summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)Author
2026-06-12virtio_net: do not allow tunnel csum offload for non GSO packetsPaolo Abeni
Fiona reports broken connectivity for virtio net setup using UDP tunnel inside the guest and NIC with not UDP tunnel TSO support in the host. Currently the virtio_net driver exposes csum offload for UDP-tunneled, TCP non GSO packets. Such packet reach the host as CSUM_PARTIAL ones with the 'encapsulation' flag cleared, as the virtio specification do not support this specific kind of offload. HW NICs with UDP tunnel TSO support - and those drivers directly accessing skb->csum_start/csum_offset - are still capable of computing the needed csum correctly, but otherwise the packets reach the wire with bad csum on both the inner and outer transport header. Address the issue explicitly disabling csum offload for UDP tunneled, non GSO packets via the ndo_features_check op. Fixes: 56a06bd40fab ("virtio_net: enable gso over UDP tunnel support.") Reported-by: Fiona Ebner <f.ebner@proxmox.com> Closes: https://bugzilla.proxmox.com/show_bug.cgi?id=7627 Tested-by: Fiona Ebner <f.ebner@proxmox.com> Tested-by: Gabriel Goller <g.goller@proxmox.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Gabriel Goller <g.goller@proxmox.com> Tested-by: Gabriel Goller <g.goller@proxmox.com> Link: https://patch.msgid.link/6c3b6c47fb05c100f384630dc48f3975cf37b67a.1781195144.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-12net: ethernet: sis900: correct CONFIG_VLAN_8021Q macro name in commentEthan Nelson-Moore
A comment in drivers/net/ethernet/sis/sis900.h incorrectly refers to CONFIG_VLAN_802_1Q instead of CONFIG_VLAN_8021Q. Correct it. Discovered while searching for CONFIG_* symbols referenced in code but not defined in any Kconfig file. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Link: https://patch.msgid.link/20260609175656.20574-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-12bnxt: fix head underflow on XDP head-growJoe Damato
The xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on a bnxt machine (and also crashes in NIPA). It seems that the bug is an underflow in bnxt_rx_multi_page_skb, which builds the skb head: napi_build_skb(data_ptr - bp->rx_offset, rxr->rx_page_size); The problem with this expression is that in page mode, rx_offset is: bp->rx_offset = NET_IP_ALIGN + XDP_PACKET_HEADROOM; Which evaluates (at least on x86_64) to 258. The test test_xdp_native_adjst_head_grow_data tests a case where the head is adjusted by -256. When this test runs, data_ptr is shifted to frag_start + 2 (where frag_start = page_address(page) + offset). Then, bnxt_rx_multi_page_skb is invoked and the napi_build_skb expression subtracts 258, landing at an address before frag_start. This could be either the previous fragment or the previous physical page when the offset is < 256 (e.g. if the fragment started at offset 0). When the skb is freed, the page pool fragment reference is dropped on either the wrong page or the wrong frag of the right page. In either case, the corrupted reference count can lead to the page being prematurely recycled while still in use. Once (incorrectly) recycled, it can be handed out again and on driver teardown this would result in a double free. The commit under fixes updated this code to handle the case where the native page size is >= 64k, but it unintentionally broke the head grow case. To fix this, add an offset field to struct bnxt_sw_rx_bd, mirroring the existing offset field in struct bnxt_sw_rx_agg_bd. Populate it on allocation and preserve it on reuse. In bnxt_rx_multi_page_skb, use the newly added offset field to compute the fragment start and pass that to napi_build_skb. Adjust the layout with skb_reserve. There are two cases, the non-adjustment case and the adjustment case. In both cases, the skb is built at page_address(page) + offset to account for the case where the native page size >= 64K and skb_reserve is called with data_ptr - (page_address(page) + offset). That difference equals bp->rx_offset when data_ptr was not moved, or bp->rx_offset + xdp_adjust when XDP adjusted the head. Re-running the failing test with this commit applied causes the test to run successfully to completion. The other rx_skb_func implementations don't have this issue. Fixes: f6974b4c2d8e ("bnxt_en: Fix page pool logic for page size >= 64K") Signed-off-by: Joe Damato <joe@dama.to> Reviewed-by: Michael Chan <michael.chan@broadcom.com> Link: https://patch.msgid.link/20260609204458.2237787-2-joe@dama.to Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-12net: stmmac: xgmac2: disable RBUE in default RX interrupt maskNazim Amirul
Enabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive and can trigger a MAC interrupt storm under heavy RX pressure. When the DMA runs out of RX descriptors it fires RBUE continuously until software refills the ring. However, RBUE is redundant: the normal RX completion interrupt (RIE) already triggers NAPI, which processes completed descriptors and refills the ring, causing the DMA to resume. The RBUE handler itself only sets handle_rx - the same outcome as RIE. On Agilex5 under heavy RX pressure, the MAC interrupt (which includes RBUE) was observed firing 1,821,811,555 times against only 2,618,627 actual RX completions - a ~695x ratio - confirming the severity of the storm. RBUE does not provide OOM recovery. If page_pool is exhausted, stmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays suspended, and RBUE fires again on the next NAPI completion - a storm with no forward progress. This patch trades that storm for a clean stall with the same RX outcome. Proper OOM recovery is a pre-existing gap outside the scope of this fix. Note: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool counter will always read 0 on XGMAC2 devices. This behaviour is already inconsistent across DWMAC core versions. Remove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX to prevent the interrupt storm while keeping normal RX handling intact. Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Signed-off-by: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260609121703.9736-1-muhammad.nazim.amirul.nazle.asmade@altera.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-12Merge tag 'thunderbolt-for-v7.2-rc1' of ↵Greg Kroah-Hartman
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-next Mika writes: thunderbolt: Changes for v7.2 merge window This includes following USB4/Thunderbolt changes for the v7.2 merge window: - Make the driver more compliant with the connection manager guide. - Improvements over Thunderbolt XDomain service handling. - USB4STREAM driver. - Split out PCIe bits into pci.c to allow the driver to work on non-PCIe hosts as well. - Various fixes and improvements. All these have been in linux-next with no reported issues. * tag 'thunderbolt-for-v7.2-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: (41 commits) thunderbolt: debugfs: Fix sideband write size check thunderbolt: debugfs: Fix margining error counter buffer leak thunderbolt: test: Release third DP tunnel thunderbolt: Prevent XDomain delayed work use-after-free on disconnect thunderbolt: test: Add KUnit tests for property parser bounds checks thunderbolt: Add some more descriptive probe error messages thunderbolt: Require nhi->ops be valid thunderbolt: Separate out common NHI bits thunderbolt: Move pci_device out of tb_nhi thunderbolt: Increase Notification Timeout to 255 ms for USB4 routers thunderbolt: Increase timeout for Configuration Ready bit thunderbolt: Verify Router Ready bit is set after router enumeration thunderbolt: Verify PCIe adapter in detect state before tunnel setup thunderbolt: Activate path hops from source to destination thunderbolt: Fix lane bonding log when bonding not possible thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() thunderbolt: Improve multi-display DisplayPort tunnel allocation docs: admin-guide: thunderbolt: Add instructions how to use USB4STREAM thunderbolt: Add support for USB4STREAM thunderbolt: Add support for ConfigFS ...
2026-06-11net: airoha: simplify WAN device check in airoha_dev_init()Lorenzo Bianconi
airoha_register_gdm_devices() iterates eth->ports[] in order, so GDM2's netdev is always registered before GDM3/GDM4. This means the explicit check for eth->ports[1] && eth->ports[1]->devs[0] is a redundant special-case of what airoha_get_wan_gdm_dev() already covers, since GDM2 is always marked as WAN during its own ndo_init. Remove the redundant check and rely solely on airoha_get_wan_gdm_dev() which handles both the GDM2-present and GDM2-absent cases. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com> Link: https://patch.msgid.link/20260610-airoha-eth-simplify-dev-init-v2-1-8f244e69b0d4@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()Wentao Liang
When mlxsw_sp_vrs_lpm_tree_replace() fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but fails to update the vr pointer, which still points to the VR that caused the failure. As a result, the condition and the rollback call always operate on the same VR, potentially calling mlxsw_sp_vr_lpm_tree_replace() multiple times on it while never rolling back the earlier VRs. Those VRs continue to hold a reference to new_tree acquired via mlxsw_sp_lpm_tree_hold(), leaking the reference count of new_tree. Fix by reinitializing vr inside the error loop with the updated index: vr = &mlxsw_sp->router->vrs[i]; so that the loop correctly iterates over all VRs that were actually replaced. Cc: stable@vger.kernel.org Fixes: fc922bb0dd94 ("mlxsw: spectrum_router: Use one LPM tree for all virtual routers") Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260609084730.215732-1-vulab@iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()Wentao Liang
When mlxsw_sp_port_lag_index_get() fails, mlxsw_sp_port_lag_join() returns an error without releasing the lag reference obtained by the earlier mlxsw_sp_lag_get(). All other error paths in the function jump to the cleanup label that ends with mlxsw_sp_lag_put(), so this is a single missed release. Fix the leak by replacing the bare 'return err' with a goto to the existing error cleanup label, which will drop the reference safely. Cc: stable@vger.kernel.org Fixes: 0d65fc13042f ("mlxsw: spectrum: Implement LAG port join/leave") Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260609083709.209743-1-vulab@iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11net: phy: micrel: expose KSZ87xx low-loss cable tunablesFidelio Lawson
Add support for the KSZ87xx low-loss cable PHY tunables in the Micrel PHY driver by implementing get_tunable and set_tunable callbacks. These callbacks expose vendor-specific PHY tunables used to control the KSZ87xx embedded PHY receiver behavior when operating with short or low-loss Ethernet cables. The tunables provide: - a boolean short-cable preset applying known good settings; - an integer LPF bandwidth control; - an integer DSP EQ initial value control. The Micrel PHY driver forwards these tunables via standard phy_read() / phy_write() operations, which are virtualized by the KSZ8 DSA driver and translated into the appropriate indirect switch register accesses. Reviewed-by: Marek Vasut <marex@nabladev.com> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Signed-off-by: Fidelio Lawson <fidelio.lawson@exotec.com> Link: https://patch.msgid.link/20260609-ksz87xx_errata_low_loss_connections-v10-3-9ba4418cf3db@exotec.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11net: dsa: microchip: implement KSZ87xx Module 3 low-loss cable errataFidelio Lawson
Implement the KSZ87xx short cable workaround. This patch implements the KSZ87xx short cable erratum described in Microchip document DS80000687C for KSZ87xx switches and the following support article: Link: https://support.microchip.com/s/article/Solution-for-Using-CAT-5E-or-CAT-6-Short-Cable-with-a-Link-Issue-for-the-KSZ8795-Family The issue affects short or low-loss cable links (e.g. CAT5e/CAT6), where the PHY receiver equalizer may amplify high-amplitude signals excessively, resulting in internal distortion and link establishment failures. KSZ87xx devices require a workaround for the Module 3 low-loss cable condition, controlled through the switch TABLE_LINK_MD_V indirect registers. This change models the erratum handling as vendor-specific Clause 22 PHY registers, virtualized by the KSZ8 DSA driver and accessed via ksz8_r_phy() / ksz8_w_phy(). The following controls are provided: - A boolean “short-cable” preset, which applies a documented and conservative configuration (LPF 62 MHz bandwidth and DSP EQ initial value 0), and is the recommended interface for typical use cases. - Separate LPF bandwidth and DSP EQ initial value controls intended for advanced or experimental tuning. These are orthogonal and independent, and override the corresponding settings without requiring any specific ordering. The preset and tunables act as simple setters with no implicit state machine or invalid combinations, keeping the API predictable and aligned with the KISS principle. The erratum affects the shared PHY analog front-end and therefore applies globally to the switch. Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Reviewed-by: Marek Vasut <marex@nabladev.com> Signed-off-by: Fidelio Lawson <fidelio.lawson@exotec.com> Link: https://patch.msgid.link/20260609-ksz87xx_errata_low_loss_connections-v10-1-9ba4418cf3db@exotec.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11net: bcmgenet: convert RX path to page_poolNicolai Buchwitz
Replace the per-packet __netdev_alloc_skb() + dma_map_single() in the RX path with page_pool. SKBs are built from pool pages via napi_build_skb() with skb_mark_for_recycle() so the network stack returns pages to the pool, and DMA mapping happens once per page instead of once per packet. Reject HW-reported lengths smaller than the RSB so a runt cannot underflow the SKB build path. Drop the now-unused priv->rx_buf_len field and the rx_dma_failed soft MIB counter (nothing increments it after the conversion). This removes the "rx_dma_failed" entry from ethtool -S, which is a user-visible change for monitoring tools that key on stat names. Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de> Reviewed-by: Justin Chen <justin.chen@broadcom.com> Tested-by: Justin Chen <justin.chen@broadcom.com> Link: https://patch.msgid.link/20260610114835.2225423-1-nb@tipi-net.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11net: airoha: move get_sport() callback at the beginning of ↵Lorenzo Bianconi
airoha_enable_gdm2_loopback() Move the get_sport() callback invocation at the beginning of airoha_enable_gdm2_loopback() routine in order to avoid leaving the hardware in a partially configured state if get_sport() fails. Previously, get_sport() was called after GDM2 forwarding, loopback, channel, length, VIP and IFC registers had already been programmed. A failure at that point would return an error leaving GDM2 with loopback enabled but WAN port, PPE CPU port and flow control mappings not configured. Performing the get_sport() lookup before any register write guarantees the routine either completes the full configuration sequence or exits with no side effects on the hardware. Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260608-airoha_enable_gdm2_loopback-minor-change-v1-1-1787a0f42b31@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11net: phy: at803x: add RX and TX clock management for IPQ5018 PHYGeorge Moussalem
Acquire and enable the RX and TX clocks for the IPQ5018 PHY. These clocks are required for the PHY's datapath to function correctly. Signed-off-by: George Moussalem <george.moussalem@outlook.com> Link: https://patch.msgid.link/20260608-ipq5018-gephy-clocks-v4-4-fb2ccd56894b@outlook.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11net: fec: remove reference to nonexistent CONFIG_GILBARCONAP optionEthan Nelson-Moore
The CONFIG_GILBARCONAP option has never been defined by the kernel, but is referred to by drivers/net/ethernet/freescale/fec_main.c. Remove this reference to eliminate dead code. Discovered while searching for CONFIG_* symbols referenced in code but not defined in any Kconfig file. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Reviewed-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260609045200.32606-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11net: pfcp: allocate per-cpu tstats for PFCP netdevsSamuel Moelius
PFCP uses dev_get_tstats64() as its ndo_get_stats64 callback, but pfcp_link_setup() does not request NETDEV_PCPU_STAT_TSTATS. The net core therefore leaves dev->tstats NULL for PFCP devices. Creating a PFCP rtnetlink device can immediately ask the new netdev for stats while building the RTM_NEWLINK notification. That reaches dev_get_tstats64() and dereferences the NULL dev->tstats pointer. Set pcpu_stat_type to NETDEV_PCPU_STAT_TSTATS during PFCP link setup so the net core allocates the storage expected by dev_get_tstats64(). Fixes: 76c8764ef36a ("pfcp: add PFCP module") Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com> Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com> Link: https://patch.msgid.link/20260609232244.1602027.c569f6c530f6.pfcp-missing-tstats-link-create-oops@trailofbits.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11bnx2x: fix resource leaks in bnx2x_init_one() error pathsHaoxiang Li
bnx2x_init_one() falls through to the common memory cleanup path for several failures after probe has already acquired additional resources. If register_netdev() fails after bnx2x_set_int_mode(), MSI/MSI-X remains enabled. If later failures happen after bnx2x_iov_init_one(), PF SR-IOV state can be left allocated. Also, failures after bnx2x_vfpf_acquire() must release the PF resources before freeing the VF-PF mailbox allocated by bnx2x_vf_pci_alloc(). Add error labels matching the resource acquisition order so probe failure disables MSI/MSI-X, removes SR-IOV state, releases VF-PF resources, deallocates VF PCI resources, and then frees the common driver memory. Also clear PCI drvdata before freeing the netdev on probe failure. Cc: stable+noautosel@kernel.org # untested fix to unlikely error path Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260609074610.1968721-1-lihaoxiang@isrc.iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11net: dsa: qca8k: fix led devicename when using external mdio busGeorge Moussalem
The qca8k dsa switch can use either an external or internal mdio bus. This depends on whether the mdio node is defined under the switch node itself. Upon registering the internal mdio bus, the internal_mdio_bus of the dsa switch is assigned to this bus. When an external mdio bus is used, the driver still uses the internal_mdio_bus id which is used to create the device names of the leds. This leads to the leds being prefixed with '(efault)' as the internal_mii_bus is null. So let's fix this by adding a null check and use the devicename of the external bus instead when an external bus is configured. Fixes: 1e264f9d2918 ("net: dsa: qca8k: add LEDs basic support") Signed-off-by: George Moussalem <george.moussalem@outlook.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260608-qca8k-leds-fix-v3-1-a915bb2f37ae@outlook.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.1-rc8). Conflicts: drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c f67aead16e85 ("net: txgbe: rework service event handling") 57d39faed4c9 ("net: txgbe: improve functions of AML 40G devices") net/rds/info.c 512db8267b73 ("rds: mark snapshot pages dirty in rds_info_getsockopt()") 6e94eeb2a2a6 ("rds: convert to getsockopt_iter") Adjacent changes: include/net/sock.h 1ee90b77b727 ("net: guard timestamp cmsgs to real error queue skbs") f0de88303d5e ("net: make is_skb_wmem() available to modules") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-11octeontx2-af: fix IP fragment flag corruption on custom KPU profile loadKiran Kumar K
npc_cn20k_apply_custom_kpu() overwrites KPU profile entries with custom firmware values and then calls npc_cn20k_update_action_entries_n_flags() over all entries. Since the same function already ran during default profile initialisation, entries not overridden by the custom firmware get their flags translated twice, corrupting the CN20K-specific values. Fix this by extracting the per-entry translation into a helper npc_cn20k_translate_action_flags() and calling it as each custom entry is loaded, removing the redundant batch call at the end. Fixes: ef992a0f12e8 ("octeontx2-af: npc: cn20k: MKEX profile support") Cc: Suman Ghosh <sumang@marvell.com> Signed-off-by: Kiran Kumar K <kirankumark@marvell.com> Signed-off-by: Nitin Shetty J <nshettyj@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260608095455.1499203-1-nshettyj@marvell.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: txgbe: initialize PHY interface to 0Jiawen Wu
DECLARE_PHY_INTERFACE_MASK() does not guarantee zeroed contents. Add a new macro DECLARE_PHY_INTERFACE_MASK_ZERO(), make the stack variable to be zeroed before setting supported interfaces. Fixes: 57d39faed4c9 ("net: txgbe: improve functions of AML 40G devices") Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com> Link: https://patch.msgid.link/20260608070842.36504-4-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: txgbe: distinguish module types by checking identifierJiawen Wu
Rework txgbe_identify_module() to validate module identifiers through explicit type checks instead of relying on transceiver_type heuristics. When using the SFP module, transceiver_type could be a random value, because it was read from an invalid register. Fixes: 57d39faed4c9 ("net: txgbe: improve functions of AML 40G devices") Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com> Link: https://patch.msgid.link/20260608070842.36504-3-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: txgbe: initialize module info bufferJiawen Wu
The module info buffer should be initialized to 0 before the firmware returns information. Otherwise, there is a risk that the buffer field not filled by the firmware is random value. Fixes: 343929799ace ("net: txgbe: Support to handle GPIO IRQs for AML devices") Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com> Link: https://patch.msgid.link/20260608070842.36504-2-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: mvpp2: build skb from XDP-adjusted data on XDP_PASSTil Kaiser
When an XDP program uses bpf_xdp_adjust_head() or bpf_xdp_adjust_tail() and then returns XDP_PASS, mvpp2 still builds the skb from fixed offsets derived from the original RX descriptor. Packet geometry changes made by the XDP program are therefore discarded before the skb reaches the stack. Update rx_offset and rx_bytes from xdp.data and xdp.data_end for XDP_PASS. This makes skb_reserve() and skb_put() reflect the packet seen by XDP, and makes RX byte accounting for XDP_PASS follow the length of the skb passed to the network stack. Keep a separate rx_sync_size for page-pool recycling on skb allocation failure, which must stay tied to the received buffer range. Non-PASS verdicts continue to account the descriptor length because no skb is passed up in those cases. Fixes: 07dd0a7aae7f ("mvpp2: add basic XDP support") Signed-off-by: Til Kaiser <mail@tk154.de> Link: https://patch.msgid.link/20260607134943.21996-5-mail@tk154.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: mvpp2: refill RX buffers before XDP or skb useTil Kaiser
The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have recycled, redirected, or queued the page for XDP_TX, and an skb free also retires the data buffer. Returning such a buffer to BM lets hardware DMA into memory that is no longer owned by the RX ring. Refill the BM pool before handing the current buffer to XDP or to the skb. If the allocation fails there, drop the packet and return the still-owned current buffer to BM, preserving the pool depth. Once the refill succeeds, later local drops retire/free the current buffer instead of returning it to BM. Fixes: 07dd0a7aae7f ("mvpp2: add basic XDP support") Fixes: d6526926de73 ("net: mvpp2: fix memory leak in mvpp2_rx") Signed-off-by: Til Kaiser <mail@tk154.de> Link: https://patch.msgid.link/20260607134943.21996-4-mail@tk154.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: mvpp2: limit XDP frame size to the RX bufferTil Kaiser
mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising PAGE_SIZE for short buffers can let bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting memory or later tripping skb tailroom checks. Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches the actual buffer backing the packet. Fixes: 07dd0a7aae7f ("mvpp2: add basic XDP support") Signed-off-by: Til Kaiser <mail@tk154.de> Link: https://patch.msgid.link/20260607134943.21996-3-mail@tk154.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-11net: mvpp2: sync RX data at the hardware packet offsetTil Kaiser
mvpp2 programs the RX queue packet offset, so hardware writes received data at dma_addr + MVPP2_SKB_HEADROOM. The current CPU sync starts at dma_addr and only covers rx_bytes + MVPP2_MH_SIZE bytes, which syncs the unused headroom and misses the same number of bytes at the packet tail. On non-coherent DMA systems this can leave the CPU reading stale cache contents for the end of the received frame. Use dma_sync_single_range_for_cpu() with MVPP2_SKB_HEADROOM as the range offset so the sync covers the Marvell header and packet data actually written by hardware. Fixes: e1921168bbd4 ("mvpp2: sync only the received frame") Signed-off-by: Til Kaiser <mail@tk154.de> Link: https://patch.msgid.link/20260607134943.21996-2-mail@tk154.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-06-10net: dsa: yt921x: Add ACL supportDavid Yang
Enable filtering of incoming traffics. Note that custom filters are yet to be utilized, and thus not all flow dissectors are implemented. Tested-by: hong son Nguyen <hongson.hn@gmail.com> Signed-off-by: David Yang <mmyangfl@gmail.com> Link: https://patch.msgid.link/20260606130011.307812-3-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-10Merge tag 'wireless-next-2026-06-10' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Quite a few last updates, notably: - b43: new support for an 11n device - mt76: - mt792x broken usb transport detection - mt7921 regd improvements - mt7927 support - iwlwifi: - more kunit tests - FW version updates - ath12k: WDS support - rtw89: - RTL8922AU support - USB 3 mode switch for performance - better monitor radiotap support - RTL8922DE preparations - cfg80211/mac80211: - update UHR to D1.4, UHR DBE support - finally remove 5/10 MHz support - S1G rate reporting - multicast encapsulation offload * tag 'wireless-next-2026-06-10' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (285 commits) b43: add RF power offset for N-PHY r8 + radio 2057 r8 b43: add channel info table for N-PHY r8 + radio 2057 r8 b43: add IPA TX gain table for N-PHY r8 + radio 2057 r8 b43: support radio 2057 rev 8 b43: route d11 corerev 22 to 24-bit indirect radio access b43: add d11 core revision 0x16 to id table b43: add firmware mappings for rev22 rfkill: Replace strcpy() with memcpy() wifi: brcmfmac: flowring: simplify flow allocation wifi: brcm80211: change current_bss to value wifi: ath12k: enable IEEE80211_VHT_EXT_NSS_BW_CAPABLE when NSS ratio is reported wifi: ath12k: fix EAPOL TX failure caused by stale tcl_metadata bits wifi: ath: Update copyright in testmode_i.h wifi: ath10k: Update Qualcomm copyrights wifi: ath11k: Update Qualcomm copyrights wifi: ath12k: Update Qualcomm copyrights wifi: mt76: Drop unneeded mt76_register_debugfs_fops() return checks wifi: mt76: mt7921: assert sniffer on chanctx change wifi: mt76: mt7996: fix potential tx_retries underflow wifi: mt76: mt7925: fix potential tx_retries underflow ... ==================== Link: https://patch.msgid.link/20260610103637.179340-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-10bonding: 3ad: fix mux port state on oper downLouis Scalbert
When the bonding interface has carrier down due to the absence of usable slaves and a slave transitions from down to up, the bonding interface briefly goes carrier up, then down again, and finally up once LACP negotiates collecting and distributing on the port. When lacp_strict mode is on, the interface should not transition to carrier up until LACP negotiation is complete. This happens because the actor and partner port states remain in Collecting_Distributing when the port goes down. When the port comes back up, it temporarily remains in this state until LACP renegotiation occurs. Previously this was mostly cosmetic, but since the bonding carrier state may depend on the LACP negotiation state, it causes the interface to flap. According to IEEE 802.3ad-2000 and IEEE 802.1ax-2014, Collecting and Distributing should be reset when a port goes down: - In the Receive state machine, port_enabled == FALSE causes a transition to the PORT_DISABLED state, which is expected to clear Partner_Oper_Port_State.Synchronization. - In the Mux state machine, Partner_Oper_Port_State.Synchronization == FALSE causes a transition to the ATTACHED state, which disables Collecting and Distributing. However, Partner_Oper_Port_State.Synchronization is not cleared in the PORT_DISABLED state. Clear Partner_Oper_Port_State.Synchronization in the Receive PORT_DISABLED state. Fixes: 655f8919d549 ("bonding: add min links parameter to 802.3ad") Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com> Acked-by: Jay Vosburgh <jv@jvosburgh.net> Link: https://patch.msgid.link/20260603150331.1919611-6-louis.scalbert@6wind.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-10bonding: 3ad: fix carrier when no usable slavesLouis Scalbert
Apply the "lacp_strict" configuration from the previous commit. "lacp_strict" mode "on" asserts that the bonding master carrier is up only when at least 'min_links' slaves are in the Collecting_Distributing state. Fixes: 655f8919d549 ("bonding: add min links parameter to 802.3ad") Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com> Acked-by: Jay Vosburgh <jv@jvosburgh.net> Link: https://patch.msgid.link/20260603150331.1919611-5-louis.scalbert@6wind.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-10bonding: 3ad: add lacp_strict configuration knobLouis Scalbert
When an 802.3ad (LACP) bonding interface has no slaves in the collecting/distributing state, the bonding master still reports carrier as up as long as at least 'min_links' slaves have carrier. In this situation, only one slave is effectively used for TX/RX, while traffic received on other slaves is dropped. Upper-layer daemons therefore consider the interface operational, even though traffic may be blackholed if the lack of LACP negotiation means the partner is not ready to deal with traffic. Introduce a configuration knob to control this behavior. It allows the bonding master to assert carrier only when at least 'min_links' slaves are in Collecting_Distributing state. The default mode preserves the existing behavior. This patch only introduces the knob; its behavior is implemented in the subsequent commit. Fixes: 655f8919d549 ("bonding: add min links parameter to 802.3ad") Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com> Acked-by: Jay Vosburgh <jv@jvosburgh.net> Link: https://patch.msgid.link/20260603150331.1919611-4-louis.scalbert@6wind.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-10b43: add RF power offset for N-PHY r8 + radio 2057 r8Alessio Ferri
Add the 2.4 GHz RF power offset table for N-PHY rev 8 paired with radio 2057 rev 8 and wire it to the existing dispatcher. b43_ntab_get_rf_pwr_offset_table() currently dispatches on phy->rev == 17 (radio_rev 14) and phy->rev == 16 (radio_rev 9) for 2.4 GHz. phy->rev == 8 falls through and the function logs: b43-phyX ERROR: No 2GHz RF power table available for this device Add a phy->rev == 8 / radio_rev == 8 case returning the new table. The values are sourced from the proprietary Broadcom wl driver's nphy_papd_padgain_dlt_2g_2057rev5 array. Reusing the rev 5 values is structurally appropriate: the IPA TX gain table added by the preceding patch in this series shares the low 24 bits of every entry with rev 5 - same gain step amplitudes, only the PAD-gain selector byte differs. b43's pad_gain extraction in b43_nphy_tx_pwr_ctl_init() reads bits 19..23 of the gain entry, which sit in the shared low-24-bit range; the same gain index therefore maps to the same physical PAD gain code on both revisions and warrants the same per-index dB offset. Note that b43_nphy_tx_gain_table_upload() currently has a "TODO: Enable this once we have gains configured" early-return for phy->rev >= 7. With that early-return in place, this table is fetched (silencing the b43err that would otherwise abort PHY init) but its values are not yet written to MMIO. Resolving the TODO is a future, separate task. Assisted-by: Claude:claude-4.7-opus Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it> Acked-by: Michael Büsch <m@bues.ch> Reviewed-by: Joshua Peisach <jpeisach@ubuntu.com> Link: https://patch.msgid.link/20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-7-464566194d47@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-10b43: add channel info table for N-PHY r8 + radio 2057 r8Alessio Ferri
Add the 2.4 GHz channel info table for N-PHY rev 8 paired with radio 2057 rev 8 and wire it to the existing dispatcher in r2057_get_chantabent_rev7(). The dispatcher's case 8 currently handles radio_rev == 5 only. For radio_rev == 8 both output pointers stay NULL, b43_nphy_set_channel() returns an error and channel switch to the default channel fails. The new b43_nphy_chantab_phy_rev8_radio_rev8[] is 14 entries covering the standard 2.4 GHz channel set (2412..2472 in 5 MHz steps, plus 2484 for channel 14). Values extracted from an MMIO dump of the proprietary Broadcom wl driver running on BCM6362 silicon (wl driver 6.30.102.7). Assisted-by: Claude:claude-4.7-opus Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it> Acked-by: Michael Büsch <m@bues.ch> Reviewed-by: Joshua Peisach <jpeisach@ubuntu.com> Link: https://patch.msgid.link/20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-6-464566194d47@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-10b43: add IPA TX gain table for N-PHY r8 + radio 2057 r8Alessio Ferri
Add the 2.4 GHz IPA TX gain table for N-PHY rev 8 paired with radio 2057 rev 8 and wire it to the existing dispatcher. b43_nphy_get_ipa_gain_table() in tables_nphy.c currently handles case 8 only for radio_rev == 5; radio_rev == 8 falls through and the function logs: b43-phyX ERROR: No 2GHz IPA gain table available for this device b43-phyX ERROR: PHY init: Channel switch to default failed leaving b43_phy_init() to return an error and core_init to abort before the MAC is enabled. The high byte of every entry differs from the rev 5 sibling (0x40 vs 0x30): different PAD-gain code prefix for the rev 8 front-end. The low 24 bits coincide with rev 5 across the whole table - the gain step amplitudes are the same, only the PAD-gain selector prefix changes. Values extracted from an MMIO dump of the proprietary Broadcom wl driver running on BCM6362 silicon (wl driver 6.30.102.7). Assisted-by: Claude:claude-4.7-opus Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it> Acked-by: Michael Büsch <m@bues.ch> Reviewed-by: Joshua Peisach <jpeisach@ubuntu.com> Link: https://patch.msgid.link/20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-5-464566194d47@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-10b43: support radio 2057 rev 8Alessio Ferri
Add support for radio 2057 revision 8, paired with N-PHY rev 8 on the Broadcom BCM6362 single-die integrated 2.4 GHz wireless block. Three correlated changes are needed for the same chip: - main.c: the radio_rev allow-list under B43_PHYTYPE_N currently accepts radio 2057 revisions 9 and 14 only; extend to include rev 8. - radio_2057.c: the existing r2057_rev8_init[] is a 54-entry stub declared inside a TODO comment block and never referenced from r2057_upload_inittabs(). Replace it with the full 412-entry register set actually programmed by the proprietary Broadcom wl driver on this radio. I couldn't find the origin of the original 54-entry stub - 8 of its entries do not appear at all in the rev 8 register set and 7 more carry different values. Loading it instead of using the real table leaves the radio hanging producing a "Microcode not responding" timeout. - radio_2057.c: r2057_upload_inittabs() case 8 handles radio_rev 5 and 7 only; add the radio_rev == 8 branch pointing at the new table. The init table is extracted from an MMIO dump of the radio register set programmed during proprietary driver initialisation on BCM6362 silicon (Broadcom wl driver 6.30.102.7). Assisted-by: Claude:claude-4.7-opus Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it> Acked-by: Michael Büsch <m@bues.ch> Reviewed-by: Joshua Peisach <jpeisach@ubuntu.com> Link: https://patch.msgid.link/20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-4-464566194d47@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-10b43: route d11 corerev 22 to 24-bit indirect radio accessAlessio Ferri
Rev 22 backports the older 802.11 core but pairs it with a radio in the 2057 family, which requires the 24-bit indirect path. With the current dispatch, corerev 22 falls into the legacy 4-wire branch, reads garbage for radio_id, and bails out with -EOPNOTSUPP at the "FOUND UNSUPPORTED RADIO" branch below. brcmsmac handles the same silicon family with the equivalent dispatch in drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/ phy_cmn.c read_radio_reg() and write_radio_reg(): if ((D11REV_GE(pi->sh->corerev, 24)) || (D11REV_IS(pi->sh->corerev, 22) && (pi->pubpi.phy_type != PHY_TYPE_SSN))) { /* radioregaddr / radioregdata (indirect) */ } else { /* phy4waddr / phy4wdatalo (legacy) */ } b43 does not support SSN/SSLPN PHYs - they are rejected earlier in b43_phy_versioning() at the "unsupported PHY type" switch - so just adding the check corerev == 22 will do. Assisted-by: Claude:claude-4.7-opus Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it> Acked-by: Michael Büsch <m@bues.ch> Reviewed-by: Joshua Peisach <jpeisach@ubuntu.com> Link: https://patch.msgid.link/20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-3-464566194d47@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-10b43: add d11 core revision 0x16 to id tableAlessio Ferri
Add d11 core revision 0x16 (= 22) to the b43 bcma device id table. The b43 bcma id table covers d11 revisions 0x11, 0x15, 0x17, 0x18, 0x1C, 0x1D, 0x1E, 0x28 and 0x2A. Revision 0x16 belongs to the same N-PHY family as revisions 0x17 and 0x18 (radio 2057) and needs no new PHY or radio code beyond the radio_rev 8 dispatcher entries added later in this series - only the device id entry is missing. Without it bcma scan enumerates the 802.11 core but no driver binds. The revision is used by the Broadcom BCM6362 single-die integrated 2.4 GHz wireless block found in xDSL SoCs. Assisted-by: Claude:claude-4.7-opus Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it> Acked-by: Michael Büsch <m@bues.ch> Reviewed-by: Joshua Peisach <jpeisach@ubuntu.com> Link: https://patch.msgid.link/20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-2-464566194d47@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-10b43: add firmware mappings for rev22Alessio Ferri
add the specific firmware mappings for rev22, and drop comments wondering about rev22 initvals Assisted-by: Claude:claude-4.7-opus Signed-off-by: Alessio Ferri <alessio.ferri@mythread.it> Acked-by: Michael Büsch <m@bues.ch> Reviewed-by: Joshua Peisach <jpeisach@ubuntu.com> Link: https://patch.msgid.link/20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-1-464566194d47@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-10wifi: brcmfmac: flowring: simplify flow allocationRosen Penev
Use a flexible array member and kzalloc_flex to combine allocations. Simplifies code slightly. Add __counted_by for extra runtime analysis. Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260608051102.6698-1-rosenp@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-10wifi: brcm80211: change current_bss to valueRosen Penev
Change to a single allocation and remove some boilerplate. Signed-off-by: Rosen Penev <rosenp@gmail.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260608052854.11718-1-rosenp@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-10Merge tag 'ath-next-20260609' of ↵Johannes Berg
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v7.2 (PR #4) An assortment of cleanups and minor bug fixes across wcn36xx, ath9k, ath10k, ath11k, and ath12k. ================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-10can: virtio: Add virtio CAN driverMatias Ezequiel Vara Larsen
Add virtio CAN driver based on Virtio 1.4 specification (see https://github.com/oasis-tcs/virtio-spec/tree/virtio-1.4). The driver implements a complete CAN bus interface over Virtio transport, supporting both CAN Classic and CAN-FD Ids. In term of frames, it supports classic and CAN FD. RTR frames are only supported with classic CAN. Usage: - "ip link set up can0" - start controller - "ip link set down can0" - stop controller - "candump can0" - receive frames - "cansend can0 123#DEADBEEF" - send frames Signed-off-by: Harald Mommer <harald.mommer@oss.qualcomm.com> Co-developed-by: Harald Mommer <harald.mommer@oss.qualcomm.com> Signed-off-by: Mikhail Golubev-Ciuchea <mikhail.golubev-ciuchea@oss.qualcomm.com> Co-developed-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Cc: Damir Shaikhutdinov <Damir.Shaikhutdinov@opensynergy.com> Reviewed-by: Francesco Valla <francesco@valla.it> Tested-by: Francesco Valla <francesco@valla.it> Signed-off-by: Matias Ezequiel Vara Larsen <mvaralar@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <ahXNb+KzuHYbS24+@fedora>
2026-06-09net: dsa: realtek: rtl8365mb: add bridge port flagsLuiz Angelo Daros de Luca
Implement support for bridge port flags to control learning and flooding behavior. This patch maps hardware functionalities to the following bridge flags: - BR_LEARNING - BR_FLOOD - BR_MCAST_FLOOD - BR_BCAST_FLOOD By default, all flooding types are enabled during port setup to ensure standard bridge behavior. Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-9-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: realtek: rtl8365mb: add port_bridge_{join,leave}Alvin Šipraga
Implement hardware offloading of bridge functionality. This is achieved by using the per-port isolation registers, which contain a forwarding port mask. The switch will refuse to forward packets ingressed on a given port to a port which is not in its forwarding mask. For each bridge that is offloaded, use the DSA-provided bridge number for the Extended Filtering ID (EFID). When using Independent VLAN Learning (IVL), the forwarding database is keyed with the tuple {VID, MAC, EFID}. There are 8 EFIDs available (0~7), but we reserve the default EFID 0 for standalone ports where learning is disabled. This fits nicely because DSA indexes the bridge number starting from 1. Because of the limited number of EFIDs, we have to set the max_num_bridges property of our switch to 7: we can't offload more than that or we will fail to offer IVL as at least two bridges would end up having to share an EFID. All ports start isolated, forwarding exclusively to CPU ports, and with VLAN transparent, ignoring VLAN membership. Once a member in a bridge, the port isolation is expanded to include the bridge members. When that bridge enables VLAN filtering, the VLAN transparent feature is disabled, letting the switch filter based on VLAN setup. Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Co-developed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-8-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: realtek: rtl8365mb: add FDB supportAlvin Šipraga
Implement support for FDB and MDB management for the RTL8365MB series switches. The hardware supports IVL by keying the unicast forwarding database with the {MAC, VID, EFID} tuple. The Extended Filtering ID (EFID) is 3 bits wide, providing 8 unique filtering domains. This driver reserves EFID 0 for standalone ports, effectively limiting the hardware offload to a maximum of 7 bridges. The multicast database uses a {MAC, VID} key, with ports from different bridges sharing the same multicast group. Introduce a mutex lock (l2_lock) to protect concurrent L2 table updates. Add support for forwarding database operations, including unicast and multicast entry handling as well as fast aging support. Set DSA switch flags assisted_learning_on_cpu_port and fdb_isolation. Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Co-developed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-7-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: realtek: rtl8365mb: add VLAN supportAlvin Šipraga
Realtek RTL8365MB switches (a.k.a. RTL8367C family) use two different structures for VLANs: - VLAN4K: A full table with 4096 entries defining port membership and tagging. - VLANMC: A smaller table with 32 entries used primarily for PVID assignment. In this hardware, a port's PVID must point to an index in the VLANMC table rather than a VID directly. Since the VLANMC table is limited to 32 entries, the driver implements a dynamic allocation scheme to maximize resource usage: - VLAN4K is treated by the driver as the source of truth for membership. - A VLANMC entry is only allocated when a port is configured to use a specific VID as its PVID. - VLANMC entries are deleted when no longer needed as a PVID by any port. Although VLANMC has a members field, the switch only checks membership in the VLAN4K table. This driver will use VLANMC members field as way to track which ports are using that entry as PVID. VLANMC index 0, although a valid entry, is reserved in this driver as a neutral PVID value for ports not using a specific PVID. In the subsequent RTL8367D switch family, VLANMC table was removed and PVID assignment was delegated to a dedicated set of registers. The use of FIELD_PREP for reconstructing LO/HI values was suggested by Yury Norov. Fix for vlan_setup and vlan_filtering was suggested by Abdulkader Alrezej. Suggested-by: Yury Norov <ynorov@nvidia.com> Suggested-by: Abdulkader Alrezej <abdulkader.alrezej@gmail.com> Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Co-developed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-6-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: realtek: rtl8365mb: add table lookup interfaceAlvin Šipraga
Add a generic table lookup interface to centralize access to the RTL8365MB internal tables. This interface abstracts the low-level table access logic and will be used by subsequent commits to implement FDB and VLAN operations. Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Co-developed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-5-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: realtek: rtl8365mb: prepare for multiple source filesAlvin Šipraga
Rename rtl8365mb.c to rtl8365mb_main.c in preparation for subsequent commits which add additional source files to the driver. The trailing backslash in the Makefile is deliberate. It allows for new files to be added without clobbering git history. Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Co-developed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-4-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: realtek: rtl8365mb: use dsa helpers for port iterationLuiz Angelo Daros de Luca
Convert open-coded port iteration loops to use the DSA helpers and restructure rtl8365mb_setup() into clear blocking, user, and CPU port phases. As part of this refactoring, unused ports are explicitly placed into a blocked, isolated state with learning disabled, ensuring safe default hardware behavior. The driver also does not allocate a virtual IRQ mapping for unused ports. To accommodate this, a guard check is added to the interrupt handler (rtl8365mb_irq) to safely skip ports without a valid IRQ mapping. The irq domain teardown, however, does clean all ports as external PHYs may still map the IRQ. Furthermore, since the new initialization loop starts with all ports administratively isolated by default, CPU port forwarding and isolation masks are explicitly configured at the end of the setup phase to prevent egress traffic from being blocked. Suggested-by: Abdulkader Alrezej <abdulkader.alrezej@gmail.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-3-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-09net: dsa: realtek: rtl8365mb: reject unsupported topologiesLuiz Angelo Daros de Luca
Explicitly enforce the presence of a CPU port (-EINVAL) and reject DSA cascade links (-EOPNOTSUPP) during setup to prevent silent failures. These topologies were already non-functional. Without a CPU port, the driver does not activate CPU tagging. Additionally, the switch hardware was not designed to be cascaded, and DSA links never worked because CPU tagging is not enabled for them. Reviewed-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Link: https://patch.msgid.link/20260606-realtek_forward-v13-2-b9e409687cbe@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>