summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)Author
2026-07-27net: enetc: remove invalid code from enetc4_pl_mac_link_up()Wei Fang
When adding phylink MAC operations support to the NETC switch driver, Russell King pointed out several pieces of invalid logic in the .mac_link_up() implementation (see [1] and [2]): 1) Half-duplex backpressure is not supported by the kernel, Ethernet relies on packet dropping for congestion management. 2) phylink_autoneg_inband() is unnecessary, as RGMII in-band status is not supported. 3) TX and RX pause are disabled in half-duplex mode, so there is no need to override them in .mac_link_up(). The same invalid logic is also present in enetc4_pl_mac_link_up(), so remove the invalid code from it. Given enetc4_set_hd_flow_control() is removed, pf->caps.half_duplex has also become useless and should therefore be removed as well. Link: https://lore.kernel.org/imx/acEIQqI-_oyCym8O@shell.armlinux.org.uk/ # 1 Link: https://lore.kernel.org/imx/acEFwqmAvWls_9Ef@shell.armlinux.org.uk/ # 2 Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260720014317.1059359-9-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27net: enetc: differentiate phylink capabilities for pseudo-MAC and standalone MACClaudiu Manoil
The ENETC pseudo-MACs are proprietary internal links that do not implement any standard MII interface, so restrict their supported PHY interface modes to PHY_INTERFACE_MODE_INTERNAL only. Since pseudo-MACs can operate at any speed between 10Mbps and 25Gbps in multiples of 10Mbps, set their MAC capabilities to cover the full range of standard full-duplex speeds: 10/100/1000/2500/5000/10000/ 20000/25000 Mbps. For standalone ENETC (v4), expand the supported interface modes to include 10GBASER in addition to the existing RGMII, SGMII, 1000BASEX, 2500BASEX and USXGMII modes, with MAC capabilities up to 10G. MAC_1000 is replaced with MAC_1000FD to explicitly exclude 1000M half-duplex, which is not supported. Note that 10GBASE-R mode of ENETC v4 has not supported yet, the current patch adds PHY_INTERFACE_MODE_10GBASER simply as preparation for the upcoming support of the 10GBASE-R mode. Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com> Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260720014317.1059359-8-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27net: enetc: simplify enetc4_set_port_speed()Wei Fang
Since phylink may pass SPEED_UNKNOWN to mac_link_up, handle it explicitly by defaulting to SPEED_10, then replace the switch statement with a direct call to PCR_PSPEED_VAL(). Also update PCR_PSPEED_VAL() to use FIELD_PREP() for proper field masking instead of an open-coded shift. Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260720014317.1059359-7-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27net: enetc: use PCI device name for debugfs directoryWei Fang
enetc_create_debugfs() is called right after register_netdev(), at which point ndev->name still holds the format "eth%d" (e.g., eth0) rather than the final assigned name (e.g., via udev rules). Use pci_name() instead of netdev_name() to name the debugfs directory. The PCI device name is unique, stable, and available from the start, making it a more reliable identifier for the debugfs entry. Therefore, the observable debugfs path from something like /sys/kernel/debug/eth0/mac_filter to a PCI BDF-style path such as /sys/kernel/debug/0002:00:00.0/mac_filter. Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Joe Damato <joe@dama.to> Link: https://patch.msgid.link/20260720014317.1059359-6-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27net: enetc: improve MAFT entry management with bitmap trackingWei Fang
Replace the counter-based MAFT entry tracking (num_mfe/mac_filter_num) with a bitmap (maft_eid_bitmap) stored in struct ntmp_user, which is a more appropriate place for NTMP resource management. The bitmap approach brings two improvements. First, the entry deletion in enetc4_pf_clear_maft_entries() now checks the return value of ntmp_maft_delete_entry() and only clears the corresponding bit on success, keeping hardware and software state in sync. Previously, the counter was reset unconditionally regardless of whether the hardware deletion actually succeeded. Second, entry allocation in enetc4_pf_add_maft_entries() uses ntmp_lookup_free_eid() to find available IDs dynamically, with an upfront capacity check via bitmap_weight() to avoid partial failures. The MAFT entry count is moved into ntmp_user.maft_num_entries and initialized once during enetc4_init_ntmp_user(). Helper functions enetc4_ntmp_bitmap_init() and enetc4_ntmp_bitmap_free() manage the bitmap lifetime. The debugfs show function is updated accordingly to iterate over set bits under rtnl_lock(). Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260720014317.1059359-5-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27net: enetc: convert ndo_set_rx_mode() to ndo_set_rx_mode_async()Wei Fang
The current ndo_set_rx_mode() is called under netif_addr_lock spinlock with BHs disabled, which prevents drivers from sleeping. To work around this limitation, the enetc driver uses a dedicated workqueue to defer MAC address list updates to a sleepable context. Since commit 3554b4345d85 ("net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work") introduced the ndo_set_rx_mode_async() callback, drivers can now handle address list updates directly in a sleepable context. Therefore, convert the enetc driver to use ndo_set_rx_mode_async() and remove the dedicated workqueue and the deferred work item accordingly. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260720014317.1059359-4-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27net: enetc: extract common helpers for MAC hash filter configurationWei Fang
The PSIUMHFR and PSIMMHFR registers in ENETC v4 have the same bit layout as in ENETC v1. The only difference between the two hardware generations is the register address offsets. Since the register functionality is identical, the MAC hash filter configuration code can be shared between the ENETC v1 and v4 drivers. Extract two new common helper functions, enetc_set_si_uc_hash_filter() and enetc_set_si_mc_hash_filter(), into enetc_pf_common.c. These helpers select the correct register offset based on the hardware revision via is_enetc_rev1(). Remove v1-specific enetc_clear_mac_ht_flt() and enetc_set_mac_ht_flt() from enetc_pf.c, and v4-specific enetc4_pf_set_si_uc_hash_filter() and enetc4_pf_set_si_mc_hash_filter() from enetc4_pf.c, as they are now superseded by the shared implementations. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260720014317.1059359-3-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27net: enetc: extract common helpers for MAC promiscuous mode settingWei Fang
The PSIPMMR (Port Station Interface Promiscuous MAC Mode Register) in ENETC v4 has the same bit layout as the PSIPMR register in ENETC v1: bit n controls unicast promiscuous mode for SI n, and bit (n + 16) controls multicast promiscuous mode for SI n. The only difference between the two hardware generations is the register address offset. Since the register functionality is identical, the MAC promiscuous mode setting code can be shared between ENETC v1 and v4 drivers. Rename ENETC_PSIPMR to ENETC_PSIPMMR in enetc_hw.h to match the actual register name used in the reference manual, and extract two new common helper functions, enetc_set_si_uc_promisc() and enetc_set_si_mc_promisc(), into enetc_pf_common.c. These helpers select the correct register offset based on the hardware revision via is_enetc_rev1(). Remove the v4-specific enetc4_pf_set_si_mac_promisc() function from enetc4_pf.c and the duplicate PSIPMMR_SI_MAC_UP/MP macro definitions from enetc4_hw.h, as they are now superseded by the shared code. Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Joe Damato <joe@dama.to> Link: https://patch.msgid.link/20260720014317.1059359-2-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27Merge tag 'wireless-2026-07-26' of ↵Jakub Kicinski
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== wireless-next-2026-07-26 Mostly driver changes this time: - new driver mm81x for an S1G device - new driver nxpwifi for NXP devices (mostly forked off from mwifiex) - ath12k: much kernel infrastructure integration work - brcmfmac: DPP support, some Cypress part update - nl80211: per-link statistics support ==================== Link: https://patch.msgid.link/20260726105205.942922-60-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27vxlan: use pskb_network_may_pull() for transmit path header pullsEric Dumazet
In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was being called to verify the availability of network layer headers (ARP, IPv6/ND, IP/IPv6 MDB keys). However, during transmit skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data rather than skb_network_offset(skb) + len, which can leave part of the network header in non-linear frags. Replace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly account for the MAC header offset. Fixes: e4f67addf158 ("add DOVE extensions for VXLAN") Fixes: f564f45c4518 ("vxlan: add ipv6 proxy support") Fixes: 0f83e69f44bf ("vxlan: Add MDB data path support") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: stable@vger.kernel.org Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260723144249.759100-6-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27vxlan: use pskb_network_may_pull() in route_shortcircuit()Eric Dumazet
route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr)) (or ipv6hdr), which checks if bytes are available starting from skb->data. However, in vxlan_xmit(), skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20) only checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of IP header), leaving the rest of the IP header potentially un-pulled in non-linear frags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled linear buffer length. Fix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to the length check to ensure the full network header is present in the linear buffer. Fixes: e4f67addf158 ("add DOVE extensions for VXLAN") Cc: stable@vger.kernel.org Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20260723144249.759100-5-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27vxlan: use neigh_ha_snapshot() in route_shortcircuit()Eric Dumazet
The neighbour hardware address n->ha can be updated asynchronously by the neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without holding the seqlock loop can lead to torn reads or reading a partially updated MAC address. Use neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under read_seqbegin()/read_seqretry() lock protection before using it. Note that arp_reduce() and neigh_reduce() seem to have the same issue left for future patches. Fixes: e4f67addf158 ("add DOVE extensions for VXLAN") Cc: stable@vger.kernel.org Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20260723144249.759100-4-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27vxlan: unclone skb head before modifying eth header in route_shortcircuit()Eric Dumazet
When route_shortcircuit() performs L3 short-circuit routing, it modifies the Ethernet header of the skb in-place: memcpy(eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, dev->addr_len); memcpy(eth_hdr(skb)->h_dest, n->ha, dev->addr_len); If the incoming skb is cloned (for example by packet sockets, tcpdump, or dev_queue_xmit), modifying the Ethernet header without uncloning can corrupt the packet header for other readers holding a reference to the cloned skb. Ensure the skb header is writable and unshared by calling skb_cow_head(skb, 0) prior to updating the Ethernet header. If skb_cow_head() fails, abort short-circuiting and return false to allow standard packet processing fallback. Fixes: e4f67addf158 ("add DOVE extensions for VXLAN") Cc: stable@vger.kernel.org Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260723144249.759100-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27vxlan: re-fetch eth header after route_shortcircuit()Eric Dumazet
Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head. In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest. Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit(). Fixes: ae8840825605 ("VXLAN: Allow L2 redirection with L3 switching") Cc: stable@vger.kernel.org Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20260723144249.759100-2-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27wifi: ath12k: resolve PENDING ML peer ID from MLO_PEER_MAP HTT eventBaochen Qiang
Add ath12k_dp_peer_fixup_peer_id() and call it from the HTT_T2H_MSG_TYPE_MLO_RX_PEER_MAP handler. For devices where the firmware allocates the MLD peer ID, this is the point at which all data structures that were left with ATH12K_MLO_PEER_ID_PENDING or ATH12K_MLO_PEER_ID_INVALID get their real ID: - dp_peer->peer_id is updated and the dp_peer is published into dp_hw->dp_peers[]; - every existing dp_link_peer in dp_peer->link_peers[] gets its ml_id set to the same value; - ahsta->ml_peer_id is updated to the same value so peer_assoc, sta_state and cleanup paths see a consistent ID. Devices with host_alloc_ml_id == true also receive the same HTT event, but the firmware-reported ID always matches the host-allocated one and everything has already been populated by ath12k_dp_peer_create(); Skips the helper entirely on those devices. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221039 Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Link: https://patch.msgid.link/20260720-ath12k-fw-allocated-ml-peer-id-v2-8-630632758a80@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-27wifi: ath12k: defer dp_peer registration when firmware allocates MLD peer IDBaochen Qiang
For chips with host_alloc_ml_id=true (QCN9274 etc.), the host allocates the MLD peer ID up front; ath12k_dp_peer_create() publishes the dp_peer into dp_hw->dp_peers[] using that ID immediately. WCN7850/QCC2072 does not work that way: the firmware picks the ID and only tells the host afterwards via HTT_T2H_MSG_TYPE_MLO_RX_PEER_MAP, so the publication has to be delayed until the event arrives. Introduce ATH12K_MLO_PEER_ID_PENDING (0xFFFE) as a sentinel for "is_mlo, but ID not yet known". On the firmware-allocates path: - ath12k_mac_op_sta_state(NOTEXIST->NONE) skips ath12k_peer_ml_alloc() and stores PENDING in ahsta->ml_peer_id and dp_params.peer_id; - ath12k_dp_peer_create() skips dp_peer registration until a real ID is known; - ath12k_peer_create() leaves peer->ml_id at INVALID so consumer sites do not treat PENDING as a real ID; - ath12k_peer_ml_free() and ath12k_mac_dp_peer_cleanup() skip the dp_peers[] write and the free_ml_peer_id_map clear when host_alloc_ml_id is false or the ID is still PENDING. The HTT handler change that resolves the PENDING ID is added in a follow-up patch. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Link: https://patch.msgid.link/20260720-ath12k-fw-allocated-ml-peer-id-v2-7-630632758a80@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-27wifi: ath12k: do not advertise MLD peer ID for firmware-allocate devicesBaochen Qiang
ath12k_peer_assoc_h_mlo() unconditionally sets ml->peer_id_valid and copies ahsta->ml_peer_id (with the ATH12K_PEER_ML_ID_VALID bookkeeping bit masked off) into the WMI_PEER_ASSOC_CMDID ML params, which causes ath12k_wmi_send_peer_assoc_cmd() to set ATH12K_WMI_FLAG_MLO_PEER_ID_VALID. This needs to be gated on chips where the firmware allocates the MLD peer ID: - WCN7850/QCC2072 firmware always picks the ID itself and does not honor a host-supplied one, so the value would be silently ignored anyway; - QCC2072 firmware additionally crashes during MLO disconnect when ATH12K_WMI_FLAG_MLO_PEER_ID_VALID was set in the preceding peer assoc, so the bit must not be sent at all. Branch on ah->host_alloc_ml_id: - When true (QCN9274 etc.), behavior is unchanged: peer_id_valid is set and the raw ahsta->ml_peer_id (without the VALID bit) is sent down. - When false (WCN7850, QCC2072), peer_id_valid stays unset and ml_peer_id is sent as 0. The firmware ignores both fields and reports the ID it allocated through HTT_T2H_MSG_TYPE_MLO_RX_PEER_MAP. The early-return on ahsta->ml_peer_id == ATH12K_MLO_PEER_ID_INVALID only applies on the host-alloc path, since on the firmware-alloc path the value is ATH12K_MLO_PEER_ID_PENDING here, not INVALID. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Link: https://patch.msgid.link/20260720-ath12k-fw-allocated-ml-peer-id-v2-6-630632758a80@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-27wifi: ath12k: introduce host_alloc_ml_id hardware parameterBaochen Qiang
Different ath12k devices diverge on who allocates MLD peer id: WCN7850/QCC2072 have the firmware allocate it and notify the host via HTT_T2H_MSG_TYPE_MLO_RX_PEER_MAP event; While others let the host allocate it and pass it down through WMI_PEER_ASSOC_CMDID with ATH12K_WMI_FLAG_MLO_PEER_ID_VALID set. Currently ath12k host allocates this ID and sends it to firmware by default for all devices. This breaks WCN7850/QCC2072, because the host maintained ID may be different from the firmware-allocated one. Consequently data path may fail to find the dp peer and drop some received packets. From user point of view, this results in bugs reported in [1] or the 4-way handshake timeout issue. Add host_alloc_ml_id flag to struct ath12k_hw_params (and a copy on struct ath12k_hw for hot-path access) so subsequent patches can branch on it. Set true for QCN9274/IPQ5332/IPQ5424, false for WCN7850/QCC2072. The flag will be consumed by subsequent patches. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Link: https://bugzilla.kernel.org/show_bug.cgi?id=221039 # 1 Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Link: https://patch.msgid.link/20260720-ath12k-fw-allocated-ml-peer-id-v2-5-630632758a80@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-27wifi: ath12k: add support for HTT_T2H_MSG_TYPE_MLO_RX_PEER_MAPBaochen Qiang
Firmware on chips that allocate the MLD peer ID itself (WCN7850 and QCC2072) reports the assignment back to the host through HTT_T2H_MSG_TYPE_MLO_RX_PEER_MAP. The message carries the chosen MLD peer id, the MLD MAC address etc. Add the message type, the on-the-wire struct, the field masks and a handler that parses them out. The host-side state update (publishing the dp peer into ath12k_dp_hw::dp_peers[], propagating the ID to ath12k_dp_link_peer::ml_id and ath12k_sta::ml_peer_id) is added in a follow-up patch; Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Link: https://patch.msgid.link/20260720-ath12k-fw-allocated-ml-peer-id-v2-4-630632758a80@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-27wifi: ath12k: keep ATH12K_PEER_ML_ID_VALID set in ath12k_sta::ml_peer_idBaochen Qiang
Several pieces of host bookkeeping for MLD peer IDs encode the same fact in different ways: - ath12k_sta::ml_peer_id stores the raw ID in [0, ATH12K_MAX_MLO_PEERS); - ath12k_dp_peer::peer_id, ath12k_dp_link_peer::ml_id and the index used on ath12k_dp_hw::dp_peers[] always carry the ATH12K_PEER_ML_ID_VALID bit (BIT(13)) when the ID is real; - WMI_MLO_PEER_ASSOC_PARAMS::ml_peer_id sent down to firmware is raw, without the bookkeeping bit. The mismatch leaks into call sites that have to remember to OR the bit in (ath12k_peer_create(), ath12k_mac_op_sta_state()) or remember not to (ath12k_peer_assoc_h_mlo()). Make ath12k_sta::ml_peer_id carry the VALID bit when valid, the same way ath12k_dp_peer::peer_id and ath12k_dp_link_peer::ml_id do: - ath12k_peer_ml_alloc() OR-s the bit in once on the way out; the internal bitmap stays raw [0, ATH12K_MAX_MLO_PEERS); - ath12k_peer_create() and ath12k_mac_op_sta_state() drop the explicit OR; - ath12k_peer_assoc_h_mlo() masks the bit off when populating the WMI ml_peer_id; While there, introduce ath12k_peer_ml_free() to mirror ath12k_peer_ml_alloc(), which helps avoid code duplication. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Link: https://patch.msgid.link/20260720-ath12k-fw-allocated-ml-peer-id-v2-3-630632758a80@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-27wifi: ath12k: factor out peer assoc send-and-wait into a helperBaochen Qiang
ath12k_bss_assoc(), ath12k_mac_station_assoc() and ath12k_sta_rc_update_wk() all open-code the same sequence: reinit the peer_assoc_done completion, send the peer assoc WMI command, then wait for the firmware confirmation event. The reinit_completion() was buried in ath12k_peer_assoc_prepare(), far from the wait_for_completion_timeout() that consumes it, making the reinit/send/wait sequence hard to follow, and the three open-coded copies are easy to get out of sync. Move the sequence into a new helper ath12k_mac_peer_assoc() and call it from all three sites. The reinit, send and wait now live together so the completion's lifecycle is easy to read. While at it, ath12k_sta_rc_update_wk() previously warned but still waited the full timeout when the peer assoc command failed to send. Now a send failure returns immediately and skips the pointless 1 second wait, matching the other two callers. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Link: https://patch.msgid.link/20260720-ath12k-fw-allocated-ml-peer-id-v2-2-630632758a80@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-27wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()Baochen Qiang
ath12k_mac_dp_peer_cleanup() clears the ML peer ID slot on the free_ml_peer_id_map bitmap by indexing it with dp_peer->peer_id. That is wrong: dp_peer->peer_id for an MLO peer always carries the ATH12K_PEER_ML_ID_VALID bit (BIT(13)), so clear_bit() is invoked with index >= 0x2000, which is far outside the bitmap of ATH12K_MAX_MLO_PEERS (256) bits and corrupts memory adjacent to ah->free_ml_peer_id_map. The intended bitmap entry also never gets cleared, so subsequent ath12k_peer_ml_alloc() calls eventually run out of IDs. The ID without the VALID bit is what ath12k_peer_ml_alloc() returned and is stored in ahsta->ml_peer_id. Use that instead. While there, also reset ahsta->ml_peer_id to ATH12K_MLO_PEER_ID_INVALID so the bitmap and ahsta->ml_peer_id stay in sync. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: ee16dcf573d5 ("wifi: ath12k: Define ath12k_dp_peer structure & APIs for create & delete") Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Link: https://patch.msgid.link/20260720-ath12k-fw-allocated-ml-peer-id-v2-1-630632758a80@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-07-27thunderbolt: Drop comma after device id array terminatorUwe Kleine-König (The Capable Hub)
The usual style for other device id arrays doesn't have a comma after the initializer. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-07-27thunderbolt: Stop passing matched device ID to .probe()Uwe Kleine-König (The Capable Hub)
No driver makes use of that parameter, so drop it and don't spend the effort to determine the matching entry. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-07-27Merge 7.2-rc5 into usb-nextGreg Kroah-Hartman
We need the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-07-27mlx5: Deprecate latency-sensitive QPs featureLeon Romanovsky
New HW no longer implements a separate class for latency-sensitive QPs and advertises this by a new cap bit. Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-24veth: convert frag_list skbs before running XDPMatt Fleming
A frag_list skb can reach veth with data_len set but nr_frags zero. veth_convert_skb_to_xdp_buff() only converts skbs that are shared, locked, have frags[], or do not have enough headroom. It later uses skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and xdp_frags_size. That exposes frag_list data to XDP as if it were stored in frags[], but frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment metadata, walk an empty fragment entry, and crash in memcpy() from __xsk_rcv(). Route non-linear skbs through skb_pp_cow_data() before exposing them to XDP, and only advertise XDP frags when the resulting skb has frags[]. skb_copy_bits() already handles frag_list input, and skb_pp_cow_data() builds frags[] output with skb_add_rx_frag(), which is the representation XDP multi-buffer expects. Fixes: 718a18a0c8a6 ("veth: Rework veth_xdp_rcv_skb in order to accept non-linear skb") Cc: stable@vger.kernel.org Signed-off-by: Matt Fleming <mfleming@cloudflare.com> Reviewed-by: Toke Høiland-Jørgensen <toke@toke.dk> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260722191925.2192070-1-matt@readmodwrite.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-24octeontx2-af: add support for custom L2 headerSatheesh Paul A
Add packet parsing support for custom L2 headers. Also add support to include a field from the custom header for flow tag generation. Introduce a new flow key type NIX_FLOW_KEY_TYPE_CH_LEN_90B which maps to the NPC_LT_LA_CUSTOM_L2_90B_ETHER layer type. This extracts a 2-byte field at a 24-byte offset in layer A to be used in flow tag generation. Signed-off-by: Satheesh Paul A <psatheesh@marvell.com> Signed-off-by: Nitin Shetty J <nshettyj@marvell.com> Link: https://patch.msgid.link/20260715072035.617544-1-nshettyj@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-24net: hns: use u32 for register offset in RCB TX coalescingDaniil Agalakov
In both hns_rcb_get_tx_coalesced_frames() and hns_rcb_set_tx_coalesced_frames(), the local variable reg holds a register offset passed to dsaf_read_dev() or dsaf_write_dev(). Register offsets on this hardware are 32-bit values. Use u32 for reg to match the register access interfaces and avoid implying that 64-bit offsets are supported. Signed-off-by: Daniil Agalakov <ade@amicon.ru> Signed-off-by: Daniil Iskhakov <dish@amicon.ru> Link: https://patch.msgid.link/20260715125856.19346-1-dish@amicon.ru Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-24wifi: rtw88: disable ASPM and deep PS on ASUS TUF Gaming A15 FA506IIMihail Dimoski
The RTL8822CE on the ASUS TUF Gaming A15 FA506II wedges during normal use. The driver watchdog toggles PCIe ASPM while leaving power save; the DBI read of the ASPM link-config register fails with -EIO, the PCIe link becomes unstable, and the device drops off the bus, taking Wi-Fi down until a cold power cycle: rtw88_8822ce 0000:03:00.0: failed to read ASPM, ret=-5 rtw88_8822ce 0000:03:00.0: firmware failed to leave lps state rtw88_8822ce 0000:03:00.0: mac power on failed This is the same platform ASPM inter-operability problem already handled for other machines through rtw_pci_quirks[]. Disabling PCI ASPM and deep power save on this model stops the failure. Add a DMI quirk so the workaround is applied automatically. Signed-off-by: Mihail Dimoski <mihaildimoski@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260718124045.23493-1-mihaildimoski@gmail.com
2026-07-24wifi: rtw89: coex: Add firmware 0.27.97.X support for RTL8852CChing-Te Ku
Newer firmware is using the new TLV-Header format, without this patch it will lead driver run into length mismatch state. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717065739.64124-14-pkshih@realtek.com
2026-07-24wifi: rtw89: coex: Add wifi role info version 101Ching-Te Ku
The structure active_role which describes the using Wi-Fi role format is different with the exist v1. Add branch to cover the difference. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717065739.64124-13-pkshih@realtek.com
2026-07-24wifi: rtw89: coex: Add cycle status report version 105Ching-Te Ku
The exists version 5 format has FDDT(frequency divided training) related information. But the feature wasn't support for RTL8852C now, so firmware will not send the related reference value. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717065739.64124-12-pkshih@realtek.com
2026-07-24wifi: rtw89: coex: Add slots version 2Ching-Te Ku
Slots structure version 2 uses new TLV-Header to package slots information, patch related entry for version 2. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717065739.64124-11-pkshih@realtek.com
2026-07-24wifi: rtw89: coex: Add TDMA version 4Ching-Te Ku
TDMA version 4 uses new TLV-Header to package TDMA information, patch related entry for version 4. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717065739.64124-10-pkshih@realtek.com
2026-07-24wifi: rtw89: coex: Add firmware 0.29.133.X support for RTL8852B familyChing-Te Ku
The new firmware modified GPIO setup structure format for third party chip set I/O control & offloaded Wi-Fi TRX status to firmware for training traffic RF-Parameters & TDMA mechanism. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717065739.64124-9-pkshih@realtek.com
2026-07-24wifi: rtw89: coex: Fix Wi-Fi role info H2C command header issueChing-Te Ku
The function to filled up H2C command data is the last step in the driver, the next step is going to firmware. So the structure version number should not included driver local branch number (like firmware is v5, but driver branch to v105), it should be assigned as a explicit version number which paired with firmware. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717065739.64124-8-pkshih@realtek.com
2026-07-24wifi: rtw89: coex: Add driver info H2C command index version 103Ching-Te Ku
The 0.29.133.X firmware driver info H2C index maximum is 5, to prevent switch case fall through and send unexpected H2C commands, add version code 103 as judgment. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717065739.64124-7-pkshih@realtek.com
2026-07-24wifi: rtw89: coex: Refine chip initial related structureChing-Te Ku
Due to the firmware version become more and more, the version divided branch coding method make the related code scattered everywhere, and too much version macro, rearrange the code, assign the value to version format only when H2C commands. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717065739.64124-6-pkshih@realtek.com
2026-07-24wifi: rtw89: coex: Branch out version 105 firmware report map indexChing-Te Ku
RTL8852B in firmware 0.29.133.X do not support BT-TX-PWR report, re-index and branch out to version 105. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717065739.64124-5-pkshih@realtek.com
2026-07-24wifi: rtw89: coex: Fix unexpected grant-signal assigneeChing-Te Ku
The C2H report is for knowing what the grant-signal setting is now, not for applying new grant-signal setting. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717065739.64124-4-pkshih@realtek.com
2026-07-24wifi: rtw89: coex: Add version 9 report control infoChing-Te Ku
WiFi firmware will save its build date/time and package into C2H event then send to driver. It helps to analyze what kind of firmware was loaded now. Remove unnecessary memory set. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717065739.64124-3-pkshih@realtek.com
2026-07-24wifi: rtw89: coex: Add version 107 TX/RX info for firmware featureChing-Te Ku
The previous version 7 format is for Dual-Bluetooth using. This patch is for single Bluetooth solution using. Driver will summary Wi-Fi now status for firmware to train RF parameters & TDMA mechanism. Signed-off-by: Ching-Te Ku <ku920601@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717065739.64124-2-pkshih@realtek.com
2026-07-24wifi: rtw89: phy: set CFR to manual mode for some 2GHz channelsPing-Ke Shih
The CFR (Channel Frequency Response) manual mode condition for 2GHz is missing to limit on bandwidth for specific channels, which are channel 13 with 20MHz bandwidth and channel 11 with 40MHz bandwidth. Also add a band check to avoid affecting 5GHz/6GHz bands. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717061910.54466-10-pkshih@realtek.com
2026-07-24wifi: rtw89: 8922d: reduce IO in power-on functionPing-Ke Shih
To improve initial time, merge some IO to reduce IO times. Two registers are: 1. R_BE_SYS_PW_CTRL: 0x4[12:11]=0, 0x4[18]=1, 0x4[15]=0, and 0x4[10]=0 2. R_BE_SYS_ADIE_PAD_PWR_CTRL: Merge 0x18[6] and 0x18[5] Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717061910.54466-9-pkshih@realtek.com
2026-07-24wifi: rtw89: pci: set PCIe maximum TS1 for RTL8922DEPing-Ke Shih
Set TS1 (training sequence 1) to 1024 when PCIe enters recovery state to improve RF interference while entering and leaving L1ss. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717061910.54466-8-pkshih@realtek.com
2026-07-24wifi: rtw89: wow: extend timeout unit to avoid SER false alarmPing-Ke Shih
With original timeout unit, it might trigger SER false alarm causing WiFi card lost. Extend timeout unit to avoid wrong SER. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717061910.54466-7-pkshih@realtek.com
2026-07-24wifi: rtw89: 8922d: bypass TXIQK when scanChih-Kang Chang
When connected to an AP and a scan is triggered, the FW may fail to transmit probe request because switching channels may load an uninitialized TXIQK table. Therefore, bypass TXIQK during scanning to avoid using invalid calibration values. Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717061910.54466-6-pkshih@realtek.com
2026-07-24wifi: rtw89: rfk: update TXIQK H2C command format to v1Chih-Kang Chang
TX IQK is a RF calibration, the v1 format adds a field for the thermal re-calibration parameter for RTL8922D after FW 0.35.113.0. Update the format accordingly. Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717061910.54466-5-pkshih@realtek.com
2026-07-24wifi: rtw89: 8852cu: add quirk to disable 2.4 GHz bandDavid Lee
Add RTW89_QUIRK_DISABLE_2GHZ to the rtw89_quirks enum to allow per-device suppression of the 2.4 GHz band. Apply the quirk only for the 0x28de:0x2432 (VID:PID) USB device, which operates only in 5/6 GHz bands. Signed-off-by: David Lee <sc.lee@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20260717061910.54466-4-pkshih@realtek.com
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-19 12:06:02 +0000