summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)Author
2026-01-09ixgbe: Add 10G-BX supportBirger Koblitz
Add support for 10G-BX modules, i.e. 10GBit Ethernet over a single strand Single-Mode fiber. The initialization of a 10G-BX SFP+ is the same as for a 10G SX/LX module, and is identified according to SFF-8472 table 5-3, footnote 3 by the 10G Ethernet Compliance Codes field being empty, the Nominal Bit Rate being compatible with 12.5GBit, and the module being a fiber module with a Single Mode fiber link length. This was tested using a Lightron WSPXG-HS3LC-IEA 1270/1330nm 10km transceiver: $ sudo ethtool -m enp1s0f1 Identifier : 0x03 (SFP) Extended identifier : 0x04 (GBIC/SFP defined by 2-wire interface ID) Connector : 0x07 (LC) Transceiver codes : 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 Encoding : 0x01 (8B/10B) BR Nominal : 10300MBd Rate identifier : 0x00 (unspecified) Length (SMF) : 10km Length (OM2) : 0m Length (OM1) : 0m Length (Copper or Active cable) : 0m Length (OM3) : 0m Laser wavelength : 1330nm Vendor name : Lightron Inc. Vendor OUI : 00:13:c5 Vendor PN : WSPXG-HS3LC-IEA Vendor rev : 0000 Option values : 0x00 0x1a Option : TX_DISABLE implemented BR margin max : 0% BR margin min : 0% Vendor SN : S142228617 Date code : 140611 Optical diagnostics support : Yes Signed-off-by: Birger Koblitz <mail@birger-koblitz.de> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Rinitha S <sx.rinitha@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-01-09ice: unify PHY FW loading status handler for E800 devicesGrzegorz Nitka
Unify handling of PHY firmware load delays across all E800 family devices. There is an existing mechanism to poll GL_MNG_FWSM_FW_LOADING_M bit of GL_MNG_FWSM register in order to verify whether PHY FW loading completed or not. Previously, this logic was limited to E827 variants only. Also, inform a user of possible delay in initialization process, by dumping informational message in dmesg log ("Link initialization is blocked by PHY FW initialization. Link initialization will continue after PHY FW initialization completes."). Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-01-09wifi: ath12k: don't force radio frequency check in freq_to_idx()Baochen Qiang
freq_to_idx() is used to map a channel to a survey index. Commit acc152f9be20 ("wifi: ath12k: combine channel list for split-phy devices in single-wiphy") adds radio specific frequency range check in this helper to make sure an invalid index is returned if the channel falls outside that range. However, this check introduces a race, resulting in below warnings as reported in [1]. ath12k_pci 0000:08:00.0: chan info: invalid frequency 6455 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6535 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6615 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6695 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6775 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6855 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6935 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 7015 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 7095 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6435 (idx 101 out of bounds) Race scenario: 1) A regdomain covering below frequency range is uploaded to host via WMI_REG_CHAN_LIST_CC_EXT_EVENTID event: Country 00, CFG Regdomain UNSET FW Regdomain 0, num_reg_rules 6 1. (2402 - 2472 @ 40) (0, 20) (0 ms) (FLAGS 360448) (0, 0) 2. (2457 - 2477 @ 20) (0, 20) (0 ms) (FLAGS 360576) (0, 0) 3. (5170 - 5330 @ 160) (0, 20) (0 ms) (FLAGS 264320) (0, 0) 4. (5490 - 5730 @ 160) (0, 20) (0 ms) (FLAGS 264320) (0, 0) 5. (5735 - 5895 @ 160) (0, 20) (0 ms) (FLAGS 264320) (0, 0) 6. (5925 - 7125 @ 320) (0, 24) (0 ms) (FLAGS 2056) (0, 255) As a result, radio frequency range is updated as [2402, 7125] ath12k_pci 0000:08:00.0: mac pdev 0 freq limit updated. New range 2402->7125 MHz If no scan in progress or after scan finished, command WMI_SCAN_CHAN_LIST_CMDID is sent to firmware notifying that firmware is allowed to do scan on all channels within that range. The running path is: /* redomain uploaded */ 1. WMI_REG_CHAN_LIST_CC_EXT_EVENTID 2. ath12k_reg_chan_list_event() 3. ath12k_reg_handle_chan_list() 4. queue_work(..., &ar->regd_update_work) 5. ath12k_regd_update_work() 6. ath12k_regd_update() /* update radio frequency range */ 7. ath12k_mac_update_freq_range() 8. regulatory_set_wiphy_regd() 9. ath12k_reg_notifier() 10. ath12k_reg_update_chan_list() 11. queue_work(..., &ar->regd_channel_update_work) 12. ath12k_regd_update_chan_list_work() /* wait scan finishes */ 13. wait_for_completion_timeout(&ar->scan.completed, ...) /* command notifying list of valid channels */ 14. ath12k_wmi_send_scan_chan_list_cmd() 2) Hardware scan is triggered on all allowed channels. 3) Before scan completed, 11D mechanism detects a new country code ath12k_pci 0000:08:00.0: wmi 11d new cc GB With this code sent to firmware, firmware uploads a new regdomain Country GB, CFG Regdomain ETSI FW Regdomain 2, num_reg_rules 9 1. (2402 - 2482 @ 40) (0, 20) (0 ms) (FLAGS 360448) (0, 0) 2. (5170 - 5250 @ 80) (0, 23) (0 ms) (FLAGS 264192) (0, 0) 3. (5250 - 5330 @ 80) (0, 23) (0 ms) (FLAGS 264216) (0, 0) 4. (5490 - 5590 @ 80) (0, 30) (0 ms) (FLAGS 264208) 5. (5590 - 5650 @ 40) (0, 30) (600000 ms) (FLAGS 264208) 6. (5650 - 5730 @ 80) (0, 30) (0 ms) (FLAGS 264208) 7. (5735 - 5875 @ 80) (0, 14) (0 ms) (FLAGS 264192) (0, 0) 8. (5855 - 5875 @ 20) (0, 14) (0 ms) (FLAGS 264192) (0, 0) 9. (5945 - 6425 @ 320) (0, 24) (0 ms) (FLAGS 2056) (0, 11) Then radio frequency range is updated as [2402, 6425] ath12k_pci 0000:08:00.0: mac pdev 0 freq limit updated. New range 2402->6425 MHz Please note this is a smaller range than the previous one. Later host runs the same path for the purpose of notifying the new channel list. However since scan not completed, host just waits there. Meanwhile, firmware is possibly scanning channels outside the new range. As a result, WMI_CHAN_INFO_EVENTID events for those channels fail freq_to_idx() check and triggers warnings above. Fix this issue by removing radio frequency check in freq_to_idx(). This is valid because channels being scanned do not synchronize with frequency range update. Besides, this won't cause any problem, since freq_to_idx() is only used for survey data. Even out-of-range channels filled in the survey, they won't get delivered to userspace due to the range check already there in ath12k_mac_op_get_survey(). Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: acc152f9be20 ("wifi: ath12k: combine channel list for split-phy devices in single-wiphy") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220871 # 1 Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260108-ath12k-fix-freq-to-idx-v1-1-b2458cf7aa0d@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-01-09wifi: ath12k: fix dma_free_coherent() pointerThomas Fourier
dma_alloc_coherent() allocates a DMA mapped buffer and stores the addresses in XXX_unaligned fields. Those should be reused when freeing the buffer rather than the aligned addresses. Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Cc: stable@vger.kernel.org Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260106084905.18622-2-fourier.thomas@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-01-09wifi: ath10k: fix dma_free_coherent() pointerThomas Fourier
dma_alloc_coherent() allocates a DMA mapped buffer and stores the addresses in XXX_unaligned fields. Those should be reused when freeing the buffer rather than the aligned addresses. Fixes: 2a1e1ad3fd37 ("ath10k: Add support for 64 bit ce descriptor") Cc: stable@vger.kernel.org Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260105210439.20131-2-fourier.thomas@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-01-09can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.Ondrej Ille
The Secondary Sample Point Source field has been set to an incorrect value by some mistake in the past 0b01 - SSP_SRC_NO_SSP - SSP is not used. for data bitrates above 1 MBit/s. The correct/default value already used for lower bitrates is 0b00 - SSP_SRC_MEAS_N_OFFSET - SSP position = TRV_DELAY (Measured Transmitter delay) + SSP_OFFSET. The related configuration register structure is described in section 3.1.46 SSP_CFG of the CTU CAN FD IP CORE Datasheet. The analysis leading to the proper configuration is described in section 2.8.3 Secondary sampling point of the datasheet. The change has been tested on AMD/Xilinx Zynq with the next CTU CN FD IP core versions: - 2.6 aka master in the "integration with Zynq-7000 system" test 6.12.43-rt12+ #1 SMP PREEMPT_RT kernel with CTU CAN FD git driver (change already included in the driver repo) - older 2.5 snapshot with mainline kernels with this patch applied locally in the multiple CAN latency tester nightly runs 6.18.0-rc4-rt3-dut #1 SMP PREEMPT_RT 6.19.0-rc3-dut The logs, the datasheet and sources are available at https://canbus.pages.fel.cvut.cz/ Signed-off-by: Ondrej Ille <ondrej.ille@gmail.com> Signed-off-by: Pavel Pisa <pisa@fel.cvut.cz> Link: https://patch.msgid.link/20260105111620.16580-1-pisa@fel.cvut.cz Fixes: 2dcb8e8782d8 ("can: ctucanfd: add support for CTU CAN FD open-source IP core - bus independent part.") Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-09can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leakMarc Kleine-Budde
In gs_can_open(), the URBs for USB-in transfers are allocated, added to the parent->rx_submitted anchor and submitted. In the complete callback gs_usb_receive_bulk_callback(), the URB is processed and resubmitted. In gs_can_close() the URBs are freed by calling usb_kill_anchored_urbs(parent->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in gs_can_close(). Fix the memory leak by anchoring the URB in the gs_usb_receive_bulk_callback() to the parent->rx_submitted anchor. Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260105-gs_usb-fix-memory-leak-v2-1-cc6ed6438034@pengutronix.de Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-09can: etas_es58x: allow partial RX URB allocation to succeedSzymon Wilczek
When es58x_alloc_rx_urbs() fails to allocate the requested number of URBs but succeeds in allocating some, it returns an error code. This causes es58x_open() to return early, skipping the cleanup label 'free_urbs', which leads to the anchored URBs being leaked. As pointed out by maintainer Vincent Mailhol, the driver is designed to handle partial URB allocation gracefully. Therefore, partial allocation should not be treated as a fatal error. Modify es58x_alloc_rx_urbs() to return 0 if at least one URB has been allocated, restoring the intended behavior and preventing the leak in es58x_open(). Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces") Reported-by: syzbot+e8cb6691a7cf68256cb8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e8cb6691a7cf68256cb8 Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com> Reviewed-by: Vincent Mailhol <mailhol@kernel.org> Link: https://patch.msgid.link/20251223011732.39361-1-swilczek.lx@gmail.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-09wifi: rtw89: fw: set RACK bit every 4 H2C command for WiFi 6 chips onlyPing-Ke Shih
RACK is to ask firmware send received ACK to driver when a H2C command is received. This is necessary for WiFi 6 chips only. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-11-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: consider hardware AID for firmware elementsPing-Ke Shih
The coming chip RTL8922D has variant of hardware with different AID. Add AID field to header of firmware elements, and compare AID with the value read from hardware. Currently, apply this rule to BB and RF parameters. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-10-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add CMAC H2C command for punctured for RTL8922DPing-Ke Shih
CMAC H2C command is to configure CMAC such as TX retry and padding. Add to update CMAC function block while puncturing is changing. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-9-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add CMAC H2C command for TX time for RTL8922DPing-Ke Shih
CMAC H2C command is to configure CMAC such as TX retry and padding. Add to update CMAC function block when BT-coex want shorter TX time due to timeslot assignment, or when MCC want higher retry time to improve connection rate. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-8-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add CMAC H2C command for TX AMPDU for RTL8922DPing-Ke Shih
CMAC H2C command is to configure CMAC such as TX retry and padding. Add to update CMAC function block while AMPDU is established. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-7-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add CMAC H2C command for association for RTL8922DPing-Ke Shih
CMAC H2C command is to configure CMAC such as TX retry and padding. Add to update CMAC function block according to associated peer. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-6-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add CMAC H2C command to initialize default value for RTL8922DPing-Ke Shih
CMAC H2C command is to configure CMAC such as TX retry and padding. Add to reset CMAC function block to default value. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-5-pkshih@realtek.com
2026-01-09wifi: rtw89: fw: add DMAC v3 H2C command for RTL8922DPing-Ke Shih
Write association data including address and security key of peer to hardware. Add the command for RTL8922D accordingly. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-4-pkshih@realtek.com
2026-01-09wifi: rtw89: update query RXDESC v3 for RTL8922DPing-Ke Shih
Add RXDESC v3 to parse meta data of receiving packets for RTL8922D. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-3-pkshih@realtek.com
2026-01-09wifi: rtw89: update TXWD v3 for RTL8922DPing-Ke Shih
Add TXWD v3 to assist in transmitting for RTL8922D according to hardware design. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260106030911.15528-2-pkshih@realtek.com
2026-01-08net: phy: microchip_rds_ptp: add HW timestamp configuration reportingVadim Fedorenko
The driver stores HW timestamping configuration and can technically report it. Add callback to do it. Reviewed-by: Kory Maincent <kory.maincent@bootlin.com> Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20260106160723.3925872-5-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08net: phy: microchip_rds_ptp: improve HW ts config logicVadim Fedorenko
The driver stores new HW timestamping configuration values unconditionally and may create inconsistency with what is actually configured in case of error. Improve the logic to store new values only once everything is configured. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Reviewed-by: Kory Maincent <kory.maincent@bootlin.com> Link: https://patch.msgid.link/20260106160723.3925872-4-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08net: phy: micrel: add HW timestamp configuration reportingVadim Fedorenko
The driver stores HW timestamping configuration and can technically report it. Add callback to do it. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Kory Maincent <kory.maincent@bootlin.com> Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20260106160723.3925872-3-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08net: phy: micrel: improve HW timestamping config logicVadim Fedorenko
The driver was adjusting stored values independently of what was actually supported and configured. Improve logic to store values once all checks are passing Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Reviewed-by: Kory Maincent <kory.maincent@bootlin.com> Link: https://patch.msgid.link/20260106160723.3925872-2-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08sfc: correct kernel-doc complaintsRandy Dunlap
Fix kernel-doc warnings by adding 3 missing struct member descriptions in struct efx_ef10_nic_data and removing preprocessor directives (which are not handled by kernel-doc). Fixes these 5 warnings: Warning: drivers/net/ethernet/sfc/nic.h:158 bad line: #ifdef CONFIG_SFC_SRIOV Warning: drivers/net/ethernet/sfc/nic.h:160 bad line: #endif Warning: drivers/net/ethernet/sfc/nic.h:204 struct member 'port_id' not described in 'efx_ef10_nic_data' Warning: drivers/net/ethernet/sfc/nic.h:204 struct member 'vf_index' not described in 'efx_ef10_nic_data' Warning: drivers/net/ethernet/sfc/nic.h:204 struct member 'licensed_features' not described in 'efx_ef10_nic_data' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Edward Cree <ecree.xilinx@gmail.com> Link: https://patch.msgid.link/20260106173224.2010703-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-6.19-rc5). No conflicts, or adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08Merge tag 'net-6.19-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter and wireless. Current release - fix to a fix: - net: do not write to msg_get_inq in callee - arp: do not assume dev_hard_header() does not change skb->head Current release - regressions: - wifi: mac80211: don't iterate not running interfaces - eth: mlx5: fix NULL pointer dereference in ioctl module EEPROM Current release - new code bugs: - eth: bnge: add AUXILIARY_BUS to Kconfig dependencies Previous releases - regressions: - eth: mlx5: dealloc forgotten PSP RX modify header Previous releases - always broken: - ping: fix ICMP out SNMP stats double-counting with ICMP sockets - bonding: preserve NETIF_F_ALL_FOR_ALL across TSO updates - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress - eth: bnxt: fix potential data corruption with HW GRO/LRO" * tag 'net-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (70 commits) arp: do not assume dev_hard_header() does not change skb->head net: enetc: fix build warning when PAGE_SIZE is greater than 128K atm: Fix dma_free_coherent() size tools: ynl: don't install tests net: do not write to msg_get_inq in callee bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup net: usb: pegasus: fix memory leak in update_eth_regs_async() net: 3com: 3c59x: fix possible null dereference in vortex_probe1() net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset wifi: mac80211: collect station statistics earlier when disconnect wifi: mac80211: restore non-chanctx injection behaviour wifi: mac80211_hwsim: disable BHs for hwsim_radio_lock wifi: mac80211: don't iterate not running interfaces wifi: mac80211_hwsim: fix typo in frequency notification wifi: avoid kernel-infoleak from struct iw_point net: airoha: Fix schedule while atomic in airoha_ppe_deinit() selftests: netdevsim: add carrier state consistency test net: netdevsim: fix inconsistent carrier state after link/unlink selftests: drv-net: Bring back tool() to driver __init__s net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy ...
2026-01-08Merge branch '200GbE' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-01-06 (idpf) This series contains updates to idpf driver only. Emil fixes issues related to resets; among them timeouts, NULL pointer dereferences, and memory leaks. Sreedevi resolves issues around RSS; mainly involving operations when the interface is down and resets. She also addresses some incomplete cleanups for ntuple filters and interrupts. Erik fixes incomplete output of ntuple filters. Josh sets restriction of Rx buffer size to follow hardware restrictions. Larysa adds check to prevent NULL pointer dereference when RDMA is not enabled. * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: idpf: fix aux device unplugging when rdma is not supported by vport idpf: cap maximum Rx buffer size idpf: Fix error handling in idpf_vport_open() idpf: Fix RSS LUT NULL ptr issue after soft reset idpf: Fix RSS LUT configuration on down interfaces idpf: Fix RSS LUT NULL pointer crash on early ethtool operations idpf: fix issue with ethtool -n command display idpf: fix memory leak of flow steer list on rmmod idpf: fix error handling in the init_task on load idpf: fix memory leak in idpf_vc_core_deinit() idpf: fix memory leak in idpf_vport_rel() idpf: detach and close netdevs while handling a reset idpf: keep the netdev when a reset fails ==================== Link: https://patch.msgid.link/20260107000648.1861994-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08net: enetc: fix build warning when PAGE_SIZE is greater than 128KWei Fang
The max buffer size of ENETC RX BD is 0xFFFF bytes, so if the PAGE_SIZE is greater than 128K, ENETC_RXB_DMA_SIZE and ENETC_RXB_DMA_SIZE_XDP will be greater than 0xFFFF, thus causing a build warning. This will not cause any practical issues because ENETC is currently only used on the ARM64 platform, and the max PAGE_SIZE is 64K. So this patch is only for fixing the build warning that occurs when compiling ENETC drivers for other platforms. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202601050637.kHEKKOG7-lkp@intel.com/ Fixes: e59bc32df2e9 ("net: enetc: correct the value of ENETC_RXB_TRUESIZE") Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260107091204.1980222-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08Merge tag 'wireless-2026-01-08' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Couple of fixes: - mac80211: - long-standing injection bug due to chanctx rework - more recent interface iteration issue - collect statistics before removing stations - hwsim: - fix NAN frequency typo (potential NULL ptr deref) - fix locking of radio lock (needs softirqs disabled) - wext: - ancient issue with compat and events copying some uninitialized stack data to userspace * tag 'wireless-2026-01-08' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211: collect station statistics earlier when disconnect wifi: mac80211: restore non-chanctx injection behaviour wifi: mac80211_hwsim: disable BHs for hwsim_radio_lock wifi: mac80211: don't iterate not running interfaces wifi: mac80211_hwsim: fix typo in frequency notification wifi: avoid kernel-infoleak from struct iw_point ==================== Link: https://patch.msgid.link/20260108140141.139687-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanupBreno Leitao
When bnxt_init_one() fails during initialization (e.g., bnxt_init_int_mode returns -ENODEV), the error path calls bnxt_free_hwrm_resources() which destroys the DMA pool and sets bp->hwrm_dma_pool to NULL. Subsequently, bnxt_ptp_clear() is called, which invokes ptp_clock_unregister(). Since commit a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events"), ptp_clock_unregister() now calls ptp_disable_all_events(), which in turn invokes the driver's .enable() callback (bnxt_ptp_enable()) to disable PTP events before completing the unregistration. bnxt_ptp_enable() attempts to send HWRM commands via bnxt_ptp_cfg_pin() and bnxt_ptp_cfg_event(), both of which call hwrm_req_init(). This function tries to allocate from bp->hwrm_dma_pool, causing a NULL pointer dereference: bnxt_en 0000:01:00.0 (unnamed net_device) (uninitialized): bnxt_init_int_mode err: ffffffed KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] Call Trace: __hwrm_req_init (drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c:72) bnxt_ptp_enable (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:323 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:517) ptp_disable_all_events (drivers/ptp/ptp_chardev.c:66) ptp_clock_unregister (drivers/ptp/ptp_clock.c:518) bnxt_ptp_clear (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:1134) bnxt_init_one (drivers/net/ethernet/broadcom/bnxt/bnxt.c:16889) Lines are against commit f8f9c1f4d0c7 ("Linux 6.19-rc3") Fix this by clearing and unregistering ptp (bnxt_ptp_clear()) before freeing HWRM resources. Suggested-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Signed-off-by: Breno Leitao <leitao@debian.org> Fixes: a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events") Cc: stable@vger.kernel.org Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Link: https://patch.msgid.link/20260106-bnxt-v3-1-71f37e11446a@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08net: usb: pegasus: fix memory leak in update_eth_regs_async()Petko Manolov
When asynchronously writing to the device registers and if usb_submit_urb() fail, the code fail to release allocated to this point resources. Fixes: 323b34963d11 ("drivers: net: usb: pegasus: fix control urb submission") Signed-off-by: Petko Manolov <petkan@nucleusys.com> Link: https://patch.msgid.link/20260106084821.3746677-1-petko.manolov@konsulko.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08net: 3com: 3c59x: fix possible null dereference in vortex_probe1()Thomas Fourier
pdev can be null and free_ring: can be called in 1297 with a null pdev. Fixes: 55c82617c3e8 ("3c59x: convert to generic DMA API") Cc: <stable@vger.kernel.org> Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com> Link: https://patch.msgid.link/20260106094731.25819-2-fourier.thomas@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08net: wan: framer: Discard pm_runtime_put() return valuesRafael J. Wysocki
The framer driver defines framer_pm_runtime_put() to return an int, but that return value is never used. It also passes the return value of pm_runtime_put() to the caller which is not very useful. Returning an error code from pm_runtime_put() merely means that it has not queued up a work item to check whether or not the device can be suspended and there are many perfectly valid situations in which that can happen, like after writing "on" to the devices' runtime PM "control" attribute in sysfs for one example. Modify phy_pm_runtime_put() to discard the pm_runtime_put() return value and change its return type to void. No intentional functional impact. This will facilitate a planned change of the pm_runtime_put() return type to void in the future. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/3027916.e9J7NaK4W3@rafael.j.wysocki Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08net: cadence: macb: Discard pm_runtime_put() return valueRafael J. Wysocki
Passing pm_runtime_put() return value to the callers is not particularly useful. Returning an error code from pm_runtime_put() merely means that it has not queued up a work item to check whether or not the device can be suspended and there are many perfectly valid situations in which that can happen, like after writing "on" to the devices' runtime PM "control" attribute in sysfs for one example. It also happens when the kernel is configured with CONFIG_PM unset. Accordingly, update at91ether_close() to simply discard the return value of pm_runtime_put() and always return success to the caller. This will facilitate a planned change of the pm_runtime_put() return type to void in the future. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com> Link: https://patch.msgid.link/2252292.irdbgypaU6@rafael.j.wysocki Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08net: ethernet: ti: am65-cpsw: Discard pm_runtime_put() return valueRafael J. Wysocki
Printing error messages on pm_runtime_put() returning negative values is not particularly useful. Returning an error code from pm_runtime_put() merely means that it has not queued up a work item to check whether or not the device can be suspended and there are many perfectly valid situations in which that can happen, like after writing "on" to the devices' runtime PM "control" attribute in sysfs for one example. Accordingly, update am65_cpsw_ethtool_op_begin() and cpsw_ethtool_op_begin() to simply discard the return value of pm_runtime_put(). This will facilitate a planned change of the pm_runtime_put() return type to void in the future. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/5042490.GXAFRqVoOG@rafael.j.wysocki Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-08wifi: libertas: fix WARNING in usb_tx_blockSzymon Wilczek
The function usb_tx_block() submits cardp->tx_urb without ensuring that any previous transmission on this URB has completed. If a second call occurs while the URB is still active (e.g. during rapid firmware loading), usb_submit_urb() detects the active state and triggers a warning: 'URB submitted while active'. Fix this by enforcing serialization: call usb_kill_urb() before submitting the new request. This ensures the URB is idle and safe to reuse. Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com> Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-08wifi: mwifiex: Allocate dev name earlier for interface workqueue nameChen-Yu Tsai
The interface specific workqueues are allocated with the interface name as part of the workqueue name. However when they are allocated, the interface name has not been allocated, thus the "name" is actually the pattern for the name "mlan%d". This ends up pretty ugly and could conflict if multiple interfaces were added. Allocate the device name earlier and use that to allocate the workqueues. Also tweak the workqueue name patterns to add a separator between the prefix and the interface name parts for readability. Signed-off-by: Chen-Yu Tsai <wenst@chromium.org> Link: https://patch.msgid.link/20260107092744.1131314-1-wenst@chromium.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-08wifi: mac80211_hwsim: disable BHs for hwsim_radio_lockBenjamin Berg
The hwsim_radio_lock spinlock expects bottom-half to be disabled, fix the call in mac80211_hwsim_nan_stop to ensure BHs are disabled. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Link: https://patch.msgid.link/20260107143805.ce7406511608.I688f8b19346e94c1f8de0cdadde072054d4b861c@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-08wifi: mac80211_hwsim: fix typo in frequency notificationBenjamin Berg
The NAN notification is for 5745 MHz which corresponds to channel 149 and not 5475 which is not actually a valid channel. This could result in a NULL pointer dereference in cfg80211_next_nan_dw_notif. Fixes: a37a6f54439b ("wifi: mac80211_hwsim: Add simulation support for NAN device") Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Reviewed-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260107143652.7dab2035836f.Iacbaf7bb94ed5c14a0928a625827e4137d8bfede@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-08Merge tag 'ath-next-20260105' of ↵Johannes Berg
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v6.20 Propagate the "Next Generation" of the ath12k driver to wireless-next. NOTE TO MAINTAINERS: There is a conflict between this tree and the MHI tree. This conflict has already been resolved by Stephen Rothwell in linux-next. Please refer to his resolution comments in: https://lore.kernel.org/all/20260105154243.7cd5d049@canb.auug.org.au/ ================== Link: https://patch.msgid.link/4ba3aecf-5194-48e3-a112-31da3a8646aa@oss.qualcomm.com/ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-08wifi: wlcore: sdio: Use pm_ptr instead of #ifdef CONFIG_PMUwe Kleine-König
This increases build coverage and removes two ugly #ifdefs. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20251217112033.3309281-4-u.kleine-koenig@baylibre.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-08wifi: brcmfmac: rename function that frees vifRafał Miłecki
Since the commit cf124db566e6 ("net: Fix inconsistent teardown and release of private netdev state.") netdev isn't freed anymore in the brcmf_cfg80211_free_netdev(). Adjust this function name to match what it actually does (freeing vif). Signed-off-by: Rafał Miłecki <rafal@milecki.pl> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20251215103817.29598-1-zajec5@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-08wifi: brcmfmac: fix/add kernel-doc commentsRandy Dunlap
Correct or add kernel-doc comments for: - an enum name typo - missing struct member comments in struct vif_saved_ie and struct brcmf_cfg80211_vif fixing these warnings: Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:195 Enum value 'BRCMF_VIF_STATUS_EAP_SUCCESS' not described in enum 'brcmf_vif_status' Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:195 Excess enum value '@BRCMF_VIF_STATUS_EAP_SUCCUSS' description in 'brcmf_vif_status' Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:220 struct member 'assoc_req_ie' not described in 'vif_saved_ie' Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:220 struct member 'assoc_req_ie_len' not described in 'vif_saved_ie' Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:255 struct member 'saved_ie' not described in 'brcmf_cfg80211_vif' Warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:255 struct member 'is_11d' not described in 'brcmf_cfg80211_vif' kernel-doc warnings for missing struct member descriptions in struct brcmf_cfg80211_info and struct brcmf_cfg80211_profile are still present. Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20251129073803.1814384-1-rdunlap@infradead.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-08net: phy: realtek: get rid of magic number in rtlgen_read_status()Daniel Golle
Use newly introduced helper macros RTL822X_VND2_TO_PAGE and RTL822X_VND2_TO_PAGE_REG to access RTL_VEND2_PHYSR register over Clause-22 paged access instead of using magic numbers. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/a53d4577335fdda4d363db9bc4bf614fd3a56c9b.1767630451.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-08net: phy: realtek: use paged access for MDIO_MMD_VEND2 in C22 modeDaniel Golle
RTL822x cannot access MDIO_MMD_VEND2 via MII_MMD_CTRL/MII_MMD_DATA. A mapping to use paged access needs to be used instead. All other MMD devices can be accessed as usual. Implement phy_read_mmd and phy_write_mmd using paged access for MDIO_MMD_VEND2 in Clause-22 mode instead of relying on MII_MMD_CTRL/MII_MMD_DATA. This allows eg. rtl822x_config_aneg to work as expected in case the MDIO bus doesn't support Clause-45 access. Suggested-by: Bevan Weiss <bevan.weiss@gmail.com> Signed-off-by: Daniel Golle <daniel@makrotopia.org> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/25aab7f02dac7c6022171455523e3db1435b0881.1767630451.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-08net: phy: move mmd_phy_read and mmd_phy_write to phylib.hDaniel Golle
Helper functions mmd_phy_read and mmd_phy_write are useful for PHYs which require custom MMD access functions for some but not all MMDs. Move mmd_phy_read and mmd_phy_write function prototypes from phylib-internal.h to phylib.h to make them available for PHY drivers. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/79169cd624a3572d426e42c7b13cd2654a35d0cb.1767630451.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-08net: phy: realtek: implement configuring in-band anDaniel Golle
Implement the inband_caps() and config_inband() PHY driver methods to allow configuring the use of in-band-status with SGMII and 2500Base-X on RTL8226 and RTL8221B 2.5GE PHYs. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/82a78a06d67be19e856d646cf880b2021ea9d837.1767630451.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-08net: phy: realtek: fix whitespace in struct phy_driver initializersDaniel Golle
Consistently use tabs instead of spaces in struct phy_driver initializers. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/42b0fac53c5c5646707ce3f3a6dacd2bc082a5b2.1767630451.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-08net: dsa: microchip: Wrap timestamp reading in a functionBastien Curutchet (Schneider Electric)
Timestamps are directly accessed through a register read in the interrupt handler. KSZ8463's logic to access it will be a bit more complex because the same interrupt can be triggered by two different timestamps being ready. Wrap the timestamp's reading in a dedicated function to ease the KSZ8463's integration in upcoming patches. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260105-ksz-rework-v1-9-a68df7f57375@bootlin.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-08net: dsa: microchip: Use regs[] to access REG_PTP_MSG_CONF1Bastien Curutchet (Schneider Electric)
Accesses to the PTP_MSG_CONF1 register are done through a hardcoded address which doesn't match with the KSZ8463's register layout. Add a new entry for the PTP_MSG_CONF1 register in the regs[] tables. Use the regs[] table to retrieve the PTP_MSG_CONF1 register address when accessing it. Remove the macro defining the address to prevent further use. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260105-ksz-rework-v1-8-a68df7f57375@bootlin.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-01-08net: dsa: microchip: Use regs[] to access REG_PTP_SUBNANOSEC_RATEBastien Curutchet (Schneider Electric)
Accesses to the PTP_SUBNANOSEC_RATE register are done through a hardcoded address which doesn't match with the KSZ8463's register layout. Add a new entry for the PTP_SUBNANOSEC_RATE register in the regs[] tables. Use the regs[] table to retrieve the PTP_SUBNANOSEC_RATE register address when accessing it. Remove the macro defining the address to prevent further use. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260105-ksz-rework-v1-7-a68df7f57375@bootlin.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-17 16:04:43 +0000