summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)AuthorFilesLines
2026-03-31fbnic: Set Relaxed Ordering PCIe TLP attributes for DMA enginesAlexander Duyck4-2/+27
Add ATTR CSR bit field definitions for the DMA engine TLP header configuration registers: AW_CFG: RDE_ATTR[17:15], RQM_ATTR[14:12], TQM_ATTR[11:9] AR_CFG: TDE_ATTR[17:15], RQM_ATTR[14:12], TQM_ATTR[11:9] These fields control the PCIe TLP attribute bits for outbound transactions from the TQM, RQM, RDE (write path), and TDE (read path) DMA engines. An enum is added with standard PCIe TLP attribute values: NS (No Snoop), RO (Relaxed Ordering), and IDO (ID-based Ordering). Read the PCIe Relaxed Ordering capability at probe time and store it in fbnic_dev. Configure Relaxed Ordering on the PCIe TLP attributes in fbnic_mbx_init_desc_ring when the capability is enabled. For the write path (AW_CFG), set RO on RDE and TQM attributes. For the read path (AR_CFG), set RO on all three attributes (TDE, RQM, TQM). This allows the PCIe fabric to reorder these transactions for improved throughput. Signed-off-by: Alexander Duyck <alexanderduyck@fb.com> Signed-off-by: Dimitri Daskalakis <daskald@meta.com> Link: https://patch.msgid.link/20260327204445.3074446-1-dimitri.daskalakis1@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-31net: xilinx: axienet: Fix BQL accounting for multi-BD TX packetsSuraj Gupta1-5/+4
When a TX packet spans multiple buffer descriptors (scatter-gather), axienet_free_tx_chain sums the per-BD actual length from descriptor status into a caller-provided accumulator. That sum is reset on each NAPI poll. If the BDs for a single packet complete across different polls, the earlier bytes are lost and never credited to BQL. This causes BQL to think bytes are permanently in-flight, eventually stalling the TX queue. The SKB pointer is stored only on the last BD of a packet. When that BD completes, use skb->len for the byte count instead of summing per-BD status lengths. This matches netdev_sent_queue(), which debits skb->len, and naturally survives across polls because no partial packet contributes to the accumulator. Fixes: c900e49d58eb ("net: xilinx: axienet: Implement BQL") Signed-off-by: Suraj Gupta <suraj.gupta2@amd.com> Reviewed-by: Sean Anderson <sean.anderson@linux.dev> Link: https://patch.msgid.link/20260327073238.134948-3-suraj.gupta2@amd.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-31net: xilinx: axienet: Correct BD length masks to match AXIDMA IP specSuraj Gupta1-2/+2
The XAXIDMA_BD_CTRL_LENGTH_MASK and XAXIDMA_BD_STS_ACTUAL_LEN_MASK macros were defined as 0x007FFFFF (23 bits), but the AXI DMA IP product guide (PG021) specifies the buffer length field as bits 25:0 (26 bits). Update both masks to match the IP documentation. In practice this had no functional impact, since Ethernet frames are far smaller than 2^23 bytes and the extra bits were always zero, but the masks should still reflect the hardware specification. Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver") Signed-off-by: Suraj Gupta <suraj.gupta2@amd.com> Reviewed-by: Sean Anderson <sean.anderson@linux.dev> Link: https://patch.msgid.link/20260327073238.134948-2-suraj.gupta2@amd.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-31net: bonding: fix use-after-free in bond_xmit_broadcast()Xiang Mei1-1/+1
bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changing which slave is "last" mid-loop. This causes the original skb to be double-consumed (double-freed). Replace the racy bond_is_last_slave() check with a simple index comparison (i + 1 == slaves_count) against the pre-snapshot slave count taken via READ_ONCE() before the loop. This preserves the zero-copy optimization for the last slave while making the "last" determination stable against concurrent list mutations. The UAF can trigger the following crash: ================================================================== BUG: KASAN: slab-use-after-free in skb_clone Read of size 8 at addr ffff888100ef8d40 by task exploit/147 CPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334) bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593) dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887) __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838) ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136) ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219) ip6_output (net/ipv6/ip6_output.c:250) ip6_send_skb (net/ipv6/ip6_output.c:1985) udp_v6_send_skb (net/ipv6/udp.c:1442) udpv6_sendmsg (net/ipv6/udp.c:1733) __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Allocated by task 147: Freed by task 147: The buggy address belongs to the object at ffff888100ef8c80 which belongs to the cache skbuff_head_cache of size 224 The buggy address is located 192 bytes inside of freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60) Memory state around the buggy address: ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fixes: 4e5bd03ae346 ("net: bonding: fix bond_xmit_broadcast return value error bug") Reported-by: Weiming Shi <bestswngs@gmail.com> Signed-off-by: Xiang Mei <xmei5@asu.edu> Link: https://patch.msgid.link/20260326075553.3960562-1-xmei5@asu.edu Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-31r8152: add helper functions for PHY OCP registersChih Kai Hsu1-465/+220
Add the following bitwise operation functions for PHY OCP registers to simplify the code. - ocp_reg_w0w1() - ocp_reg_clr_bits() - ocp_reg_set_bits() - sram_write_w0w1() - sram_clr_bits() - sram_set_bits() - r8152_mdio_clr_bit() - r8152_mdio_set_bit() - r8152_mdio_test_and_clr_bit() In addition, remove variable set but not used from r8153_init(), r8153b_init() and r8153c_init(). Signed-off-by: Chih Kai Hsu <hsu.chih.kai@realtek.com> Reviewed-by: Hayes Wang <hayeswang@realtek.com> Link: https://patch.msgid.link/20260326073925.32976-456-nic_swsd@realtek.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-31r8152: add helper functions for PLA/USB OCP registersChih Kai Hsu1-694/+407
Add the following bitwise operation functions for PLA/USB OCP registers to simplify the code. - ocp_dword_w0w1() - ocp_word_w0w1() - ocp_byte_w0w1() - ocp_dword_clr_bits() - ocp_dword_set_bits() - ocp_word_clr_bits() - ocp_word_set_bits() - ocp_word_test_and_clr_bits() - ocp_byte_clr_bits() - ocp_byte_set_bits() Signed-off-by: Chih Kai Hsu <hsu.chih.kai@realtek.com> Reviewed-by: Hayes Wang <hayeswang@realtek.com> Link: https://patch.msgid.link/20260326073925.32976-455-nic_swsd@realtek.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-31r8152: fix incorrect register write to USB_UPHY_XTALChih Kai Hsu1-1/+1
The old code used ocp_write_byte() to clear the OOBS_POLLING bit (BIT(8)) in the USB_UPHY_XTAL register, but this doesn't correctly clear a bit in the upper byte of the 16-bit register. Fix this by using ocp_write_word() instead. Fixes: 195aae321c82 ("r8152: support new chips") Signed-off-by: Chih Kai Hsu <hsu.chih.kai@realtek.com> Reviewed-by: Hayes Wang <hayeswang@realtek.com> Link: https://patch.msgid.link/20260326073925.32976-454-nic_swsd@realtek.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-03-30FDDI: defxx: Rate-limit memory allocation errorsMaciej W. Rozycki1-1/+1
Prevent the system from becoming unstable or unusable due to a flood of memory allocation error messages under memory pressure, e.g.: [...] fddi0: Could not allocate receive buffer. Dropping packet. fddi0: Could not allocate receive buffer. Dropping packet. fddi0: Could not allocate receive buffer. Dropping packet. fddi0: Could not allocate receive buffer. Dropping packet. rcu: INFO: rcu_sched self-detected stall on CPU rcu: 0-...!: (332 ticks this GP) idle=255c/1/0x40000000 softirq=16420123/16420123 fqs=0 rcu: (t=2103 jiffies g=35680089 q=4 ncpus=1) rcu: rcu_sched kthread timer wakeup didn't happen for 2102 jiffies! g35680089 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 rcu: Possible timer handling issue on cpu=0 timer-softirq=12779658 rcu: rcu_sched kthread starved for 2103 jiffies! g35680089 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0 rcu: Unless rcu_sched kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_sched state:I stack:0 pid:14 tgid:14 ppid:2 flags:0x00004000 Call Trace: __schedule+0x258/0x580 schedule+0x19/0xa0 schedule_timeout+0x4a/0xb0 ? hrtimers_cpu_dying+0x1b0/0x1b0 rcu_gp_fqs_loop+0xb1/0x450 rcu_gp_kthread+0x9d/0x130 kthread+0xb2/0xe0 ? rcu_gp_init+0x4a0/0x4a0 ? kthread_park+0x90/0x90 ret_from_fork+0x2d/0x50 ? kthread_park+0x90/0x90 ret_from_fork_asm+0x12/0x20 entry_INT80_32+0x10d/0x10d CPU: 0 UID: 500 PID: 21895 Comm: 31370.exe Not tainted 6.13.0-dirty #2 (here running the libstdc++-v3 testsuite). Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/alpine.DEB.2.21.2603291236590.60268@angie.orcam.me.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30FDDI: defza: Rate-limit memory allocation errorsMaciej W. Rozycki1-2/+3
Prevent the system from becoming unstable or unusable due to a flood of memory allocation error messages under memory pressure. Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/alpine.DEB.2.21.2603291252380.60268@angie.orcam.me.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30bnxt_en: set backing store type from query typePengpeng Hou1-4/+4
bnxt_hwrm_func_backing_store_qcaps_v2() stores resp->type from the firmware response in ctxm->type and later uses that value to index fixed backing-store metadata arrays such as ctx_arr[] and bnxt_bstore_to_trace[]. ctxm->type is fixed by the current backing-store query type and matches the array index of ctx->ctx_arr. Set ctxm->type from the current loop variable instead of depending on resp->type. Also update the loop to advance type from next_valid_type in the for statement, which keeps the control flow simpler for non-valid and unchanged entries. Fixes: 6a4d0774f02d ("bnxt_en: Add support for new backing store query firmware API") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Reviewed-by: Michael Chan <michael.chan@broadcom.com> Tested-by: Michael Chan <michael.chan@broadcom.com> Link: https://patch.msgid.link/20260328234357.43669-1-pengpeng@iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: airoha: Delay offloading until all net_devices are fully registeredLorenzo Bianconi3-0/+10
Netfilter flowtable can theoretically try to offload flower rules as soon as a net_device is registered while all the other ones are not registered or initialized, triggering a possible NULL pointer dereferencing of qdma pointer in airoha_ppe_set_cpu_port routine. Moreover, if register_netdev() fails for a particular net_device, there is a small race if Netfilter tries to offload flowtable rules before all the net_devices are properly unregistered in airoha_probe() error patch, triggering a NULL pointer dereferencing in airoha_ppe_set_cpu_port routine. In order to avoid any possible race, delay offloading until all net_devices are registered in the networking subsystem. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260329-airoha-regiser-race-fix-v2-1-f4ebb139277b@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: stmmac: qcom-ethqos: move phase_shift to register update siteRussell King (Oracle)1-8/+9
Move the determination of the phase shift enable alongside the register update, and make "phase_shift" unsigned. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1w62o3-0000000E3DE-3Vf8@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: stmmac: qcom-ethqos: correct prg_rclk_dly commentRussell King (Oracle)1-2/+4
The comment for calculating the prg_rclk_dly value is incorrect as it omits the brackets around the divisor. Add the brackets to allow the reader to correctly evaluate the value. Validated with the values given in the driver. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1w62ny-0000000E3D8-38Yp@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: stmmac: qcom-ethqos: move loopback decision next to reg updateRussell King (Oracle)1-8/+6
Move the loopback decision next to the register update, and make the local variable unsigned. As a result, there is now no need for the comment referring to the programming being later. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1w62nt-0000000E3D2-2fWk@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: stmmac: qcom-ethqos: simplify prg_rclk_dly programmingRussell King (Oracle)1-6/+7
Rather than coding the entire register update twice with different values, use a local variable to specify the value and have one register update statement that uses this local variable. This results in neater code. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1w62no-0000000E3Cw-2EmH@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: stmmac: qcom-ethqos: finally eliminate the switchRussell King (Oracle)1-31/+16
Move the RCLK delay configuration out of the switch, which just leaves the RGMII_CONFIG_LOOPBACK_EN setting in all three paths. This makes it trivial to eliminate the switch. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1w62nj-0000000E3Cq-1lPL@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: stmmac: qcom-ethqos: move RGMII_CONFIG2_RX_PROG_SWAPRussell King (Oracle)1-15/+6
Move RGMII_CONFIG2_RX_PROG_SWAP out of the switch. 1G speed always sets this field. 100M and 10M sets it for has_emac_ge_3 devices, otherwise it is cleared. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1w62ne-0000000E3Ck-1Haf@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: stmmac: qcom-ethqos: move RGMII_CONFIG2_RSVD_CONFIG15 outRussell King (Oracle)1-7/+3
All paths through the switch clear the RGMII_CONFIG2_RSVD_CONFIG15 field. move it out of the switch statement. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1w62nZ-0000000E3Ce-0lyP@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: stmmac: qcom-ethqos: move 100M/10M speed programmingRussell King (Oracle)1-6/+9
Move the speed programming for 100M and 10M out of the switch. There is no programming done for 1G speed. It looks like there are two fields, 7:6 which are programemd to '1' to select a /2 divisor for 100M, and bits 16:8 which are programmed to '19' to select a /20 divisor. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1w62nU-0000000E3CX-0KF9@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: stmmac: qcom-ethqos: move two more RGMII_IO_MACRO_CONFIG2 outRussell King (Oracle)1-13/+5
RGMII_CONFIG2_DATA_DIVIDE_CLK_SEL is always cleared, and RGMII_CONFIG2_TX_CLK_PHASE_SHIFT_EN is always updated with the phase shift in each path through the switch, so these are independent of the speed. Move them out. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1w62nO-0000000E3CR-445p@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: stmmac: qcom-ethqos: move 1G vs 100M/10M RGMII settingsRussell King (Oracle)1-14/+12
Move RGMII_CONFIG_BYPASS_TX_ID_EN, RGMII_CONFIG_POS_NEG_DATA_SEL and RGMII_CONFIG_PROG_SWAP. There are two states for these: one group for 1G, and the logical inversion for 100M and 10M. Move this out of the switch into an if-else clause. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1w62nJ-0000000E3CL-3YSr@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: stmmac: qcom-ethqos: move RGMII_CONFIG_DDR_MODERussell King (Oracle)1-6/+2
RGMII_CONFIG_DDR_MODE is always set irrespective of the speed. Move this out of the switch. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1w62nE-0000000E3CF-331r@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: stmmac: qcom-ethqos: move detection of invalid RGMII speedRussell King (Oracle)1-3/+5
Move detection of invalid RGMII speeds (which will never be triggered) before the switch() to allow register modifications that are common to all speeds to be moved out of the switch. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1w62n9-0000000E3C9-2Zkr@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: stmmac: qcom-ethqos: eliminate configure_funcRussell King (Oracle)1-20/+15
Since ethqos_fix_mac_speed() is called via a function pointer, and only indirects via the configure_func function pointer, eliminate this unnecessary indirection. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1w62n4-0000000E3C3-251S@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: stmmac: qcom-ethqos: pass ethqos to ethqos_pcs_set_inband()Russell King (Oracle)1-5/+5
Rather than getting the stmmac_priv pointer in ethqos_configure_sgmii(), move it into ethqos_pcs_set_inband() and pass the struct qcom_ethqos pointer instead. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1w62mz-0000000E3Bx-1Xd8@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: stmmac: qcom-ethqos: remove ethqos_configure()Russell King (Oracle)1-7/+1
ethqos_configure() does nothing more than indirect via ethqos->configure_func, and is only called from ethqos_fix_mac_speed() just below. Move the indirect call into ethqos_fix_mac_speed(). Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> Link: https://patch.msgid.link/E1w62mu-0000000E3Bq-15wa@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue()Lorenzo Bianconi1-1/+17
In order to properly cleanup hw rx QDMA queues and bring the device to the initial state, reset rx DMA queue head/tail index. Moreover, reset queued DMA descriptor fields. Fixes: 23020f049327 ("net: airoha: Introduce ethernet support for EN7581 SoC") Tested-by: Madhur Agrawal <Madhur.Agrawal@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260327-airoha_qdma_cleanup_rx_queue-fix-v1-1-369d6ab1511a@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30net: sfp: add quirk for ZOERAX SFP-2.5G-TJan Hoffmann1-0/+2
This is a 2.5G copper module which appears to be based on a Motorcomm YT8821 PHY. There doesn't seem to be a usable way to to access the PHY (I2C address 0x56 provides only read-only C22 access, and Rollball is also not working). The module does not report the correct extended compliance code for 2.5GBase-T, and instead claims to support SONET OC-48 and Fibre Channel: Identifier : 0x03 (SFP) Extended identifier : 0x04 (GBIC/SFP defined by 2-wire interface ID) Connector : 0x07 (LC) Transceiver codes : 0x00 0x01 0x00 0x00 0x40 0x40 0x04 0x00 0x00 Transceiver type : FC: Multimode, 50um (M5) Encoding : 0x05 (SONET Scrambled) BR Nominal : 2500MBd Despite this, the kernel still enables the correct 2500Base-X interface mode. However, for the module to actually work, it is also necessary to disable inband auto-negotiation. Enable the existing "sfp_quirk_oem_2_5g" for this module, which handles that and also sets the bit for 2500Base-T link mode. Signed-off-by: Jan Hoffmann <jan@3e8.eu> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20260329191304.720160-1-jan@3e8.eu Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-30RDMA/mana_ib: Disable RX steering on RSS QP destroyLong Li1-1/+10
When an RSS QP is destroyed (e.g. DPDK exit), mana_ib_destroy_qp_rss() destroys the RX WQ objects but does not disable vPort RX steering in firmware. This leaves stale steering configuration that still points to the destroyed RX objects. If traffic continues to arrive (e.g. peer VM is still transmitting) and the VF interface is subsequently brought up (mana_open), the firmware may deliver completions using stale CQ IDs from the old RX objects. These CQ IDs can be reused by the ethernet driver for new TX CQs, causing RX completions to land on TX CQs: WARNING: mana_poll_tx_cq+0x1b8/0x220 [mana] (is_sq == false) WARNING: mana_gd_process_eq_events+0x209/0x290 (cq_table lookup fails) Fix this by disabling vPort RX steering before destroying RX WQ objects. Note that mana_fence_rqs() cannot be used here because the fence completion is delivered on the CQ, which is polled by user-mode (e.g. DPDK) and not visible to the kernel driver. Refactor the disable logic into a shared mana_disable_vport_rx() in mana_en, exported for use by mana_ib, replacing the duplicate code. The ethernet driver's mana_dealloc_queues() is also updated to call this common function. Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter") Cc: stable@vger.kernel.org Signed-off-by: Long Li <longli@microsoft.com> Link: https://patch.msgid.link/20260325194100.1929056-1-longli@microsoft.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-03-30Merge branch 'master' into rdma-nextLeon Romanovsky144-750/+1546
Let's bring v7.0-rc6 to the -next branch, so we can merge the DMA attributes fix [1] without merge conflicts. [1] https://lore.kernel.org/all/20260323-umem-dma-attrs-v1-1-d6890f2e6a1e@nvidia.com Signed-off-by: Leon Romanovsky <leon@kernel.org> * master: (1688 commits) Linux 7.0-rc6 ...
2026-03-30wifi: rtw88: coex: Ignore BT info byte 5 from RTL8821ABitterblue Smith1-0/+3
Sometimes while watching a Youtube video with Bluetooth headphones the audio has a lot of interruptions, because the 5th byte of the BT info sent by RTL8821AU has strange values, which result in coex_stat->bt_hid_pair_num being 2 or 3. When this happens rtw_coex_freerun_check() returns true, which causes rtw_coex_action_wl_connected() to call rtw_coex_action_freerun() instead of rtw_coex_action_bt_a2dp(). The RTL8821AU vendor driver doesn't do anything with the 5th byte of the BT info, so ignore it here as well. Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/bbf06c83-d2ee-4205-8fbb-829e2347586f@gmail.com
2026-03-30wifi: rtw89: fw: load TX power elements according to AIDZong-Zhe Yang1-0/+5
For different A-die, there will be different TX power parameters. In FW element header, the corresponding A-die ID will be described. So, compare runtime AID with that to load the target TX power parameters. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260325072130.41751-9-pkshih@realtek.com
2026-03-30wifi: rtw89: phy: load RF parameters relying on ACV for RTL8922DPing-Ke Shih1-7/+8
RF parameters are conditional formats with RFE type and CV as arguments, but RTL8922D has many variants and use ACV as argument instead of CV. Add to select proper register values. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260325072130.41751-8-pkshih@realtek.com
2026-03-30wifi: rtw89: phy: expand PHY page for RTL8922DEric Huang1-1/+1
PHY page range is to define offset from PHY0 to PHY1, and RTL8922D needs to expand page to 0x2E0. Signed-off-by: Eric Huang <echuang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260325072130.41751-7-pkshih@realtek.com
2026-03-30wifi: rtw89: mac: disable pre-load function for RTL8922DEPing-Ke Shih1-2/+1
The pre-load function is a MAC function to pre-load TX packets into WiFi device's memory, so it can enhance performance. However, RTL8922DE has not fully verified and fine tune this function, temporarily disable this function. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260325072130.41751-6-pkshih@realtek.com
2026-03-30wifi: rtw89: mac: add specific case to dump mac memory for RTL8922DPing-Ke Shih4-4/+17
The RTL8922D can reuse most mac memory addresses, but only RTW89_MAC_MEM_SECURITY_CAM is different from existing one. Add a function to return the specific memory address for RTL8922D. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260325072130.41751-5-pkshih@realtek.com
2026-03-30wifi: rtw89: pci: clear SER ISR when initial and leaving WoWLAN for WiFi 7 chipsPing-Ke Shih2-8/+47
The PCIE SER is to diagnose PCIE becomes abnormal, relying on IMR settings to trigger interrupt when status is weird. Update settings to disable PHY error flag 9, and clear ISR when initial and leaving WoWLAN. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260325072130.41751-4-pkshih@realtek.com
2026-03-30wifi: rtw89: wow: enable MLD address for Magic packet wakeupChin-Yen Lee2-1/+8
Under MLO connections, the original Magic Packet configuration only supported Link Addresses for wakeup. Update the setting to support both MLD Address and Link Addresses for wakeup process. Signed-off-by: Chin-Yen Lee <timlee@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260325072130.41751-3-pkshih@realtek.com
2026-03-30wifi: rtw89: wow: use struct style to fill WOW wakeup control H2C commandChin-Yen Lee2-51/+26
The WOW wakeup control command is used to tell firmware the content of wakeup feature. Use struct instead of macros to fill the data. Signed-off-by: Chin-Yen Lee <timlee@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260325072130.41751-2-pkshih@realtek.com
2026-03-30wifi: rtw89: 8922d: add set channel of RF partPing-Ke Shih3-0/+48
The set channel of RF part is to configure channel and bandwidth on a register. The function to encode channel and bandwidth into register value will be implemented by coming patch. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260324062049.52266-8-pkshih@realtek.com
2026-03-30wifi: rtw89: 8922d: add set channel of BB partPing-Ke Shih3-0/+884
The set channel of BB part is the main part, which according to channel and bandwidth to configure CCK SCO, RX gain of LNA and TIA programmed in efuse for CCK and OFDM rate, and spur elimination of CSI and NBI tones. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260324062049.52266-7-pkshih@realtek.com
2026-03-30wifi: rtw89: 8922d: add set channel of MAC partPing-Ke Shih2-0/+93
The set channel is a key function to switch to specific operating channel. For MAC part, configure hardware according to channel bandwidth, and enable CCK rate for 2GHz band only. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260324062049.52266-6-pkshih@realtek.com
2026-03-30wifi: rtw89: 8922d: read and configure RF by calibration data from efuse ↵Ping-Ke Shih3-0/+209
physical map The calibration data is from physical map, including 1) thermal trim to align output thermal value across chips, and 2) PA bias to transmit expected power by controller. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260324062049.52266-5-pkshih@realtek.com
2026-03-30wifi: rtw89: 8922d: define efuse map and read necessary fieldsPing-Ke Shih3-0/+235
Define specific efuse map for RTL8922D, including TSSI, RX gain, MAC address, RFE type and etc. The additional fields comparing to existing chips are BT setting (define BT switch GPIO, antenna number and etc) and gain offset2 (define more fields like existing RX gain offset). Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260324062049.52266-4-pkshih@realtek.com
2026-03-30wifi: rtw89: 8922d: add power on/off functionsPing-Ke Shih2-0/+300
The power on function is the first entry to power on hardware including all MAC/BB/RF circuits, and then it becomes possible to do high level operations, such as WiFi scan, connection. If connection becomes unavailable, device stays into idle mode, calling power off function to cut power. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260324062049.52266-3-pkshih@realtek.com
2026-03-30wifi: rtw89: 8922d: add definition of quota, registers and efuse blockPing-Ke Shih3-0/+278
The quota is used to configure memory size for TX/RX, and the definition of registers includes H2C command, C2H event, WoWLAN reason, IMR of CMAC and DMAC, ACK rate selector, RF kill GPIO, and BB functions of dynamic initial gain and EDCCA. The layout of efuse block is to define logic map of efuse, such as MAC address and RF calibration values. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260324062049.52266-2-pkshih@realtek.com
2026-03-30wifi: rtw88: validate RX rate to prevent out-of-boundPing-Ke Shih1-0/+8
The reported RX rate might be unexpected, causing kernel warns: Rate marked as a VHT rate but data is invalid: MCS: 0, NSS: 0 WARNING: net/mac80211/rx.c:5491 at ieee80211_rx_list+0x183/0x1020 [mac80211] As the RX rate can be index of an array under certain conditions, validate it to prevent accessing array out-of-bound potentially. Tested on HP Notebook P3S95EA#ACB (kernel 6.19.9-1-cachyos): - No WARNING: net/mac80211/rx.c:5491 observed after the v2 patch. The unexpected `NSS: 0, MCS: 0` VHT rate warnings are successfully mitigated. - The system remains fully stable through prolonged idle periods, high network load, active Bluetooth A2DP usage, and multiple deep suspend/resume cycles. - Zero h2c timeouts or firmware lps state errors observed in dmesg. Reported-by: Oleksandr Havrylov <goainwo@gmail.com> Closes: https://lore.kernel.org/linux-wireless/CALdGYqSMUPnPfW-_q1RgYr0_SjoXUejAaJJr-o+jpwCk1S7ndQ@mail.gmail.com/ Tested-by: Oleksandr Havrylov <goainwo@gmail.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260324011001.5742-1-pkshih@realtek.com
2026-03-30wifi: rtw89: phy: fix uninitialized variable access in ↵Alexey Velichayshiy1-1/+1
rtw89_phy_cfo_set_crystal_cap() In the rtw89_phy_cfo_set_crystal_cap() function, for chips other than RTL8852A/RTL8851B, the values read by rtw89_mac_read_xtal_si() are stored into the local variables sc_xi_val and sc_xo_val. If either read fails, these variables remain uninitialized, they are later used to update cfo->crystal_cap and in debug print statements. This can lead to undefined behavior. Fix the issue by initializing sc_xi_val and sc_xo_val to zero, like is implemented in vendor driver. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 8379fa611536 ("rtw89: 8852c: add write/read crystal function in CFO tracking") Signed-off-by: Alexey Velichayshiy <a.velichayshiy@ispras.ru> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260323140613.1615574-1-a.velichayshiy@ispras.ru
2026-03-30wifi: rtw89: Add support for Buffalo WI-U3-2400XE2Zenm Chen1-0/+2
Add the ID 0411:03a6 to the table to support an additional RTL8832CU adapter: Buffalo WI-U3-2400XE2. Link: https://github.com/morrownr/rtw89/commit/506d193b8cb7d6394509aebcf8de1531629f6100 Signed-off-by: Zenm Chen <zenmchen@gmail.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260320154136.5750-1-zenmchen@gmail.com
2026-03-30wifi: rtw89: Add support for TP-Link Archer TX50UZenm Chen1-0/+2
Add the ID 37ad:0103 to the table to support an additional RTL8832CU adapter: TP-Link Archer TX50U. Link: https://github.com/morrownr/rtl8852cu-20251113/issues/2 Signed-off-by: Zenm Chen <zenmchen@gmail.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260320093122.6754-1-zenmchen@gmail.com
generated by cgit (git 2.54.0.dirty) at 2026-10-02 00:32:00 +0000