summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)Author
2026-05-06w5300: remove unused driverArnd Bergmann
Unlike w5100, this driver does not support SPI mode or devicetree bindings, and is hence entirely unusable without third-party board support patches that likely haven't existed for any recent kernel version. Remove the entire driver. If anyone is in fact using it with their custom board files, they can bring it back and include an earlier patch I sent to add DT based probing for the GPIO lines. Link: https://lore.kernel.org/all/20260427142924.2702598-1-arnd@kernel.org/ Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://patch.msgid.link/20260505180459.1247690-2-arnd@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06w5100: remove MMIO supportArnd Bergmann
This driver supports both SPI and MMIO based register access, but only the former has devicetree support. While MMIO mode would have worked with old-style board files, those have never defined such a device upstream. Remove the MMIO mode, leaving SPI as the only way to use this driver, but leave it in two loadable modules. More cleanups can be done by combining the two into one file. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://patch.msgid.link/20260505180459.1247690-1-arnd@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06net/mlx5: E-Switch, load reps via work queue after registrationMark Bloch
mlx5_eswitch_register_vport_reps() only installs representor callbacks and marks the rep type as registered. If the E-Switch is already in switchdev mode, the newly registered rep type must then be loaded for already enabled vports. That load path needs to run under the devlink lock, which is not held by the auxiliary driver registration context. Queue the reload to the E-Switch workqueue, whose handler acquires the devlink lock, and load the relevant representors from there. Since representor registration runs from sleepable auxiliary-driver context, queue the late reload with GFP_KERNEL. The functions-change notifier path remains the GFP_ATOMIC user of mlx5_esw_add_work(). The unregister path is unchanged and still unloads representors synchronously while tearing down the registered callbacks. Signed-off-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260503202726.266415-8-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06net/mlx5: E-Switch, unwind only newly loaded representor typesMark Bloch
__esw_offloads_load_rep() may return success without invoking the representor load callback when the representor type is already loaded. On a later load failure, mlx5_esw_offloads_rep_load() unconditionally unloaded all previously iterated representor types. This could unload representor types that were already loaded before this load attempt. Track which representor types were actually loaded by the current call and unwind only those on error. Also restore the representor state back to REP_REGISTERED when the load callback itself fails. Signed-off-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260503202726.266415-7-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06net/mlx5: E-Switch, serialize representor lifecycleMark Bloch
Representor callbacks can be registered and unregistered while the E-Switch is already in switchdev mode, and the same E-Switch may also be reconfigured by devlink, VF changes and SF changes. Serialize these paths with the per-E-Switch representor mutex instead of relying on ad-hoc bit state and wait queues. Take the representor lock around the mode transition, VF/SF representor changes and representor ops registration. Keep mode_lock and the representor lock unnested by using the operation flag while the mode lock is dropped. During mode changes, drop the representor lock around the auxiliary bus rescan because driver bind/unbind may register or unregister representor ops. Split representor ops registration into locked public wrappers and blocked internal helpers, clear the ops pointer on unregister, and add nested wrappers for the shared-FDB master IB path that registers peer representor ops while another E-Switch representor lock is already held. On unregister, always call __unload_reps_all_vport() before marking reps unregistered and clearing rep_ops. The per-representor state check makes this a no-op for types that were not loaded, so unregister no longer has to infer load state from esw->mode. Signed-off-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260503202726.266415-6-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06net/mlx5: Lag, avoid LAG and representor lock cyclesMark Bloch
The LAG shared-FDB and multiport E-Switch transitions rescan auxiliary devices and reload IB representors while holding ldev->lock. Driver bind/unbind paths may register or unregister E-Switch representor ops, and representor load paths may enter LAG code, so holding ldev->lock across those calls creates lock-order cycles with the E-Switch representor lock. Keep the devcom component locked for the transition, but drop ldev->lock before rescanning auxiliary devices or reloading IB representors. Mark the LAG transition as in progress while the lock is dropped and assert the devcom lock where the helper relies on it. This preserves LAG serialization while avoiding ldev->lock nesting under E-Switch representor registration. Signed-off-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260503202726.266415-5-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06net/mlx5: E-Switch, add representor lifecycle lockMark Bloch
Add a per-E-Switch mutex for serializing representor lifecycle work and provide small helpers for taking and dropping it. Initialize and destroy the mutex with the E-Switch offloads state. Add the lock and helper API first. Follow-up patches will take the lock in the individual representor lifecycle components. This keeps the functional changes split by component and leaves this patch without intended behavior change, making the series easier to review and bisectable. Signed-off-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260503202726.266415-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06net/mlx5: E-Switch, let esw work callers choose GFP flagsMark Bloch
mlx5_esw_add_work() always allocates the queued work item with GFP_ATOMIC. That is required for the E-Switch functions-change notifier, but not every caller of this helper will run from atomic context. Pass an allocation flag to mlx5_esw_add_work() and keep the notifier caller using GFP_ATOMIC. This allows sleepable callers to use GFP_KERNEL instead of unnecessarily relying on atomic reserves. Signed-off-by: Mark Bloch <mbloch@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260503202726.266415-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06net/mlx5: Lag: refactor representor reload handlingMark Bloch
Representor reload during LAG/MPESW transitions has to be repeated in several flows, and each open-coded loop was easy to get out of sync when adding new flags or tweaking error handling. Move the sequencing into a single helper so that all call sites share the same ordering and checks. Signed-off-by: Mark Bloch <mbloch@nvidia.com> Reviewed-by: Shay Drori <shayd@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260503202726.266415-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06r8152: Add firmware upload capability for RTL8157/RTL8159Birger Koblitz
The RTL8159 (RTL_VER_17) requires firmware for its PHY in order to work at connection speeds > 5GBit. Add support for uploading firmware for the PHY using the existing rtl8152_apply_firmware() function in r8157_hw_phy_cfg() and set up the correct names for the firmware files. This also adds support for uploading firmware for the RTL8157 (RTL_VER_16) PHY, for which firmware is however not strictly necessary to work. Still, this allows to upload newer versions of the firmware used by this chip, e.g. to improve interoperability. If no firmware is found, both the RTL8157 and the RTL8159 will continue to work. Signed-off-by: Birger Koblitz <mail@birger-koblitz.de> Tested-by: Aleksander Jan Bajkowski <olek2@wp.pl> Link: https://patch.msgid.link/20260505-rtl8159_net_next-v4-3-1a648a9c4d8d@birger-koblitz.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06r8152: Add support for the RTL8159 chipBirger Koblitz
The RTL8159 re-uses the packet descriptor format introduced with the RTL8157 and other hardware features of the RTL8157 (RTL_VER_16) such as the SRAM access. The support therefore consists in expanding the existing RTL8157 code for initialization and USB power management to also be used for the RTL8159 (RTL_VER_17). Most of the additional code is added in r8157_hw_phy_cfg() to configure the RTL8159 PHY. Add support for the USB device ID of Realtek RTL8159-based adapters, for which the product ID is 0x815a. Detect the RTL8159 as RTL_VER_17 and set it up. Signed-off-by: Birger Koblitz <mail@birger-koblitz.de> Tested-by: Aleksander Jan Bajkowski <olek2@wp.pl> Link: https://patch.msgid.link/20260505-rtl8159_net_next-v4-2-1a648a9c4d8d@birger-koblitz.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06r8152: Add support for 10Gbit Link Speeds and EEEBirger Koblitz
The RTL8159 supports 10GBit Link speeds. Add support for this speed in the setup and setting/getting through ethtool. Also add 10GBit EEE. Add functionality for setup and ethtool get/set methods. Signed-off-by: Birger Koblitz <mail@birger-koblitz.de> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Tested-by: Aleksander Jan Bajkowski <olek2@wp.pl> Link: https://patch.msgid.link/20260505-rtl8159_net_next-v4-1-1a648a9c4d8d@birger-koblitz.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06net: ethernet: cortina: Drop half-assembled SKBAndreas Haarmann-Thiemann
In gmac_rx() (drivers/net/ethernet/cortina/gemini.c), when gmac_get_queue_page() returns NULL for the second page of a multi-page fragment, the driver logs an error and continues — but does not free the partially assembled skb that was being assembled via napi_build_skb() / napi_get_frags(). Free the in-progress partially assembled skb via napi_free_frags() and increase the number of dropped frames appropriately and assign the skb pointer NULL to make sure it is not lingering around, matching the pattern already used elsewhere in the driver. Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") Signed-off-by: Andreas Haarmann-Thiemann <eitschman@nebelreich.de> Signed-off-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com> Link: https://patch.msgid.link/20260505-gemini-ethernet-fix-v2-1-997c31d06079@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06net/mlx5e: Report stop and wake TX queue statsGal Pressman
Report TX queue stop and wake statistics via the netdev queue stats API by mapping the existing stopped and wake counters to the stop and wake fields. Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260504183704.272322-6-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06net/mlx5e: Report TX csum_none netdev statGal Pressman
Report TX csum_none statistic via the netdev queue stats API by mapping the existing csum_none counter to the csum_none field. Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260504183704.272322-5-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06net/mlx5e: Report RX HW-GRO netdev statsGal Pressman
Report RX hardware GRO statistics via the netdev queue stats API by mapping the existing gro_packets, gro_bytes and gro_skbs counters to the hw_gro_wire_packets, hw_gro_wire_bytes and hw_gro_packets fields. Signed-off-by: Gal Pressman <gal@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260504183704.272322-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06net/mlx5e: Report hw_gso_packets and hw_gso_bytes netdev statsGal Pressman
Report hardware GSO statistics via the netdev queue stats API by mapping the existing TSO counters to hw_gso_packets and hw_gso_bytes fields. Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260504183704.272322-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06net/mlx5e: Count full skb length in TSO byte countersGal Pressman
The tso_bytes and tso_inner_bytes counters currently subtract the header length from skb->len, counting only the payload. This is confusing and doesn't align with the behavior of other _bytes counters in the driver. Report the full skb length to align with this expectation. This also makes our behavior consistent with the netdev stats API and virtio spec definition. Signed-off-by: Gal Pressman <gal@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260504183704.272322-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06net: rtsn: fix mdio_node leak in rtsn_mdio_alloc()Shitalkumar Gandhi
of_get_child_by_name() takes a reference. The rtsn_reset() and rtsn_change_mode() failure paths jump to out_free_bus and leak mdio_node. Add out_put_node to drop it before falling through. Fixes: b0d3969d2b4d ("net: ethernet: rtsn: Add support for Renesas Ethernet-TSN") Signed-off-by: Shitalkumar Gandhi <shitalkumar.gandhi@cambiumnetworks.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Link: https://patch.msgid.link/20260505123236.406000-1-shitalkumar.gandhi@cambiumnetworks.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06netdevsim: psp: rcu protect psp_dev referenceDaniel Zahka
There are two issues with the way psp_dev is used in nsim_do_psp(): 1. There is no check for IS_ERR() on the peers psp_dev, before dereferencing. 2. The refcount on this psp_dev can be dropped by nsim_psp_rereg_write() To fix this, we can make netdevsim's reference to its psp_dev an rcu reference, and then nsim_do_psp() can read the fields it needs from an rcu critical section. Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation") Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260505-psd-rcu-v1-3-a8f69ec1ab96@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06netdevsim: psp: serialize calls to nsim_psp_uninit()Daniel Zahka
The debugfs write handler, nsim_psp_rereg_write(), can race against nsim_destroy() and against itself, causing nsim_psp_uninit() to run more than once concurrently. Two complementary changes serialize all callers: 1. Delete the psp_rereg debugfs file from nsim_psp_uninit() before doing the actual teardown. debugfs_remove() drains any in-flight writers and prevents new ones from starting. 2. Add a mutex around the body of nsim_psp_rereg_write() so that two concurrent userspace writers cannot both enter the teardown path at once. The teardown work itself is moved into a new __nsim_psp_uninit() that the rereg handler calls under the mutex, while the public nsim_psp_uninit() wraps it with the debugfs_remove()/mutex_destroy() pair so nsim_destroy() doesn't have to know about the psp internals. Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation") Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260505-psd-rcu-v1-2-a8f69ec1ab96@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06netdevsim: psp: only call nsim_psp_uninit() on PFsDaniel Zahka
VFs go through nsim_init_netdevsim_vf() which never calls nsim_psp_init(), so ns->psp.dev stays NULL. nsim_psp_uninit() guards with !IS_ERR(ns->psp.dev), so destroying a VF reaches psp_dev_unregister(NULL) and dereferences NULL on the first mutex_lock(&psd->lock): BUG: kernel NULL pointer dereference, address: 0000000000000020 RIP: 0010:mutex_lock+0x1c/0x30 Call Trace: psp_dev_unregister+0x2a/0x1a0 nsim_psp_uninit+0x1f/0x40 [netdevsim] nsim_destroy+0x61/0x1e0 [netdevsim] __nsim_dev_port_del+0x47/0x90 [netdevsim] nsim_drv_configure_vfs+0xc9/0x130 [netdevsim] nsim_bus_dev_numvfs_store+0x79/0xb0 [netdevsim] Gate nsim_psp_uninit() on nsim_dev_port_is_pf(), matching the pattern already used for nsim_exit_netdevsim() and the bpf/ipsec/macsec/queue teardowns. Reproducer: modprobe netdevsim echo "10 1" > /sys/bus/netdevsim/new_device echo 1 > /sys/bus/netdevsim/devices/netdevsim10/sriov_numvfs devlink dev eswitch set netdevsim/netdevsim10 mode switchdev echo 0 > /sys/bus/netdevsim/devices/netdevsim10/sriov_numvfs Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation") Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260505-psd-rcu-v1-1-a8f69ec1ab96@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06rtase: Fix flow control configurationJustin Lai
The hardware has two sets of registers controlling TX/RX flow control. The effective flow control state is determined by the logical OR of these two sets of bits. RTASE_FORCE_TXFLOW_EN and RTASE_FORCE_RXFLOW_EN in RTASE_CPLUS_CMD are the bits used by the driver to control TX/RX flow control according to the ethtool pause configuration. RTASE_TXFLOW_EN and RTASE_RXFLOW_EN in RTASE_GPHY_STD_00 are another set of TX/RX flow control enable bits. Clear them by default so they do not keep flow control enabled independently of the driver setting. With the RTASE_GPHY_STD_00 bits cleared, the effective flow control state is controlled through RTASE_CPLUS_CMD, so the ethtool setting can take effect correctly. Signed-off-by: Justin Lai <justinlai0215@realtek.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260505064121.31286-1-justinlai0215@realtek.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06Merge tag 'ovpn-net-20260504' of https://github.com/OpenVPN/ovpn-net-nextJakub Kicinski
Antonio Quartulli says: ==================== Includes changes: * ensure MAC header offset is reset before delivering packet * ensure gro_cells_receive() and dstats_dev_add() are called with BH disabled * reduce ping count in selftest to ensure it completes within timeout * tag 'ovpn-net-20260504' of https://github.com/OpenVPN/ovpn-net-next: selftests: ovpn: reduce ping count in test.sh ovpn: ensure packet delivery happens with BH disabled ovpn: reset MAC header before passing skb up ==================== Link: https://patch.msgid.link/20260504230305.2681646-1-antonio@openvpn.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06Merge tag 'wireless-next-2026-05-06' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Lots of new content in cfg80211/mac80211, notably - more NAN work, mostly complete now (also hwsim) - more UHR work (e.g. non-primary channel access), this will continue for a while - FTM ranging APIs * tag 'wireless-next-2026-05-06' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (70 commits) wifi: mac80211: explicitly disable FTM responder on AP stop wifi: iwlwifi: don't blindly start the responder upon BSS_CHANGED_FTM_RESPONDER wifi: mac80211_hwsim: claim HT STBC capability wifi: mac80211_hwsim: enable NAN_DATA interface simulation support wifi: mac80211_hwsim: Support Tx of multicast data on NAN wifi: mac80211_hwsim: Do not declare support for NDPE wifi: mac80211_hwsim: Declare support for secure NAN wifi: mac80211_hwsim: add NAN data path TX/RX support wifi: mac80211_hwsim: set HAS_RATE_CONTROL when using NAN wifi: mac80211_hwsim: implement NAN schedule callbacks wifi: mac80211_hwsim: add NAN PHY capabilities wifi: mac80211_hwsim: add NAN_DATA interface limits wifi: mac80211_hwsim: implement NAN synchronization wifi: mac80211_hwsim: protect tsf_offset using a spinlock wifi: mac80211_hwsim: only RX on NAN when active on a slot wifi: mac80211_hwsim: select NAN TX channel based on current TSF wifi: mac80211_hwsim: limit TX of frames to the NAN DW wifi: cfg80211: don't allow NAN DATA on multi radio devices wifi: mac80211: check AP using NPCA has NPCA capability wifi: mac80211: don't parse full UHR operation from beacons ... ==================== Link: https://patch.msgid.link/20260506111147.224296-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06Merge tag 'wireless-2026-05-06' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Quite a number of fixes now: - mac80211 - remove HT NSS validation to work with broken APs (with a kunit fix now) - remove 'static' that could cause races - check station link lookup before further processing - fix use-after-free due to delete in list iteration - remove AP station on assoc failures to fix crashes - ath12k - fix OF node refcount imbalance - fix queue flush ("REO update") in MLO - fix RCU assert - ath12k: - fix Kconfig with POWER_SEQUENCING - fix WMI buffer leaks on error conditions - don't use uninitialized stack data when processing RSSI events - fix logic for determining the peer ID in the RX path - ath5k: fix a potential stack buffer overwrite - rsi: fix thread lifetime race - brcmfmac: fix potential UAF - nl80211: - stricter permissions/checks for PMK and netns - fix netlink policy vs. code type confusion - cw1200: revert a broken locking change - various fixes to not trust values from firmware * tag 'wireless-2026-05-06' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (25 commits) wifi: nl80211: re-check wiphy netns in nl80211_prepare_wdev_dump() continuation wifi: nl80211: require CAP_NET_ADMIN over the target netns in SET_WIPHY_NETNS wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage wifi: mac80211: remove station if connection prep fails wifi: mac80211: use safe list iteration in radar detect work wifi: libertas: notify firmware load wait on disconnect wifi: ath5k: do not access array OOB wifi: ath12k: fix peer_id usage in normal RX path wifi: ath12k: initialize RSSI dBm conversion event state wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions wifi: cw1200: Revert "Fix locking in error paths" wifi: mac80211: tests: mark HT check strict wifi: rsi: fix kthread lifetime race between self-exit and external-stop wifi: mac80211: drop stray 'static' from fast-RX rx_result wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path wifi: nl80211: require admin perm on SET_PMK / DEL_PMK wifi: libertas: fix integer underflow in process_cmdrequest() wifi: b43legacy: enforce bounds check on firmware key index in RX path wifi: b43: enforce bounds check on firmware key index in b43_rx() wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task ... ==================== Link: https://patch.msgid.link/20260506110325.219675-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-06treewide: Explicitly include the x86 CPUID headersAhmed S. Darwish
Modify all CPUID call sites which implicitly include any of the CPUID headers to explicitly include them instead. For KVM's reverse_cpuid.h, just include <asm/cpuid/types.h> since it references the CPUID_EAX..EDX symbols without using the CPUID APIs. Note, this allows removing the inclusion of <asm/cpuid/api.h> from within <asm/processor.h> next. That allows the CPUID API headers to include <asm/processor.h> without introducing a circular dependency. Signed-off-by: Ahmed S. Darwish <darwi@linutronix.de> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://lore.kernel.org/20260327021645.555257-1-darwi@linutronix.de
2026-05-06wifi: iwlwifi: don't blindly start the responder upon BSS_CHANGED_FTM_RESPONDEREmmanuel Grumbach
mac80211 may just want to stop it, so check the ftm_responder boolean before starting the responder. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260505151241.285da8fbf7f4.I1b6922ca8d06d592356d7a5d190e6118fec1d5b5@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: claim HT STBC capabilityJohannes Berg
This is already claimed for VHT and HE, so it doesn't really make sense to not claim it for HT, and this causes sigma-dut failures since it assumes VHT support implies HT support. Link: https://patch.msgid.link/20260506093231.155762-2-johannes@sipsolutions.net Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: enable NAN_DATA interface simulation supportDaniel Gabay
Enable NAN_DATA interface simulation support by adding it to the supported interface types. This completes the NAN Data Path simulation introduced in the previous patches. Signed-off-by: Daniel Gabay <daniel.gabay@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.d4bd95959bfa.I450087714bd55189242ab6a72ce6650be36edbcb@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: Support Tx of multicast data on NANIlan Peer
Add support for transmitting multicast data frames. These frames can be transmitted when all the peer NDI stations on the interface are available at the current slot. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.0af7e24f0df3.I3c2de3e456ae092c939e6bfd3d30960fbf2fbeaa@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: Do not declare support for NDPEIlan Peer
Do not declare support for NAN Data Path Extension attribute as this is handled by user space and should be set by it. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.711c61538c8a.I9796410c0376f50a07259cc611428d76c51f180a@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: Declare support for secure NANDaniel Gabay
Advertise NL80211_EXT_FEATURE_SECURE_NAN to indicate support for NAN Pairing, enabling peer authentication and secure data path establishment. Signed-off-by: Daniel Gabay <daniel.gabay@intel.com> Reviewed-by: Avraham Stern <avraham.stern@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.d3bcc26b4525.I6993cc70c43579694ffd429f1afb971a73db2ae4@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: add NAN data path TX/RX supportDaniel Gabay
Implement TX and RX path handling for NAN Data Path (NDP) frames, enabling data communication between NAN peers during scheduled availability windows. TX path: - Select TX channel based on current time slot: use DW channel during Discovery Windows, or FAW channel from local schedule during Further Availability Windows. - Verify peer availability before transmission by checking committed DW schedule or FAW of the peer schedule. RX path: - Extend NAN receive filtering to handle NAN_DATA interface frames. - Accept incoming frames during FAW slots when channel matches local schedule. Signed-off-by: Daniel Gabay <daniel.gabay@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.155252ebc72b.Ic210f6c095c6ff372941bc8c77ee9c8c37d0356c@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: set HAS_RATE_CONTROL when using NANDaniel Gabay
- NAN switches between bands/channels per its schedule, so mac80211 rate control can't work, set HAS_RATE_CONTROL instead. - Skip rate control checks for NAN interfaces in mac80211_hwsim_sta_rc_update() as it's not relevant. - Move set_rts_threshold stub to HWSIM_COMMON_OPS and return 0 instead of -EOPNOTSUPP to prevent failures in non-MLO tests that set RTS threshold (hwsim ignores the use_rts instruction from mac80211 anyway). Signed-off-by: Daniel Gabay <daniel.gabay@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.216e68be61ac.If9ef94a12cec8dfc55416afaf745d6e5025a5ec9@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: implement NAN schedule callbacksDaniel Gabay
Implement mac80211 schedule callbacks for NAN Data Path support: - Track local schedule via BSS_CHANGED_NAN_LOCAL_SCHED, caching the channel for each 16TU time slot. - Copy peer schedule to driver-private storage in nan_peer_sched_changed callback for use in TX availability decisions. Signed-off-by: Daniel Gabay <daniel.gabay@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.f3ad9e3dc9d4.I75cf3555b7506d5b8bb30e70a0f3721ab73477cb@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: add NAN PHY capabilitiesDaniel Gabay
Add static HT, VHT and HE PHY capabilities to the NAN capabilities structure. These are based on the existing band capability structures and initialization in mac80211_hwsim. The NAN PHY capabilities are used by mac80211 and nl80211 to advertise device capabilities for NAN data interfaces. Signed-off-by: Daniel Gabay <daniel.gabay@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.2c94c156f05d.I539fab4adf2eb43bfec27006f7529b926e5208ea@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: add NAN_DATA interface limitsDaniel Gabay
Increase interface limits for NAN_DATA interface. Signed-off-by: Daniel Gabay <daniel.gabay@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.587955b23089.I261b782e5c198726b9465815d59ce037f094784d@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: implement NAN synchronizationBenjamin Berg
Add all the handling to do NAN synchronization on 2.4 GHz including sending out beacons. With this, the mac80211_hwsim NAN device also works when used in conjunction with an external medium simulation. Note that the TSF sync is not ideal in case of an external medium simulation. This is because the mactime for received frames needs to be estimated and the simulation may not update the timestamp of beacons to the actual time that the frame was transmitted. The implementation has an initial short phase where it scans for clusters. This facilitates cluster joining and avoids creating a new cluster immediately, which would result in two cluster join notifications. It does not scan otherwise and will only see another cluster appearing if a discovery beacon happens to be sent during the 2.4 GHz discovery window (DW). Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.7d21c3cdc565.I98b6c15eadefd6d123658294ef1a0cd3c2ce3054@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: protect tsf_offset using a spinlockBenjamin Berg
To implement NAN synchronization in hwsim, the TSF needs to be adjusted regularly from the RX path. Add a spinlock so that this can be done in a safe manner. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.18f36f264eb9.I0da5477220b896e2177bd521f7d9a8f2595631e6@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: only RX on NAN when active on a slotBenjamin Berg
This moves the NAN receive into the main code and changes it so that frame RX only happens when the device is active on the channel. This limits RX to the DW slots as there is currently no datapath. With this the globally stored channel is obsolete, remove it. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.8cf4a67d3436.Ife07cf4ae8a2d59766356398163f7ee8d734bd6a@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: select NAN TX channel based on current TSFBenjamin Berg
Move the TX channel selection into the NAN specific file and select the channel based on the current slot. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.c235b5a78b98.I5ec4076a8a9445233dc414c6ecaa39f32f1e9595@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: mac80211_hwsim: limit TX of frames to the NAN DWBenjamin Berg
Frames submitted on the NAN device interface should only be transmitted during one of the discovery windows (DWs). It is assumed that software submits frames from the DW end notifications for the next DW period. Simulate this behaviour by checking that we are currently in a DW before transmitting from ieee80211_hwsim_wake_tx_queue. As frames will be queued up at the start of a DW, wake the management TX queue every time a DW is started. Do so with a randomized offset just to avoid every client transmitting at the same time. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260506064301.f3456f159655.Id6780e2f7f7cab03264299b7d696ba5b1269e451@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-06wifi: rtw89: debug: add BB diagnoseKuan-Chung Chen
Add BB diagnostic to track potential abnormal conditions. Currently, five diagnostic metrics are monitored: 1) Hang detection monitors consecutive absence of TX and RX activity. 2) PD maximum triggers when PD stays at its maximum threshold for a period. 3) No RX occurs when no CCA activity is detected over multiple consecutive cycles. 4) High FA indicates a high false alarm ratio, reflecting severe environmental interference. 5) EDCCA alerts when high EDCCA ratio, signaling a potential TX hang. These metrics are exposed via debugfs diag_bb. Output: [PHY 0] Diag bitmap = 0x0 Event{Hang, PD MAX, No RX, High FA, High EDCCA Ratio} = {0, 0, 0, 0, 0} consecutive_no_tx_cnt=0, consecutive_no_rx_cnt=0 Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260429132625.1659182-8-pkshih@realtek.com
2026-05-06wifi: rtw89: debug: add RX statistics in bb_infoKuan-Chung Chen
Expand RX packet statistics including coding type, spatial diversity, and beamforming. These statistics are accumulated per PHY and displayed in bb_info debugfs. RX statistics output: == RX General LDPC: 190, BCC: 0, STBC: 0, SU_NON_BF: 0, SU_BF: 190, MU: 0 Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260429132625.1659182-7-pkshih@realtek.com
2026-05-06wifi: rtw89: debug: extend bb_info with TX status and PERKuan-Chung Chen
Enhance bb_info debugfs by adding TX status information to aid debugging and performance analysis. A snapshot of TX-related registers, including PPDU type and subtype, bandwidth, TX power, STBC, etc. The information is collected per PHY during track_work and displayed via bb_info debugfs. TX status output: == TX General EHT_MU_SU DATA BW: 160, TX_SC: 0, TX_PATH_EN: 3, PATH_MAP: 0xe4 TXPWR TMAC: 11, P0: 11, P1: 11 dBm MCS: 9, STBC: 0 Info: [0x0000000b, 0xc1702c30, 0x0ff1e430, 0xc0000000, 0x99000009, 0x40000000] Common ctrl: [0x00000150, 0x40190140] In addition, include the retry ratio from RA reports and display it as PER (packet error rate) in station debug information. PER output: TX rate [0, 0]: HE 2SS MCS-4 GI:0.8 BW:20 (hw_rate=0x324) PER:23 Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260429132625.1659182-6-pkshih@realtek.com
2026-05-06wifi: rtw89: debug: add PMAC counter in bb_infoKuan-Chung Chen
PMAC (Pseudo MAC) is a circuit within the baseband that can report various packet-related counters through registers, such as TX ON, TX EN, CCA, FA, CRC, etc. The driver periodically collects per PHY PMAC counters in track_work and exposes them through the bb_info debugfs for easier debugging. The output of PMAC counter: == PMAC TX [CCK_TXEN, CCK_TXON, OFDM_TXEN, OFDM_TXON]: [0, 0, 17, 17] CRC [CCK, OFDM, HT, VHT, HE, EHT, ALL, MPDU] ok: [0, 301, 0, 0, 5, 0, 306, 5] err: [0, 4, 0, 0, 0, 0, 4, 0] CCA [CCK, OFDM]: [0, 353] FA [CCK, OFDM]: [0, 39] CCA spoofing [CCK, OFDM]: [0, 0] CCK SFD: 0, SIG_GG: 0 OFDM Parity: 4, Rate: 2, LSIG_BRK_S: 0, LSIG_BRK_L: 7, SBD: 5 AMPDU miss: 0 Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260429132625.1659182-5-pkshih@realtek.com
2026-05-06wifi: rtw89: debug: bb_info entry including TX rate count for WiFi 7 chipsKuan-Chung Chen
Enhance TX performance visibility for WiFi 7 chips by introducing TX rate count tracking. This is critical for debugging and validation. Additionally, introduce a new debugfs bb_info to enable and provide baseband status. Usage of bb_info debugfs: $ echo enable 1 > bb_info // Start logging BB statistics information $ echo mac_id 0 > bb_info // Specify mac_id for TX rate count tracking The output of bb_info: TP TX: 0 [0] Mbps, RX: 0 [0] Mbps Avg packet length: TX=118, RX=136 TF: 0 TX count [0]: Legacy: [0, 0, 0, 0] OFDM: [0, 0, 0, 0, 0, 0, 0, 0] MCS 1SS: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] MCS 2SS: [183, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] [PHY 0] == RSSI/RX Rate Beacon: 19 (-41 dBm) RX count: Legacy: [0, 0, 0, 0] OFDM: [0, 0, 0, 0, 0, 0, 0, 0] HT 0: [0, 0, 0, 0, 0, 0, 0, 0] HT 1: [0, 0, 0, 0, 0, 0, 0, 0] VHT 1SS: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0][0, 0] VHT 2SS: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0][0, 0] HE 1SS: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] HE 2SS: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] EHT 1SS: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0][0, 0] EHT 2SS: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 185] TX rate [0, 2]: EHT 2SS MCS-0 GI:0.8 FB_G BW:160 (hw_rate=0x420) ==> agg_wait=-1 (1) RX rate [0, 2]: EHT 2SS MCS-13 GI:0.8 BW:160 (hw_rate=0x42d) RSSI: -43 dBm (raw=134, prev=135) [-43, -44] EVM: [38.75, (41.50, 43.00)] SNR: 39 Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260429132625.1659182-4-pkshih@realtek.com
2026-05-06wifi: rtw89: phy: support per PHY RX statisticsKuan-Chung Chen
Previously, RX statistics such as beacon RSSI and packet counters were shared across all PHYs. To support MLO, extend the statistics to be maintained per PHY. Update the debugfs output for phy_info and beacon_info to include a "[PHY X]" label for better clarity. The output of phy_info: TP TX: 0 [0] Mbps (lv: 0), RX: 0 [0] Mbps (lv: 0) Avg packet length: TX=0, RX=120 TF: 0 [PHY 0] Beacon: 19 (-45 dBm) RX count: Legacy: [0, 0, 0, 0] ... EHT 2SS: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] The output of beacon_info: [PHY 0] Beacon: 20 raw rssi: 131 hw rate: 4 length: 437 [Beacon info] interval: 100 dtim: 1 Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260429132625.1659182-3-pkshih@realtek.com
2026-05-06wifi: rtw89: mlo: rearrange MLSR link decision flowKuan-Chung Chen
The original MLSR link decision refers to RSSI, but it should be based on the premise of an existing link. Otherwise, make a link decision to select a new link from any available band. Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260429132625.1659182-2-pkshih@realtek.com
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-06 18:45:31 +0000