summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)Author
2026-07-20ovpn: use monotonic clock for peer keepalive timeoutsMarco Baffo
Replace ktime_get_real_seconds() with the monotonic ktime_get_boottime_seconds() to ensure the keepalive mechanism is robust against system clock modifications. Right now, the driver uses ktime_get_real_seconds() to track peer timeouts, relying on the system wall-clock. An administrative time adjustment or an NTP sync that steps the clock forward can cause `now' to instantly exceed `last_recv + timeout'. When this occurs, the driver artificially expires healthy peers. Depending on the OpenVPN user-space configuration, this triggers a premature tunnel restart (if --keepalive or --ping-restart is used) or a complete disconnection of the client (if --ping-exit is used). Fixes: 3ecfd9349f40 ("ovpn: implement keepalive mechanism") Signed-off-by: Marco Baffo <marco@mandelbit.com> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-07-20ovpn: fix use after free in unlock_ovpn()Marco Baffo
unlock_ovpn() iterates over the release_list using llist_for_each_entry() and drops the peer reference inside the loop body via ovpn_peer_put(). If this drops the last reference, the peer is eventually freed. However, llist_for_each_entry() reads peer->release_entry.next in the loop advance expression, which runs after the body. By that time the peer may have already been freed, resulting in a use after free when advancing to the next list entry. Fix this by using llist_for_each_entry_safe(), which caches the next pointer before executing the loop body. Fixes: 80747caef33d ("ovpn: introduce the ovpn_peer object") Signed-off-by: Marco Baffo <marco@mandelbit.com> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-07-20ovpn: hold peer before scheduling keepalive workShuvam Pandey
ovpn_peer_keepalive_send() passes its peer reference to ovpn_xmit_special(), which ultimately drops it. The keepalive scheduler currently queues the work first and takes the reference only after schedule_work() reports that the work was queued. Once schedule_work() queues the item, another CPU may run the worker before the caller gets to ovpn_peer_hold(). In that case the worker can consume a reference that was not acquired for it, corrupting the peer lifetime accounting. Take the peer reference before queueing the work and drop it again when the work was already pending. Fixes: 3ecfd9349f40 ("ovpn: implement keepalive mechanism") Cc: stable@vger.kernel.org Signed-off-by: Shuvam Pandey <shuvampandey1@gmail.com> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-07-20ovpn: fix peer refcount leak in TCP error pathsPavitra Jha
When either the TCP RX or TX error path calls ovpn_peer_hold() followed by schedule_work(&peer->tcp.defer_del_work), and the work item is already pending from the other path, schedule_work() returns false and the work runs only once. Since ovpn_tcp_peer_del_work() calls ovpn_peer_put() exactly once, the extra reference taken by the losing path is never dropped, leaking the peer object. The race window: CPU0 (strparser/RX error): CPU1 (tcp_tx_work/TX error): ovpn_peer_hold() <- refcnt+1 ovpn_peer_hold() <- refcnt+2 schedule_work() <- queued schedule_work() <- NO-OP (work already pending) ovpn_tcp_peer_del_work runs: ovpn_peer_del() ovpn_peer_put() <- refcnt+1 <- peer never freed Fix by checking the return value of schedule_work() in both paths and calling ovpn_peer_put() to drop the extra reference if the work was already pending. ovpn_peer_hold() is kept unconditional in the TX path as it cannot fail at that point. Fixes: a6a5e87b3ee4 ("ovpn: avoid sleep in atomic context in TCP RX error path") Cc: stable@vger.kernel.org Signed-off-by: Pavitra Jha <jhapavitra98@gmail.com> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-07-20ovpn: avoid putting unrelated P2P peer on socket releaseQing Ming
ovpn_peer_release_p2p() is called when an OVPN UDP socket is being destroyed. It checks the currently published P2P peer and releases it only if that peer still uses the socket being destroyed. A peer replacement can publish a new peer before the old UDP socket is destroyed. When the old socket destruction path runs afterwards, ovpn_peer_release_p2p() observes the new peer through ovpn->peer. Since the new peer uses a different socket, the function takes the socket mismatch branch. That branch still calls ovpn_peer_put(peer). At this point, however, peer is the currently published replacement peer, not the peer associated with the socket being destroyed. Dropping its reference can free it while ovpn->peer still points to it, leading to later use-after-free accesses from the peer and socket cleanup paths. KASAN reports this as a slab-use-after-free on the kmalloc-1k ovpn_peer object. In the reproducer, the object is allocated from ovpn_peer_new() via ovpn_nl_peer_new_doit(), and freed through ovpn_peer_release_rcu() from RCU callback processing. Observed access sites include ovpn_peer_remove(), ovpn_socket_release(), ovpn_nl_peer_del_notify(), and unlock_ovpn(). Fix this by returning from the socket mismatch branch without putting the peer. Fixes: f6226ae7a0cd ("ovpn: introduce the ovpn_socket object") Signed-off-by: Qing Ming <a0yami@mailbox.org> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-07-20Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netPaolo Abeni
Cross-merge networking fixes after downstream PR (net-7.2-rc4). No conflicts. Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-18wifi: iwlwifi: mld: move BIOS reading code to where it belongsMiri Korenblit
We have a dedicated function to fetch all the BIOS tables when the opmode starts, and yet we read a couple of tables directly from iwl_op_mode_mld_start, which is already a large function that does multiple things. Move the reading of the sgom, puncturing, and RFI enablement to the dedicated iwl_mld_get_bios_tables. Link: https://patch.msgid.link/20260717172958.b19a33e0b507.I73f6b5e6a81d0f411f12589ceb30afa655c0a16b@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mld: add debug log after AP type commandPagadala Yesu Anjaneyulu
Add a radio debug trace when MCC_ALLOWED_AP_TYPE_CMD is sent successfully during AP type table initialization. This improves bring-up visibility without changing runtime behavior. Failures are still reported through the existing error log path. Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com> Link: https://patch.msgid.link/20260717172958.18e1fc5ec109.I76dd832f62d00a8f358f8e4a705f25184ac53da2@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mld: support update_mcc notification v2Pagadala Yesu Anjaneyulu
New firmware will support version 2 of the update_mcc notification. The extra field is used for a new feature, but we does not support it. Keep the existing payload definition compatible with both versions and register version 2 in the MLD notification version table so the driver accepts the newer notification without changing the behavior. This preserves version 1 support and adds compatibility with firmware that sends version 2. Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com> Link: https://patch.msgid.link/20260717172958.9c5a940d37dc.I955800c2377b802ffb99003349552cc4036ca4bd@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: fw: move SAR defines from acpi.h to regulatory.hAvinash Bhatt
IWL_SAR_ENABLE_MSK and IWL_REDUCE_POWER_FLAGS_POS describe the layout of the shared WRDS/SAR table format. They are not ACPI-specific: the same bit positions are used regardless of whether the data originates from ACPI, UEFI, or another BIOS source. IWL_SAR_ENABLE_MSK was already duplicated in regulatory.h; remove it from acpi.h to eliminate the duplication. Move IWL_REDUCE_POWER_FLAGS_POS to regulatory.h alongside IWL_SAR_ENABLE_MSK so that both SAR field descriptors live in the shared regulatory header, accessible to all BIOS configuration sources. No functional change. Signed-off-by: Avinash Bhatt <avinash.bhatt@intel.com> Link: https://patch.msgid.link/20260717172958.32e5dcde4b90.I420c58b05ab6ab011c4c771ca9e4eb62740de549@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mld: drop connection on D3 resume failureAyala Beker
When FW crashes on D3 exit, iwl_mld_nic_error() sets STATUS_RESET_PENDING and queues restart wk, but mac80211's resume callback synchronously calls iwl_trans_stop_device() which clears the flag. As a result restart wk skips sw_reset, and the FW error recovery buffer is never read. The new FW boots with empty BA state and initial sequence numbers, while the AP still holds its A-MPDU RX reorder window. This causes MPDUs to be dropped as IWL_RX_MPDU_REORDER_BA_OLD_SN until ADDBA is renegotiated. We don't know how long the firmware has been in an error state or whether the AP still considers us associated, so keeping the connection alive is not worth it. Call ieee80211_resume_disconnect() when iwl_mld_wait_d3_notif() fails, and let userspace reassociate. Signed-off-by: Ayala Beker <ayala.beker@intel.com> Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717172958.3e10c8498f53.Icf5644b42d79e984ecc16abfa873bd37f611e778@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mvm: ignore sync frames when sync is disabledEmmanuel Grumbach
Gate time-sync frame interception on the active flag so frames are not queued after time-sync teardown. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717172958.ac73ee199a25.Ic1489244f9b02da93060f0a0e5b300a73527f265@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mld: initialize scan-abort statusEmmanuel Grumbach
Initialize abort status before issuing the abort command so debug logging never reads an uninitialized value on error paths. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717172958.9d804f466534.I4e10270bd1dde4a80940a47ef5d383729cc66cb1@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: mld: validate wake packet crypto overheadEmmanuel Grumbach
Wake packet parsing only accounted for FCS and missed per-key IV/ICV overhead for protected data frames. Prevent size underflow and bad packet trimming when notifications are malformed or truncated. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717172958.e06595623533.Ie09494b7e34e5872b750fd90e325648ee469d0da@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: validate SEC_RT TLV minimum sizeEmmanuel Grumbach
Reject firmware section TLVs that are shorter than the offset field before subtracting sizeof(offset) from the section size. This prevents size underflow for malformed TLVs. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717173215.17b040b27edc.I6b32d1e9ad707417e2e604f08a63582456209372@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: uefi: bound PPAG revision bitmap shiftEmmanuel Grumbach
Validate revision is below 32 before BIT(revision) in PPAG parsing. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717173215.d116dd2efdc1.I3c6cae5cb9d0acc2d94544bc755b0754a91b10ba@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: acpi: validate WGDS table revision indexEmmanuel Grumbach
Check tbl_rev bounds before BIT(tbl_rev) to avoid undefined shifts when firmware reports an invalid revision value. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717173215.52a01f841f2a.Ic0131eaac31d9ff71b169138d9b0865cb39b44a9@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: dbg-tlv: bound aligned TLV walk lengthEmmanuel Grumbach
Validate ALIGN(tlv_len, 4) before advancing through external debug TLVs to prevent parser length underflow. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717173215.e08d6550c6ec.Iad64190a7d5cded553aff41973120396aef1b557@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-18wifi: iwlwifi: bound aligned TLV advance in FW parserEmmanuel Grumbach
Validate ALIGN(tlv_len, 4) against remaining parser length before consuming bytes from the firmware image. This avoids length underflow on malformed TLVs. Assisted-by: GitHubCopilot:GPT-5.3-Codex Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Link: https://patch.msgid.link/20260717173215.393c286488f9.Ia39144dc3ca334325ee4eacb7420901e2446fc23@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-07-17net: phy: at803x: Use a helper to check for phy reset existenceMaxime Chevallier
The at803x family of devices are subjected to an errata that requires hard-reseting the PHY upon link change. That can only work if there's a physical reset line wired to the PHY, which the driver checks by looking if there's a reset GPIO configured for the MDIO device. The reset may however be controlled through a reset controller, which isn't accounted for in the errata handling. Besides that, PHY drivers aren't expected to directly access the mdiodev's resources directly, let's therefore wrap this with a phylib helper, that uses a similar mdio helper to check for reset existence. This was found in preparation for bus-level resource management for better mdio scan support. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Link: https://patch.msgid.link/20260715101355.88536-1-maxime.chevallier@bootlin.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17net: mana: Add handler for sriov configureHaiyang Zhang
Add callback function for the pci_driver / sriov_configure. It asks the NIC to provide certain number of VFs, or disable VFs if the request is zero. Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com> Link: https://patch.msgid.link/20260710192735.2921300-1-haiyangz@linux.microsoft.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17net: mana: Add debug knob to skip TX timeout recovery resetAditya Garg
Add a per-port debugfs boolean "tx_timeout_skip_reset" that, when enabled, makes mana_tx_timeout() log the TX timeout and return without queueing the per-port detach/attach recovery work. This is a debug-only aid for bringup and qualification: skipping the recovery reset keeps the device and queue state intact so a TX timeout can be correlated with hardware telemetry. The knob defaults to false, so production recovery behaviour is unchanged. Signed-off-by: Aditya Garg <gargaditya@linux.microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Reviewed-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260710132229.2851441-1-gargaditya@linux.microsoft.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17net: airoha: add preliminary support to configure tx hw QoS queue during ↵Lorenzo Bianconi
flowtable offloading Add the plumbing to program the AIROHA_FOE_QID field in the PPE FOE entry with a per-flow priority value during flowtable offload. This allows the hardware to steer offloaded flows to a specific QoS queue on the egress QDMA block for traffic forwarded between two interfaces via hardware acceleration, bypassing the kernel forwarding path. The priority parameter is currently always zero because netfilter does not yet provide a mechanism to pass the skb priority field to the flowtable offload driver. Once that support is added in the netfilter subsystem, the driver will be able to extract the priority from the flow rule and map it to the appropriate hardware queue. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260703-airoha-hw-qos-queue-stub-v1-1-ef253ffdd093@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17bnxt_en: Handle partially initialized auxiliary devicesRuoyu Wang
bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are initialized. After auxiliary_device_init() succeeds, later errors must unwind with auxiliary_device_uninit(), which invokes the release callback. The release callback assumes that aux_priv->id, aux_priv->edev, edev->net and edev->ulp_tbl are all populated. If allocation fails after auxiliary_device_init(), the release path can otherwise dereference or clear partially initialized state. Allocate and attach the bnxt_en_dev and ULP table before calling auxiliary_device_init(), so the release callback only sees a fully initialized auxiliary private object. If auxiliary_device_init() itself fails, free those allocations directly because device_initialize() has not run and the release callback will not be invoked. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 194fad5b2781 ("bnxt_en: Refactor bnxt_rdma_aux_device_init/uninit functions") Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com> Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Link: https://patch.msgid.link/20260711163716.3996929-1-ruoyuw560@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move skb_pool / refill_wq from struct netpoll to netconsole_targetBreno Leitao
These two fields back the fallback skb pool that find_skb() uses. Every helper that touches them lives in netconsole now (refill_skbs, refill_skbs_work_handler, netconsole_skb_pool_init, netconsole_skb_pool_flush, find_skb, netcons_skb_pop), so the data can move alongside its only consumer. Add skb_pool and refill_wq to struct netconsole_target, drop them from struct netpoll. This will save 48-bytes for every netpoll user instance (except netconsole that will have it in netconsole target struct). Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-7-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move remote_mac from struct netpoll to netconsole_targetBreno Leitao
The destination ethernet address is netconsole configuration: no other netpoll user (bonding, team, vlan, bridge, macvlan, dsa) references np->remote_mac, only netconsole's ethernet framing and its configfs/cmdline interface do. Move it into struct netconsole_target and convert push_eth() to take the netconsole_target; netconsole_print_banner() and netconsole_parser_cmdline() already take it. The configfs show/store handlers and alloc_and_init() reach the field directly. No functional change; the remote_mac sysfs attribute is unchanged. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-9-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move skb_pool_flush() from netpollBreno Leitao
skb_pool_flush() has no callers left in net/core/netpoll.c after netconsole took over the pool lifecycle. Inline its body into netconsole_skb_pool_flush() (the only caller) and drop the function and its export from netpoll. The prototype goes from <linux/netpoll.h>. Pure code motion: cancel_work_sync() + skb_queue_purge_reason() semantics are unchanged. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-6-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move local_port / remote_port from struct netpoll to ↵Breno Leitao
netconsole_target The source and destination UDP ports live in struct netpoll but are netconsole configuration. No other netpoll user (bonding, team, vlan, bridge, macvlan, dsa) touches np->local_port or np->remote_port; they only use the netpoll TX/forwarding path. Only netconsole's UDP framing and its configfs/cmdline interface read these fields. Move both into struct netconsole_target and convert the three helpers that read them - push_udp(), netconsole_print_banner() and netconsole_parser_cmdline() - to take the netconsole_target. The configfs show/store handlers already have the target in hand. No functional change; the local_port / remote_port sysfs attributes are unchanged. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-8-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move refill_skbs() and skb-pool sizing macros from netpollBreno Leitao
refill_skbs() is now only called from netconsole (directly via netconsole_skb_pool_init() and indirectly via the just-moved refill_skbs_work_handler()), and the MAX_UDP_CHUNK / MAX_SKBS / MAX_SKB_SIZE macros are private to it. Move them all into drivers/net/netconsole.c. MAX_UDP_CHUNK and MAX_SKB_SIZE were promoted to <linux/netpoll.h> by commit 6c537b845c99 ("netconsole: do not dequeue pooled skbs that cannot satisfy len") so find_skb() could detect oversized requests against the same value refill_skbs() used. With both functions now local to netconsole, the shared definition no longer needs to live in the header. Pure code motion: bodies and pool sizing semantics are unchanged. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-5-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: move refill_skbs_work_handler() from netpollBreno Leitao
The work handler is wired via INIT_WORK() in netconsole_skb_pool_init() and has no other callers since the previous patch took the skb pool lifecycle out of __netpoll_setup(). Move the function body into drivers/net/netconsole.c as a file-static helper, drop EXPORT_SYMBOL_GPL() and remove the prototype from <linux/netpoll.h>. Pure code motion: the body is unchanged and still calls the exported refill_skbs() in net/core/netpoll.c. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-4-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: take over skb pool lifecycle from netpollBreno Leitao
The fallback skb pool fronted by find_skb() is netconsole's only client: every other netpoll goes through __netpoll_setup() / netpoll_send_skb() without ever touching np->skb_pool. Today __netpoll_setup() and __netpoll_cleanup() create and destroy the pool for everyone, paying ~48 KB of pre-allocated skbs per netpoll instance that only netconsole uses, what a waste! Move the responsibility to netconsole. __netpoll_setup() did this under the RTNL, but netconsole enables targets from enabled_store() / alloc_param_target() without it, while the teardown path flushes the pool (cancel_work_sync() + skb_queue_purge()) under the RTNL from netconsole_process_cleanups_core(). Initialising the queue head and the refill work on every enable would therefore race that flush. They only need initialising once: after a flush the queue head is left valid and empty and cancel_work_sync() leaves the work re-armable. Set them up in alloc_and_init(), while the target is not yet reachable, and let the enable paths only refill the pool via refill_skbs(), which serialises with the flush through skb_pool.lock. See discussions in [1] Link: https://lore.kernel.org/all/alDMvD5S7TZnoD_V@gmail.com/ [1] Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-3-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17netconsole: clean up released targets dropped before the cleanup workerBreno Leitao
drop_netconsole_target() might eventually tear down a target that netconsole_netdev_event() had moved to target_cleanup_list but that netconsole_process_cleanups_core() had not processed yet. Always cleanup devices that eventually have a device attached to the target, independent of the state. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260710-netconsole_move_more-v3-1-6f63f76b28bc@debian.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17net/mlx5: free mlx5_st_idx_data on final deallocZhiping Zhang
Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints (e.g. churning RDMA MRs) leak one struct mlx5_st_idx_data per cycle; kmemleak flags it as unreferenced and the kmalloc slab grows over time. When the last reference to an ST table entry is dropped, mlx5_st_dealloc_index() removed the entry from idx_xa but the backing mlx5_st_idx_data allocation was never freed. Free idx_data after the xa_erase() so the lifetime of the bookkeeping struct matches the lifetime of the ST entry it tracks. Cc: stable@vger.kernel.org Fixes: 888a7776f4fb ("net/mlx5: Add support for device steering tag") Reviewed-by: Michael Gur <michaelgur@nvidia.com> Signed-off-by: Zhiping Zhang <zhipingz@meta.com> Reviewed-by: Leon Romanovsky <leonro@nvidia.com> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260702222507.1234467-1-zhipingz@meta.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17wifi: rtw89: fw: use MAC source for IO offload delay commandChia-Yuan Li
The udelay/mdelay helpers set the command source to RTW89_FW_CMD_OFLD_SRC_OTHER (4), which does not fit the two-bit field RTW89_H2C_CMD_OFLD_W0_SRC (GENMASK(1, 0)). The le32_encode_bits() masks it down to 0 (RTW89_FW_CMD_OFLD_SRC_BB), and compiler throws __field_overflow() error. Fortunately it still works because firmware ignores the source field for a delay command. Use RTW89_FW_CMD_OFLD_SRC_MAC as the vendor driver does, and drop the unused RTW89_FW_CMD_OFLD_SRC_OTHER enumerator. Reported-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Closes: https://github.com/morrownr/rtw89/issues/111 Fixes: ae3d327515f2 ("wifi: rtw89: add IO offload support via firmware") Signed-off-by: Chia-Yuan Li <leo.li@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260714074811.30124-1-pkshih@realtek.com
2026-07-17wifi: rtw89: wow: fix unsupported cipher debug messagesGuoHan Zhao
Correct two WoWLAN debug messages to say "unsupported cipher". Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260715060813.476245-1-zhaoguohan@kylinos.cn
2026-07-17wifi: rtw89: debug: add diagnosis for RFZong-Zhe Yang
Add debugfs diag_rf and show RFK (RF calibration) diagnosis things for now. Record channel related info before triggering RFK, and then record state of each kind of RFK from C2H event report. Besides, in track work, monitor TSSI status too. Both support history up to 10, and show records via debugfs. The following is an example of output. RFK (next index: 2) PHY-X = 0 0 0 0 0 0 0 0 0 0 S0-CH = 0012a 0012a 00000 00000 00000 00000 00000 00000 00000 00000 S0-CV = 0032c 0032c 00000 00000 00000 00000 00000 00000 00000 00000 S0-C5 = 10000 10000 00000 00000 00000 00000 00000 00000 00000 00000 S1-CH = 0012a 0012a 00000 00000 00000 00000 00000 00000 00000 00000 S1-CV = 0032d 0032d 00000 00000 00000 00000 00000 00000 00000 00000 S1-C5 = 00000 00000 00000 00000 00000 00000 00000 00000 00000 00000 PRE_NTFY = 0 0 0 0 0 0 0 0 0 0 TSSI = 1 1 0 0 0 0 0 0 0 0 IQK = 1 1 0 0 0 0 0 0 0 0 DPK = 1 1 0 0 0 0 0 0 0 0 TXGAPK = 1 1 0 0 0 0 0 0 0 0 DACK = 0 0 0 0 0 0 0 0 0 0 RX_DCK = 1 1 0 0 0 0 0 0 0 0 TX_IQK = 1 1 0 0 0 0 0 0 0 0 CIM3k = 1 1 0 0 0 0 0 0 0 0 TSSI-track (next index: 6) S0 = 00e 00e 00c 00d 00d 00e 00d 00d 00d 00e S1 = 00a 00b 009 00a 00a 00a 009 009 009 00a Debugfs diag_rf can also be used to manually trigger RFK when written by 1. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260712034506.53209-9-pkshih@realtek.com
2026-07-17wifi: rtw89: fw: do bb_preinit before downloading firmwarePing-Ke Shih
The firmware access BB registers while initialization, so driver should do bb_preinit before downloading firmware. Otherwise, it might get BB IO stuck and throw error. rtw89_8922de 0000:04:00.0: loaded firmware rtw89/rtw8922d_fw.bin rtw89_8922de 0000:04:00.0: Firmware version 0.35.111.7 (51c56e7b), cmd version 1, type 14 rtw89_8922de 0000:04:00.0: Firmware version 0.35.111.7 (51c56e7b), cmd version 1, type 15 rtw89_8922de 0000:04:00.0: fw unexpected status 6 rtw89_8922de 0000:04:00.0: download firmware fail rtw89_8922de 0000:04:00.0: [ERR]fwdl 0x1E0 = 0x8000012 rtw89_8922de 0000:04:00.0: [ERR]fwdl 0x78F0 = 0x290900 rtw89_8922de 0000:04:00.0: [ERR]fw PC = 0x201445f2 rtw89_8922de 0000:04:00.0: [ERR]fw PC = 0x201445f2 rtw89_8922de 0000:04:00.0: [ERR]fw PC = 0x201445f2 rtw89_8922de 0000:04:00.0: [ERR]fw PC = 0x201445f2 rtw89_8922de 0000:04:00.0: [ERR]fw PC = 0x201445f2 rtw89_8922de 0000:04:00.0: [ERR]fw PC = 0x201445f2 rtw89_8922de 0000:04:00.0: [ERR]fw PC = 0x201445f2 rtw89_8922de 0000:04:00.0: [ERR]fw PC = 0x201445f2 rtw89_8922de 0000:04:00.0: [ERR]fw PC = 0x201445f2 rtw89_8922de 0000:04:00.0: [ERR]fw PC = 0x201445f2 rtw89_8922de 0000:04:00.0: [ERR]fw PC = 0x201445f2 rtw89_8922de 0000:04:00.0: [ERR]fw PC = 0x201445f2 rtw89_8922de 0000:04:00.0: [ERR]fw PC = 0x201445f2 rtw89_8922de 0000:04:00.0: [ERR]fw PC = 0x201445f2 rtw89_8922de 0000:04:00.0: [ERR]fw PC = 0x201445f2 rtw89_8922de 0000:04:00.0: [ERR]H2C path ready Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260712034506.53209-8-pkshih@realtek.com
2026-07-17wifi: rtw89: extend tx shape format for regulatory 6 GHz power typeZong-Zhe Yang
Even under the same regulation, TX shape may need different settings for different 6 GHz power types. So, add one more dimension for that. Because TX shape parameters are not quite large, the 2/5/6 GHz sections are not divided into different structures. So, the 2/5 GHz sections will also get the new dimension. To 2/5 GHz sections, fill the TX shape settings with RTW89_REG_6GHZ_POWER_DFLT (0) field. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260712034506.53209-7-pkshih@realtek.com
2026-07-17wifi: rtw89: add tx shape v0 to keep built-in arrays compatible during ↵Zong-Zhe Yang
transitions TX shape parameters can come from (old way) built-in arrays or (new way) FW elements. The built-in arrays will no longer be updated, but will be retained during a certain transition period. However, the format of newer TX shape parameters are going to be expanded. It will only be applied to FW elements. To keep built-in arrays compatible during transition period, add tx shape v0 for old format. The v0 fields can be removed along with built-in arrays once transition period ends. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260712034506.53209-6-pkshih@realtek.com
2026-07-17wifi: rtw89: introduce helper to get tx shape indexZong-Zhe Yang
TX shape has a set of parameters inside RFE (RF Front End) parameters. It also depends on regulation and even will depend on regulatory 6 GHz power type afterwards. Introduce a helper to encapsulate the access to TX shape index. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260712034506.53209-5-pkshih@realtek.com
2026-07-17wifi: rtw89: 8922d: add TX time limit for 2GHz bandPing-Ke Shih
Fix 2.4GHz specific L-SIG length TX issue, causing interoperability problem with certain APs. Limit the A-MPDU duration to be workaround. For 8922DE, the MAC limit is 164 ticks, and BB limit is 4608 us. The conversion is 32.768us / tick. Since smaller limit should be adopted, BB limit is filled into newly added field. The units of register and CCTL table are tick and us/512 respectively. Convert to target unit when filling values. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260712034506.53209-4-pkshih@realtek.com
2026-07-17wifi: rtw89: mac: abstract register definition of firmware boot debugPing-Ke Shih
The registers of firmware boot debug are different between WiFi 6 and 7 chips. Add field to abstract it accordingly. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260712034506.53209-3-pkshih@realtek.com
2026-07-17wifi: rtw89: pack I/O during bb_sethw to reduce API execution timeEric Huang
Wrap rtw89_chip_bb_sethw() with rtw89_io_pack/unpack so all register writes during baseband hardware initialization are batched into a single bus transaction. This reduces API execution time from ~11000 us to ~4000 us on affected platforms. Signed-off-by: Eric Huang <echuang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260712034506.53209-2-pkshih@realtek.com
2026-07-17wifi: rtw89: coex: Update coexistence version to 9.24.0Ching-Te Ku
RTL8922D first release, add related feature support. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260712030506.43438-12-pkshih@realtek.com
2026-07-17wifi: rtw89: coex: update external control length by caseChing-Te Ku
Update recommend external control slot length to driver. Some of the Wi-Fi feature has its time slot requirement can not be simply controlled by coexistence firmware TDMA timer. For example: Wi-Fi scan/MCC etc. In the same time, coexistence need to tell driver the recommend Bluetooth slot length to make sure Bluetooth can still has enough time slot to traffic. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260712030506.43438-11-pkshih@realtek.com
2026-07-17wifi: rtw89: coex: Add firmware report control report v11Ching-Te Ku
In the version 11 report control report, firmware will report firmware build date, version. And Bluetooth to Wi-Fi scoreboard value will be read at Wi-Fi firmware and update to Wi-Fi driver. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260712030506.43438-10-pkshih@realtek.com
2026-07-17wifi: rtw89: coex: Correct SET_RFE settingsChing-Te Ku
Because of dual-BT & dual-MAC, RTL8922D has more complex antenna settings. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260712030506.43438-9-pkshih@realtek.com
2026-07-17wifi: rtw89: coex: Refine _reset_btc_var()Ching-Te Ku
To avoid the default value not match the real using scenario, it should after assign desired default value after variable reset. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260712030506.43438-8-pkshih@realtek.com
2026-07-17wifi: rtw89: coex: Refine send firmware command functionChing-Te Ku
Because the coexistence offload more register/ hardware setting I/O to firmware by coexistence itself, and it goes with the same entry with other control action, so the firmware command entry need to add different condition to judge should it followed coexistence TLV format or not. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260712030506.43438-7-pkshih@realtek.com
2026-07-17wifi: rtw89: coex: Rearrange Bluetooth firmware report entryChing-Te Ku
To enable/disable firmware report once at the end of mechanism round. This can make the logic more clearly, and make sure every round the mechanism running can refresh the settings. It can avoid some report missing after driver status change. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260712030506.43438-6-pkshih@realtek.com
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-20 00:09:41 +0000