summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)Author
2025-09-08wireguard: kconfig: simplify crypto kconfig selectionsEric Biggers
Simplify the kconfig entry for WIREGUARD: - Drop the selections of the arch-optimized ChaCha20, Poly1305, BLAKE2s, and Curve25519 code. These options no longer exist, as lib/crypto/ now enables the arch-optimized code automatically. - Drop the selection of CRYPTO. This was needed only to make the arch-optimized options visible. lib/crypto/ now handles these options internally, without any dependency on CRYPTO. - Drop the dependency on !KMSAN. This was needed only to avoid selecting arch-optimized code that isn't compatible with KMSAN. lib/crypto/ now handles the !KMSAN dependencies internally. - Add a selection of CRYPTO_LIB_UTILS, since WireGuard directly calls crypto_memneq(). This gets selected indirectly by CRYPTO_LIB_CURVE25519 and CRYPTO_LIB_CHACHA20POLY1305 anyway, but it's best to make this dependency explicit. Link: https://lore.kernel.org/r/20250906213523.84915-13-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-09-07wifi: iwlwifi: Fix dentry reference leak in iwl_mld_add_link_debugfsMiaoqian Lin
The debugfs_lookup() function increases the dentry reference count. Add missing dput() call to release the reference when the "iwlmld" directory already exists. Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin <linmq006@gmail.com> Link: https://patch.msgid.link/20250902040955.2362472-1-linmq006@gmail.com Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2025-09-07wifi: iwlwifi: mei: Remove unused flexible-array member in struct iwl_sap_hdrGustavo A. R. Silva
Remove unused fexible-array member and avoid 14 of the following type of warnings: drivers/net/wireless/intel/iwlwifi/mei/sap.h:318:28: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Link: https://patch.msgid.link/aK6-usANI1UPtFVo@kspp Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2025-09-07wifi: iwlwifi: Remove redundant header filesLiao Yuanhong
The header file "fw/img.h" is already included on line 9. Remove the redundant include. Fixes: 2594e4d9e1a2d ("wifi: iwlwifi: prepare for reading SAR tables from UEFI") Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com> Link: https://patch.msgid.link/20250819121201.608770-2-liaoyuanhong@vivo.com Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2025-09-07wifi: iwlwifi: Remove duplicated include in trans.cYang Li
The header files fw/api/tx.h is included twice in gen1_2/trans.c, so one inclusion of each can be removed. Reported-by: Abaci Robot <abaci@linux.alibaba.com> Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=22932 Signed-off-by: Yang Li <yang.lee@linux.alibaba.com> Link: https://patch.msgid.link/20250723070522.2195817-1-yang.lee@linux.alibaba.com Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2025-09-05net: phy: aquantia: support phy-mode = "10g-qxgmii" on NXP SPF-30841 (AQR412C)Vladimir Oltean
The quad port PHYs (AQR4*) have 4 system interfaces, and some of them, like AQR412C, can be used with a special firmware provisioning which multiplexes all ports over a single host-side SerDes lane. The protocol used over this lane is Cisco 10G-QXGMII feature, or "MUSX", as Aquantia seems to call it. One such example is the AQR412C PHY from the NXP SPF-30841 10G-QXGMII add-in card, which uses this firmware file: https://github.com/nxp-qoriq/qoriq-firmware-aquantia/blob/master/AQR-G3_v4.3.C-AQR_NXP_SPF-30841_MUSX_ID40019_VER1198.cld There seems to be no disagreement, including from Marvell FAE, that 10G-QXGMII is reported to the host over MDIO as USXGMII and indistinguishable from it. This includes the registers from the provisioning based on which the firmware configures a single system interface (lane C in the case of SPF-30841) to multiplex all ports - they are also only accessible from the firmware, or over I2C (?!). However, the Linux MAC and especially SerDes drivers may need to know if it is using 1 port per lane (USXGMII) or 4 ports per lane (10G-QXGMII). In the downstream Layerscape SDK we have previously implemented a simpler scheme where for certain PHY interface modes, we trust the device tree and never let the PHY driver overwrite phydev->interface: https://github.com/nxp-qoriq/linux/commit/862694a4961db590c4d8a5590b84791361ca773d but for upstream, a nicer detection method is implemented, where although we can not distinguish USXGMII from 10G-QXGMII per se, we create a whitelist of firmware fingerprints for which USXGMII is translated into 10G-QXGMII. At the time of writing, it is expected that this should only happen for the NXP SPF-30841 card, although extending for more is trivial - just uncomment the phydev_dbg() in aqr_build_fingerprint(). An advantage of this method is that it doesn't strictly require updates to arch/arm64/boot/dts/freescale/fsl-ls1028a-qds-13bb.dtso, since the PHY driver will transition from "usxgmii" to "10g-qxgmii". All aqr_translate_interface() callers have also previously called aqr107_probe(), so dereferencing phydev->priv is safe. Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Link: https://patch.msgid.link/20250903130730.2836022-7-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-05net: phy: aquantia: create and store a 64-bit firmware image fingerprintVladimir Oltean
Some PHY features cannot be queried through MDIO registers and require alternative driver detection methods. One such feature is 10G-QXGMII (4 ports of up to 2.5G multiplexed over a single SerDes lane), or "MUSX" as it is called by Aquantia/Marvell. The firmware has provisioning to modify some registers which seem inaccessible for read or write over MDIO, which configure an internal mux for MUSX. To the host, over MDIO, the system interface appears indistinguishable from single-port-per-lane USXGMII. Marvell FAE Ziang You recommended a detection method for this feature based on a tuple which should hopefully identify the firmware build uniquely. Most of the tuple items are already printed by aqr107_chip_info(), and an extra set is the misc ID (reg 1.c41d) and the misc version (reg 1.c41e). These are auto-generated by the Marvell firmware tool for formal builds, and should be unique (not my claim). In addition, at least for the builds provided to NXP and redistributed here: https://github.com/nxp-qoriq/qoriq-firmware-aquantia/tree/master these registers are part of the name, for example in AQR-G3_v4.3.C-AQR_NXP_SPF-30841_MUSX_ID40019_VER1198.cld, reg 1.c41d will contain 40019 and reg 1.c41e will contain 1198. Note that according to commit 43429a0353af ("net: phy: aquantia: report PHY details like firmware version"), the "chip may be functional even w/o firmware image." In that case, we can't construct a fingerprint and it will remain zero. That shouldn't imact the use case though. Dereferencing phydev->priv should be ok in all cases: all aqr_gen1_config_init() callers have also previously called aqr107_probe(). Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Link: https://patch.msgid.link/20250903130730.2836022-6-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-05net: phy: aquantia: report and configure in-band autoneg capabilitiesVladimir Oltean
The Global System Configuration registers for each media side link speed have bit 3 which controls auto-negotiation for the system interface. Since bits 2:0 of the same register indicate the SerDes protocol for the same system interface, it makes sense to filter these registers for the SerDes protocol matching phydev->interface, and to read/write the auto-negotiation bit. However, experimentally, USXGMII in-band auto-negotiation is unaffected by this bit, and instead reacts to bit 3 of register 4.C441 (PHY XS Transmit Reserved Vendor Provisioning 2). Both the Global System Configuration as well as the aforementioned register 4.C441 are documented as PD (Provisioning Defaults), i.e. each PHY firmware may provision its own values. I was initially planning to only read these values and not support changing them (instead just the MAC PCS reconfigures itself, if it can). But there is one problem: Linux expects that the in-band capability is configured the same for all speeds where a given SerDes protocol is used. I was going to add logic that detects mismatched vendor provisioning (in-band autoneg enabled for speed X, disabled for speed Y) and warn about it and return 0 (unknown capabilities). Funnily enough, there is already a known instance where speed 2500 has "autoneg 1" and the lower speeds have "autoneg 0": https://lore.kernel.org/netdev/aJH8n0zheqB8tWzb@FUE-ALEWI-WINX/ I don't think it's worth fighting the battle with inconsistent firmware images built by Aquantia/Marvell, and reporting that to the user, when we have the ability to modify these fields to values that make sense to us. We see the same situation with all the aqr*_get_features() functions which fix up nonsensical supported link modes. Furthermore, altering the in-band auto-negotiation setting can be considered a minor change, compared to changing the SerDes protocol in its entirety, for which we are still not prepared. Testing was done on: - AQR107 (Gen2) in USXGMII mode, as found on the NXP LX2160A-RDB. - AQR112 (Gen3) in USXGMII mode, as found on the NXP SCH-30842 riser card, plugged into LS1028A-QDS. - AQR412C (Gen3) in 10G-QXGMII mode, as found on the NXP SCH-30841 riser card, plugged into the LS1028A-QDS. - AQR115 (Gen4) in SGMII mode, as found on the NXP LS1046A-RDB rev E. Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Link: https://patch.msgid.link/20250903130730.2836022-5-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-05net: phy: aquantia: print global syscfg registersVladimir Oltean
Sometimes people with unknown firmware provisioning post on the mailing lists asking for support. The information collected by aqr_gen2_read_global_syscfg() is sufficiently important to warrant a phydev_dbg() that can easily be turned into a verbose print by the system owner in case some debugging is needed. Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Link: https://patch.msgid.link/20250903130730.2836022-4-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-05net: dsa: felix: support phy-mode = "10g-qxgmii"Vladimir Oltean
The "usxgmii" phy-mode that the Felix switch ports support on LS1028A is not quite USXGMII, it is defined by the USXGMII multiport specification document as 10G-QXGMII. It uses the same signaling as USXGMII, but it multiplexes 4 ports over the link, resulting in a maximum speed of 2.5G per port. This change is needed in preparation for the lynx-10g SerDes driver on LS1028A, which will make a more clear distinction between usxgmii (supported on lane 0) and 10g-qxgmii (supported on lane 1). These protocols have their configuration in different PCCR registers (PCCRB vs PCCR9). Continue parsing and supporting single-port-per-lane USXGMII when found in the device tree as usual (because it works), but add support for 10G-QXGMII too. Using phy-mode = "10g-qxgmii" will be required when modifying the device trees to specify a "phys" phandle to the SerDes lane. The result when the "phys" phandle is present but the phy-mode is wrong is undefined. The only PHY driver in known use with this phy-mode, AQR412C, will gain logic to transition from "usxgmii" to "10g-qxgmii" in a future change. Prepare the driver by also setting PHY_INTERFACE_MODE_10G_QXGMII in supported_interfaces when PHY_INTERFACE_MODE_USXGMII is there, to prevent breakage with existing device trees. Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Link: https://patch.msgid.link/20250903130730.2836022-3-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-05net: pcs: lynx: support phy-mode = "10g-qxgmii"Vladimir Oltean
This is a SerDes protocol with 4 ports multiplexed over a single SerDes lane, each port capable of 10/100/1000/2500. It is used on LS1028A lane 1, connected to the 4 switch ports. Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Link: https://patch.msgid.link/20250903130730.2836022-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-05net: stmmac: intel: only populate plat->crosststamp when supportedRussell King (Oracle)
To allow the ptp_chardev code to correctly detect whether crosststamps are supported, we need to conditionally populate the .getcrosststamp() method. As the previous patch implements that functionality by detecting whether the platform glue provides a crosststamp() method, arrange for the dwmac-intel code to only populate this if the X86 ART feature is present, rather than testing for it at runtime in intel_crosststamp(). This reflects what other x86 PTP clock drivers do, e.g. ice_ptp_set_funcs_e830(), e1000e_ptp_init(), idpf_ptp_set_caps() etc. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1uto2i-00000001seA-0lxv@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-05net: stmmac: ptp: conditionally populate getcrosststamp() methodRussell King (Oracle)
drivers/char/ptp_chardev.c::ptp_clock_getcaps() uses the presence of the getcrosststamp() method to indicate to userspace whether crosststamping is supported or not. Therefore, we should not provide this method unless it is functional. Only set this method pointer in stmmac_ptp_register() if the platform glue provides the necessary functionality. This does not mean that it will be supported (see intel_crosststamp(), which is the only implementation that may have support) but at least we won't be suggesting that it is supported on many platforms where there is no hope. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1uto2d-00000001se4-0JSY@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-05net: fman: clean up included headersHeiner Kallweit
Both headers aren't used in this source code file. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/a6c502bc-1736-4bab-98dc-7e194d490c19@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-05sh_eth: Use async pm_runtime_put()Geert Uytterhoeven
There is no stringent need to power down the device immediately after a register read, or after a failed open. Relax power down handling by replacing calls to synchronous pm_runtime_put_sync() by calls to asynchronous pm_runtime_put(). Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Tested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Link: https://patch.msgid.link/77562617360e30a47746e53e392905ea312a2f97.1756998732.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-05sh_eth: Convert to DEFINE_SIMPLE_DEV_PM_OPS()Geert Uytterhoeven
Convert the Renesas SuperH Ethernet driver from an open-coded dev_pm_ops structure to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the checks for CONFIG_PM and CONFIG_PM_SLEEP without impacting code size, while increasing build coverage. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Tested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Link: https://patch.msgid.link/ee4def57eb68dd2c32969c678ea916d2233636ed.1756998732.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-05sh_eth: Remove dummy Runtime PM callbacksGeert Uytterhoeven
Since commit 63d00be69348fda4 ("PM: runtime: Allow unassigned ->runtime_suspend|resume callbacks"), unassigned .runtime_{suspend,resume}() callbacks are treated the same as dummy callbacks that just return zero. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Tested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Link: https://patch.msgid.link/ab2a8bb51eb7d02426f4072c27523c8f41ac1ad4.1756998732.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-05net: phy: transfer phy_config_inband() locking responsibility to phylinkVladimir Oltean
Problem description =================== Lockdep reports a possible circular locking dependency (AB/BA) between &pl->state_mutex and &phy->lock, as follows. phylink_resolve() // acquires &pl->state_mutex -> phylink_major_config() -> phy_config_inband() // acquires &pl->phydev->lock whereas all the other call sites where &pl->state_mutex and &pl->phydev->lock have the locking scheme reversed. Everywhere else, &pl->phydev->lock is acquired at the top level, and &pl->state_mutex at the lower level. A clear example is phylink_bringup_phy(). The outlier is the newly introduced phy_config_inband() and the existing lock order is the correct one. To understand why it cannot be the other way around, it is sufficient to consider phylink_phy_change(), phylink's callback from the PHY device's phy->phy_link_change() virtual method, invoked by the PHY state machine. phy_link_up() and phy_link_down(), the (indirect) callers of phylink_phy_change(), are called with &phydev->lock acquired. Then phylink_phy_change() acquires its own &pl->state_mutex, to serialize changes made to its pl->phy_state and pl->link_config. So all other instances of &pl->state_mutex and &phydev->lock must be consistent with this order. Problem impact ============== I think the kernel runs a serious deadlock risk if an existing phylink_resolve() thread, which results in a phy_config_inband() call, is concurrent with a phy_link_up() or phy_link_down() call, which will deadlock on &pl->state_mutex in phylink_phy_change(). Practically speaking, the impact may be limited by the slow speed of the medium auto-negotiation protocol, which makes it unlikely for the current state to still be unresolved when a new one is detected, but I think the problem is there. Nonetheless, the problem was discovered using lockdep. Proposed solution ================= Practically speaking, the phy_config_inband() requirement of having phydev->lock acquired must transfer to the caller (phylink is the only caller). There, it must bubble up until immediately before &pl->state_mutex is acquired, for the cases where that takes place. Solution details, considerations, notes ======================================= This is the phy_config_inband() call graph: sfp_upstream_ops :: connect_phy() | v phylink_sfp_connect_phy() | v phylink_sfp_config_phy() | | sfp_upstream_ops :: module_insert() | | | v | phylink_sfp_module_insert() | | | | sfp_upstream_ops :: module_start() | | | | | v | | phylink_sfp_module_start() | | | | v v | phylink_sfp_config_optical() phylink_start() | | | phylink_resume() v v | | phylink_sfp_set_config() | | | v v v phylink_mac_initial_config() | phylink_resolve() | | phylink_ethtool_ksettings_set() v v v phylink_major_config() | v phy_config_inband() phylink_major_config() caller #1, phylink_mac_initial_config(), does not acquire &pl->state_mutex nor do its callers. It must acquire &pl->phydev->lock prior to calling phylink_major_config(). phylink_major_config() caller #2, phylink_resolve() acquires &pl->state_mutex, thus also needs to acquire &pl->phydev->lock. phylink_major_config() caller #3, phylink_ethtool_ksettings_set(), is completely uninteresting, because it only calls phylink_major_config() if pl->phydev is NULL (otherwise it calls phy_ethtool_ksettings_set()). We need to change nothing there. Other solutions =============== The lock inversion between &pl->state_mutex and &pl->phydev->lock has occurred at least once before, as seen in commit c718af2d00a3 ("net: phylink: fix ethtool -A with attached PHYs"). The solution there was to simply not call phy_set_asym_pause() under the &pl->state_mutex. That cannot be extended to our case though, where the phy_config_inband() call is much deeper inside the &pl->state_mutex section. Fixes: 5fd0f1a02e75 ("net: phylink: add negotiation of in-band capabilities") Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20250904125238.193990-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-05net: phylink: add lock for serializing concurrent pl->phydev writes with ↵Vladimir Oltean
resolver Currently phylink_resolve() protects itself against concurrent phylink_bringup_phy() or phylink_disconnect_phy() calls which modify pl->phydev by relying on pl->state_mutex. The problem is that in phylink_resolve(), pl->state_mutex is in a lock inversion state with pl->phydev->lock. So pl->phydev->lock needs to be acquired prior to pl->state_mutex. But that requires dereferencing pl->phydev in the first place, and without pl->state_mutex, that is racy. Hence the reason for the extra lock. Currently it is redundant, but it will serve a functional purpose once mutex_lock(&phy->lock) will be moved outside of the mutex_lock(&pl->state_mutex) section. Another alternative considered would have been to let phylink_resolve() acquire the rtnl_mutex, which is also held when phylink_bringup_phy() and phylink_disconnect_phy() are called. But since phylink_disconnect_phy() runs under rtnl_lock(), it would deadlock with phylink_resolve() when calling flush_work(&pl->resolve). Additionally, it would have been undesirable because it would have unnecessarily blocked many other call paths as well in the entire kernel, so the smaller-scoped lock was preferred. Link: https://lore.kernel.org/netdev/aLb6puGVzR29GpPx@shell.armlinux.org.uk/ Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/20250904125238.193990-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-05net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()Stefan Wahren
The function of_phy_find_device may return NULL, so we need to take care before dereferencing phy_dev. Fixes: 64a632da538a ("net: fec: Fix phy_device lookup for phy_reset_after_clk_enable()") Signed-off-by: Stefan Wahren <wahrenst@gmx.net> Cc: Christoph Niedermaier <cniedermaier@dh-electronics.com> Cc: Richard Leitner <richard.leitner@skidata.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20250904091334.53965-1-wahrenst@gmx.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-05net: phy: fixed_phy: remove link gpio supportHeiner Kallweit
The only user of fixed_phy gpio functionality was here: arch/arm/boot/dts/nxp/vf/vf610-zii-dev-rev-b.dts Support for the switch on this board was migrated to phylink (DSA - mv88e6xxx) years ago, so the functionality is unused now. Therefore remove it. Note: There is a very small risk that there's out-of-tree users who use link gpio with a switch chip not handled by DSA. However we care about in-tree device trees only. Suggested-by: Russell King (Oracle) <linux@armlinux.org.uk> Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Link: https://patch.msgid.link/75295a9a-e162-432c-ba9f-5d3125078788@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-05wifi: mwifiex: fix double free in mwifiex_send_rgpower_table()Dan Carpenter
The "hostcmd" is freed using cleanup.h, so calling kfree() will lead to a double free. Delete the kfree(). Fixes: 7b6f16a25806 ("wifi: mwifiex: add rgpower table loading support") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com> Link: https://patch.msgid.link/aLqZBh5_dSHUb4AE@stanley.mountain Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-09-04smsc911x: add second read of EEPROM mac when possible corruption seenColin Foster
When the EEPROM MAC is read by way of ADDRH, it can return all 0s the first time. Subsequent reads succeed. This is fully reproduceable on the Phytec PCM049 SOM. Re-read the ADDRH when this behaviour is observed, in an attempt to correctly apply the EEPROM MAC address. Signed-off-by: Colin Foster <colin.foster@in-advantage.com> Link: https://patch.msgid.link/20250903132610.966787-1-colin.foster@in-advantage.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-04Merge branch '10GbE' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-09-03 (ixgbe, igbvf, e1000, e1000e, igb, igbvf, igc) Piotr allows for 2.5Gb and 5Gb autoneg for ixgbe E610 devices. Jedrzej refactors reading of OROM data to be more efficient on ixgbe. Kohei Enju adds reporting of loopback Tx packets and bytes on igbvf. He also removes redundant reporting of Rx bytes. Jacek Kowalski remove unnecessary u16 casts in e1000, e1000e, igb, igc, and ixgbe drivers. * '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ixgbe: drop unnecessary casts to u16 / int igc: drop unnecessary constant casts to u16 igb: drop unnecessary constant casts to u16 e1000e: drop unnecessary constant casts to u16 e1000: drop unnecessary constant casts to u16 igbvf: remove redundant counter rx_long_byte_count from ethtool statistics igbvf: add lbtx_packets and lbtx_bytes to ethtool statistics ixgbe: reduce number of reads when getting OROM data ixgbe: add the 2.5G and 5G speeds in auto-negotiation for E610 ==================== Link: https://patch.msgid.link/20250903202536.3696620-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-04net: libwx: fix to enable RSSJiawen Wu
Now when SRIOV is enabled, PF with multiple queues can only receive all packets on queue 0. This is caused by an incorrect flag judgement, which prevents RSS from being enabled. In fact, RSS is supported for the functions when SRIOV is enabled. Remove the flag judgement to fix it. Fixes: c52d4b898901 ("net: libwx: Redesign flow when sriov is enabled") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/A3B7449A08A044D0+20250904024322.87145-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-04Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-6.17-rc5). No conflicts. Adjacent changes: include/net/sock.h c51613fa276f ("net: add sk->sk_drop_counters") 5d6b58c932ec ("net: lockless sock_i_ino()") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-04phy: mscc: Stop taking ts_lock for tx_queue and use its own lockHoratiu Vultur
When transmitting a PTP frame which is timestamp using 2 step, the following warning appears if CONFIG_PROVE_LOCKING is enabled: ============================= [ BUG: Invalid wait context ] 6.17.0-rc1-00326-ge6160462704e #427 Not tainted ----------------------------- ptp4l/119 is trying to lock: c2a44ed4 (&vsc8531->ts_lock){+.+.}-{3:3}, at: vsc85xx_txtstamp+0x50/0xac other info that might help us debug this: context-{4:4} 4 locks held by ptp4l/119: #0: c145f068 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x58/0x1440 #1: c29df974 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x5c4/0x1440 #2: c2aaaad0 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x108/0x350 #3: c2aac170 (&lan966x->tx_lock){+.-.}-{2:2}, at: lan966x_port_xmit+0xd0/0x350 stack backtrace: CPU: 0 UID: 0 PID: 119 Comm: ptp4l Not tainted 6.17.0-rc1-00326-ge6160462704e #427 NONE Hardware name: Generic DT based system Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x7c/0xac dump_stack_lvl from __lock_acquire+0x8e8/0x29dc __lock_acquire from lock_acquire+0x108/0x38c lock_acquire from __mutex_lock+0xb0/0xe78 __mutex_lock from mutex_lock_nested+0x1c/0x24 mutex_lock_nested from vsc85xx_txtstamp+0x50/0xac vsc85xx_txtstamp from lan966x_fdma_xmit+0xd8/0x3a8 lan966x_fdma_xmit from lan966x_port_xmit+0x1bc/0x350 lan966x_port_xmit from dev_hard_start_xmit+0xc8/0x2c0 dev_hard_start_xmit from sch_direct_xmit+0x8c/0x350 sch_direct_xmit from __dev_queue_xmit+0x680/0x1440 __dev_queue_xmit from packet_sendmsg+0xfa4/0x1568 packet_sendmsg from __sys_sendto+0x110/0x19c __sys_sendto from sys_send+0x18/0x20 sys_send from ret_fast_syscall+0x0/0x1c Exception stack(0xf0b05fa8 to 0xf0b05ff0) 5fa0: 00000001 0000000e 0000000e 0004b47a 0000003a 00000000 5fc0: 00000001 0000000e 00000000 00000121 0004af58 00044874 00000000 00000000 5fe0: 00000001 bee9d420 00025a10 b6e75c7c So, instead of using the ts_lock for tx_queue, use the spinlock that skb_buff_head has. Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Fixes: 7d272e63e0979d ("net: phy: mscc: timestamping and PHC support") Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com> Link: https://patch.msgid.link/20250902121259.3257536-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-04net: dsa: dsa_loop: use int type to store negative error codesQianfeng Rong
Change the 'ret' variable in dsa_loop_init() from unsigned int to int, as it needs to store either negative error codes or zero returned by mdio_driver_register(). Storing the negative error codes in unsigned type, doesn't cause an issue at runtime but can be confusing. Additionally, assigning negative error codes to unsigned type may trigger a GCC warning when the -Wsign-conversion flag is enabled. No effect on runtime. Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com> Reviewed-by: Vladimir Oltean <olteanv@gmail.com> Link: https://patch.msgid.link/20250903123404.395946-1-rongqianfeng@vivo.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-04ppp: fix memory leak in pad_compress_skbQingfang Deng
If alloc_skb() fails in pad_compress_skb(), it returns NULL without releasing the old skb. The caller does: skb = pad_compress_skb(ppp, skb); if (!skb) goto drop; drop: kfree_skb(skb); When pad_compress_skb() returns NULL, the reference to the old skb is lost and kfree_skb(skb) ends up doing nothing, leading to a memory leak. Align pad_compress_skb() semantics with realloc(): only free the old skb if allocation and compression succeed. At the call site, use the new_skb variable so the original skb is not lost when pad_compress_skb() fails. Fixes: b3f9b92a6ec1 ("[PPP]: add PPP MPPE encryption module") Signed-off-by: Qingfang Deng <dqfext@gmail.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Yue Haibing <yuehaibing@huawei.com> Link: https://patch.msgid.link/20250903100726.269839-1-dqfext@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-04net: xilinx: axienet: Add error handling for RX metadata pointer retrievalAbin Joseph
Add proper error checking for dmaengine_desc_get_metadata_ptr() which can return an error pointer and lead to potential crashes or undefined behaviour if the pointer retrieval fails. Properly handle the error by unmapping DMA buffer, freeing the skb and returning early to prevent further processing with invalid data. Fixes: 6a91b846af85 ("net: axienet: Introduce dmaengine support") Signed-off-by: Abin Joseph <abin.joseph@amd.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Link: https://patch.msgid.link/20250903025213.3120181-1-abin.joseph@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-04wifi: brcmfmac: support AP isolation to restrict reachability between stationsWright Feng
hostapd & wpa_supplicant userspace daemons exposes an AP mode specific config file parameter "ap_isolate" to the user, which is used to control low-level bridging of frames between the stations associated in the BSS. In driver, handle this user setting in the newly defined cfg80211_ops function brcmf_cfg80211_change_bss() by enabling "ap_isolate" IOVAR in the firmware. In AP mode, the "ap_isolate" value from the cfg80211 layer represents, 0 = allow low-level bridging of frames between associated stations 1 = restrict low-level bridging of frames to isolate associated stations -1 = do not change existing setting Signed-off-by: Wright Feng <wright.feng@cypress.com> Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com> Signed-off-by: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com> [arend: indicate ap_isolate support in struct wiphy::bss_param_support] Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20250817190435.1495094-5-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-09-04wifi: drivers: indicate support for attributes in NL80211_CMD_SET_BSSArend van Spriel
The command NL80211_CMD_SET_BSS has a number of individual attributes and the driver can advertise which of those it will handle when it is changed by user-space. For drivers providing an empty .change_bss() the callback has been removed. Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20250817190435.1495094-3-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-09-04wifi: mac80211: support parsing S1G TIM PVBLachlan Hodges
An S1G TIM PVB has 3 mandatory encoding modes, that being block bitmap, single AID and OBL alongside the ability for each encoding mode to be inverted. Introduce the ability to parse the 3 encoding formats. The implementation specification for the encoding formats can be found in IEEE80211-2024 9.4.2.5. Signed-off-by: Arien Judge <arien.judge@morsemicro.com> Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com> Link: https://patch.msgid.link/20250725132221.258217-3-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-09-04Merge tag 'iwlwifi-next-2025-09-03' of ↵Johannes Berg
https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next into HEAD Miri Korenblit says: ==================== iwlwifi features, notably: - more cleanups of d3 code - cleanups of the transport layer ==================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-09-04eth: fbnic: support queue ops / zero-copy RxJakub Kicinski
Support queue ops. fbnic doesn't shut down the entire device just to restart a single queue. ./tools/testing/selftests/drivers/net/hw/iou-zcrx.py TAP version 13 1..3 ok 1 iou-zcrx.test_zcrx ok 2 iou-zcrx.test_zcrx_oneshot ok 3 iou-zcrx.test_zcrx_rss # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0 Acked-by: Mina Almasry <almasrymina@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20250901211214.1027927-15-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-04eth: fbnic: don't pass NAPI into pp allocJakub Kicinski
Queue API may ask us to allocate page pools when the device is down, to validate that we ingested a memory provider binding. Don't require NAPI to be passed to fbnic_alloc_qt_page_pools(), to make calling fbnic_alloc_qt_page_pools() without NAPI possible. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20250901211214.1027927-14-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-04eth: fbnic: defer page pool recycling activation to queue startJakub Kicinski
We need to be more careful about when direct page pool recycling is enabled in preparation for queue ops support. Don't set the NAPI pointer, call page_pool_enable_direct_recycling() from the function that activates the queue (once the config can no longer fail). Reviewed-by: Mina Almasry <almasrymina@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20250901211214.1027927-13-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-04eth: fbnic: allocate unreadable page pool for the payloadsJakub Kicinski
Allow allocating a page pool with unreadable memory for the payload ring (sub1). We need to provide the queue ID so that the memory provider can match the PP. Use the appropriate page pool DMA sync helper. For unreadable mem the direction has to be FROM_DEVICE. The default is BIDIR for XDP, but obviously unreadable mem is not compatible with XDP in the first place, so that's fine. While at it remove the define for page pool flags. The rxq_idx is passed to fbnic_alloc_rx_qt_resources() explicitly to make it easy to allocate page pools without NAPI (see the patch after the next). Reviewed-by: Mina Almasry <almasrymina@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20250901211214.1027927-12-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-04net: add helper to pre-check if PP for an Rx queue will be unreadableJakub Kicinski
mlx5 pokes into the rxq state to check if the queue has a memory provider, and therefore whether it may produce unreadable mem. Add a helper for doing this in the page pool API. fbnic will want a similar thing (tho, for a slightly different reason). Reviewed-by: Mina Almasry <almasrymina@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20250901211214.1027927-11-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-04eth: fbnic: split fbnic_fill()Jakub Kicinski
Factor out handling a single nv from fbnic_fill() to make it reusable for queue ops. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20250901211214.1027927-10-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-04eth: fbnic: split fbnic_enable()Jakub Kicinski
Factor out handling a single nv from fbnic_enable() to make it reusable for queue ops. Use a __ prefix for the factored out code. The real fbnic_nv_enable() which will include fbnic_wrfl() will be added with the qops, to avoid unused function warnings. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20250901211214.1027927-9-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-04eth: fbnic: split fbnic_flush()Jakub Kicinski
Factor out handling a single nv from fbnic_flush() to make it reusable for queue ops. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20250901211214.1027927-8-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-04eth: fbnic: split fbnic_disable()Jakub Kicinski
Factor out handling a single nv from fbnic_disable() to make it reusable for queue ops. Use a __ prefix for the factored out code. The real fbnic_nv_disable() which will include fbnic_wrfl() will be added with the qops, to avoid unused function warnings. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20250901211214.1027927-7-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-04eth: fbnic: request ops lockJakub Kicinski
We'll add queue ops soon so. queue ops will opt the driver into extra locking. Request this locking explicitly already to make future patches smaller and easier to review. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20250901211214.1027927-6-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-04eth: fbnic: use netmem_ref where applicableJakub Kicinski
Use netmem_ref instead of struct page pointer in prep for unreadable memory. fbnic has separate free buffer submission queues for headers and for data. Refactor the helper which returns page pointer for a submission buffer to take the high level queue container, create a separate handler for header and payload rings. This ties the "upcast" from netmem to system page to use of sub0 which we know has system pages. Reviewed-by: Mina Almasry <almasrymina@google.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20250901211214.1027927-5-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-04eth: fbnic: move page pool alloc to fbnic_alloc_rx_qt_resources()Jakub Kicinski
page pools are now at the ring level, move page pool alloc to fbnic_alloc_rx_qt_resources(), and freeing to fbnic_free_qt_resources(). This significantly simplifies fbnic_alloc_napi_vector() error handling, by removing a late failure point. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20250901211214.1027927-4-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-04eth: fbnic: move xdp_rxq_info_reg() to resource allocJakub Kicinski
Move rxq_info and mem model registration from fbnic_alloc_napi_vector() and fbnic_alloc_nv_resources() to fbnic_alloc_rx_qt_resources(). The rxq_info is now registered later in the process, but that should not cause any issues. rxq_info lives in the fbnic_q_triad (qt) struct so qt init is a more natural place. Encapsulating the logic in the qt functions will also allow simplifying the cleanup in the NAPI related alloc functions in the next commit. Rx does not have a dedicated fbnic_free_rx_qt_resources(), but we can use xdp_rxq_info_is_reg() to tell whether given rxq_info was in use (effectively - if it's a qt for an Rx queue). Having to pass nv into fbnic_alloc_rx_qt_resources() is not great in terms of layering, but that's temporary, pp will move soon.. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20250901211214.1027927-3-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-04eth: fbnic: move page pool pointer from NAPI to the ring structJakub Kicinski
In preparation for memory providers we need a closer association between queues and page pools. We used to have a page pool at the NAPI level to serve all associated queues but with MP the queues under a NAPI may no longer be created equal. The "ring" structure in fbnic is a descriptor ring. We have separate "rings" for payload and header pages ("to device"), as well as a ring for completions ("from device"). Technically we only need the page pool pointers in the "to device" rings, so adding the pointer to the ring struct is a bit wasteful. But it makes passing the structures around much easier. For now both "to device" rings store a pointer to the same page pool. Using more than one queue per NAPI is extremely rare so don't bother trying to share a single page pool between queues. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20250901211214.1027927-2-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-04net: renesas: rswitch: add modifiable ageing timeMichael Dege
Allow the setting of the MAC table aging in the R-Car S4 Rswitch using the SWITCHDEV_ATTR_ID_BRIDGE_AGEING_TIME attribute. Signed-off-by: Michael Dege <michael.dege@renesas.com> Link: https://patch.msgid.link/20250901-add_l2_switching-v5-4-5f13e46860d5@renesas.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-09-04net: renesas: rswitch: add offloading for L2 switchingMichael Dege
Add hardware offloading for L2 switching on R-Car S4. On S4 brdev is limited to one per-device (not per port). Reasoning is that hw L2 forwarding support lacks any sort of source port based filtering, which makes it unusable to offload more than one bridge device. Either you allow hardware to forward destination MAC to a port, or you have to send it to CPU. You can't make it forward only if src and dst ports are in the same brdev. Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com> Signed-off-by: Michael Dege <michael.dege@renesas.com> Link: https://patch.msgid.link/20250901-add_l2_switching-v5-3-5f13e46860d5@renesas.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>