summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)Author
2026-05-28net: make page_pool_get_stats() voidJakub Kicinski
The kdoc for page_pool_get_stats() is missing a Returns: statement. Looking at this function, I have no idea what is the purpose of the bool it returns. My guess was that maybe the static inline stub returns false if CONFIG_PAGE_POOL_STATS=n but such static inline helper doesn't exist at all. All callers pass a pointer to a struct on the stack. Make this function void. Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260526155722.2790742-5-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-28net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configurationFrank Wunderlich
Commit 8871389da151 introduces common pcs dts properties which writes rx=normal,tx=normal polarity to register SGMSYS_QPHY_WRAP_CTRL of switch. This is initialized with tx-bit set and so change inverts polarity compared to before. It looks like mt7531 has tx polarity inverted in hardware and set tx-bit by default to restore the normal polarity. The MT7531 datasheet quite clearly states: Register 000050EC QPHY_WRAP_CTRL -- QPHY wrapper control Reset value: 0x00000501 BIT 1 RX_BIT_POLARITY -- RX bit polarity control 1'b0: normal 1'b1: inverted BIT 0 TX_BIT_POLARITY -- TX bit polarity control (TX default inversed in MT7531) 1'b0: normal 1'b1: inverted Till this patch the register write was only called when mediatek,pnswap property was set which cannot be done for switch because the fw-node param was always NULL from switch driver in the mtk_pcs_lynxi_create call. Do not configure switch side like it's done before. Fixes: 8871389da151 ("net: pcs: pcs-mtk-lynxi: deprecate "mediatek,pnswap"") Signed-off-by: Frank Wunderlich <frank-w@public-files.de> Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com> Link: https://patch.msgid.link/20260526153239.30194-1-linux@fw-web.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-28net: Use named initializer for zorro_device_id arraysUwe Kleine-König (The Capable Hub)
Using named initializers is more explicit and thus easier to parse for a human. While touching these arrays, drop explicit zeros from the list terminator. This change doesn't introduce changes to the compiled zorro_device_id arrays. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Link: https://patch.msgid.link/2243204c0f57f79750de00c072914354d4f65707.1779803053.git.u.kleine-koenig@baylibre.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-28Merge tag 'wireless-next-2026-05-28' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Mostly driver updates: - iwlwifi - more UHR support - NAN (multicast, schedule improvements, multi-station) - cleanups, etc. - ath12k - thermal throttling/cooling device support - 6 GHz incumbent interference detection - channel 177 in 5 GHz - hwsim: S1G fixes - mac80211: NAN channel handling improvements * tag 'wireless-next-2026-05-28' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (143 commits) wifi: cfg80211: use strscpy in cfg80211_wext_giwname wifi: mac80211: fix channel evacuation logic wifi: mac80211: refactor ieee80211_nan_try_evacuate wifi: mac80211: add an option to filter out a channel in combinations check wifi: mac80211_hwsim: add debug messages for link changes wifi: nl80211: re-check wiphy netns in testmode and vendor dump continuations wifi: mac80211_hwsim: modernise S1G channel list wifi: mac80211_hwsim: don't run RC update on new STA on S1G vif wifi: mwifiex: remove an unnecessary check wifi: mac80211: add KUnit coverage for negotiated TTLM parser wifi: ath12k: fix error unwind on arch_init() failure in PCI probe wifi: iwlwifi: mld: fix indentation in iwl_mld_fill_supp_rates() wifi: iwlwifi: transport: add memory read under NIC access wifi: iwlwifi: dbg: remove unused 'range_len' arg from dump wifi: iwlwifi: fw: separate out old-style dump code wifi: iwlwifi: fw: dbg: always use non-tracing PRPH access wifi: iwlwifi: fw: separate ini dump allocation wifi: iwlwifi: fw: move struct iwl_fw_ini_dump_entry to dbg.c wifi: iwlwifi: clean up location format/BW encoding wifi: iwlwifi: Add names for Killer BE1735x and BE1730x ... ==================== Link: https://patch.msgid.link/20260528123911.284536-26-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-28net: mana: Skip redundant detach on already-detached portDipayaan Roy
When mana_per_port_queue_reset_work_handler() runs after a previous detach succeeded but attach failed, the port is left in a detached state with apc->tx_qp and apc->rxqs already freed. Calling mana_detach() again unconditionally leads to NULL pointer dereferences during queue teardown. Add an early exit in mana_detach() when the port is already in detached state (!netif_device_present) for non-close callers, making it safe to call idempotently. This allows the queue reset handler and other recovery paths to simply retry mana_attach() without redundant teardown. Fixes: 3b194343c250 ("net: mana: Implement ndo_tx_timeout and serialize queue resets per port.") Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Link: https://patch.msgid.link/20260525081129.1230035-3-dipayanroy@linux.microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-28net: mana: Add NULL guards in teardown path to prevent panic on attach failureDipayaan Roy
When queue allocation fails partway through, the error cleanup frees and NULLs apc->tx_qp and apc->rxqs. Multiple teardown paths such as mana_remove(), mana_change_mtu() recovery, and internal error handling in mana_alloc_queues() can subsequently call into functions that dereference these pointers without NULL checks: - mana_chn_setxdp() dereferences apc->rxqs[0], causing a NULL pointer dereference panic (CR2: 0000000000000000 at mana_chn_setxdp+0x26). - mana_destroy_vport() iterates apc->rxqs without a NULL check. - mana_fence_rqs() iterates apc->rxqs without a NULL check. - mana_dealloc_queues() iterates apc->tx_qp without a NULL check. Add NULL guards for apc->rxqs in mana_fence_rqs(), mana_destroy_vport(), and before the mana_chn_setxdp() call. Add a NULL guard for apc->tx_qp in mana_dealloc_queues() to skip TX queue draining when TX queues were never allocated or already freed. Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com> Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Link: https://patch.msgid.link/20260525081129.1230035-2-dipayanroy@linux.microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-28Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.1-rc6). Conflicts: drivers/net/phy/air_en8811h.c d895767c33781 ("net: phy: air_en8811h: add AN8811HB MCU assert/deassert support") dddfadd75197e ("net: phy: Add Airoha phy library for shared code") 5226bb6634cdf ("net: phy: air_phy_lib: Factorize BuckPBus register accessors") e08f0ea6daf2e ("net: phy: Rename Airoha common BuckPBus register accessors") net/sched/sch_netem.c a2f6ed7b4873 ("net/sched: netem: add per-impairment extended statistics") 9552b11e3eda ("net/sched: fix packet loop on netem when duplicate is on") Adjacent changes: drivers/dpll/zl3073x/core.c c1224569cef0 ("dpll: zl3073x: make frequency monitor a per-device attribute") 54e65df8cf18 ("dpll: zl3073x: report FFO as DPLL vs input reference offset") net/iucv/af_iucv.c 347fdd4df85f ("af_iucv: convert to getsockopt_iter") 3589d20a666c ("net/iucv: fix locking in .getsockopt") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-28Merge tag 'net-7.1-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "This is again significantly bigger than the same point into the previous cycle, but at least smaller than last week. I'm not aware of any pending regression for the current cycle. Including fixes from netfilter. Current release - regressions: - netfilter: walk fib6_siblings under RCU Previous releases - regressions: - netlink: fix sending unassigned nsid after assigned one - bridge: fix sleep in atomic context in netlink path - sched: fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop - ipv4: fix net->ipv4.sysctl_local_reserved_ports UaF - eth: tun: free page on short-frame rejection in tun_xdp_one() Previous releases - always broken: - skbuff: fix missing zerocopy reference in pskb_carve helpers - handshake: drain pending requests at net namespace exit - ethtool: - rss: avoid modifying the RSS context response - module: avoid leaking a netdev ref on module flash errors - coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES - netfilter: fix dst corruption in same register operation - nfc: hci: fix out-of-bounds read in HCP header parsing - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - eth: - vti: use ip6_tnl.net in vti6_changelink(). - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()" * tag 'net-7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (94 commits) dpll: zl3073x: make frequency monitor a per-device attribute dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work dpll: export __dpll_device_change_ntf() for use under dpll_lock net/handshake: Drain pending requests at net namespace exit net/handshake: Verify file-reference balance in submit paths net/handshake: Close the submit-side sock_hold race net/handshake: hand off the pinned file reference to accept_doit net/handshake: Take a long-lived file reference at submit net/handshake: Pass negative errno through handshake_complete() nvme-tcp: store negative errno in queue->tls_err net/handshake: Use spin_lock_bh for hn_lock net: skbuff: fix missing zerocopy reference in pskb_carve helpers net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path net: hibmcge: disable Relaxed Ordering to fix RX packet corruption selftests/tc-testing: Add netem test case exercising loops selftests/tc-testing: Add mirred test cases exercising loops net/sched: act_mirred: Fix return code in early mirred redirect error paths net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop net/sched: fix packet loop on netem when duplicate is on ...
2026-05-28net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX pathJijie Shao
The dma_rmb() barrier was placed before dma_sync_single_for_cpu(), which is incorrect. DMA sync must complete first to make the buffer accessible to the CPU, then the rmb barrier ensures subsequent descriptor reads observe the latest data written by the hardware. Reorder the operations so dma_sync_single_for_cpu() is called before dma_rmb() to guarantee the driver reads consistent data from the DMA buffer. Fixes: f72e25594061 ("net: hibmcge: Implement rx_poll function to receive packets") Signed-off-by: Jijie Shao <shaojijie@huawei.com> Link: https://patch.msgid.link/20260525144525.94884-3-shaojijie@huawei.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-28net: hibmcge: disable Relaxed Ordering to fix RX packet corruptionJijie Shao
When SMMU is disabled, the hibmcge driver may receive corrupted packets. The hardware writes packet data and descriptors to the same page, but with Relaxed Ordering enabled, PCI write transactions may not be strictly ordered. This can cause the driver to observe a valid descriptor before the corresponding packet data is fully written. Fix this by clearing PCI_EXP_DEVCTL_RELAX_EN in the PCI bridge control register to ensure strict write ordering between packet data and descriptors. Fixes: f72e25594061 ("net: hibmcge: Implement rx_poll function to receive packets") Signed-off-by: Jijie Shao <shaojijie@huawei.com> Link: https://patch.msgid.link/20260525144525.94884-2-shaojijie@huawei.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-28net: txgbe: rework service event handlingJiawen Wu
Convert to use test_and_clear_bit() for link event subtasks. Only re-arm the WX_FLAG_NEED_MODULE_RESET flag when module is absent. Unsupported or invalid modules no longer cause the service task to continuously retry module identification. Additionally, explicitly cancel service_task during device teardown to ensure no pending asynchronous service work survives after the device has entered the DOWN state. Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com> Link: https://patch.msgid.link/20260525100543.27140-4-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-28net: wangxun: avoid statistics updates during device teardownJiawen Wu
After introducing WX_STATE_DOWN, wx_update_stats() now explicitly skips statistics collection while the device is in teardown or reset state. Calling wx_update_stats() from the device disable path therefore becomes redundant. Remove wx_update_stats() calls from ngbe_disable_device() and txgbe_disable_device(). Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com> Link: https://patch.msgid.link/20260525100543.27140-3-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-28net: wangxun: introduce WX_STATE_DOWN to serialize device shutdown stateJiawen Wu
Replace various netif_running() checks with an explicit WX_STATE_DOWN state bit to track whether the device datapath and interrupt handling are operational. The previous logic relied on netif_running() to gate interrupt reenablement, queue wakeups, statistics updates, and service task execution. However, netif_running() only reflects the administrative state of the netdevice and does not fully serialize against teardown and reset paths. During device shutdown and reset flows, asynchronous contexts such as interrupt handlers, NAPI poll, and service work could still observe netif_running() as true while device resources were already being disabled or freed. Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com> Link: https://patch.msgid.link/20260525100543.27140-2-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-28Merge tag 'ath-next-20260526' of ↵Johannes Berg
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v7.2 (PR #2) For ath12k: - Add thermal throttling and cooling device support - Add support for handling incumbent signal interference in 6 GHz - Add support for channel 177 in the 5 GHz band In addition, a large number of cleanup and minor bug fixing across all supported drivers. ================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-28Merge tag 'iwlwifi-next-2026-05-26' of ↵Johannes Berg
https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi - next: 2026-05-26 This contains mainly: UHR support (DPS, DUO, multi-link PM), NAN enhancements (multicast, schedule config v2, multiple stations), EMLSR fixes, new Killer/LNL device IDs, firmware API cleanups, and a few bugfixes ==================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-28wifi: mac80211_hwsim: add debug messages for link changesJohannes Berg
It's useful to be able to see the link addresses when the interface links change, so add some prints to hwsim for the vif link change callback. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Reviewed-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260527224151.b22a048abc7c.Ief2132c5c4bb67fa56e90eb8e7d59dfd9f2b9378@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-28wifi: mac80211_hwsim: modernise S1G channel listLachlan Hodges
The current S1G channel list in mac80211_hwsim does not represent what S1G drivers would advertise that being 1MHz primaries. Also, include the NO_PRIMARY flag on the edgeband 1MHz primaries to emulate US operation such that it can also be tested. Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com> Link: https://patch.msgid.link/20260527033828.183821-3-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-28wifi: mac80211_hwsim: don't run RC update on new STA on S1G vifLachlan Hodges
mac80211_hwsim_sta_rc_update() is unable to handle S1G widths so when a new STA is added under a S1G vif the WARN is hit preventing hwsim use for S1G. For now, skip calling rc_update() for S1G interfaces. This is required such that the soon-to-be S1G hwsim tests can successfully run. Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com> Link: https://patch.msgid.link/20260527033828.183821-2-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-28wifi: mwifiex: remove an unnecessary checkDan Carpenter
We know that "start_raw" is true so remove this check and pull the code in an tab. Signed-off-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/ahPypOdz-KXh5KAJ@stanley.mountain Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-05-27net: phy: air_an8801: ensure maximum available speed link useLouis-Alexis Eyraud
To ensure that the Airoha AN8801R PHY uses the maximum available link speed, an additional register write is needed to configure the function mode for either 1G or 100M/10M operation after link detection. So, in air_an8801 driver, implement a custom read_status callback, that after genphy_read_status determines the link speed, sets the bit 0 of the link mode register (REG_LINK_MODE) if the detected speed is 1Gbps, or unsets it otherwise. Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260526-add-airoha-an8801-support-v5-6-01aea8dee69b@collabora.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-27net: phy: Introduce Airoha AN8801R Gigabit Ethernet PHY driverAngeloGioacchino Del Regno
Introduce a driver for the Airoha AN8801R Series Gigabit Ethernet PHY; this currently supports setting up PHY LEDs, 10/100M, 1000M speeds, and Wake on LAN and PHY interrupts. Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260526-add-airoha-an8801-support-v5-5-01aea8dee69b@collabora.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-27net: phy: Rename Airoha common BuckPBus register accessorsLouis-Alexis Eyraud
Rename the BuckPBus register accessors functions present in air_phy_lib and their calls in air_en8811h driver, so all exported functions start with the same prefix. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com> Link: https://patch.msgid.link/20260526-add-airoha-an8801-support-v5-4-01aea8dee69b@collabora.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-27net: phy: air_phy_lib: Factorize BuckPBus register accessorsLouis-Alexis Eyraud
In preparation of Airoha AN8801R PHY support, move the BuckPBus register accessors and definitions, present in air_en8811h driver, into the Airoha PHY shared code (air_phy_lib), so they will be usable by the new driver without duplicating them. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com> Link: https://patch.msgid.link/20260526-add-airoha-an8801-support-v5-3-01aea8dee69b@collabora.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-27net: phy: Add Airoha phy library for shared codeLouis-Alexis Eyraud
In preparation of Airoha AN8801R PHY support, split out the interface functions that will be common between the already present air_en8811h driver and the new one, and put them into a new library named air_phy_lib. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com> Link: https://patch.msgid.link/20260526-add-airoha-an8801-support-v5-2-01aea8dee69b@collabora.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-27net: sfp: add quirk for OEM 2.5G optical modulesWei Qisen
Some OEM-branded SFP modules are incorrectly detected as 1000Base-X and fail to establish link on 2.5G-capable ports. These modules do not properly advertise 2500Base-X capability in their EEPROM and require forcing the correct SerDes mode. Add sfp_quirk_2500basex for: - OEM SFP-2.5G-LH03-B - OEM SFP-2.5G-LH20-A Both modules report: Vendor name: OEM Vendor PN: SFP-2.5G-LH03-B / SFP-2.5G-LH20-A Tested on OpenWrt with successful 2.5G link establishment. Signed-off-by: Wei Qisen <weixiansen574@163.com> Link: https://patch.msgid.link/20260526055206.1750-1-weixiansen574@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-27bonding: refuse to enslave CAN devicesOliver Hartkopp
syzbot reported a kernel paging request crash in can_rx_unregister() inside net/can/af_can.c. The crash occurs because a virtual CAN device (vxcan) is being enslaved to a bonding master. During the enslavement process, the bonding driver mutates and modifies the network device states to fit an Ethernet-like aggregation model. However, CAN devices operate on a completely different Layer 2 architecture, relying on the CAN mid-layer private data structure (can_ml_priv) instead of standard Ethernet structures. Since bonding does not initialize or maintain these CAN structures, subsequent operations on the half-enslaved interface (such as closing associated sockets via isotp_release) lead to a null-pointer dereference when accessing the CAN receiver lists. Bonding CAN interfaces is architecturally invalid as CAN lacks MAC addresses, ARP capabilities, and standard Ethernet link-layer mechanisms. While generic loopback devices are blocked globally in net/core/dev.c, virtual CAN devices bypass this check because they do not carry the IFF_LOOPBACK flag, despite acting as local software-loopbacks. Fix this by explicitly blocking network devices of type ARPHRD_CAN from being enslaved at the very beginning of bond_enslave(). This prevents illegal state mutations, eliminates the resulting KASAN crashes, and avoids potential memory leaks from incomplete socket cleanups. As the CAN support has been added a long time after bonding the Fixes-tag points to the introduction of ARPHRD_CAN that would have needed a specific handling in bonding_main.c. Fixes: cd05acfe65ed ("[CAN]: Allocate protocol numbers for PF_CAN") Reported-by: syzbot+8ed98cbd0161632bce95@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8ed98cbd0161632bce95 Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Acked-by: Jay Vosburgh <jv@jvosburgh.net> Link: https://patch.msgid.link/20260526-bonding-candev-v1-1-ba1df400918a@hartkopp.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-27wifi: rtw89: usb: Support switching to USB 3 modeBitterblue Smith
The Realtek wifi 6/7 devices which support USB 3 are weird: when first plugged in, they pretend to be USB 2. The driver needs to send some commands to the device, which make it disappear and come back as a USB 3 device. Implement the required commands in rtw89. Add a new function rtw89_usb_write32_quiet() to avoid the warnings when writing to R_{AX,BE}_PAD_CTRL2. Even though the write succeeds, usb_control_msg() returns -EPROTO, probably because the USB device disappears immediately. This results in some confusing warnings in the kernel log. When a USB 3 device is plugged into a USB 2 port, rtw89 will try to switch it to USB 3 mode only once. The device will disappear and come back still in USB 2 mode, of course. Tested with RTL8832AU, RTL8832BU, RTL8832CU, and RTL8912AU. Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/e955451c-93a1-4d04-8024-d224a04f1d4a@gmail.com
2026-05-27wifi: rtw88: Add more validation for the RX descriptorBitterblue Smith
Some RTL8821CE cards can return frames with corrupted RX descriptor, causing warnings and crashes if they are passed to the upper layers. The PHY status size field is 4 bits wide, but in rtw88 its value should only be 0 or 4. Checking this catches most of the corrupt frames. If a PHY status is present, the PHY status size should not be 0. The frame size should not be less than or equal to 4 and should not exceed 11454. The rate should not exceed 4SS MCS9. Discard the frame if any of these checks fail. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221286 Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Tested-by: Oleksandr Havrylov <goainwo@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/5bfecba3-8a90-4e0f-9558-af5cd8a14975@gmail.com
2026-05-27wifi: rtw89: 8922d: configure TX shape settingsZong-Zhe Yang
By default, BB enables triangular spectrum by a series of register settings. According to band and regulation, RF parameters determine whether TX shape needs to be restricted or not. So now, clear the corresponding settings if it has no need to do. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260520123823.1792954-8-pkshih@realtek.com
2026-05-27wifi: rtw89: debug: show large MRU in txpwr_table dbgfsZong-Zhe Yang
Read and print the CR settings of large MRU. For now, only RTL8922D_CID7090 support it. For example, [TX power limit_large_mru] RU484_242 1TX - IDX_0 IDX_1 IDX_2 IDX_3 | 17, 0, 0, 0, dBm RU484_242 2TX - IDX_0 IDX_1 IDX_2 IDX_3 | 16, 0, 0, 0, dBm RU996_484 1TX - IDX_0 IDX_1 | 0, 0, dBm RU996_484 2TX - IDX_0 IDX_1 | 0, 0, dBm RU996_484_242 1TX - IDX_0 IDX_1 | 0, 0, dBm RU996_484_242 2TX - IDX_0 IDX_1 | 0, 0, dBm Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260520123823.1792954-7-pkshih@realtek.com
2026-05-27wifi: rtw89: Wi-Fi 7 configure TX power limit for large MRUZong-Zhe Yang
Support of Large MRU (Multiple Resource Unit) starts from RTL8922D_CID7090, i.e. RTL8922A and RTL8922D-VS variant do not support it. There are the new corresponding control registers. So, configure them. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260520123823.1792954-6-pkshih@realtek.com
2026-05-27wifi: rtw89: fw: load TX compensation element by RFE typePing-Ke Shih
Originally driver uses TX compensation element by AID, and now tables are by RFE type. Add the logic accordingly. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260520123823.1792954-5-pkshih@realtek.com
2026-05-27wifi: rtw89: 8922d: support new digital power compensation formatPing-Ke Shih
The new format shared the base set (7 elements). As there are total 40 sets, save 7 * 39 elements. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260520123823.1792954-4-pkshih@realtek.com
2026-05-27wifi: rtw89: 8922d: refactor digital power compensation to support new formatPing-Ke Shih
Because base settings of digital power compensation can be shared across all bands, the settings are divided into two parts -- base and individual values per bands. Refactor the code to be reuse with new format. No change logic at all. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260520123823.1792954-3-pkshih@realtek.com
2026-05-27wifi: rtw89: fw: load TX power track element according to AIDZong-Zhe Yang
RF parameters has different TX power track table for different AID. FW elements may include multiple TX power track tables for different AID. So, load the corresponding one. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260520123823.1792954-2-pkshih@realtek.com
2026-05-26net: thunderx: fix PTP device ref leak in nicvf_probe()Haoxiang Li
cavium_ptp_get() acquires a reference to the PTP PCI device through pci_get_device(). If any initialization step fails after cavium_ptp_get(), the PTP PCI device reference is leaked. Add a common error path to release the PTP reference before returning from probe failures. Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> Link: https://patch.msgid.link/20260525082611.61817-1-lihaoxiang@isrc.iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-26vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()Eric Dumazet
skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instead ip_hdr(skb) as done in drivers/net/bareudp.c and drivers/net/geneve.c. Found by Sashiko. Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets") Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Stefano Brivio <sbrivio@redhat.com> Link: https://patch.msgid.link/20260525203642.2389723-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-26netconsole: Constify struct configfs_item_operations and ↵Christophe JAILLET
configfs_group_operations 'struct configfs_item_operations' and 'configfs_group_operations' are not modified in this driver. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 64259 24272 608 89139 15c33 drivers/net/netconsole.o After: ===== text data bss dec hex filename 64579 23952 608 89139 15c33 drivers/net/netconsole.o Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Reviewed-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/7ff56bdb0cee826a56365f930dcdf457b44931df.1779711734.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-26mlxsw: spectrum_fid: use a dedicated list head pointer for sorted insertMaoyi Xie
mlxsw_sp_fid_port_vid_list_add() inserts into a list sorted by local_port. It walks the list to find the first entry with a larger local_port, then inserts the new entry before it: list_add_tail(&port_vid->list, &tmp_port_vid->list); If the loop falls through (the new local_port is the largest), tmp_port_vid runs off the end of the list. &tmp_port_vid->list then ends up at the list head itself (container_of() offsets cancel), and list_add_tail() inserts at the tail. So the code works today. It is fragile though. Anyone who later adds a read of another field of tmp_port_vid will hit memory outside the list head. Track the insertion point with a dedicated list_head pointer. Initialise insert_before to &fid->port_vid_list, set it to &tmp_port_vid->list only on early break, and pass insert_before to list_add_tail(). The cursor is no longer touched after the loop. Behaviour is unchanged. Same shape as the Koschel cleanups from 2022 (e.g. 99d8ae4ec8a tracing, 2966a9918df clockevents, dc1acd5c946 dlm). Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260525071759.1517576-1-maoyixie.tju@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-26net: dsa: netc: fix unmet Kconfig dependencies for NET_DSA_NETC_SWITCHWei Fang
NET_DSA_NETC_SWITCH selects NXP_NTMP, NXP_NETC_LIB and FSL_ENETC_MDIO, but these symbols depend on NET_VENDOR_FREESCALE which may not be enabled. This results in Kconfig warnings and linker errors like: undefined reference to `ntmp_bpt_update_entry' undefined reference to `ntmp_fdbt_search_port_entry' undefined reference to `ntmp_free_cbdr' undefined reference to `enetc_hw_alloc' ... Therefore, add "depends on NET_VENDOR_FREESCALE" to NET_DSA_NETC_SWITCH, ensuring that the selected symbols NXP_NTMP, NXP_NETC_LIB and FSL_ENETC_MDIO, which all depend on NET_VENDOR_FREESCALE, can only be selected when that dependency is already satisfied. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202605240046.8MvKuOMg-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202605240706.EuGmnrz5-lkp@intel.com/ Fixes: 187fbae024c8 ("net: dsa: netc: introduce NXP NETC switch driver for i.MX94") Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260524070310.2429819-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-26net: phy: air_en8811h: add AN8811HB MCU assert/deassert supportLucien.Jheng
AN8811HB needs a MCU soft-reset cycle before firmware loading begins. Assert the MCU (hold it in reset) and immediately deassert (release) via a dedicated PBUS register pair (0x5cf9f8 / 0x5cf9fc), accessed through a registered mdio_device at PHY-addr+8. Add __air_pbus_reg_write() as a low-level helper taking a struct mdio_device *, create and register the PBUS mdio_device in an8811hb_probe() and store it in priv->pbusdev, then implement an8811hb_mcu_assert() / _deassert() on top of it. Add an8811hb_remove() to unregister the PBUS device on teardown. Wire both calls into an8811hb_load_firmware() and en8811h_restart_mcu() so every firmware load or MCU restart on AN8811HB correctly sequences the reset control registers. Fixes: 5afda1d734ed ("net: phy: air_en8811h: add Airoha AN8811HB support") Signed-off-by: Lucien Jheng <lucienzx159@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260524063915.47961-1-lucienzx159@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-26wifi: ath12k: fix error unwind on arch_init() failure in PCI probeRipan Deuri
When arch_init() fails in ath12k_pci_probe(), the code jumps to err_pci_msi_free, leaking resources in teardown. Redirect the failure path to err_free_irq so teardown matches the setup order. Compile-tested only. Fixes: 614c23e24ee8 ("wifi: ath12k: Support arch-specific DP device allocation") Signed-off-by: Ripan Deuri <ripan.deuri@oss.qualcomm.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260519192815.3911324-1-ripan.deuri@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-05-26Merge tag 'mm-hotfixes-stable-2026-05-25-16-22' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "13 hotfixes. 9 are for MM. 9 are cc:stable and the remaining 4 address post-7.1 issues or aren't considered suitable for backporting. All patches are singletons - please see the individual changelogs for details" * tag 'mm-hotfixes-stable-2026-05-25-16-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: Revert "mm: introduce a new page type for page pool in page type" mm/vmalloc: do not trigger BUG() on BH disabled context MAINTAINERS, mailmap: change email for Eugen Hristev mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page kernel/fork: validate exit_signal in kernel_clone() mm: memcontrol: propagate NMI slab stats to memcg vmstats mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one zram: fix use-after-free in zram_writeback_endio memfd: deny writeable mappings when implying SEAL_WRITE ipc: limit next_id allocation to the valid ID range Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare" MAINTAINERS: .mailmap: update after GEHC spin-off
2026-05-26wifi: iwlwifi: mld: fix indentation in iwl_mld_fill_supp_rates()Dongyang Jin
Fix the following inconsistent indentation warnings reported by smatch: smatch warnings: drivers/net/wireless/intel/iwlwifi/mld/tlc.c:454 iwl_mld_fill_supp_rates() warn: inconsistent indenting There's an extra tab, remove it. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202605170928.yPTN7kOn-lkp@intel.com/ Signed-off-by: Dongyang Jin <jindongyang@kylinos.cn> Link: https://patch.msgid.link/20260519060259.2327712-1-jindongyang@kylinos.cn Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-05-26wifi: iwlwifi: transport: add memory read under NIC accessJohannes Berg
Add functions to be able to do memory read under NIC access, in order to use them later during firmware dump. These may drop and re-acquire the spinlock, but will not acquire and release the NIC access. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Link: https://patch.msgid.link/20260517100550.7bb1ea51c347.I91420a24fb0c481c75a2600d60e1365c15c1c5a9@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-05-26wifi: iwlwifi: dbg: remove unused 'range_len' arg from dumpJohannes Berg
None of the functions use this, and it's not really passed the length of the specific range anyway, but rather the entire remaining size. Remove the unused argument. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Link: https://patch.msgid.link/20260517100550.ea3502f97c2a.I4ce08f0ea7ea3bacd4928b427c0710b77259d002@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-05-26wifi: iwlwifi: fw: separate out old-style dump codeJohannes Berg
There are two dump paths: new "ini" style, and the old, more driver-centric, way. Separate out the code for the old way into a separate dbg-old.c file, to simplify. Fix a typo ('trasport') along the way. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Link: https://patch.msgid.link/20260517100550.1de0f1110d5a.I4faebe15192a1f27cb4b7270fb52154f06eb2a10@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-05-26wifi: iwlwifi: fw: dbg: always use non-tracing PRPH accessJohannes Berg
The iwl_{read,write}_prph_no_grab() functions will trace each access, but in debug dump a lot of accesses already use the transport versions of these functions directly. Since the data (register addresses and their content) is going into the dump file, tracing isn't really needed. Use the transport functions in all places. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Link: https://patch.msgid.link/20260517100550.bbc7623a0348.I827729916da8f264befbcb90ac6509c359ee97a3@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-05-26wifi: iwlwifi: fw: separate ini dump allocationJohannes Berg
Separate out the ini dump allocation to happen before the actual dumping in preparation for better device MAC access. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Link: https://patch.msgid.link/20260517100550.01a65fd9e6de.If9b648a5565671801c15be898f2b89afdb878256@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2026-05-26wifi: iwlwifi: fw: move struct iwl_fw_ini_dump_entry to dbg.cJohannes Berg
This is only used/needed in this file, so move it to clarify that it's not part of any external API. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Link: https://patch.msgid.link/20260517100550.72b02319e812.I5cf95f64e3c3c688871bfabbe4fd7393b63a7dc8@changeid Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-16 22:34:36 +0000