summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)Author
2026-07-03wifi: rtw89: coex: Add Wi-Fi firmware 0.35.94.1 support for RTL8922DChing-Te Ku
The firmware 0.35.94.1 included several new features. Wi-Fi TX power setting offload to firmware. Including dual BT / dual Wi-Fi MAC related configurations. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-10-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Renaming drvinfo_type to drvinfo_verChing-Te Ku
It's more closing to the original meaning. It is defined for rearranging driver info index by firmware support version. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-9-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Add TX/RX RF parameter format version 9Ching-Te Ku
In order to support external Zigbee/Thread/Bluetooth etc module, the version 8 add the parameter for the case. And also update the related configuration function. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-8-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Refine third party module related coexistenceChing-Te Ku
The incoming chip reserved several IO ports to coexist with the other vendor's stand along chips. In order to configured them easier add the structure. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-7-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Move Bluetooth related counters to BT infoChing-Te Ku
In order to support dual Bluetooth chip, move Bluetooth counters to BT info. Because the two Bluetooth need to collect their own counters. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-6-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Extend bt_slot_req for dual MAC wifiChing-Te Ku
This variable is for asking driver occupied Bluetooth traffic slot while wifi is running at multi-port mode. Example like station + AP. The time slot is separated by wifi driver under these wifi modes. And to ensure Bluetooth performance, Coex will advice the Bluetooth slot length to driver. And each MAC is able to run multi-port mode, so extend the variable's index. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-5-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: Move wifi related counters to wifi infoChing-Te Ku
Move wifi related counters to wifi main info, it is to facilitate the after modification for dual MAC wifi structure. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-4-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: offset current BT info to BT0 for dual BT configurationChing-Te Ku
In order to compatible with single/dual Bluetooth structure in one branch, offset the currently using BT info structure to BT-0. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-3-pkshih@realtek.com
2026-07-03wifi: rtw89: coex: force to exit Wi-Fi LPS while Bluetooth profile existChing-Te Ku
Wi-Fi can not reach LPS leave threshold while Wi-Fi only throughput not good & Bluetooth share bandwidth. Add logic to let force leave Wi-Fi LPS while Bluetooth profile exist. Update COEX version to 9.0.1. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260624033941.45918-2-pkshih@realtek.com
2026-07-03wifi: rtw88: Enable receiving control frames in monitor modeBitterblue Smith (S.E.A. Datentechnik GmbH)
By default RTL8723D, RTL8703B, RTL8812A, RTL8821A, and RTL8814A are configured to filter out all control frames except PS-Poll, even in monitor mode. Handle FIF_CONTROL in rtw_ops_configure_filter(). When it's set, configure REG_RXFLTMAP1 to let all control frames through. When it's unset, restore the original value. Because some drivers configure REG_RXFLTMAP1 differently, keep track of its value in a new member of struct rtw_hal. Signed-off-by: Bitterblue Smith (S.E.A. Datentechnik GmbH) <rtl8821cerfe2@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/2a52d718-9e46-47f2-84a1-d8e7b1ed89a8@gmail.com
2026-07-03wifi: rtl8xxxu: 8723bu: remove reference of non-existing firmware ↵Ping-Ke Shih
rtl8723bu_bt.bin A report from [1] that firmware is missing in linux-firmware repository. However, there is no specific firmware for RTL8723BU for Bluetooth enabled. Remove the unnecessary reference of firmware file. [1] https://github.com/rtlwifi-linux/rtlwifi-next/issues/20 Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260622015439.9621-1-pkshih@realtek.com
2026-07-03wifi: rtlwifi: rtl8192du: check QoS TID before indexing tidsRunyu Xiao
rtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID from the 802.11 header and then uses it as an index into sta_entry->tids[]. ieee80211_get_tid() returns the low 4-bit QoS TID value, so the result can be in the range 0..15. rtlwifi only allocates MAX_TID_COUNT entries for sta_entry->tids[], and MAX_TID_COUNT is 9. A QoS TID greater than 8 therefore indexes past the aggregation state array. Keep the default RTL_AGG_STOP state for out-of-range TIDs, matching rtl92cu_tx_fill_desc(). This issue was detected by our static analysis tool and confirmed by manual audit. UBSAN validation for the same bug pattern reports an array-index-out-of-bounds access with index 10 for type 'rtl_tid_data [9]'. Fixes: 8321424134a4 ("wifi: rtlwifi: Add rtl8192du/trx.{c,h}") Cc: stable@vger.kernel.org Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260620025632.46206-1-runyu.xiao@seu.edu.cn
2026-07-03wifi: rtw88: pci: fix resource leak on failed NAPI setupDawei Feng
rtw_pci_probe() allocates PCI resources through rtw_pci_setup_resource() before it sets up NAPI. If rtw_pci_napi_init() fails, the error path jumps straight to err_pci_declaim and skips rtw_pci_destroy(), leaving the PCI resources allocated by rtw_pci_setup_resource() behind. Add a dedicated cleanup label for the NAPI setup failure path so probe destroys the PCI resources. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing current mainline kernels. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc7. An x86_64 allyesconfig build showed no new warnings. As we do not have a suitable rtw88 PCI board to test with, no runtime testing was able to be performed. Fixes: d0bcb10e7b94 ("wifi: rtw88: Un-embed dummy device") Cc: stable@vger.kernel.org Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260617013502.114057-1-dawei.feng@seu.edu.cn
2026-07-03wifi: rtw88: 8822c: replace msleep() with fsleep() for DPK delaysChen Jung Ku
Replace msleep() with fsleep(), because msleep() may oversleep to as much as 20 ms when used for a 10 ms delay. According to the kernel documentation, fsleep() is more suitable and aligns better with modern kernel style. Signed-off-by: Chen Jung Ku <ku.loong@gapp.nthu.edu.tw> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260613170434.23645-1-ku.loong@gapp.nthu.edu.tw
2026-07-03wifi: rtw89: use str_enable_disable() helperPanagiotis Petrakopoulos
Replace "enable"/"disable" strings in ternary expressions with the str_enable_disable() helper from <linux/string_choices.h>. This covers the rfkill state log in rtw89_core_rfkill_poll() and the DPK on/off log in _dpk_onoff(). No functional change intended. Signed-off-by: Panagiotis Petrakopoulos <npetrakopoulos2003@gmail.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260612223012.504886-1-npetrakopoulos2003@gmail.com
2026-07-03wifi: rtw89: fw: correct preload field of w2 in ↵Wentao Guan
rtw89_fw_h2c_default_cmac_tbl_be() BE_CCTL_INFO_W2_PRELOAD_ENABLE is for h2c->w2, not h2c->w1. These will cause h2c->w1 wrong overlap by w2 and w2 not initialized. Fixes: c73607b3a8ef ("wifi: rtw89: fw: add CMAC H2C command to initialize default value for RTL8922D") Signed-off-by: Wentao Guan <guanwentao@uniontech.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260611082021.46650-1-guanwentao@uniontech.com
2026-07-03wifi: rtw88: 8822b: Don't process RF path C in query_phy_status_page1Bitterblue Smith
Replace <= with < in the loop in query_phy_status_page1(). It was processing data related to RF path C, which this chip doesn't have. The only bad effect seems to be that the phy_info file in debugfs was printing unexpected values for RF path C. Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/9c4beb36-2954-4db0-844a-74ba5eacf21b@gmail.com
2026-07-03wifi: rtw88: 8822c: Don't process RF path C in query_phy_status_page{0,1}Bitterblue Smith
Replace <= with < in the loops in query_phy_status_page{0,1}(). They were processing data related to RF path C, which this chip doesn't have. The only bad effect seems to be that the phy_info file in debugfs was printing unexpected values for RF path C. Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/ee30b95f-bc68-4711-9b15-cf5fd23c3c48@gmail.com
2026-07-03wifi: rtlwifi: rtl8723be: Remove unnecessary irq save/restore in hw_init()William Hansen-Baird
rtl8723be hw_init() calls local_save_flags(flags) followed by local_irq_enable(). Later, local_irq_restore(flags) is called. This causes warnings from Lockdep on boot and modprobe, as local_irq_restore(flags) should only be called while irqs are disabled. The warning was introduced to detect this class of bug in [1]. With testing I found that all paths which call hw_init() have irqs already enabled for rtl8723be. Furthermore, the calls were originally added for the rtl8192ce in commit f78bccd79ba3 ("rtlwifi: rtl8192ce: Fix too long disable of IRQs") before later being added to most other rtlwifi drivers. Commit d3feae41a347 ("rtlwifi: Update power-save routines for 062814 driver") then replaces the call to spin_lock_irqsave() before hw_init(), and thus the codepath which caused irqs to be disabled in hw_init and prompted the original commit has been removed. The same irq save/restore pattern is also present in the hw_init() of rtl8192ce, rtl8723ae, rtl8188ee, rtl8192se and rtl8192cu, however I don't have the hardware to test them, so I did not include them in my changes. Tested on a Razer Blade 14 2017. Example of output from Lockdep prior to fix: raw_local_irq_restore() called with IRQs enabled ... Call Trace: <TASK> rtl8723be_hw_init+0x5992/0x7220 [rtl8723be] ? static_obj+0x61/0xa0 rtl_pci_start+0x222/0x5c0 [rtl_pci] rtl_op_start+0x128/0x1a0 [rtlwifi] ? __kasan_check_read+0x11/0x20 drv_start+0x16c/0x550 [mac80211] ... irq event stamp: 887679 hardirqs last enabled at (887689): [<ffffffff96511170>] __up_console_sem+0x90/0xa0 hardirqs last disabled at (887698): [<ffffffff96511155>] __up_console_sem+0x75/0xa0 softirqs last enabled at (887670): [<ffffffff962f4675>] __irq_exit_rcu+0x175/0x2f0 softirqs last disabled at (887649): [<ffffffff962f4675>] __irq_exit_rcu+0x175/0x2f0 ---[ end trace 0000000000000000 ]--- [1] https://lore.kernel.org/all/20210111153707.10071-1-mark.rutland@arm.com/ Signed-off-by: William Hansen-Baird <william.hansen.baird@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260609095359.2964193-1-william.hansen.baird@gmail.com
2026-07-03wifi: rtw89: debug: fix off by on in rtw89_ppdu_str()Dan Carpenter
This > comparison should be >= to avoid an out of bounds access. Fixes: 419ed7f4a053 ("wifi: rtw89: debug: extend bb_info with TX status and PER") Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/aia25i0ds3B6QF6c@stanley.mountain
2026-07-03wifi: rtw89: fw: support scan offload v2 for WiFi 7 chipsPing-Ke Shih
The format of scan offload v2 is to extend fields to consider channel noise as a factor to adjust dwell time of certain channels. Leave empty for now to ignore this factor. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260525070735.27659-3-pkshih@realtek.com
2026-07-03wifi: rtw89: fw: add first set of firmware features by version for RTL8922DPing-Ke Shih
The firmware features including version of command/event format are maintained by this table, which enables features by firmware version. Define the first feature set accordingly. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260525070735.27659-2-pkshih@realtek.com
2026-07-02wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_beginGaole Zhang
In ATH11K_QMI_EVENT_FW_READY, ATH11K_FLAG_REGISTERED is set unconditionally even when ath11k_core_qmi_firmware_ready() fails. This leaves the driver in an inconsistent state where initialization is considered complete although the firmware ready handling did not finish successfully. During the subsequent SSR, the driver enters the restart path based on this incorrect state and dereferences uninitialized srng members, resulting in a NULL pointer dereference. Call trace: ath11k_hal_srng_access_begin+0xc/0x60 [ath11k] (P) ath11k_ce_cleanup_pipes+0x17c/0x180 [ath11k] ath11k_core_restart+0x40/0x168 [ath11k] Fix this by: - skipping firmware_ready if ATH11K_FLAG_REGISTERED is already set - setting ATH11K_FLAG_REGISTERED only when firmware_ready succeeds - setting ATH11K_FLAG_QMI_FAIL and aborting the FW_READY handling on error Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1 Fixes: 6fe62a8cec51c ("wifi: ath11k: Add cold boot calibration support on WCN6750") Signed-off-by: Gaole Zhang <gaole.zhang@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Link: https://patch.msgid.link/20260609090609.4041009-1-gaole.zhang@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-02wifi: ath6kl: fix use-after-free in aggr_reset_state()Daniel Hodges
The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info->aggr_conn) in aggr_module_destroy(). Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning. Fixes: bdcd81707973 ("Add ath6kl cleaned up driver") Cc: stable@vger.kernel.org Signed-off-by: Daniel Hodges <git@danielhodges.dev> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20260206185207.30098-1-git@danielhodges.dev Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-02wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware requestCheng Yongkang
ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_dev as the completion context, and then still dereferences hif_dev: dev_info(&hif_dev->udev->dev, "ath9k_htc: Firmware %s requested\n", hif_dev->fw_name); The re-armed callback ath9k_hif_usb_firmware_cb() runs on the "events" workqueue and, when the firmware is missing, walks the retry chain into ath9k_hif_usb_firmware_fail() -> complete_all(&hif_dev->fw_done). That releases the wait_for_completion(&hif_dev->fw_done) in a concurrent ath9k_hif_usb_disconnect(), which then kfree()s hif_dev. The trailing dev_info() in the frame that re-armed the request can therefore read freed memory (hif_dev->udev, the first field of struct hif_device_usb): BUG: KASAN: slab-use-after-free in ath9k_hif_request_firmware Read of size 8 ... by task kworker/... ath9k_hif_request_firmware ath9k_hif_usb_firmware_cb drivers/net/wireless/ath/ath9k/hif_usb.c:1247 request_firmware_work_func Allocated by ...: ath9k_hif_usb_probe drivers/net/wireless/ath/ath9k/hif_usb.c Freed by ...: ath9k_hif_usb_disconnect -> kfree drivers/net/wireless/ath/ath9k/hif_usb.c The fw_done barrier only makes disconnect wait for the firmware chain to *terminate*; it does not protect the outer ath9k_hif_request_firmware() frame that re-armed the request and keeps touching hif_dev afterwards. Drop the post-request dev_info(): it is the only use of hif_dev after the async request is armed, and it is purely informational (the dev_err() on the failure path runs only when request_firmware_nowait() did not arm a callback, so hif_dev is still alive there). This was first reported by syzbot as a single, non-reproduced crash that was later auto-obsoleted, and was independently rediscovered by the reFuzz fuzzer, which produced a C reproducer (USB-gadget connect/disconnect of an ath9k_htc device whose firmware download fails). The vulnerable code is unchanged and still present in v7.1-rc6, where the slab-use-after-free reproduces under KASAN once the (sub-microsecond) race window is widened. Fixes: e904cf6fe230 ("ath9k_htc: introduce support for different fw versions") Reported-by: syzbot+50122cbc2874b1eb25b0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=50122cbc2874b1eb25b0 Signed-off-by: Cheng Yongkang <teel4res@gmail.com> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> Link: https://patch.msgid.link/20260605153210.20471-1-1020691186@qq.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-02octeontx2-af: Add RSS hashing support based on RoCEv2 headerKiran Kumar K
Add NIX_FLOW_KEY_TYPE_ROCEV2 flow key type to support RSS hashing on the RoCEv2 destination Queue Pair (QP) field, allowing RoCEv2 traffic to be distributed across receive queues. Signed-off-by: Kiran Kumar K <kirankumark@marvell.com> Signed-off-by: Nitin Shetty J <nshettyj@marvell.com> Link: https://patch.msgid.link/20260630062145.2533816-3-nshettyj@marvell.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-02octeontx2-af: reserve 4 PKINDs for skip-size custom useKiran Kumar K
The NPC block uses PKINDs to determine how incoming packets are parsed. Reserve PKINDs 46-49 (NPC_RX_SKIP_SIZE_PKIND) for configurable L2 skip-size use in the first pass, and PKINDs 50-53 (NPC_RX_CPT_SKIP_SIZE_PKIND) for the second pass where packets carry a CPT (Cryptographic Accelerator Unit) header. Add npc_set_skip_size_pkind() to program NPC_AF_PKINDX_ACTION0 for these reserved PKINDs with a user-supplied ptr_advance value representing the L2 size to skip. For the corresponding CPT PKINDs (pkind + 4), additionally configure the var_len_offset, var_len_mask, var_len_shift, and var_len_right fields so the NPC can extract the inner payload length from the CPT header. Update rvu_npc_set_parse_mode() to accept a new skip_size argument and dispatch to npc_set_skip_size_pkind() when the requested PKIND falls in the newly reserved range. Extend the npc_set_pkind mbox message struct with a skip_size field so PF/VF drivers can supply this value at run time. Advance NPC_UNRESERVED_PKIND_COUNT to NPC_RX_SKIP_SIZE_PKIND to reflect the updated reservation boundary. Signed-off-by: Kiran Kumar K <kirankumark@marvell.com> Signed-off-by: Nitin Shetty J <nshettyj@marvell.com> Link: https://patch.msgid.link/20260630062145.2533816-2-nshettyj@marvell.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-02net: mvneta_bm: add suspend/resume support to prevent crash after resumeYun Zhou
The mvneta driver uses the hardware Buffer Manager (BM) for RX buffer allocation. During suspend, mvneta disables its clock, causing BM to lose all buffer address state. On resume, mvneta_bm_port_init() re- attaches the BM pool to the NIC, but BM hardware returns stale/garbage buffer addresses. When NAPI poll processes these buffers, DMA cache sync hits an invalid virtual address causing a kernel panic: Unable to handle kernel paging request at virtual address b0000080 PC is at v7_dma_inv_range Call trace: v7_dma_inv_range from arch_sync_dma_for_cpu+0x94/0x158 arch_sync_dma_for_cpu from __dma_sync_single_for_cpu+0xc4/0x15c __dma_sync_single_for_cpu from mvneta_rx_swbm+0x6c8/0xf48 mvneta_rx_swbm from mvneta_poll+0x6fc/0x70c mvneta_poll from __napi_poll.constprop.0+0x2c/0x1e0 __napi_poll.constprop.0 from net_rx_action+0x160/0x2c4 net_rx_action from handle_softirqs+0xd8/0x2b8 handle_softirqs from run_ksoftirqd+0x30/0x94 run_ksoftirqd from smpboot_thread_fn+0x100/0x204 smpboot_thread_fn from kthread+0xf4/0x110 kthread from ret_from_fork+0x14/0x28 Fix by adding suspend/resume callbacks to the BM driver: - suspend: drain all buffers (with DMA unmapping), free the BPPE regions, and reset pool state to FREE before stopping BM and gating the clock. - resume: enable the clock, reinitialize BM defaults, and restore pool read/write pointers and size registers. Pool allocation and buffer refill are handled by mvneta_resume() through the normal mvneta_bm_port_init() path, which sees pools as FREE and performs full initialization identical to probe. Add a device_link (DL_FLAG_AUTOREMOVE_CONSUMER) in mvneta_probe to guarantee BM resumes before mvneta and suspends after mvneta. If the link cannot be created, fall back to SW buffer management to avoid a potential crash on resume due to unordered PM transitions. Signed-off-by: Yun Zhou <yun.zhou@windriver.com> Link: https://patch.msgid.link/20260630060311.4072140-1-yun.zhou@windriver.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-02net: dsa: qca8k: fall back to ethernet-ports node name for LEDsRosen Penev
The device tree binding allows both "ports" and "ethernet-ports" as the container node name. Try "ethernet-ports" when "ports" is absent so that newer DTBs with the preferred name work. This matches the handling already present in qca8k-8xxx.c Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260630015137.1591152-1-rosenp@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-02octeontx2-pf: link RQ page pools to netdev for Netlink statsRatheesh Kannoth
page_pool_create() only registers pools with the netdev Netlink interface when pp_params.netdev is set. Set netdev in page pool params. Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260630013814.3657831-1-rkannoth@marvell.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-02net: dsa: realtek: rtl8366rb: Switch to generic learning enablementLinus Walleij
Instead of just writing the learning disablement register in setup and a custom handling of BR_LEARNING, implement the generic RTL83xx .port_set_learning() callback for setting learning on a port, and call this in the per-port loop in .setup(). Instead of the custom rtl83366rb_port_bridge_flags() function for setting learning mode on each port, use the RTL83xx generic rtl83xx_port_bridge_flags() callback. Signed-off-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260630-rtl8366rb-improvements-v2-5-05eb9d6a37f5@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-02net: dsa: realtek: rtl8366rb: Disable STP learning on all ports in setupLinus Walleij
When we loop over all ports in the switch .setup() callback, make sure to disable learning on all user ports. This is what is normally expected and what the RTL8365MB is doing. Move the code around to accommodate for the new call. Reviewed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260630-rtl8366rb-improvements-v2-4-05eb9d6a37f5@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-02net: dsa: realtek: rtl8366rb: Use DSA port iteratorsLinus Walleij
Instead of custom loops for intializing the ports (including the CPU port) use the DSA helpers dsa_switch_for_each_port() and dsa_switch_for_each_cpu_port() following the pattern in RTL8365MB by accumulatong masks for the upstream and downstream ports. This gives us similar enough code to the RTL8365MB that we can start using more generic rtl83xx helpers. Reviewed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260630-rtl8366rb-improvements-v2-3-05eb9d6a37f5@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-02net: dsa: realtek: rtl8366rb: Switch to generic port_bridge* handlersLinus Walleij
The RTL8366RB is using its own sub-standard port isolation code. Implement the required isolation helpers, use these directly in the port setup callback, and switch over to the standard port isolation code. Signed-off-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260630-rtl8366rb-improvements-v2-2-05eb9d6a37f5@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-02net: dsa: realtek: rtl83xx: Make learning optional in join/leaveLinus Walleij
Mostly to make it possible to add rtl83xx support piece by piece, make the port learning callback optional in rtl83xx_port_bridge_join() and rtl83xx_port_bridge_leave(). Signed-off-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260630-rtl8366rb-improvements-v2-1-05eb9d6a37f5@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-02ionic: Change list definition methodLei Zhu
The LIST_HEAD macro can both define a linked list and initialize it in one step. To simplify code, we replace the separate operations of linked list definition and manual initialization with the LIST_HEAD macro. Signed-off-by: Lei Zhu <zhulei@kylinos.cn> Reviewed-by: Brett Creeley <brett.creeley@amd.com> Link: https://patch.msgid.link/20260630065457.160081-1-zhulei_szu@163.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-02net: usb: rtl8150: handle link status read failuresYousef Alhouseen
set_carrier() ignores the result of the USB control transfer and tests the stack variable supplied as its receive buffer. If the device rejects or aborts the request, that variable remains uninitialized and the driver chooses an arbitrary carrier state. Leave the existing carrier state unchanged when the link status cannot be read. A transient USB error should not be treated as link loss. Reported-by: syzbot+9db6c624635564ad813c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9db6c624635564ad813c Suggested-by: Petko Manolov <petkan@nucleusys.com> Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260630101216.10365-1-alhouseenyousef@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-02ehea: remove the ehea driverDavid Christensen
The IBM eHEA (Ethernet Host Ethernet Adapter) driver has been orphaned since April 2024 with no active maintainer. The hardware was last supported on IBM POWER7 systems which reached end-of-support in December 2020. The driver has received no functional updates since October 2022, with all subsequent changes being mechanical API migrations affecting the entire kernel tree. A search of lore.kernel.org for the last 24 months reveals no user reports, no objections to the orphan status, and no maintenance discussions indicating active hardware deployment. The code is preserved in git history and can be restored if a maintainer steps forward to take ownership. Signed-off-by: David Christensen <drc@linux.ibm.com> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Link: https://patch.msgid.link/20260629211343.3712775-2-drc@linux.ibm.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-02net: phylink: Drop references to the .validate() method in commentsMaxime Chevallier
The phylink_mac_ops '.validate()' has been removed in: commit da5f6b80ad64 ("net: phylink: remove .validate() method") There are still a few comments around in phylink that references that, related to the ports fields as well as the Pause configuration. Let's drop these references and update the comments related to Pause handling. Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260630083700.2041915-1-maxime.chevallier@bootlin.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-02net/mlx5: HWS, fix matcher leak on resize target setup failureDawei Feng
hws_bwc_matcher_move() allocates a replacement matcher before setting it as the resize target. If mlx5hws_matcher_resize_set_target() fails, the replacement matcher is not attached anywhere and is leaked. Fix the leak by destroying the replacement matcher before returning from the resize-target failure path. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1.1. An x86_64 allyesconfig build showed no new warnings. As we do not have a mlx5 HWS-capable device to test with, no runtime testing was able to be performed. Fixes: 2111bb970c78 ("net/mlx5: HWS, added backward-compatible API handling") Cc: stable@vger.kernel.org Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn> Reviewed-by: Yevgeny Kliteynik <kliteyn@nvidia.com> Acked-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260629064049.3852759-1-dawei.feng@seu.edu.cn Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-01igc: add support for forcing link speed without autonegotiationFaizal Rahim
Allow users to force 10/100 Mb/s link speed and duplex via ethtool when autonegotiation is disabled. Previously, the driver rejected these requests with "Force mode currently not supported.". Forcing at 1000 Mb/s and 2500 Mb/s is not supported. Reviewed-by: Looi Hong Aun <hong.aun.looi@intel.com> Signed-off-by: Faizal Rahim <faizal.abdul.rahim@linux.intel.com> Signed-off-by: Khai Wen Tan <khai.wen.tan@linux.intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Dima Ruinskiy <dima.ruinskiy@intel.com> Tested-by: Moriya Kadosh <moriyax.kadosh@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-07-01igc: replace goto out with direct returns in igc_config_fc_after_link_up()Faizal Rahim
The out: label only returns ret_val with no cleanup. The kernel coding style guide states: "If there is no cleanup needed then just return directly." (Documentation/process/coding-style.rst, section 7). This improves readability ahead of a subsequent patch that introduces a new goto label in this function. No functional change. Reviewed-by: Looi Hong Aun <hong.aun.looi@intel.com> Signed-off-by: Faizal Rahim <faizal.abdul.rahim@linux.intel.com> Signed-off-by: Khai Wen Tan <khai.wen.tan@linux.intel.com> Reviewed-by: Dima Ruinskiy <dima.ruinskiy@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Tested-by: Moriya Kadosh <moriyax.kadosh@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-07-01igc: move autoneg-enabled settings into igc_handle_autoneg_enabled()Faizal Rahim
Move the advertised link modes and flow control configuration from igc_ethtool_set_link_ksettings() into igc_handle_autoneg_enabled(). No functional change. Reviewed-by: Looi Hong Aun <hong.aun.looi@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Faizal Rahim <faizal.abdul.rahim@linux.intel.com> Signed-off-by: Khai Wen Tan <khai.wen.tan@linux.intel.com> Reviewed-by: Dima Ruinskiy <dima.ruinskiy@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Tested-by: Moriya Kadosh <moriyax.kadosh@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-07-01igc: remove unused autoneg_failed fieldFaizal Rahim
autoneg_failed in struct igc_mac_info is never set in the igc driver. Remove the field and the dead code checking it in igc_config_fc_after_link_up(). The field originates from the e1000/e1000e fiber/serdes forced-link path, where MAC-level autoneg timeout sets it to signal the flow-control code to force pause. igc supports only copper, so it never needs to set this field. Reviewed-by: Looi Hong Aun <hong.aun.looi@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Faizal Rahim <faizal.abdul.rahim@linux.intel.com> Signed-off-by: Khai Wen Tan <khai.wen.tan@linux.intel.com> Reviewed-by: Dima Ruinskiy <dima.ruinskiy@intel.com> Reviewed-by: Piotr Kwapulinski <piotr.kwapulinski@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Tested-by: Moriya Kadosh <moriyax.kadosh@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-07-01igb: set skb hash type from RSS_TYPEKohei Enju
igb always marks the RX hash as L3 regardless of RSS_TYPE in the advanced descriptor, which may indicate L4 (TCP/UDP) hash. This can trigger unnecessary SW hash recalculation and breaks toeplitz selftests. Use RSS_TYPE from pkt_info to set the correct PKT_HASH_TYPE_* Tested by toeplitz.py with the igb RSS key get/set patches applied as they are required for toeplitz.py (see Link below). # ethtool -N $DEV rx-flow-hash udp4 sdfn # ethtool -N $DEV rx-flow-hash udp6 sdfn # python toeplitz.py | grep -E "^# Totals" Without patch: # Totals: pass:0 fail:12 xfail:0 xpass:0 skip:0 error:0 With patch: # Totals: pass:12 fail:0 xfail:0 xpass:0 skip:0 error:0 Link: https://lore.kernel.org/intel-wired-lan/20260119084511.95287-5-takkozu@amazon.com/ Signed-off-by: Kohei Enju <kohei@enjuk.jp> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-07-01igb: allow configuring RSS key via ethtool set_rxfhTakashi Kozu
Change igb_set_rxfh() to accept and save a userspace-provided RSS key. When a key is provided, store it in the adapter and write the E1000 registers accordingly. This can be tested using `ethtool -X <dev> hkey <key>`. Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Takashi Kozu <takkozu@amazon.com> Tested-by: Kohei Enju <kohei@enjuk.jp> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-07-01igb: expose RSS key via ethtool get_rxfhTakashi Kozu
Implement igb_get_rxfh_key_size() and extend igb_get_rxfh() to return the RSS key to userspace. This can be tested using `ethtool -x <dev>`. Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Takashi Kozu <takkozu@amazon.com> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-07-01igb: prepare for RSS key get/set supportTakashi Kozu
Store the RSS key inside struct igb_adapter and introduce the igb_write_rss_key() helper function. This allows the driver to program the E1000 registers using a persistent RSS key, instead of using a stack-local buffer in igb_setup_mrqc(). Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Piotr Kwapulinski <piotr.kwapulinski@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Takashi Kozu <takkozu@amazon.com> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-07-01igc: allow configuring RSS key via ethtool set_rxfhKohei Enju
Change igc_ethtool_set_rxfh() to accept and save a userspace-provided RSS key. When a key is provided, store it in the adapter and write the RSSRK registers accordingly. This can be tested using `ethtool -X <dev> hkey <key>`. Signed-off-by: Kohei Enju <kohei@enjuk.jp> Reviewed-by: Simon Horman <horms@kernel.org> Tested-by: Avigail Dahan <avigailx.dahan@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-07-01igc: expose RSS key via ethtool get_rxfhKohei Enju
Implement igc_ethtool_get_rxfh_key_size() and extend igc_ethtool_get_rxfh() to return the RSS key to userspace. This can be tested using `ethtool -x <dev>`. Signed-off-by: Kohei Enju <kohei@enjuk.jp> Tested-by: Avigail Dahan <avigailx.dahan@intel.com> Reviewed-by: Vitaly Lifshits <vitaly.lifshits@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-20 23:23:48 +0000