summaryrefslogtreecommitdiff
path: root/drivers/net
AgeCommit message (Collapse)Author
2026-01-19bonding: 3ad: Add support for SPEED_80000Mika Westerberg
Add support for ethtool SPEED_80000. This is needed to allow Thunderbolt/USB4 networking driver to be used with the bonding driver. Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260115115646.328898-4-mika.westerberg@linux.intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-19net: ethtool: Add support for 80Gbps speedMika Westerberg
USB4 v2 link used in peer-to-peer networking is symmetric 80Gbps so in order to support reading this link speed, add support for it to ethtool. Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260115115646.328898-3-mika.westerberg@linux.intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-19net: thunderbolt: Allow changing MAC address of the deviceMika Westerberg
The MAC address we use is based on a suggestion in the USB4 Inter-domain spec but it is not really used in the USB4NET protocol. It is more targeted for the upper layers of the network stack. There is no reason why it should not be changed by the userspace for example if needed for bonding. Reported-by: Ian MacDonald <ian@netstatz.com> Closes: https://lore.kernel.org/netdev/CAFJzfF9N4Hak23sc-zh0jMobbkjK7rg4odhic1DQ1cC+=MoQoA@mail.gmail.com/ Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com> Link: https://patch.msgid.link/20260115115646.328898-2-mika.westerberg@linux.intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-19Merge tag 'linux-can-fixes-for-6.19-20260116' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2026-01-16 The first patch is by me and sets the missing CAN device default capabilities in the CAN device layer. The next patch is by me, target the gs_usb driver and adds the missing unanchor URB on usb_submit_urb() error. The last 5 patches are also from me and fix the same USB-URB leak (as in the gs_usb driver) in the affected CAN-USB driver: ems_usb, esd_usb, kvaser_usb, mcba_usb and usb_8dev. * tag 'linux-can-fixes-for-6.19-20260116' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error can: dev: alloc_candev_mqs(): add missing default CAN capabilities ==================== Link: https://patch.msgid.link/20260116200323.366877-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-19octeontx2: cn10k: fix RX flowid TCAM mask handlingAlok Tiwari
The RX flowid programming initializes the TCAM mask to all ones, but then overwrites it when clearing the MAC DA mask bits. This results in losing the intended initialization and may affect other match fields. Update the code to clear the MAC DA bits using an AND operation, making the handling of mask[0] consistent with mask[1], where the field-specific bits are cleared after initializing the mask to ~0ULL. Fixes: 57d00d4364f3 ("octeontx2-pf: mcs: Match macsec ethertype along with DMAC") Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Reviewed-by: Subbaraya Sundeep <sbhatta@marvell.com> Link: https://patch.msgid.link/20260116164724.2733511-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-19net: dsa: mxl-gsw1xx: Support R(G)MII slew rate configurationAlexander Sverdlin
Support newly introduced maxlinear,slew-rate-txc and maxlinear,slew-rate-txd device tree properties to configure R(G)MII interface pins' slew rate. It might be used to reduce the radiated emissions. Reviewed-by: Daniel Golle <daniel@makrotopia.org> Tested-by: Daniel Golle <daniel@makrotopia.org> Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Vladimir Oltean <olteanv@gmail.com> Link: https://patch.msgid.link/20260114104509.618984-3-alexander.sverdlin@siemens.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-19ipvlan: Make the addrs_lock be per portDmitry Skorodumov
Make the addrs_lock be per port, not per ipvlan dev. Initial code seems to be written in the assumption, that any address change must occur under RTNL. But it is not so for the case of IPv6. So 1) Introduce per-port addrs_lock. 2) It was needed to fix places where it was forgotten to take lock (ipvlan_open/ipvlan_close) This appears to be a very minor problem though. Since it's highly unlikely that ipvlan_add_addr() will be called on 2 CPU simultaneously. But nevertheless, this could cause: 1) False-negative of ipvlan_addr_busy(): one interface iterated through all port->ipvlans + ipvlan->addrs under some ipvlan spinlock, and another added IP under its own lock. Though this is only possible for IPv6, since looks like only ipvlan_addr6_event() can be called without rtnl_lock. 2) Race since ipvlan_ht_addr_add(port) is called under different ipvlan->addrs_lock locks This should not affect performance, since add/remove IP is a rare situation and spinlock is not taken on fast paths. Fixes: 8230819494b3 ("ipvlan: use per device spinlock to protect addrs list updates") Signed-off-by: Dmitry Skorodumov <skorodumov.dmitry@huawei.com> Reviewed-by: Paolo Abeni <pabeni@redhat.com> Link: https://patch.msgid.link/20260112142417.4039566-2-skorodumov.dmitry@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-19wifi: wlcore: Add support for IGTK keyPeter Åstrand
This change re-applies commit 2b7aadd3b9e1 ("wlcore: Adding suppoprt for IGTK key in wlcore driver") (sic), but only enables WLAN_CIPHER_SUITE_AES_CMAC with modern firmware. This patch is required to support WPA3 connections. Signed-off-by: Peter Åstrand <astrand@lysator.liu.se> Link: https://patch.msgid.link/0d3df7ab-6c41-c3cc-83cc-5ba55fe4e4bd@lysator.liu.se Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-19Merge tag 'rtw-next-2026-01-15' of https://github.com/pkshih/rtwJohannes Berg
Ping-Ke Shih says: ================== rtw-next patches for -next release. Main changes are to prepare to support RTL8922DE, including refactor/add register settings in common flow, and add newly firmware command/event handlers. Others are some random fixes and improvements across all drivers. ================== Link: https://patch.msgid.link/006be16d-61ba-4af8-b76a-bc94100c3555@RTKEXHMBS03.realtek.com.tw Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-01-17net: txgbe: convert to use .get_rx_ring_countBreno Leitao
Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-9-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: macb: convert to use .get_rx_ring_countBreno Leitao
Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-8-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: cxgb4: convert to use .get_rx_ring_countBreno Leitao
Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-7-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: xgbe: convert to use .get_rx_ring_countBreno Leitao
Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Since ETHTOOL_GRXRINGS was the only command handled by xgbe_get_rxnfc(), remove the function entirely. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-6-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: lan743x: convert to use .get_rx_ring_countBreno Leitao
Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Since ETHTOOL_GRXRINGS was the only command handled by lan743x_ethtool_get_rxnfc(), remove the function entirely. Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-5-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: ena: convert to use .get_rx_ring_countBreno Leitao
Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Since ETHTOOL_GRXRINGS was the only useful command handled by ena_get_rxnfc(), remove the function entirely. Signed-off-by: Breno Leitao <leitao@debian.org> Reviewed-by: Arthur Kiyanovski <akiyano@amazon.com> Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-4-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: mediatek: convert to use .get_rx_ring_countBreno Leitao
Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-3-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: tsnep: convert to use .get_rx_ring_countBreno Leitao
Use the newly introduced .get_rx_ring_count ethtool ops callback instead of handling ETHTOOL_GRXRINGS directly in .get_rxnfc(). Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260115-grxring_big_v2-v1-2-b3e1b58bced5@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ StickHamza Mahfooz
This is another one of those XGSPON ONU sticks that's using the X-ONU-SFPP internally, thus it also requires the potron quirk to avoid tx faults. So, add an entry for it in sfp_quirks[]. Cc: stable@vger.kernel.org Signed-off-by: Hamza Mahfooz <someguy@effective-light.com> Link: https://patch.msgid.link/20260113232957.609642-1-someguy@effective-light.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17veth: fix data race in veth_get_ethtool_statsDavid Yang
In veth_get_ethtool_stats(), some statistics protected by u64_stats_sync, are read and accumulated in ignorance of possible u64_stats_fetch_retry() events. These statistics, peer_tq_xdp_xmit and peer_tq_xdp_xmit_err, are already accumulated by veth_xdp_xmit(). Fix this by reading them into a temporary buffer first. Fixes: 5fe6e56776ba ("veth: rely on peer veth_rq for ndo_xdp_xmit accounting") Signed-off-by: David Yang <mmyangfl@gmail.com> Link: https://patch.msgid.link/20260114122450.227982-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: phy: realtek: simplify bogus paged operationsDaniel Golle
Only registers 0x10~0x17 are affected by the value in the page selection register 0x1f. Hence there is no point in using paged operations when accessing any other registers. Simplify the driver by using the normal phy_read and phy_write operations for registers which are anyway not affected by paging. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/0c5cbb66ce3e72a011d76f8c3d61ebcac44483bb.1768275364.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: phy: realtek: demystify PHYSR register locationDaniel Golle
Turns out that register address RTL_VND2_PHYSR (0xa434) maps to Clause-22 register MII_RESV2. Use that to get rid of yet another magic number, and rename access macros accordingly. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/6ed246e0aa3ca8038d2fa432d51518959fb89b6b.1768275364.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: phy: realtek: reunify C22 and C45 driversDaniel Golle
Reunify the split C22/C45 drivers for the RTL8221B-VB-CG 2.5Gbps and RTL8221B-VM-CG 2.5Gbps PHYs back into a single driver. This is possible now by using all the driver operations previously used by the C45 driver, as transparent access to all MMDs including MDIO_MMD_VEND2 is now possible also over Clause-22 MDIO. The unified driver will still only use Clause-45 access on any Clause-45 capable busses while still working fine on Clause-22 busses. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/bffcb85fdc20e07056976962d3caaa1be5d0ddb0.1768275364.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: phy: realtek: simplify C22 reg access via MDIO_MMD_VEND2Daniel Golle
RealTek 2.5GE PHYs have all standard Clause-22 registers mapped also inside MDIO_MMD_VEND2 at offset 0xa400. This is used mainly in case the PHY is connected to a Clause-45-only bus. The RTL8221B is frequently used in copper SFP module which uses the RollBall MDIO-over-I2C method which *only* supports Clause-45, for example. In order to support using the PHY on Clause-45-only busses, the PHY driver has previously been split into a C22-only and C45-only instances, creating quite a bit of redundancy and confusion. In preparation of reunifying the two driver instances, add support for translating MDIO_MMD_VEND2 registers 0xa400 to 0xa43c back to Clause-22 registers 0 to 30 in case the PHY is accessed on a Clause-22 bus. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/fd49d86bd0445b76269fd3ea456c709c2066683f.1768275364.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: phy: realtek: support interrupt also for C22 variantsDaniel Golle
Now that access to MDIO_MMD_VEND2 works transparently also in Clause-22 mode, add interrupt support also for the C22 variants of the RTL8221B-VB-CG and RTL8221B-VM-CG. This results in the C22 and C45 driver instances now having all the same features implemented. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/7620084b1de01580edc2d0e1b9548507fb4643a8.1768275364.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: stmmac: fix dwmac4 transmit performance regressionRussell King (Oracle)
dwmac4's transmit performance dropped by a factor of four due to an incorrect assumption about which definitions are for what. This highlights the need for sane register macros. Commit 8409495bf6c9 ("net: stmmac: cores: remove many xxx_SHIFT definitions") changed the way the txpbl value is merged into the register: value = readl(ioaddr + DMA_CHAN_TX_CONTROL(dwmac4_addrs, chan)); - value = value | (txpbl << DMA_BUS_MODE_PBL_SHIFT); + value = value | FIELD_PREP(DMA_BUS_MODE_PBL, txpbl); With the following in the header file: #define DMA_BUS_MODE_PBL BIT(16) -#define DMA_BUS_MODE_PBL_SHIFT 16 The assumption here was that DMA_BUS_MODE_PBL was the mask for DMA_BUS_MODE_PBL_SHIFT, but this turns out not to be the case. The field is actually six bits wide, buts 21:16, and is called TXPBL. What's even more confusing is, there turns out to be a PBLX8 single bit in the DMA_CHAN_CONTROL register (0x1100 for channel 0), and DMA_BUS_MODE_PBL seems to be used for that. However, this bit et.al. was listed under a comment "/* DMA SYS Bus Mode bitmap */" which is for register 0x1004. Fix this up by adding an appropriately named field definition under the DMA_CHAN_TX_CONTROL() register address definition. Move the RPBL mask definition under DMA_CHAN_RX_CONTROL(), correctly renaming it as well. Also move the PBL bit definition under DMA_CHAN_CONTROL(), correctly renaming it. This removes confusion over the PBL fields. Fixes: 8409495bf6c9 ("net: stmmac: cores: remove many xxx_SHIFT definitions") Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Bisected-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://lore.kernel.org/51859704-57fd-4913-b09d-9ac58a57f185@bootlin.com Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/E1vgY1k-00000003vOC-0Z1H@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17amd-xgbe: avoid misleading per-packet error logRaju Rangoju
On the receive path, packet can be damaged because of buffer overflow in Rx FIFO. Avoid misleading per-packet error log when packet->errors is set, this can flood the log. Instead, rely on the standard rtnl_link_stats64 stats. Fixes: c5aa9e3b8156 ("amd-xgbe: Initial AMD 10GbE platform driver") Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com> Link: https://patch.msgid.link/20260114163037.2062606-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: ethernet: ti: cpsw_ale: Remove obsolete macrosStefan Wiehler
- ALE_VERSION_MAJOR/MINOR are no longer used following the transition to regmaps in commit bbfc7e2b9ebe ("net: ethernet: ti: cpsw_ale: use regfields for ALE registers") - ALE_VERSION_IR3 is unused since entry mask bits are no longer hardcoded with commit b5d31f294027 ("net: ethernet: ti: ale: optimize ale entry mask bits configuartion") - ALE_VERSION_IR4 has never been used since its introduction in commit ca47130a744b ("net: netcp: ale: update to support unknown vlan controls for NU switch") Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com> Link: https://patch.msgid.link/20260114144425.3973272-1-stefan.wiehler@nokia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17octeontx2: Fix otx2_dma_map_page() error return codeThomas Fourier
0 is a valid DMA address [1] so using it as the error value can lead to errors. The error value of dma_map_XXX() functions is DMA_MAPPING_ERROR which is ~0. The callers of otx2_dma_map_page() use dma_mapping_error() to test the return value of otx2_dma_map_page(). This means that they would not detect an error in otx2_dma_map_page(). Make otx2_dma_map_page() return the raw value of dma_map_page_attrs(). [1] https://lore.kernel.org/all/f977f68b-cec5-4ab7-b4bd-2cf6aca46267@intel.com Fixes: caa2da34fd25 ("octeontx2-pf: Initialize and config queues") Cc: <stable@vger.kernel.org> Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com> Link: https://patch.msgid.link/20260114123107.42387-2-fourier.thomas@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: usb: sr9700: remove code to drive nonexistent MIIEthan Nelson-Moore
This device does not have a MII, even though the driver contains code to drive one (because it originated as a copy of the dm9601 driver). It also only supports 10Mbps half-duplex operation (the DM9601 registers to set the speed/duplex mode are read-only). Remove all MII-related code and implement sr9700_get_link_ksettings which returns hardcoded correct information for the link speed and duplex mode. Also add announcement of the link status like many other Ethernet drivers have. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Link: https://patch.msgid.link/20260113040649.54248-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17net: pcs: rzn1-miic: Add PHY_LINK active-level configuration supportLad Prabhakar
Add support to configure the active level of MIIC PHY_LINK status signals on a per-converter basis using a DT property. MIIC provides dedicated PHY_LINK signals that indicate EtherPHY link-up and link-down status in hardware. These signals are required regardless of whether GMAC or ETHSW is used. With GMAC, link state is retrieved via MDC/MDIO and handled in software, while ETHSW relies on PHY_LINK pins for both CPU-assisted operation and switch-only data paths that do not involve the host. Hardware PHY_LINK signals are also critical for fast reaction to link-down events, for example when running redundancy protocols such as Device Level Ring (DLR), where rapid detection of cable faults is required to switch to an alternate path without software latency. Parse the requested polarity from DT, accumulate the configuration during probing, and apply it to the MIIC_PHY_LINK register once hardware initialization is complete, when the registers can be safely modified. Handle SoC-specific bit layout differences between RZ/N1 and RZ/T2H/N2H within the driver. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/20260112173555.1166714-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17mctp i2c: initialise event handler read bytesMatt Johnston
Set a 0xff value for i2c reads of an mctp-i2c device. Otherwise reads will return "val" from the i2c bus driver. For i2c-aspeed and i2c-npcm7xx that is a stack uninitialised u8. Tested with "i2ctransfer -y 1 r10@0x34" where 0x34 is a mctp-i2c instance, now it returns all 0xff. Fixes: f5b8abf9fc3d ("mctp i2c: MCTP I2C binding driver") Signed-off-by: Matt Johnston <matt@codeconstruct.com.au> Link: https://patch.msgid.link/20260113-mctp-read-fix-v1-1-70c4b59c741c@codeconstruct.com.au Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-17nfp: tls: Avoid -Wflex-array-member-not-at-end warningsGustavo A. R. Silva
-Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. So, in order to avoid ending up with flexible-array members in the middle of other structs, we use the `struct_group_tagged()` helper to separate the flexible array from the rest of the members in the flexible structure. We then use the newly created tagged `struct nfp_crypto_req_add_front_hdr` to replace the type of the objects causing trouble in a couple of structures. We also want to ensure that when new members need to be added to the flexible structure, they are always included within the newly created tagged struct. For this, we use `static_assert()`. This ensures that the memory layout for both the flexible structure and the new tagged struct is the same after any changes. Lastly, use container_of() to retrieve a pointer to the flexible structure and, through that, access the flexible-array member when needed. So, with these changes, fix the following warnings: drivers/net/ethernet/netronome/nfp/nfd3/../crypto/fw.h:58:41: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/ethernet/netronome/nfp/nfd3/../crypto/fw.h:65:41: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Link: https://patch.msgid.link/aSfDqouLFcA4h8JX@kspp Signed-off-by: Kees Cook <kees@kernel.org>
2026-01-17carl9170: Avoid -Wflex-array-member-not-at-end warningGustavo A. R. Silva
-Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Move the conflicting declaration (which happens to be in a union, so we're moving the entire union) to the end of the corresponding structure. Notice that `struct carl9170_rsp` is a flexible structure, this is a structure that contains a flexible-array member. With these changes fix the following warning: drivers/net/wireless/ath/carl9170/carl9170.h:382:9: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Acked-by: Christian Lamparter <chunkeey@gmail.com> Link: https://patch.msgid.link/aR1yxjmzb2DM2-Uq@kspp Signed-off-by: Kees Cook <kees@kernel.org>
2026-01-16can: rcar_canfd: Add RZ/T2H supportLad Prabhakar
The CAN-FD IP on the RZ/T2H SoC is similar to R-Car Gen4, but differs in the AFLPN and CFTML bits and supports two channels with eight interrupts. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260114154525.3169992-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-16can: rcar_canfd: Add support for FD-Only modeBiju Das
The RZ/{G2L,G3E} and R-Car Gen4 SoCs support additional CAN FD mode called FD-only mode. In this mode, communication in Classical CAN frame format is disabled. Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20251126155911.320563-3-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-16can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leakMarc Kleine-Budde
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In usb_8dev_open() -> usb_8dev_start(), the URBs for USB-in transfers are allocated, added to the priv->rx_submitted anchor and submitted. In the complete callback usb_8dev_read_bulk_callback(), the URBs are processed and resubmitted. In usb_8dev_close() -> unlink_all_urbs() the URBs are freed by calling usb_kill_anchored_urbs(&priv->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in usb_kill_anchored_urbs(). Fix the memory leak by anchoring the URB in the usb_8dev_read_bulk_callback() to the priv->rx_submitted anchor. Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from 8 devices") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-5-4b8cb2915571@pengutronix.de Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-16can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leakMarc Kleine-Budde
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In mcba_usb_probe() -> mcba_usb_start(), the URBs for USB-in transfers are allocated, added to the priv->rx_submitted anchor and submitted. In the complete callback mcba_usb_read_bulk_callback(), the URBs are processed and resubmitted. In mcba_usb_close() -> mcba_urb_unlink() the URBs are freed by calling usb_kill_anchored_urbs(&priv->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in usb_kill_anchored_urbs(). Fix the memory leak by anchoring the URB in the mcba_usb_read_bulk_callback()to the priv->rx_submitted anchor. Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-4-4b8cb2915571@pengutronix.de Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-16can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leakMarc Kleine-Budde
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In kvaser_usb_set_{,data_}bittiming() -> kvaser_usb_setup_rx_urbs(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback kvaser_usb_read_bulk_callback(), the URBs are processed and resubmitted. In kvaser_usb_remove_interfaces() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in usb_kill_anchored_urbs(). Fix the memory leak by anchoring the URB in the kvaser_usb_read_bulk_callback() to the dev->rx_submitted anchor. Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-3-4b8cb2915571@pengutronix.de Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-16can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leakMarc Kleine-Budde
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In esd_usb_open(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback esd_usb_read_bulk_callback(), the URBs are processed and resubmitted. In esd_usb_close() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in esd_usb_close(). Fix the memory leak by anchoring the URB in the esd_usb_read_bulk_callback() to the dev->rx_submitted anchor. Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-2-4b8cb2915571@pengutronix.de Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-16can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leakMarc Kleine-Budde
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In ems_usb_open(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback ems_usb_read_bulk_callback(), the URBs are processed and resubmitted. In ems_usb_close() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in ems_usb_close(). Fix the memory leak by anchoring the URB in the ems_usb_read_bulk_callback() to the dev->rx_submitted anchor. Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-1-4b8cb2915571@pengutronix.de Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-16can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on ↵Marc Kleine-Budde
usb_submit_urb() error In commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"), the URB was re-anchored before usb_submit_urb() in gs_usb_receive_bulk_callback() to prevent a leak of this URB during cleanup. However, this patch did not take into account that usb_submit_urb() could fail. The URB remains anchored and usb_kill_anchored_urbs(&parent->rx_submitted) in gs_can_close() loops infinitely since the anchor list never becomes empty. To fix the bug, unanchor the URB when an usb_submit_urb() error occurs, also print an info message. Fixes: 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak") Reported-by: Jakub Kicinski <kuba@kernel.org> Closes: https://lore.kernel.org/all/20260110223836.3890248-1-kuba@kernel.org/ Link: https://patch.msgid.link/20260116-can_usb-fix-reanchor-v1-1-9d74e7289225@pengutronix.de Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-16can: dev: alloc_candev_mqs(): add missing default CAN capabilitiesMarc Kleine-Budde
The idea behind series 6c1f5146b214 ("Merge patch series "can: raw: better approach to instantly reject unsupported CAN frames"") is to set the capabilities of a CAN device (CAN-CC, CAN-FD, CAN-XL, and listen only) [1] and, based on these capabilities, reject unsupported CAN frames in the CAN-RAW protocol [2]. This works perfectly for CAN devices configured in CAN-FD or CAN-XL mode. CAN devices with static CAN control modes define their capabilities via can_set_static_ctrlmode() -> can_set_cap_info(). CAN devices configured by the user space for CAN-FD or CAN-XL set their capabilities via can_changelink() -> can_ctrlmode_changelink() -> can_set_cap_info(). However, in commit 166e87329ce6 ("can: propagate CAN device capabilities via ml_priv"), the capabilities of CAN devices are not initialized. This results in CAN-RAW rejecting all CAN frames on devices directly after ifup if the user space has not changed the CAN control mode. Fix this problem by setting the default capabilities to CAN-CC in alloc_candev_mqs() as soon as the CAN specific ml_priv is allocated. [1] commit 166e87329ce6 ("can: propagate CAN device capabilities via ml_priv") [2] commit faba5860fcf9 ("can: raw: instantly reject disabled CAN frames") Fixes: 166e87329ce6 ("can: propagate CAN device capabilities via ml_priv") Acked-by: Oliver Hartkopp <socketcan@hartkopp.net> Tested-by: Oliver Hartkopp <socketcan@hartkopp.net> Link: https://patch.msgid.link/20260116-can_add_missing_set_caps-v1-1-7525126d8b20@pengutronix.de [mkl: fix typo in subject] Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-01-15net: freescale: ucc_geth: Return early when TBI PHY can't be foundMaxime Chevallier
In ucc_geth's .mac_config(), we configure the TBI Serdes block represented by a struct phy_device that we get from firmware. While porting to phylink, a check was missed to make sure we don't try to access the TBI PHY if we can't get it. Let's add it and return early in case of error Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/r/202601130843.rFGNXA5a-lkp@intel.com/ Fixes: 53036aa8d031 ("net: freescale: ucc_geth: phylink conversion") Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260114080247.366252-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-15xgbe: Use netlink extack to report errors to ethtoolVishal Badole
Upgrade XGBE driver to report errors via netlink extack instead of netdev_error so ethtool userspace can be aware of failures. Signed-off-by: Vishal Badole <Vishal.Badole@amd.com> Reviewed-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com> Link: https://patch.msgid.link/20260114080357.1778132-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-15Merge branch '100GbE' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-01-13 (ice, igc) For ice: Jake adds missing initialization calls to u64_stats_init(). Dave stops deletion of VLAN 0 from prune list when device is primary LAG interface. Ding Hui adds a missed unit conversion function for proper timeout value. For igc: Kurt Kanzenbach adds a call to re-set default Qbv schedule when number of channels changes. Chwee-Lin Choong reworks Tx timestamp detection logic to resolve a race condition and reverts changes to TSN packet buffer size causing Tx hangs under heavy load. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue igc: fix race condition in TX timestamp read for register 0 igc: Restore default Qbv schedule when changing channels ice: Fix incorrect timeout ice_release_res() ice: Avoid detrimental cleanup for bond during interface stop ice: initialize ring_stats->syncp ==================== Link: https://patch.msgid.link/20260113220220.1034638-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-15bnxt_en: Fix build break on non-x86 platformsPavan Chebbi
Commit c470195b989fe added .getcrosststamp() interface where the code uses boot_cpu_has() function which is available only in x86 platforms. This fails the build on any other platform. Since the interface is going to be supported only on x86 anyway, we can simply compile out the entire support on non-x86 platforms. Cover the .getcrosststamp support under CONFIG_X86 Fixes: c470195b989f ("bnxt_en: Add PTP .getcrosststamp() interface to get device/host times") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202601111808.WnBJCuWI-lkp@intel.com Signed-off-by: Pavan Chebbi <pavan.chebbi@broadcom.com> Signed-off-by: Michael Chan <michael.chan@broadcom.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20260113183422.508851-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-15bonding: limit BOND_MODE_8023AD to Ethernet devicesEric Dumazet
BOND_MODE_8023AD makes sense for ARPHRD_ETHER only. syzbot reported: BUG: KASAN: global-out-of-bounds in __hw_addr_create net/core/dev_addr_lists.c:63 [inline] BUG: KASAN: global-out-of-bounds in __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118 Read of size 16 at addr ffffffff8bf94040 by task syz.1.3580/19497 CPU: 1 UID: 0 PID: 19497 Comm: syz.1.3580 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:200 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105 __hw_addr_create net/core/dev_addr_lists.c:63 [inline] __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118 __dev_mc_add net/core/dev_addr_lists.c:868 [inline] dev_mc_add+0xa1/0x120 net/core/dev_addr_lists.c:886 bond_enslave+0x2b8b/0x3ac0 drivers/net/bonding/bond_main.c:2180 do_set_master+0x533/0x6d0 net/core/rtnetlink.c:2963 do_setlink+0xcf0/0x41c0 net/core/rtnetlink.c:3165 rtnl_changelink net/core/rtnetlink.c:3776 [inline] __rtnl_newlink net/core/rtnetlink.c:3935 [inline] rtnl_newlink+0x161c/0x1c90 net/core/rtnetlink.c:4072 rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 ____sys_sendmsg+0x505/0x820 net/socket.c:2592 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2646 __sys_sendmsg+0x164/0x220 net/socket.c:2678 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0x1dc/0x560 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e </TASK> The buggy address belongs to the variable: lacpdu_mcast_addr+0x0/0x40 Fixes: 872254dd6b1f ("net/bonding: Enable bonding to enslave non ARPHRD_ETHER") Reported-by: syzbot+9c081b17773615f24672@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6966946b.a70a0220.245e30.0002.GAE@google.com/T/#u Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Andrew Lunn <andrew+netdev@lunn.ch> Acked-by: Jay Vosburgh <jv@jvosburgh.net> Link: https://patch.msgid.link/20260113191201.3970737-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-15hinic3: add WQ_PERCPU to alloc_workqueue usersMarco Crivellari
This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Reviewed-by: Fan Gong <gongfan1@huawei.com> Link: https://patch.msgid.link/20260113151433.257320-1-marco.crivellari@suse.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-15net: phy: realtek: fix in-band capabilities for 2.5G PHYsJan Hoffmann
It looks like the configuration of in-band AN only affects SGMII, and it is always disabled for 2500Base-X. Adjust the reported capabilities accordingly. This is based on testing using OpenWrt on Zyxel XGS1010-12 rev A1 with RTL8226-CG, and Zyxel XGS1210-12 rev B1 with RTL8221B-VB-CG. On these devices, 2500Base-X in-band AN is known to work with some SFP modules (containing an unknown PHY). However, with the built-in Realtek PHYs, no auto-negotiation takes place, irrespective of the configuration of the PHY. Fixes: 10fbd71fc5f9b ("net: phy: realtek: implement configuring in-band an") Signed-off-by: Jan Hoffmann <jan@3e8.eu> Reviewed-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/20260113205557.503409-1-jan@3e8.eu Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-15net: phy: remove unused fixup unregistering functionsHeiner Kallweit
No user of PHY fixups unregisters these. IOW: The fixup unregistering functions are unused and can be removed. Remove also documentation for these functions. Whilst at it, remove also mentioning of phy_register_fixup() from the Documentation, as this function has been static since ea47e70e476f ("net: phy: remove fixup-related definitions from phy.h which are not used outside phylib"). Fixup unregistering functions were added with f38e7a32ee4f ("phy: add phy fixup unregister functions") in 2016, and last user was removed with 6782d06a47ad ("net: usb: lan78xx: Remove KSZ9031 PHY fixup") in 2024. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Link: https://patch.msgid.link/ff8ac321-435c-48d0-b376-fbca80c0c22e@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>