summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)AuthorFilesLines
2026-07-21net: phy: Add support for the ADIN1140 PHYCiprian Regus3-0/+79
Add a driver for the ADIN1140's internal 10BASE-T1S PHY. The device doesn't implement autonegotiation, so the link is always reported as being up. The device implements both C22 and C45 MDIO access methods, but can only be discovered over C22, since the C45 MMD devices lack the MDIO_DEVID1 and MDIO_DEVID2 registers. The indirect C45 over C22 feature is not supported. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-12-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: phy: microchip-t1s: use generic C45 MMD access helpersCiprian Regus1-30/+2
Replace the driver specific lan865x_phy_read_mmd() and lan865x_phy_write_mmd() with the shared genphy_read_mmd_c45() and genphy_write_mmd_c45() helpers. No functional change. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-11-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: phy: add generic helpers for direct C45 MMD accessCiprian Regus1-0/+25
Some PHYs support direct C45 register access but not C22 indirect MMD access (registers 0xD and 0xE). When discovered via C22, phylib routes MMD access through the indirect path, which won't work on these devices. Add genphy_read_mmd_c45() and genphy_write_mmd_c45() as read_mmd/ write_mmd callbacks that bypass the C22 indirect path and use the bus C45 accessors directly. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-10-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: ethernet: oa_tc6: Use the read_mms/write_mms functions for C45Ciprian Regus1-9/+10
Accessing PHY MMD devices requires control transactions to registers in a memory map other than 0. Replace the current formatting of the register addresses with the oa_tc6_{read,write}_register_mms() functions. While we're here, introduce the mms variable to store the memory map returned by oa_tc6_get_phy_c45_mms() instead of ret, in order to improve the code readability. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-8-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: ethernet: oa_tc6: Add read_mms/write_mms register access functionsCiprian Regus1-0/+44
The Open Alliance TC6 standard defines multiple memory maps for the MAC-PHY's register space. These are used to separate standard, vendor and PHY MMD specific registers. Define register access functions that allow the caller to specify the MMS. Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-7-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: ethernet: oa_tc6: Add the OA_TC6_ prefix to standard registersCiprian Regus1-18/+19
The OA TC6 standard registers are currently exported in a header file. Add the OA_TC6_ prefix to the register address and subfield mask macros to avoid future naming conflicts. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-6-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: ethernet: oa_tc6: Export standard defined registersCiprian Regus1-50/+0
Move defines for standard Open Alliance TC6 register addresses and subfields in the oa_tc6's header. As such, other ethernet drivers that rely on oa_tc6 can use them directly. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-5-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: ethernet: oa_tc6: Export the C45 access functionsCiprian Regus1-4/+6
The C45 access functions can still be used by some Ethernet drivers which set the OA_TC6_BROKEN_PHY flag. Export them. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-4-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: ethernet: oa_tc6: add OA_TC6_BROKEN_PHY quirk flagCiprian Regus2-2/+14
Some MAC-PHY devices need custom MDIO bus access functions to work around hardware issues. Add the OA_TC6_BROKEN_PHY quirk flag so drivers can opt in to skip oa_tc6's internal PHY init and manage the PHY themselves. When the flag is set, oa_tc6 skips MDIO bus registration, PHY discovery and PHY connection, leaving these to the driver. Drivers that do not set the flag retain the existing behavior. Update lan865x and the framework documentation accordingly. Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-3-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: ethernet: oa_tc6: Handle the OA TC6 SPI protected modeCiprian Regus1-17/+76
Implement the OA TC6 standard defined protected mode for control (register access) transactions. In addition to the current register access formats the oa_tc6 driver handles, 1's complement values of the data field are included (by both the host and the MACPHY) in the SPI transfer frames. This feature acts as an integrity check. Control write transactions look like this: |<- 32 bits ->|<--- data_size --->|<- 32 bits ->| MOSI: | ctrl header | reg write data | ignored | MISO: | (discard) | echoed ctrl hdr | echoed data | data_size (LEN = number of registers to read in a sequence): Unprotected: 32 x (LEN + 1) bits Protected: 2 x 32 x (LEN + 1) bits Control read transaction: |<- 32 bits ->|<--- 32 bits --> |<- data_size ->| MOSI: | ctrl header | ignored ... | MISO: | (discard) | echoed ctrl hdr | reg read data | data_size (LEN = number of registers to read in a sequence): Unprotected: 32 x (LEN + 1) bits Protected: 2 x 32 x (LEN + 1) bits Register data format ("reg write data" and "reg read data"): Unprotected: | W1 (normal) | W2 (normal) | ... | Wx (normal) | Protected: | W1 (normal) | W1 (complement) | ... | Wx (normal) | Wx (complement)| The protected mode state can be read from the bit 5 of CONFIG0 (0x4) register, and this setting is usually only configured during the MACPHY's reset (depending on the device it can be done by setting the state of a pin). We can read the protected mode configuration before any other register access and since the SPI transfer is initially sized for an unprotected read, the MACPHY's complement words are never clocked out and no checking is required. The data transactions (Ethernet frames) remain unchanged. Signed-off-by: Ciprian Regus <ciprian.regus@analog.com> Link: https://patch.msgid.link/20260708-adin1140-driver-v5-2-4aca7b51a58b@analog.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: sparx5: configure TAS port link speedRobert Marko7-0/+75
On the TSN and RED variants of LAN969x and SparX-5i TAS (Time-Aware Shaper) is present in the silicon. Currently, the driver does not use configure it at all, which means that the TAS_PROFILE_CONFIG.LINK_SPEED[1] value is left at the default of 3 which means that its configured for 1 Gbps. So, running iperf between two 10G switch ports will result in only 940-ish Mbps while we should be getting around 9.3 Gbps. Correctly populating the TAS_PROFILE_CONFIG.LINK_SPEED[1] with the current port speed fixes this issue and we achieve around 9.4 Gbps between two 10G switch ports. So, port the TAS port link speed setting from the vendor BSP 6.18 kernel[2] [1] https://microchip-ung.github.io/lan969x-industrial_reginfo/reginfo_LAN969x-Industrial.html?select=hsch,tas_profile_cfg,tas_profile_config,link_speed [2] https://github.com/microchip-ung/linux/tree/bsp-6.18-2026 Signed-off-by: Robert Marko <robert.marko@sartura.hr> Link: https://patch.msgid.link/20260707170531.1129866-1-robert.marko@sartura.hr Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: airoha: fix MIB stats collection to be losslessAniket Negi2-66/+132
REG_FE_GDM_MIB_CLEAR after every read creates a race window where packets arriving between read and clear are lost from statistics. Switch to a delta-based approach instead: - 64-bit H+L registers (ok pkts/bytes, E64..L1023): read absolute hardware total directly into a local variable; clamp with max(new, old) to prevent torn-read regression when the counter carries between the two reads. - 32-bit registers (drops, bc, mc, errors, runt, long): accumulate (u32)(curr - prev) into a 64-bit software counter; unsigned subtraction handles wrap-around transparently. - tx/rx_len[0] ([0,64] bucket): combines RUNT_CNT (32-bit, delta via tx_runt/rx_runt) and E64_CNT (64-bit, absolute) into a single local accumulator; max(new, old) applied here too to guard against a torn read of E64 when the RUNT accumulator is unchanged between polls. MIB counters are zeroed by the SCU FE reset (EN7581_FE_RST) asserted in airoha_hw_init() at module load, so no explicit MIB clear is needed in airoha_fe_init(). Merge airoha_dev_get_hw_stats() into airoha_update_hw_stats() and move stats_lock inside. Plain spin_lock() is correct: the function is only called from ndo_get_stats64() in process context. Each dev refreshes only its own MIB counters; sibling devs on a shared GDM3/4 port are polled when their own netdev is queried. Fixes: 8f4695fb67b2 ("net: airoha: better handle MIBs for GDM ports with multiple devs attached") Signed-off-by: Aniket Negi <aniket.negi03@gmail.com> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260707152639.105628-1-aniket.negi03@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21geneve: make geneve_fill_info() RTNL independentEric Dumazet1-11/+24
Now that geneve->cfg is an RCU-protected pointer, update geneve_fill_info() to read the configuration under RCU read lock instead of relying on RTNL. Also add const qualifiers to the dereferenced pointers where appropriate and fix local variable declaration ordering. Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260707145331.3717941-4-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21geneve: convert config to RCU-protected pointerEric Dumazet1-95/+118
geneve_changelink() currently updates configuration by copying it over the old one using memcpy() under RTNL, forcing data path pause via geneve_quiesce() and synchronize_net() to avoid reading torn values. Convert geneve->cfg to an RCU-protected pointer, allowing lockless and safe reads under RCU read lock without synchronization overhead. Key changes: - Introduced geneve_config_alloc/free() helpers for lifecycle. - geneve_configure() allocates config and publishes it via RCU. - Setting dev->priv_destructor = geneve_free_dev handles config cleanup if register_netdevice() fails or during netdev unregistration. - geneve_changelink() performs RCU swap; old config is freed via call_rcu_hurry(). - Allocates new dst_cache during changelink to prevent pcpu sharing. - Removed geneve_quiesce/unquiesce() and synchronize_net() from changelink. - Added rcu_barrier() to module exit to wait for pending callbacks. - Updated data path to use rcu_dereference(). - Updated geneve_fill_info() to use rtnl_dereference() for now. Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260707145331.3717941-3-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21geneve: pass geneve_config pointer to helper functionsEric Dumazet1-64/+76
In preparation for converting geneve->cfg to an RCU-protected pointer, update helper functions to explicitly accept a const struct geneve_config pointer instead of dereferencing geneve->cfg directly. Signed-off-by: Eric Dumazet <edumazet@google.com> Suggested-by: Paolo Abeni <pabeni@redhat.com> Link: https://patch.msgid.link/20260707145331.3717941-2-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: stmmac: eic7700: add support for eth1 clock inversion variantZhi Li1-8/+103
The eth1 MAC exhibits silicon-inherent RX and TX timing behavior that differs from the eth0 implementation. At 1000Mbps, RX sampling requires clock inversion due to a fixed MAC input skew that cannot be compensated by standard RGMII delay settings. The TX path includes a fixed ~2ns internal delay introduced by the MAC silicon. This delay is always present and is already accounted for in the device tree tx-internal-delay-ps property as part of the effective output timing. The tx-internal-delay-ps property describes the effective delay seen at the MAC output. Since the hardware register controls only the programmable portion of the delay, the driver subtracts the fixed silicon-inherent component before programming the delay register. Use compatible-specific match data to identify the eth1 variant and apply RX clock inversion only at 1000Mbps. The PHY interface mode is adjusted via phy_fix_phy_mode_for_mac_delays() to avoid double-application of RGMII delays when MAC-side delays are already present. Link speed dependency means RX sampling configuration is applied in the fix_mac_speed callback after negotiation. No behavior changes for the existing eth0 controller. Signed-off-by: Zhi Li <lizhi2@eswincomputing.com> Link: https://patch.msgid.link/20260707064234.1333-1-lizhi2@eswincomputing.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-21net: stmmac: eic7700: make RGMII delay properties optionalZhi Li1-6/+0
Make rx-internal-delay-ps and tx-internal-delay-ps optional in the EIC7700 DWMAC driver. The driver previously required both properties to be present and would fail probe when they were missing. This restricts valid hardware configurations where RGMII timing is instead provided by the PHY or board design. Update the driver to treat missing delay properties as zero delay, allowing systems without explicit MAC-side delay tuning to operate correctly. This aligns the driver behavior with the updated device tree binding and provides a safe default configuration when MAC-side delay programming is not required. Signed-off-by: Zhi Li <lizhi2@eswincomputing.com> Link: https://patch.msgid.link/20260707064218.1316-1-lizhi2@eswincomputing.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-20bnx2x: fix null pointer dereference in bnx2x_free_mem_bp()Abdun Nihaal1-4/+4
In one of the error path in bnx2x_alloc_mem_bp(), bnx2x_free_mem_bp() may be called with bp->fp uninitialized. And so, there could be a null pointer dereference in bnx2x_free_mem_bp(). Fix that by initializing the fp_array_size after the bp->fp pointer is correctly initialized. Cc: stable+noautosel@kernel.org # untested fix to unlikely error path Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260707054618.932108-1-nihaal@cse.iitm.ac.in Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-20bonding: fix devconf_all NULL dereference when IPv6 is disabledZhaolong Zhang1-1/+2
When booting with the 'ipv6.disable=1' parameter, the devconf_all is never initialized because inet6_init() exits before addrconf_init() is called which initializes it. bond_send_validate(), however, will still call bond_ns_send_all() even ipv6 is indeed disabled. It will lead to NULL derefence of net->ipv6.devconf_all in ip6_pol_route(). BUG: kernel NULL pointer dereference, address: 000000000000000c [...] Workqueue: bond0 bond_arp_monitor [bonding] RIP: 0010:ip6_pol_route+0x69/0x480 [...] Call Trace: <TASK> ? srso_return_thunk+0x5/0x5f ? __pfx_ip6_pol_route_output+0x10/0x10 fib6_rule_lookup+0xfe/0x260 ? wakeup_preempt+0x8a/0x90 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? sched_balance_rq+0x369/0x810 ip6_route_output_flags+0xd7/0x170 bond_ns_send_all+0xde/0x280 [bonding] bond_ab_arp_probe+0x296/0x320 [bonding] ? srso_return_thunk+0x5/0x5f bond_activebackup_arp_mon+0xb4/0x2c0 [bonding] process_one_work+0x196/0x370 worker_thread+0x1af/0x320 ? srso_return_thunk+0x5/0x5f ? __pfx_worker_thread+0x10/0x10 kthread+0xe3/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x199/0x260 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Fix this by adding ipv6_mod_enabled() condition check in the caller. Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets") Signed-off-by: Qianheng Peng <pengqh1@chinatelecom.cn> Signed-off-by: Zhaolong Zhang <zhangzl68@chinatelecom.cn> Reviewed-by: Hangbin Liu <liuhangbin@gmail.com> Link: https://patch.msgid.link/20260707010622.487333-1-zhangzl2013@126.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-20net: phy: marvell: fix return codeMichael Walle1-1/+1
Return the correct error code, not the value written to the register. Fixes: a219912e0fec ("net: phy: marvell: implement config_inband() method") Signed-off-by: Michael Walle <mwalle@kernel.org> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260706120637.1947685-1-mwalle@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-20ovpn: use monotonic clock for peer keepalive timeoutsMarco Baffo2-4/+4
Replace ktime_get_real_seconds() with the monotonic ktime_get_boottime_seconds() to ensure the keepalive mechanism is robust against system clock modifications. Right now, the driver uses ktime_get_real_seconds() to track peer timeouts, relying on the system wall-clock. An administrative time adjustment or an NTP sync that steps the clock forward can cause `now' to instantly exceed `last_recv + timeout'. When this occurs, the driver artificially expires healthy peers. Depending on the OpenVPN user-space configuration, this triggers a premature tunnel restart (if --keepalive or --ping-restart is used) or a complete disconnection of the client (if --ping-exit is used). Fixes: 3ecfd9349f40 ("ovpn: implement keepalive mechanism") Signed-off-by: Marco Baffo <marco@mandelbit.com> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-07-20ovpn: fix use after free in unlock_ovpn()Marco Baffo1-2/+3
unlock_ovpn() iterates over the release_list using llist_for_each_entry() and drops the peer reference inside the loop body via ovpn_peer_put(). If this drops the last reference, the peer is eventually freed. However, llist_for_each_entry() reads peer->release_entry.next in the loop advance expression, which runs after the body. By that time the peer may have already been freed, resulting in a use after free when advancing to the next list entry. Fix this by using llist_for_each_entry_safe(), which caches the next pointer before executing the loop body. Fixes: 80747caef33d ("ovpn: introduce the ovpn_peer object") Signed-off-by: Marco Baffo <marco@mandelbit.com> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-07-20ovpn: hold peer before scheduling keepalive workShuvam Pandey1-2/+4
ovpn_peer_keepalive_send() passes its peer reference to ovpn_xmit_special(), which ultimately drops it. The keepalive scheduler currently queues the work first and takes the reference only after schedule_work() reports that the work was queued. Once schedule_work() queues the item, another CPU may run the worker before the caller gets to ovpn_peer_hold(). In that case the worker can consume a reference that was not acquired for it, corrupting the peer lifetime accounting. Take the peer reference before queueing the work and drop it again when the work was already pending. Fixes: 3ecfd9349f40 ("ovpn: implement keepalive mechanism") Cc: stable@vger.kernel.org Signed-off-by: Shuvam Pandey <shuvampandey1@gmail.com> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-07-20ovpn: fix peer refcount leak in TCP error pathsPavitra Jha1-2/+4
When either the TCP RX or TX error path calls ovpn_peer_hold() followed by schedule_work(&peer->tcp.defer_del_work), and the work item is already pending from the other path, schedule_work() returns false and the work runs only once. Since ovpn_tcp_peer_del_work() calls ovpn_peer_put() exactly once, the extra reference taken by the losing path is never dropped, leaking the peer object. The race window: CPU0 (strparser/RX error): CPU1 (tcp_tx_work/TX error): ovpn_peer_hold() <- refcnt+1 ovpn_peer_hold() <- refcnt+2 schedule_work() <- queued schedule_work() <- NO-OP (work already pending) ovpn_tcp_peer_del_work runs: ovpn_peer_del() ovpn_peer_put() <- refcnt+1 <- peer never freed Fix by checking the return value of schedule_work() in both paths and calling ovpn_peer_put() to drop the extra reference if the work was already pending. ovpn_peer_hold() is kept unconditional in the TX path as it cannot fail at that point. Fixes: a6a5e87b3ee4 ("ovpn: avoid sleep in atomic context in TCP RX error path") Cc: stable@vger.kernel.org Signed-off-by: Pavitra Jha <jhapavitra98@gmail.com> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-07-20ovpn: avoid putting unrelated P2P peer on socket releaseQing Ming1-1/+0
ovpn_peer_release_p2p() is called when an OVPN UDP socket is being destroyed. It checks the currently published P2P peer and releases it only if that peer still uses the socket being destroyed. A peer replacement can publish a new peer before the old UDP socket is destroyed. When the old socket destruction path runs afterwards, ovpn_peer_release_p2p() observes the new peer through ovpn->peer. Since the new peer uses a different socket, the function takes the socket mismatch branch. That branch still calls ovpn_peer_put(peer). At this point, however, peer is the currently published replacement peer, not the peer associated with the socket being destroyed. Dropping its reference can free it while ovpn->peer still points to it, leading to later use-after-free accesses from the peer and socket cleanup paths. KASAN reports this as a slab-use-after-free on the kmalloc-1k ovpn_peer object. In the reproducer, the object is allocated from ovpn_peer_new() via ovpn_nl_peer_new_doit(), and freed through ovpn_peer_release_rcu() from RCU callback processing. Observed access sites include ovpn_peer_remove(), ovpn_socket_release(), ovpn_nl_peer_del_notify(), and unlock_ovpn(). Fix this by returning from the socket mismatch branch without putting the peer. Fixes: f6226ae7a0cd ("ovpn: introduce the ovpn_socket object") Signed-off-by: Qing Ming <a0yami@mailbox.org> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-07-20Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netPaolo Abeni35-65/+139
Cross-merge networking fixes after downstream PR (net-7.2-rc4). No conflicts. Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-18wifi: iwlwifi: mld: move BIOS reading code to where it belongsMiri Korenblit2-2/+3
We have a dedicated function to fetch all the BIOS tables when the opmode starts, and yet we read a couple of tables directly from iwl_op_mode_mld_start, which is already a large function that does multiple things. Move the reading of the sgom, puncturing, and RFI enablement to the dedicated iwl_mld_get_bios_tables. Link: https://patch.msgid.link/20260717172958.b19a33e0b507.I73f6b5e6a81d0f411f12589ceb30afa655c0a16b@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mld: add debug log after AP type commandPagadala Yesu Anjaneyulu1-0/+2
Add a radio debug trace when MCC_ALLOWED_AP_TYPE_CMD is sent successfully during AP type table initialization. This improves bring-up visibility without changing runtime behavior. Failures are still reported through the existing error log path. Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com> Link: https://patch.msgid.link/20260717172958.18e1fc5ec109.I76dd832f62d00a8f358f8e4a705f25184ac53da2@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mld: support update_mcc notification v2Pagadala Yesu Anjaneyulu2-2/+6
New firmware will support version 2 of the update_mcc notification. The extra field is used for a new feature, but we does not support it. Keep the existing payload definition compatible with both versions and register version 2 in the MLD notification version table so the driver accepts the newer notification without changing the behavior. This preserves version 1 support and adds compatibility with firmware that sends version 2. Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com> Link: https://patch.msgid.link/20260717172958.9c5a940d37dc.I955800c2377b802ffb99003349552cc4036ca4bd@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: fw: move SAR defines from acpi.h to regulatory.hAvinash Bhatt2-5/+3
IWL_SAR_ENABLE_MSK and IWL_REDUCE_POWER_FLAGS_POS describe the layout of the shared WRDS/SAR table format. They are not ACPI-specific: the same bit positions are used regardless of whether the data originates from ACPI, UEFI, or another BIOS source. IWL_SAR_ENABLE_MSK was already duplicated in regulatory.h; remove it from acpi.h to eliminate the duplication. Move IWL_REDUCE_POWER_FLAGS_POS to regulatory.h alongside IWL_SAR_ENABLE_MSK so that both SAR field descriptors live in the shared regulatory header, accessible to all BIOS configuration sources. No functional change. Signed-off-by: Avinash Bhatt <avinash.bhatt@intel.com> Link: https://patch.msgid.link/20260717172958.32e5dcde4b90.I420c58b05ab6ab011c4c771ca9e4eb62740de549@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mld: drop connection on D3 resume failureAyala Beker1-0/+3
When FW crashes on D3 exit, iwl_mld_nic_error() sets STATUS_RESET_PENDING and queues restart wk, but mac80211's resume callback synchronously calls iwl_trans_stop_device() which clears the flag. As a result restart wk skips sw_reset, and the FW error recovery buffer is never read. The new FW boots with empty BA state and initial sequence numbers, while the AP still holds its A-MPDU RX reorder window. This causes MPDUs to be dropped as IWL_RX_MPDU_REORDER_BA_OLD_SN until ADDBA is renegotiated. We don't know how long the firmware has been in an error state or whether the AP still considers us associated, so keeping the connection alive is not worth it. Call ieee80211_resume_disconnect() when iwl_mld_wait_d3_notif() fails, and let userspace reassociate. Signed-off-by: Ayala Beker <ayala.beker@intel.com> Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717172958.3e10c8498f53.Icf5644b42d79e984ecc16abfa873bd37f611e778@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mvm: ignore sync frames when sync is disabledEmmanuel Grumbach1-0/+4
Gate time-sync frame interception on the active flag so frames are not queued after time-sync teardown. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717172958.ac73ee199a25.Ic1489244f9b02da93060f0a0e5b300a73527f265@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mld: initialize scan-abort statusEmmanuel Grumbach1-1/+2
Initialize abort status before issuing the abort command so debug logging never reads an uninitialized value on error paths. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717172958.9d804f466534.I4e10270bd1dde4a80940a47ef5d383729cc66cb1@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mld: validate wake packet crypto overheadEmmanuel Grumbach1-6/+57
Wake packet parsing only accounted for FCS and missed per-key IV/ICV overhead for protected data frames. Prevent size underflow and bad packet trimming when notifications are malformed or truncated. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717172958.e06595623533.Ie09494b7e34e5872b750fd90e325648ee469d0da@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: validate SEC_RT TLV minimum sizeEmmanuel Grumbach1-1/+4
Reject firmware section TLVs that are shorter than the offset field before subtracting sizeof(offset) from the section size. This prevents size underflow for malformed TLVs. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717173215.17b040b27edc.I6b32d1e9ad707417e2e604f08a63582456209372@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: uefi: bound PPAG revision bitmap shiftEmmanuel Grumbach1-1/+1
Validate revision is below 32 before BIT(revision) in PPAG parsing. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717173215.d116dd2efdc1.I3c6cae5cb9d0acc2d94544bc755b0754a91b10ba@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: acpi: validate WGDS table revision indexEmmanuel Grumbach1-0/+5
Check tbl_rev bounds before BIT(tbl_rev) to avoid undefined shifts when firmware reports an invalid revision value. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717173215.52a01f841f2a.Ic0131eaac31d9ff71b169138d9b0865cb39b44a9@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: dbg-tlv: bound aligned TLV walk lengthEmmanuel Grumbach1-2/+11
Validate ALIGN(tlv_len, 4) before advancing through external debug TLVs to prevent parser length underflow. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717173215.e08d6550c6ec.Iad64190a7d5cded553aff41973120396aef1b557@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: bound aligned TLV advance in FW parserEmmanuel Grumbach1-2/+11
Validate ALIGN(tlv_len, 4) against remaining parser length before consuming bytes from the firmware image. This avoids length underflow on malformed TLVs. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717173215.393c286488f9.Ia39144dc3ca334325ee4eacb7420901e2446fc23@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-17net: phy: at803x: Use a helper to check for phy reset existenceMaxime Chevallier1-1/+1
The at803x family of devices are subjected to an errata that requires hard-reseting the PHY upon link change. That can only work if there's a physical reset line wired to the PHY, which the driver checks by looking if there's a reset GPIO configured for the MDIO device. The reset may however be controlled through a reset controller, which isn't accounted for in the errata handling. Besides that, PHY drivers aren't expected to directly access the mdiodev's resources directly, let's therefore wrap this with a phylib helper, that uses a similar mdio helper to check for reset existence. This was found in preparation for bus-level resource management for better mdio scan support. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Link: https://patch.msgid.link/20260715101355.88536-1-maxime.chevallier@bootlin.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17net: mana: Add handler for sriov configureHaiyang Zhang1-0/+24
Add callback function for the pci_driver / sriov_configure. It asks the NIC to provide certain number of VFs, or disable VFs if the request is zero. Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com> Link: https://patch.msgid.link/20260710192735.2921300-1-haiyangz@linux.microsoft.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17net: mana: Add debug knob to skip TX timeout recovery resetAditya Garg1-0/+14
Add a per-port debugfs boolean "tx_timeout_skip_reset" that, when enabled, makes mana_tx_timeout() log the TX timeout and return without queueing the per-port detach/attach recovery work. This is a debug-only aid for bringup and qualification: skipping the recovery reset keeps the device and queue state intact so a TX timeout can be correlated with hardware telemetry. The knob defaults to false, so production recovery behaviour is unchanged. Signed-off-by: Aditya Garg <gargaditya@linux.microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Reviewed-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260710132229.2851441-1-gargaditya@linux.microsoft.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17net: airoha: add preliminary support to configure tx hw QoS queue during ↵Lorenzo Bianconi1-4/+6
flowtable offloading Add the plumbing to program the AIROHA_FOE_QID field in the PPE FOE entry with a per-flow priority value during flowtable offload. This allows the hardware to steer offloaded flows to a specific QoS queue on the egress QDMA block for traffic forwarded between two interfaces via hardware acceleration, bypassing the kernel forwarding path. The priority parameter is currently always zero because netfilter does not yet provide a mechanism to pass the skb priority field to the flowtable offload driver. Once that support is added in the netfilter subsystem, the driver will be able to extract the priority from the flow rule and map it to the appropriate hardware queue. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260703-airoha-hw-qos-queue-stub-v1-1-ef253ffdd093@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17bnxt_en: Handle partially initialized auxiliary devicesRuoyu Wang1-19/+20
bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are initialized. After auxiliary_device_init() succeeds, later errors must unwind with auxiliary_device_uninit(), which invokes the release callback. The release callback assumes that aux_priv->id, aux_priv->edev, edev->net and edev->ulp_tbl are all populated. If allocation fails after auxiliary_device_init(), the release path can otherwise dereference or clear partially initialized state. Allocate and attach the bnxt_en_dev and ULP table before calling auxiliary_device_init(), so the release callback only sees a fully initialized auxiliary private object. If auxiliary_device_init() itself fails, free those allocations directly because device_initialize() has not run and the release callback will not be invoked. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 194fad5b2781 ("bnxt_en: Refactor bnxt_rdma_aux_device_init/uninit functions") Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com> Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Link: https://patch.msgid.link/20260711163716.3996929-1-ruoyuw560@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move skb_pool / refill_wq from struct netpoll to netconsole_targetBreno Leitao1-23/+30
These two fields back the fallback skb pool that find_skb() uses. Every helper that touches them lives in netconsole now (refill_skbs, refill_skbs_work_handler, netconsole_skb_pool_init, netconsole_skb_pool_flush, find_skb, netcons_skb_pop), so the data can move alongside its only consumer. Add skb_pool and refill_wq to struct netconsole_target, drop them from struct netpoll. This will save 48-bytes for every netpoll user instance (except netconsole that will have it in netconsole target struct). Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-7-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move remote_mac from struct netpoll to netconsole_targetBreno Leitao1-9/+11
The destination ethernet address is netconsole configuration: no other netpoll user (bonding, team, vlan, bridge, macvlan, dsa) references np->remote_mac, only netconsole's ethernet framing and its configfs/cmdline interface do. Move it into struct netconsole_target and convert push_eth() to take the netconsole_target; netconsole_print_banner() and netconsole_parser_cmdline() already take it. The configfs show/store handlers and alloc_and_init() reach the field directly. No functional change; the remote_mac sysfs attribute is unchanged. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-9-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move skb_pool_flush() from netpollBreno Leitao1-1/+4
skb_pool_flush() has no callers left in net/core/netpoll.c after netconsole took over the pool lifecycle. Inline its body into netconsole_skb_pool_flush() (the only caller) and drop the function and its export from netpoll. The prototype goes from <linux/netpoll.h>. Pure code motion: cancel_work_sync() + skb_queue_purge_reason() semantics are unchanged. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-6-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move local_port / remote_port from struct netpoll to ↵Breno Leitao1-21/+26
netconsole_target The source and destination UDP ports live in struct netpoll but are netconsole configuration. No other netpoll user (bonding, team, vlan, bridge, macvlan, dsa) touches np->local_port or np->remote_port; they only use the netpoll TX/forwarding path. Only netconsole's UDP framing and its configfs/cmdline interface read these fields. Move both into struct netconsole_target and convert the three helpers that read them - push_udp(), netconsole_print_banner() and netconsole_parser_cmdline() - to take the netconsole_target. The configfs show/store handlers already have the target in hand. No functional change; the local_port / remote_port sysfs attributes are unchanged. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-8-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move refill_skbs() and skb-pool sizing macros from netpollBreno Leitao1-0/+29
refill_skbs() is now only called from netconsole (directly via netconsole_skb_pool_init() and indirectly via the just-moved refill_skbs_work_handler()), and the MAX_UDP_CHUNK / MAX_SKBS / MAX_SKB_SIZE macros are private to it. Move them all into drivers/net/netconsole.c. MAX_UDP_CHUNK and MAX_SKB_SIZE were promoted to <linux/netpoll.h> by commit 6c537b845c99 ("netconsole: do not dequeue pooled skbs that cannot satisfy len") so find_skb() could detect oversized requests against the same value refill_skbs() used. With both functions now local to netconsole, the shared definition no longer needs to live in the header. Pure code motion: bodies and pool sizing semantics are unchanged. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-5-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move refill_skbs_work_handler() from netpollBreno Leitao1-0/+8
The work handler is wired via INIT_WORK() in netconsole_skb_pool_init() and has no other callers since the previous patch took the skb pool lifecycle out of __netpoll_setup(). Move the function body into drivers/net/netconsole.c as a file-static helper, drop EXPORT_SYMBOL_GPL() and remove the prototype from <linux/netpoll.h>. Pure code motion: the body is unchanged and still calls the exported refill_skbs() in net/core/netpoll.c. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-4-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
generated by cgit (git 2.54.0.dirty) at 2026-09-23 13:37:00 +0000