initialization (e.g., bnxt_init_int_mode returns -ENODEV), the error path calls bnxt_free_hwrm_resources() which destroys the DMA pool and sets bp->hwrm_dma_pool to NULL. Subsequently, bnxt_ptp_clear() is called, which invokes ptp_clock_unregister(). Since commit a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events"), ptp_clock_unregister() now calls ptp_disable_all_events(), which in turn invokes the driver's .enable() callback (bnxt_ptp_enable()) to disable PTP events before completing the unregistration. bnxt_ptp_enable() attempts to send HWRM commands via bnxt_ptp_cfg_pin() and bnxt_ptp_cfg_event(), both of which call hwrm_req_init(). This function tries to allocate from bp->hwrm_dma_pool, causing a NULL pointer dereference: bnxt_en 0000:01:00.0 (unnamed net_device) (uninitialized): bnxt_init_int_mode err: ffffffed KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] Call Trace: __hwrm_req_init (drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c:72) bnxt_ptp_enable (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:323 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:517) ptp_disable_all_events (drivers/ptp/ptp_chardev.c:66) ptp_clock_unregister (drivers/ptp/ptp_clock.c:518) bnxt_ptp_clear (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:1134) bnxt_init_one (drivers/net/ethernet/broadcom/bnxt/bnxt.c:16889) Lines are against commit f8f9c1f4d0c7 ("Linux 6.19-rc3") Fix this by clearing and unregistering ptp (bnxt_ptp_clear()) before freeing HWRM resources. Suggested-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Signed-off-by: Breno Leitao <leitao@debian.org> Fixes: a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events") Cc: stable@vger.kernel.org Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Link: https://patch.msgid.link/20260106-bnxt-v3-1-71f37e11446a@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08net: usb: pegasus: fix memory leak in update_eth_regs_async()Petko Manolov1-0/+2
When asynchronously writing to the device registers and if usb_submit_urb() fail, the code fail to release allocated to this point resources. Fixes: 323b34963d11 ("drivers: net: usb: pegasus: fix control urb submission") Signed-off-by: Petko Manolov <petkan@nucleusys.com> Link: https://patch.msgid.link/20260106084821.3746677-1-petko.manolov@konsulko.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit (git 2.54.0.dirty) at 2026-10-01 03:04:43 +0000