summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)Author
2025-10-21net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditionsAksh Garg
Resolve race conditions in timestamp events list handling between TX and RX paths causing missed timestamps. The current implementation uses a single events list for both TX and RX timestamps. The am65_cpts_find_ts() function acquires the lock, splices all events (TX as well as RX events) to a temporary list, and releases the lock. This function performs matching of timestamps for TX packets only. Before it acquires the lock again to put the non-TX events back to the main events list, a concurrent RX processing thread could acquire the lock (as observed in practice), find an empty events list, and fail to attach timestamp to it, even though a relevant event exists in the spliced list which is yet to be restored to the main list. Fix this by creating separate events lists to handle TX and RX timestamps independently. Fixes: c459f606f66df ("net: ethernet: ti: am65-cpts: Enable RX HW timestamp for PTP packets using CPTS FIFO") Signed-off-by: Aksh Garg <a-garg7@ti.com> Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com> Link: https://patch.msgid.link/20251016115755.1123646-1-a-garg7@ti.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-10-21wifi: rtl8xxxu: Use correct power off sequence for RTL8192CUBitterblue Smith
RTL8192CU disappears and reappears when rtl8xxxu is unloaded: usbcore: deregistering interface driver rtl8xxxu wlp3s0f3u2: deauthenticating from ... by local choice (Reason: 3=DEAUTH_LEAVING) usb 1-2: rtl8xxxu_active_to_emu: Disabling MAC timed out usb 1-2: USB disconnect, device number 7 usb 1-2: disconnecting usb 1-2: new high-speed USB device number 8 using xhci_hcd usb 1-2: New USB device found, idVendor=0bda, idProduct=8178, bcdDevice= 2.00 usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-2: Product: 802.11n WLAN Adapter usb 1-2: Manufacturer: Realtek usb 1-2: SerialNumber: 00e04c000001 This is because rtl8xxxu is using the power off sequence for RTL8723AU. Add the correct power off sequence for RTL8192CU. rtl8xxxu_power_off(), rtl8xxxu_active_to_emu(), and rtl8xxxu_emu_to_disabled() are now only used for RTL8723AU, so move them to 8723a.c and rename them to have the "rtl8723au" prefix. Tested only with RTL8192CU. Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Reviewed-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/b9d3f137-12ce-4bd9-8ada-3b8874bc3615@gmail.com
2025-10-21wifi: rtl8xxxu: Dump the efuse right after reading itBitterblue Smith
Someone reported a problem with their TP-Link WN722N (RTL8188EUS): usb 1-1: This Realtek USB WiFi dongle (0x2357:0x010c) is untested! usb 1-1: Please report results to Jes.Sorensen@gmail.com usb 1-1: Fatal - failed to parse EFuse rtl8xxxu: probe of 1-1:1.0 failed with error -22 This error can happen when the first two bytes of the efuse don't have the expected magic value of 0x8129. In a situation like this it could be useful to see the contents of the efuse. Dump the efuse right after reading it, before trying to parse it. Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Reviewed-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/1f544dc4-17f6-4401-995d-5cb4567b82fa@gmail.com
2025-10-21wifi: rtl8xxxu: Report the signal strength only if it's knownBitterblue Smith
These chips don't report the signal strength for many (any?) data frames. When the signal strength is not known, set RX_FLAG_NO_SIGNAL_VAL in order to avoid reporting a signal strength of 0. Tested with RTL8192FU and RTL8192CU. Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com> Reviewed-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/cdbe1a18-f6f1-4575-bad9-e85db8101247@gmail.com
2025-10-21wifi: rtw89: Replace hardcoded strings with helper functionsYu-Chun Lin
Replace hardcoded strings with 'str_on_off()', 'str_enable_disable()', and 'str_read_write()'. The change improves readability. Signed-off-by: Yu-Chun Lin <eleanor15x@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20250930000545.2192692-1-eleanor15x@gmail.com
2025-10-21wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1Zenm Chen
Add USB ID 2001:3329 for D-Link AC13U rev. A1 which is a RTL8812CU-based Wi-Fi adapter. Compile tested only. Cc: stable@vger.kernel.org # 6.6.x Signed-off-by: Zenm Chen <zenmchen@gmail.com> Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20250929035719.6172-2-zenmchen@gmail.com
2025-10-21wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1Zenm Chen
Add USB ID 2001:3328 for D-Link AN3U rev. A1 which is a RTL8192FU-based Wi-Fi adapter. Compile tested only. Cc: stable@vger.kernel.org # 6.6.x Signed-off-by: Zenm Chen <zenmchen@gmail.com> Reviewed-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Link: https://patch.msgid.link/20250929035719.6172-1-zenmchen@gmail.com
2025-10-20Merge tag 'linux-can-next-for-6.19-20251017' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2025-10-17 The first patch is by me and adds support for an optional reset to the m_can drivers. Vincent Mailhol's patch targets all drivers and removes the can_change_mtu() function, since the netdev's min and max MTU are populated. Markus Schneider-Pargmann contributes 4 patches to the m_can driver to add am62 wakeup support. The last 7 patches are by me and provide various cleanups to the m_can driver. * tag 'linux-can-next-for-6.19-20251017' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next: can: m_can: m_can_get_berr_counter(): don't wake up controller if interface is down can: m_can: m_can_tx_submit(): remove unneeded sanity checks can: m_can: m_can_class_register(): remove error message in case devm_kzalloc() fails can: m_can: m_can_interrupt_enable(): use m_can_write() instead of open coding it net: m_can: convert dev_{dbg,info,err} -> netdev_{dbg,info,err} can: m_can: hrtimer_callback(): rename to m_can_polling_timer() can: m_can: m_can_init_ram(): make static can: m_can: Support pinctrl wakeup state can: m_can: Return ERR_PTR on error in allocation can: m_can: Map WoL to device_set_wakeup_enable dt-bindings: can: m_can: Add wakeup properties can: treewide: remove can_change_mtu() can: m_can: add support for optional reset ==================== Link: https://patch.msgid.link/20251017150819.1415685-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20e1000e: Introduce private flag to disable K1Vitaly Lifshits
The K1 state reduces power consumption on ICH family network controllers during idle periods, similarly to L1 state on PCI Express NICs. Therefore, it is recommended and enabled by default. However, on some systems it has been observed to have adverse side effects, such as packet loss. It has been established through debug that the problem may be due to firmware misconfiguration of specific systems, interoperability with certain link partners, or marginal electrical conditions of specific units. These problems typically cannot be fixed in the field, and generic workarounds to resolve the side effects on all systems, while keeping K1 enabled, were found infeasible. Therefore, add the option for users to globally disable K1 idle state on the adapter. Additionally, disable K1 by default for MTL and later platforms, due to issues reported with the current configuration. Link: https://lore.kernel.org/intel-wired-lan/CAMqyJG3LVqfgqMcTxeaPur_Jq0oQH7GgdxRuVtRX_6TTH2mX5Q@mail.gmail.com/ Link: https://lore.kernel.org/intel-wired-lan/20250626153544.1853d106@onyx.my.domain/ Link: https://lore.kernel.org/intel-wired-lan/Z_z9EjcKtwHCQcZR@mail-itl/ Link: https://github.com/QubesOS/qubes-issues/issues/9896 Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2115393 Signed-off-by: Vitaly Lifshits <vitaly.lifshits@intel.com> Reviewed-by: Timo Teräs <timo.teras@iki.fi> Tested-by: Timo Teräs <timo.teras@iki.fi> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Dima Ruinskiy <dima.ruinskiy@intel.com> Tested-by: Avraham Koren <Avrahamx.koren@intel.com> Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20251016-jk-iwl-next-2025-10-15-v2-14-ff3a390d9fc6@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20ice: refactor to use helpersJesse Brandeburg
Use the ice_netdev_to_pf() helper in more places and remove a bunch of boilerplate code. Not every instance could be replaced due to use of the netdev_priv() output or the vsi variable within a bunch of functions. Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Rinitha S <sx.rinitha@intel.com> Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20251016-jk-iwl-next-2025-10-15-v2-12-ff3a390d9fc6@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20ice: implement transmit hardware timestamp statisticsJesse Brandeburg
The kernel now has common statistics for transmit timestamps, so implement them in the ice driver. use via ethtool -I -T eth0 Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Jakub Kicinski <kuba@kernel.org> Reviewed-by: Hariprasad Kelam <hkelam@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Rinitha S <sx.rinitha@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20251016-jk-iwl-next-2025-10-15-v2-11-ff3a390d9fc6@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20ice: add tracking of good transmit timestampsJesse Brandeburg
As a pre-requisite to implementing timestamp statistics, start tracking successful PTP timestamps. There already existed a trace event, but add a counter as well so it can be displayed by the next patch. Good count is a u64 as it is much more likely to be incremented. The existing error stats are all u32 as before, and are less likely so will wrap less. Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Jakub Kicinski <kuba@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Rinitha S <sx.rinitha@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20251016-jk-iwl-next-2025-10-15-v2-10-ff3a390d9fc6@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20ice: implement ethtool standard statsJesse Brandeburg
Add support for MAC/pause/RMON stats. This enables reporting hardware statistics in a common way via: ethtool -S eth0 --all-groups and ethtool --include-statistics --show-pause eth0 While doing so, add support for one new stat, receive length error (RLEC), which is extremely unlikely to happen since most L2 frames have a type/length field specifying a "type", and raw ethernet frames aren't used much any longer. NOTE: I didn't implement Ctrl aka control frame stats because the hardware doesn't seem to implement support. Reviewed-by: Marcin Szycik <marcin.szycik@linux.intel.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Jakub Kicinski <kuba@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Tested-by: Rinitha S <sx.rinitha@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20251016-jk-iwl-next-2025-10-15-v2-9-ff3a390d9fc6@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20gve: Consolidate and persist ethtool ring changesAnkit Garg
Refactor the ethtool ring parameter configuration logic to address two issues: unnecessary queue resets and lost configuration changes when the interface is down. Previously, `gve_set_ringparam` could trigger multiple queue destructions and recreations for a single command, as different settings (e.g., header split, ring sizes) were applied one by one. Furthermore, if the interface was down, any changes made via ethtool were discarded instead of being saved for the next time the interface was brought up. This patch centralizes the configuration logic. Individual functions like `gve_set_hsplit_config` are modified to only validate and stage changes in a temporary config struct. The main `gve_set_ringparam` function now gathers all staged changes and applies them as a single, combined configuration: 1. If the interface is up, it calls `gve_adjust_config` once. 2. If the interface is down, it saves the settings directly to the driver's private struct, ensuring they persist and are used when the interface is brought back up. Signed-off-by: Ankit Garg <nktgrg@google.com> Reviewed-by: Harshitha Ramamurthy <hramamurthy@google.com> Reviewed-by: Jordan Rhee <jordanrhee@google.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Joshua Washington <joshwash@google.com> Link: https://patch.msgid.link/20251017012614.3631351-1-joshwash@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQAmery Hung
XDP programs can change the layout of an xdp_buff through bpf_xdp_adjust_tail() and bpf_xdp_adjust_head(). Therefore, the driver cannot assume the size of the linear data area nor fragments. Fix the bug in mlx5 by generating skb according to xdp_buff after XDP programs run. Currently, when handling multi-buf XDP, the mlx5 driver assumes the layout of an xdp_buff to be unchanged. That is, the linear data area continues to be empty and fragments remain the same. This may cause the driver to generate erroneous skb or triggering a kernel warning. When an XDP program added linear data through bpf_xdp_adjust_head(), the linear data will be ignored as mlx5e_build_linear_skb() builds an skb without linear data and then pull data from fragments to fill the linear data area. When an XDP program has shrunk the non-linear data through bpf_xdp_adjust_tail(), the delta passed to __pskb_pull_tail() may exceed the actual nonlinear data size and trigger the BUG_ON in it. To fix the issue, first record the original number of fragments. If the number of fragments changes after the XDP program runs, rewind the end fragment pointer by the difference and recalculate the truesize. Then, build the skb with the linear data area matching the xdp_buff. Finally, only pull data in if there is non-linear data and fill the linear part up to 256 bytes. Fixes: f52ac7028bec ("net/mlx5e: RX, Add XDP multi-buffer support in Striding RQ") Signed-off-by: Amery Hung <ameryhung@gmail.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/1760644540-899148-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQAmery Hung
XDP programs can release xdp_buff fragments when calling bpf_xdp_adjust_tail(). The driver currently assumes the number of fragments to be unchanged and may generate skb with wrong truesize or containing invalid frags. Fix the bug by generating skb according to xdp_buff after the XDP program runs. Fixes: ea5d49bdae8b ("net/mlx5e: Add XDP multi buffer support to the non-linear legacy RQ") Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Amery Hung <ameryhung@gmail.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/1760644540-899148-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20funeth: convert to ndo_hwtstamp APIVadim Fedorenko
Convert driver to use .ndo_hwtstamp_get()/.ndo_hwtstamp_set() callbacks. .ndo_eth_ioctl() implementation becomes empty, remove it. Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20251016152515.3510991-8-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20tsnep: convert to ndo_hwtstatmp APIVadim Fedorenko
Convert to .ndo_hwtstamp_get()/.ndo_hwtstamp_set() callbacks. After conversions the rest of tsnep_netdev_ioctl() becomes pure phy_do_ioctl_running(), so remove tsnep_netdev_ioctl() and replace it with phy_do_ioctl_running() in .ndo_eth_ioctl. Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Gerhard Engleder <gerhard@engleder-embedded.com> Link: https://patch.msgid.link/20251016152515.3510991-7-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20cxgb4: convert to ndo_hwtstamp APIVadim Fedorenko
Convert to use .ndo_hwtstamp_get()/.ndo_hwtstamp_set() callbacks. There is some change in the logic as well. Previously, the driver was storing newly requested configuration regardless of whether it was applied or not. In case of request validation error, inconsistent configuration would be returned by the driver. New logic stores configuration only if was properly validated and applied. It brings the consistency between reported and actual configuration. Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20251016152515.3510991-6-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: atlantic: convert to ndo_hwtstamp APIVadim Fedorenko
Convert driver to .ndo_hwtstamp_get()/.ndo_hwtstamp_set() callbacks. .ndo_eth_ioctl() becomes empty so remove it. Also simplify code with no functional changes. Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20251016152515.3510991-5-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20amd-xgbe: convert to ndo_hwtstamp callbacksVadim Fedorenko
Convert driver to use .ndo_hwtstamp_get()/.ndo_hwtstamp_set() callbacks. .ndo_eth_ioctl() becomes empty function, remove it. Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20251016152515.3510991-4-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20ti: icssg: convert to ndo_hwtstamp APIVadim Fedorenko
Convert driver to use .ndo_hwtstamp_get()/.ndo_hwtstamp_set() API. .ndo_eth_ioctl() implementation becomes pure phy_do_ioctl(), remove it from common module, remove exported symbol and replace ndo callback. Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20251016152515.3510991-3-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: ti: am65-cpsw: move hw timestamping to ndo callbackVadim Fedorenko
Migrate driver to new API for HW timestamping. Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20251016152515.3510991-2-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: stmmac: convert to phylink PCS supportRussell King (Oracle)
Now that stmmac's PCS support is much more simple - just a matter of configuring the control register - the basic conversion to phylink PCS support becomes straight forward. Create the infrastructure to setup a phylink_pcs instance for the integrated PCS: - add a struct stmmac_pcs to encapsulate the phylink_pcs structure, pointer to stmmac_priv, and the core-specific base address of the PCS registers. - modify stmmac_priv and stmmac_mac_select_pcs() to return the embedded phylink_pcs structure when setup and STMMAC_PCS_SGMII is in use, and move the comment from stmmac_hw_setup() to here. - create stmmac_pcs.c, which contains the phylink_pcs_ops structure, a dummy .pcs_get_state() method which always reports link-down, and .pcs_config() method, moving the call to stmmac_pcs_ctrl_ane() here, but without indirecting through the dwmac specific core code. The link-down behaviour mentioned above maintains the current behaviour when phylink is used with inband but without a PCS. This will ensure that the PCS control register is configured to the same settings as before, but will now happen when the netdev is opened or reusmed rather than only during probe time. However, this will be before the .fix_mac_speed() method is called, which is critical for the behaviour in dwmac-qcom-ethqos's ethqos_configure_sgmii() function to be maintained. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/E1v9P72-0000000AomR-3ro4@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: stmmac: provide PCS initialisation hookRussell King (Oracle)
dwmac cores provide a feature bit to indicate when the PCS block is present, but features are only read after the core's setup() function has been called, meaning we can't decide whether to initialise the integrated PCS in the setup function. Provide a new MAC core hook for PCS initialisation, which will be called after the feature registers have been read. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/E1v9P6x-0000000AomL-3OKd@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: stmmac: only call stmmac_pcs_ctrl_ane() for integrated SGMII PCSRussell King (Oracle)
The internal PCS registers only exist if the core is synthesized with SGMII, TBI or RTBI support. They have no relevance for RGMII. However, priv->hw->pcs contains a STMMAC_PCS_RGMII flag, which is set if a PCS has been synthesized but we are operating in RGMII mode. As the register has no effect for RGMII, there is no point calling stmmac_pcs_ctrl_ane() in this case. Add a comment describing this and make it conditional on STMMAC_PCS_SGMII. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/E1v9P6s-0000000AomE-2pAa@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: stmmac: do not require snps,ps-speed for SGMIIRussell King (Oracle)
SGMII mode does not require port-speed to be specified; this only switches SGMII to use the MAC configuration register speed settings and the actual value is irrelevant when the link comes up. As it seems the intention was to support "reverse SGMII" with this setting, but the code didn't actually configure that due to a typo, the warning and bad DT binding documentation has led people to specify snps,ps-speed in their DT files inappropriately. If mac_port_sel_speed is zero, then don't complain that the speed is invalid, as this means we're using "normal" SGMII. This does _not_ obsolete snps,ps-speed, nor does it change the behaviour of that property, with the exception of not making people mistakenly believe that they need to specify this option to use normal SGMII. There is no need to modify the binding. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/E1v9P6n-0000000Aom9-2LuZ@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: stmmac: hw->ps becomes hw->reverse_sgmii_enableRussell King (Oracle)
After a lot of digging, it seems that the oddly named hw->ps member is all about setting the core into reverse SGMII speed. When set to a non-zero value, it: 1. Configures the MAC at initialisation time to operate at a specific speed. 2. It _incorrectly_ enables the transmitter (GMAC_CONFIG_TE) which makes no sense, rather than enabling the "transmit configuration" bit (GMAC_CONFIG_TC). 3. It configures the SGMII rate adapter layer to retrieve its speed setting from the MAC configuration register rather than the PHY. In the previous commit, we removed (1) and (2) as phylink overwrites the configuration set at that step. Thus, the only functional aspect is (3), which is a boolean operation. This means there is no need to store the actual speed, and just have a boolean flag. Convert the priv->ps member to a boolean, and rename it to priv->reverse_sgmii_enable to make it more understandable. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/E1v9P6i-0000000Aom3-1y2y@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: stmmac: simplify stmmac_check_pcs_mode()Russell King (Oracle)
Now that we only support one mode, simplify stmmac_check_pcs_mode(). Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/E1v9P6d-0000000Aolw-1T7d@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: stmmac: move reverse-"pcs" mode setup to stmmac_check_pcs_mode()Russell King (Oracle)
The broken reverse-mode, selected by snps,ps-speed, is configured when the platform provides a valid port speed and a PCS is being used. Both these remain constant after the driver has probed, so the software state doesn't need to be re-initialised each time stmmac_hw_setup() is called (which is called at open and resume time.) Move the software setup of reverse-mode to stmmac_check_pcs_mode() which is called from the driver probe function. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/E1v9P6Y-0000000Aolr-0vLH@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: stmmac: remove RGMII "pcs" modeRussell King (Oracle)
Remove the RGMII "pcs" code in stmmac_check_pcs_mode() due to: 1) This should never have been conditional on a PCS being present, as when a core is synthesised using only RGMII, the PCS won't be present and priv->dma_cap.pcs will be false. Only multi-interface cores which have a PCS present would have detected RGMII. 2) STMMAC_PCS_RGMII has no effect since the broken netif_carrier and ethtool code was removed. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/E1v9P6T-0000000Aoll-0Ify@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: stmmac: remove hw->ps xxx_core_init() hardware setupRussell King (Oracle)
After a lot of digging, it seems that the oddly named hw->ps member is all about configuring the core for reverse SGMII. This member is set to one of 0, SPEED_10, SPEED_100 or SPEED_1000 depending on priv->plat->mac_port_sel_speed. On DT systems, this comes from the "snps,ps-speed" DT property. When set to a non-zero value, it: 1. Configures the MAC at initialisation time to operate at a specific speed. However, this will be overwritten by mac_link_up() when the link comes up (e.g. with the fixed-link parameters.) Note that dwxgmac2 wants to also support SPEED_2500 and SPEED_10000, but both these values are impossible. 2. It _incorrectly_ enables the transmitter (GMAC_CONFIG_TE) which makes no sense, rather than enabling the "transmit configuration" bit (GMAC_CONFIG_TC). Likely a typo. 3. It configures the SGMII rate adapter layer to retrieve its speed setting from the MAC configuration register rather than the PHY. There are two ways forward here: a) fixing (2) so that we set GMAC_CONFIG_TC. However, we have platform that set the "snps,ps-speed" property and that work today. Fixing this will cause the RGMII, SGMII or SMII inband configuration to be transmitted, which will be a functional change which could cause a regression. b) ripping out (1) and (2) as they are ineffective. This also has the possibility of regressions, but the patch author believes this risk is much lower than (a). Therefore, this commit takes the approach in (b). Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/E1v9P6N-0000000Aolg-3y0a@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: stmmac: remove unused PCS loopback supportRussell King (Oracle)
Nothing calls stmmac_pcs_ctrl_ane() with the "loopback" argument set to anything except zero, so this serves no useful purpose. Remove the argument to reduce the code complexity. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/E1v9P6I-0000000Aola-3Sih@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: stmmac: remove PCS "mode" pause handlingRussell King (Oracle)
Remove the "we always autoneg pause" forcing when the stmmac driver decides that a "PCS" is present, which blocks passing the ethtool pause calls to phylink when using SGMII mode. This prevents the pause results being reported when a PHY is attached using SGMII mode, or the pause settings being changed in SGMII mode. There is no reason to prevent this. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/E1v9P6D-0000000AolU-2zjv@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: stmmac: remove SGMII/RGMII/SMII interrupt handlingRussell King (Oracle)
Now that the only use for the interrupt is to clear it and increment a statistic counter (which is not that relevant anymore) remove all this code and ensure that the interrupt remains disabled to avoid a stuck interrupt. dwmac-sun8i still uses this statistic counter, so it is inappropriate for this patch to remove it. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/E1v9P68-0000000AolO-2W5s@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: stmmac: remove xstats.pcs_* membersRussell King (Oracle)
As a result of the previous commit, the pcs_link, pcs_duplex and pcs_speed members are not used outside of the interrupt handling code, and are only used to print their status using the misleading "Link is" messages that bear no relation to the actual status of the link. Remove the printing of these messages, these members, and the code that decodes them from the hardware. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/E1v9P63-0000000AolI-23Kf@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: stmmac: remove broken PCS codeRussell King (Oracle)
Changing the netif_carrier_*() state behind phylink's back has always been prohibited because it messes up with phylinks state tracking, and means that phylink no longer guarantees to call the mac_link_down() and mac_link_up() methods at the appropriate times. This was later documented in the sfp-phylink network driver conversion guide. stmmac was converted to phylink in 2019, but nothing was done with the "PCS" code. Since then, apart from the updates as part of phylink development, nothing has happened with stmmac to improve its use of phylink, or even to address this point. A couple of years ago, a has_integrated_pcs boolean was added by Bart, which later became the STMMAC_FLAG_HAS_INTEGRATED_PCS flag, to avoid manipulating the netif_carrier_*() state. This flag is mis-named, because whenever the stmmac is synthesized for its native SGMII, TBI or RTBI interfaces, it has an "integrated PCS". This boolean/flag actually means "ignore the status from the integrated PCS". Discussing with Bart, the reasons for this are lost to the winds of time (which is why we should always document the reasons in the commit message.) RGMII also has in-band status, and the dwmac cores and stmmac code supports this but with one bug that saves the day. When dwmac cores are synthesised for RGMII only, they do not contain an integrated PCS, and so priv->dma_cap.pcs is clear, which prevents (incorrectly) the "RGMII PCS" being used, meaning we don't read the in-band status. However, a core synthesised for RGMII and also SGMII, TBI or RTBI will have this capability bit set, thus making these code paths reachable. The Jetson Xavier NX uses RGMII mode to talk to its PHY, and removing the incorrect check for priv->dma_cap.pcs reveals the theortical issue with netif_carrier_*() manipulation is real: dwc-eth-dwmac 2490000.ethernet eth0: Register MEM_TYPE_PAGE_POOL RxQ-0 dwc-eth-dwmac 2490000.ethernet eth0: PHY [stmmac-0:00] driver [RTL8211F Gigabit Ethernet] (irq=141) dwc-eth-dwmac 2490000.ethernet eth0: No Safety Features support found dwc-eth-dwmac 2490000.ethernet eth0: IEEE 1588-2008 Advanced Timestamp supported dwc-eth-dwmac 2490000.ethernet eth0: registered PTP clock dwc-eth-dwmac 2490000.ethernet eth0: configuring for phy/rgmii-id link mode 8021q: adding VLAN 0 to HW filter on device eth0 dwc-eth-dwmac 2490000.ethernet eth0: Adding VLAN ID 0 is not supported Link is Up - 1000/Full Link is Down Link is Up - 1000/Full This looks good until one realises that the phylink "Link" status messages are missing, even when the RJ45 cable is reconnected. Nothing one can do results in the interface working. The interrupt handler (which prints those "Link is" messages) always wins over phylink's resolve worker, meaning phylink never calls the mac_link_up() nor mac_link_down() methods. eth0 also sees no traffic received, and is unable to obtain a DHCP address: 3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group defa ult qlen 1000 link/ether e6:d3:6a:e6:92:de brd ff:ff:ff:ff:ff:ff RX: bytes packets errors dropped overrun mcast 0 0 0 0 0 0 TX: bytes packets errors dropped carrier collsns 27686 149 0 0 0 0 With the STMMAC_FLAG_HAS_INTEGRATED_PCS flag set, which disables the netif_carrier_*() manipulation then stmmac works normally: dwc-eth-dwmac 2490000.ethernet eth0: Register MEM_TYPE_PAGE_POOL RxQ-0 dwc-eth-dwmac 2490000.ethernet eth0: PHY [stmmac-0:00] driver [RTL8211F Gigabit Ethernet] (irq=141) dwc-eth-dwmac 2490000.ethernet eth0: No Safety Features support found dwc-eth-dwmac 2490000.ethernet eth0: IEEE 1588-2008 Advanced Timestamp supported dwc-eth-dwmac 2490000.ethernet eth0: registered PTP clock dwc-eth-dwmac 2490000.ethernet eth0: configuring for phy/rgmii-id link mode 8021q: adding VLAN 0 to HW filter on device eth0 dwc-eth-dwmac 2490000.ethernet eth0: Adding VLAN ID 0 is not supported Link is Up - 1000/Full dwc-eth-dwmac 2490000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx and packets can be transferred. This clearly shows that when priv->hw->pcs is set, but STMMAC_FLAG_HAS_INTEGRATED_PCS is clear, the driver reliably fails. Discovering whether a platform falls into this is impossible as parsing all the dtsi and dts files to find out which use the stmmac driver, whether any of them use RGMII or SGMII and also depends whether an external interface is being used. The kernel likely doesn't contain all dts files either. The only driver that sets this flag uses the qcom,sa8775p-ethqos compatible, and uses SGMII or 2500BASE-X. but these are saved from this problem by the incorrect check for priv->dma_cap.pcs. So, we have to assume that for every other platform that uses SGMII with stmmac is using an external PCS. Moreover, ethtool output can be incorrect. With the full-duplex link negotiated, ethtool reports: Speed: 1000Mb/s Duplex: Half because with dwmac4, the full-duplex bit is in bit 16 of the status, priv->xstats.pcs_duplex becomes BIT(16) for full duplex, but the ethtool ksettings duplex member is u8 - so becomes zero. Moreover, the supported, advertised and link partner modes are all "not reported". Finally, ksettings_set() won't be able to set the advertisement on a PHY if this PCS code is activated, which is incorrect when SGMII is used with a PHY. Thus, remove: 1. the incorrect netif_carrier_*() manipulation. 2. the broken ethtool ksettings code. Given that all uses of STMMAC_FLAG_HAS_INTEGRATED_PCS are now gone, remove the flag from stmmac.h and dwmac-qcom-ethqos.c. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/E1v9P5y-0000000AolC-1QWH@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: phy: micrel: fix typos in commentsAlok Tiwari
Fix several spelling and grammatical errors in comments across micrel PHY drivers. Corrections include: - "dealy" -> "delay" - "autonegotation" -> "autonegotiation" - "recheas" -> "reaches" - "one" -> "on" - "improvenent" -> "improvement" - "intput" -> "input" Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20251017193525.1457064-2-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20net: phy: micrel: simplify return in ksz9477_phy_errata()Alok Tiwari
ksz9477_phy_errata function currently assigns the return value of genphy_restart_aneg() to a variable and then immediately returns it err = genphy_restart_aneg(phydev); if (err) return err; return err; This can be simplified by directly returning the function call result, as the intermediate variable and conditional are redundant. Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20251017193525.1457064-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-20can: netlink: can_changelink(): allow disabling of automatic restartMarc Kleine-Budde
Since the commit c1f3f9797c1f ("can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode"), the automatic restart delay can only be set for devices that implement the restart handler struct can_priv::do_set_mode. As it makes no sense to configure a automatic restart for devices that doesn't support it. However, since systemd commit 13ce5d4632e3 ("network/can: properly handle CAN.RestartSec=0") [1], systemd-networkd correctly handles a restart delay of "0" (i.e. the restart is disabled). Which means that a disabled restart is always configured in the kernel. On systems with both changes active this causes that CAN interfaces that don't implement a restart handler cannot be brought up by systemd-networkd. Solve this problem by allowing a delay of "0" to be configured, even if the device does not implement a restart handler. [1] https://github.com/systemd/systemd/commit/13ce5d4632e395521e6205c954493c7fc1c4c6e0 Cc: stable@vger.kernel.org Cc: Andrei Lalaev <andrey.lalaev@gmail.com> Reported-by: Marc Kleine-Budde <mkl@pengutronix.de> Closes: https://lore.kernel.org/all/20251020-certain-arrogant-vole-of-sunshine-141841-mkl@pengutronix.de Fixes: c1f3f9797c1f ("can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode") Link: https://patch.msgid.link/20251020-netlink-fix-restart-v1-1-3f53c7f8520b@pengutronix.de Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-10-20can: rockchip-canfd: rkcanfd_start_xmit(): use can_dev_dropped_skb() instead ↵Marc Kleine-Budde
of can_dropped_invalid_skb() In addition to can_dropped_invalid_skb(), the helper function can_dev_dropped_skb() checks whether the device is in listen-only mode and discards the skb accordingly. Replace can_dropped_invalid_skb() by can_dev_dropped_skb() to also drop skbs in for listen-only mode. Reported-by: Marc Kleine-Budde <mkl@pengutronix.de> Closes: https://lore.kernel.org/all/20251017-bizarre-enchanted-quokka-f3c704-mkl@pengutronix.de/ Fixes: ff60bfbaf67f ("can: rockchip_canfd: add driver for Rockchip CAN-FD controller") Link: https://patch.msgid.link/20251017-fix-skb-drop-check-v1-3-556665793fa4@pengutronix.de Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-10-20can: esd: acc_start_xmit(): use can_dev_dropped_skb() instead of ↵Marc Kleine-Budde
can_dropped_invalid_skb() In addition to can_dropped_invalid_skb(), the helper function can_dev_dropped_skb() checks whether the device is in listen-only mode and discards the skb accordingly. Replace can_dropped_invalid_skb() by can_dev_dropped_skb() to also drop skbs in for listen-only mode. Reported-by: Marc Kleine-Budde <mkl@pengutronix.de> Closes: https://lore.kernel.org/all/20251017-bizarre-enchanted-quokka-f3c704-mkl@pengutronix.de/ Fixes: 9721866f07e1 ("can: esd: add support for esd GmbH PCIe/402 CAN interface family") Link: https://patch.msgid.link/20251017-fix-skb-drop-check-v1-2-556665793fa4@pengutronix.de Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-10-20can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of ↵Marc Kleine-Budde
can_dropped_invalid_skb() In addition to can_dropped_invalid_skb(), the helper function can_dev_dropped_skb() checks whether the device is in listen-only mode and discards the skb accordingly. Replace can_dropped_invalid_skb() by can_dev_dropped_skb() to also drop skbs in for listen-only mode. Reported-by: Marc Kleine-Budde <mkl@pengutronix.de> Closes: https://lore.kernel.org/all/20251017-bizarre-enchanted-quokka-f3c704-mkl@pengutronix.de/ Fixes: f00647d8127b ("can: bxcan: add support for ST bxCAN controller") Link: https://patch.msgid.link/20251017-fix-skb-drop-check-v1-1-556665793fa4@pengutronix.de Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-10-20Merge tag 'iwlwifi-fixes-2025-10-19' of ↵Johannes Berg
https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi fix avoid use after free ==================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-10-20wifi: brcmfmac: fix crash while sending Action Frames in standalone AP ModeGokul Sivakumar
Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to firmware. The P2P interfaces were available when wpa_supplicant is managing the wlan interface. However, the P2P interfaces are not created/initialized when only hostapd is managing the wlan interface. And if hostapd receives an ANQP Query REQ Action frame even from an un-associated STA, the brcmfmac driver tries to use an uninitialized P2P vif pointer for sending the IOVAR to firmware. This NULL pointer dereferencing triggers a driver crash. [ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 1417.075653] Call trace: [ 1417.075662] brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac] [ 1417.075738] brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac] [ 1417.075810] cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211] [ 1417.076067] nl80211_tx_mgmt+0x238/0x388 [cfg80211] [ 1417.076281] genl_family_rcv_msg_doit+0xe0/0x158 [ 1417.076302] genl_rcv_msg+0x220/0x2a0 [ 1417.076317] netlink_rcv_skb+0x68/0x140 [ 1417.076330] genl_rcv+0x40/0x60 [ 1417.076343] netlink_unicast+0x330/0x3b8 [ 1417.076357] netlink_sendmsg+0x19c/0x3f8 [ 1417.076370] __sock_sendmsg+0x64/0xc0 [ 1417.076391] ____sys_sendmsg+0x268/0x2a0 [ 1417.076408] ___sys_sendmsg+0xb8/0x118 [ 1417.076427] __sys_sendmsg+0x90/0xf8 [ 1417.076445] __arm64_sys_sendmsg+0x2c/0x40 [ 1417.076465] invoke_syscall+0x50/0x120 [ 1417.076486] el0_svc_common.constprop.0+0x48/0xf0 [ 1417.076506] do_el0_svc+0x24/0x38 [ 1417.076525] el0_svc+0x30/0x100 [ 1417.076548] el0t_64_sync_handler+0x100/0x130 [ 1417.076569] el0t_64_sync+0x190/0x198 [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000) Fix this, by always using the vif corresponding to the wdev on which the Action frame Transmission request was initiated by the userspace. This way, even if P2P vif is not available, the IOVAR is sent to firmware on AP vif and the ANQP Query RESP Action frame is transmitted without crashing the driver. Move init_completion() for "send_af_done" from brcmf_p2p_create_p2pdev() to brcmf_p2p_attach(). Because the former function would not get executed when only hostapd is managing wlan interface, and it is not safe to do reinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior init_completion(). And in the brcmf_p2p_tx_action_frame() function, the condition check for P2P Presence response frame is not needed, since the wpa_supplicant is properly sending the P2P Presense Response frame on the P2P-GO vif instead of the P2P-Device vif. Cc: stable@vger.kernel.org Fixes: 18e2f61db3b7 ("brcmfmac: P2P action frame tx") Signed-off-by: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20251013102819.9727-1-gokulkumar.sivakumar@infineon.com [Cc stable] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-10-20Merge tag 'ath-current-20251006' of ↵Johannes Berg
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v6.18-rc1 Fix memory leaks in both ath10k and ath12k. Fix a sparse issue in ath11k. Allow ath11k suspend/resume to work on more Lenovo laptops. ================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2025-10-19wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()Dan Carpenter
This code frees "link" by calling kfree_rcu(link, rcu_head) and then it dereferences "link" to get the "link->fw_id". Save the "link->fw_id" first to avoid a potential use after free. Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/aNKCcKlbSkkS4_gO@stanley.mountain Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2025-10-18wifi: ath12k: Add MODULE_FIRMWARE() entriesTakashi Iwai
Some systems such as live-image or installer require the firmware information for each module declared by MODULE_FIRMWARE(), which is currently missing in ath12k driver. For addressing it, this patch adds the MODULE_FIRMWARE() entries. Like ath11k driver, we can just put the currently used firmware entries for QCN9274 and WCN7850 with wildcards. Signed-off-by: Takashi Iwai <tiwai@suse.de> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20251003082955.11436-1-tiwai@suse.de Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-10-17net: dsa: lantiq_gswip: treat VID 0 like the PVIDVladimir Oltean
Documentation/networking/switchdev.rst says that VLAN-aware bridges must treat packets tagged with VID 0 the same as untagged. It appears from the documentation that setting the GSWIP_PCE_VCTRL_VID0 flag (which this driver already had defined) might achieve this. Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/b220ac149922839a261b754202c05df5bb253c98.1760566491.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-17net: dsa: lantiq_gswip: drop untagged on VLAN-aware bridge ports with no PVIDVladimir Oltean
Implement the required functionality, as written in Documentation/networking/switchdev.rst section "Bridge VLAN filtering", by using the "VLAN Ingress Tag Rule" feature of the switch. The bit field definitions for this were found while browsing the Intel dual BSD/GPLv2 licensed drivers for this switch IP. Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/787aa807d00b726d75db2a40add215c8b8ba7466.1760566491.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>