Gal Pressman [Wed, 7 Jan 2026 09:18:47 +0000 (11:18 +0200)]
net/mlx5e: TSO for UDP over GRE over vlan packets
The hardware supports segmentation offload of UDP over GRE over vlan
packets, allow it by adding NETIF_F_GSO_UDP_L4 to hw_enc_features which
will make the vlan device inherit it to its own hw_enc_features.
Side note: it is quite confusing that this change wasn't needed to
offload encapsulated UDP packets regardless of vlan, but that's the way
that the stack handles gso partial features, it assumes they're
supported without caring if the feature is supported in hw_enc_features.
Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Signed-off-by: Mark Bloch <mbloch@nvidia.com> Link: https://patch.msgid.link/20260107091848.621884-3-mbloch@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
SGMII in-band autonegotiation was previously kept untouched (and restored
after switching back from 2500Base-X to SGMII). Now that the kernel offers
a way to announce in-band capabilities and nable/disable in-band AN,
implement the .inband_caps and .config_inband driver ops.
This moves the responsibility to configure SGMII in-band AN from the PHY
driver to phylink.
Jakub Kicinski [Wed, 7 Jan 2026 23:25:57 +0000 (15:25 -0800)]
selftests: drv-net: gro: increase the rcvbuf size
The gro.py test (testing software GRO) is slightly flaky when
running against fbnic. We see one flake per roughly 20 runs in NIPA,
mostly in ipip.large, and always including some EAGAIN:
# Shouldn't coalesce if exceed IP max pkt size: Test succeeded
# Expected {65475 899 }, Total 2 packets
# Received {65475 899 }, Total 2 packets.
# Expected {64576 900 900 }, Total 3 packets
# Received {64576 /home/virtme/testing/wt-24/tools/testing/selftests/drivers/net/gro: could not receive: Resource temporarily unavailable
The test sends 2 large frames (64k + change). Looks like the default
packet socket rcvbuf (~200kB) may not be large enough to hold them.
Bump the rcvbuf to 1MB.
Add a debug print showing socket statistics to make debugging this
issue easier in the future. Without the rcvbuf increase we see:
# Shouldn't coalesce if exceed IP max pkt size: Test succeeded
# Expected {65475 899 }, Total 2 packets
# Received {65475 899 }, Total 2 packets.
# Expected {64576 900 900 }, Total 3 packets
# Received {64576 Socket stats: packets=7, drops=3
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# /home/virtme/testing/wt-24/tools/testing/selftests/drivers/net/gro: could not receive: Resource temporarily unavailable
Jakub Kicinski [Tue, 6 Jan 2026 20:02:05 +0000 (12:02 -0800)]
selftests: tls: avoid flakiness in data_steal
We see the following failure a few times a week:
# RUN global.data_steal ...
# tls.c:3280:data_steal:Expected recv(cfd, buf2, sizeof(buf2), MSG_DONTWAIT) (10000) == -1 (-1)
# data_steal: Test failed
# FAIL global.data_steal
not ok 8 global.data_steal
The 10000 bytes read suggests that the child process did a recv()
of half of the data using the TLS ULP and we're now getting the
remaining half. The intent of the test is to get the child to
enter _TCP_ recvmsg handler, so it needs to enter the syscall before
parent installed the TLS recvmsg with setsockopt(SOL_TLS).
Instead of the 10msec sleep send 1 byte of data and wait for the
child to consume it.
------------------------------------------------------------------
Your code has been rated at 9.97/10 (previous run: 8.59/10, +1.38)
====================
====================
support for hwtstamp_get in phy - part 2
There are 2 drivers which had some inconsistency in HW timestamping
configuration logic. Improve both of them and add hwtstamp_get()
callback.
====================
The driver stores new HW timestamping configuration values
unconditionally and may create inconsistency with what is actually
configured in case of error. Improve the logic to store new values only
once everything is configured.
The driver was adjusting stored values independently of what was
actually supported and configured. Improve logic to store values
once all checks are passing
Randy Dunlap [Tue, 6 Jan 2026 17:32:24 +0000 (09:32 -0800)]
sfc: correct kernel-doc complaints
Fix kernel-doc warnings by adding 3 missing struct member descriptions
in struct efx_ef10_nic_data and removing preprocessor directives (which
are not handled by kernel-doc).
Fixes these 5 warnings:
Warning: drivers/net/ethernet/sfc/nic.h:158 bad line: #ifdef CONFIG_SFC_SRIOV
Warning: drivers/net/ethernet/sfc/nic.h:160 bad line: #endif
Warning: drivers/net/ethernet/sfc/nic.h:204 struct member 'port_id'
not described in 'efx_ef10_nic_data'
Warning: drivers/net/ethernet/sfc/nic.h:204 struct member 'vf_index'
not described in 'efx_ef10_nic_data'
Warning: drivers/net/ethernet/sfc/nic.h:204 struct member 'licensed_features'
not described in 'efx_ef10_nic_data'
Frank Li [Tue, 6 Jan 2026 14:36:19 +0000 (09:36 -0500)]
dt-bindings: net: dsa: microchip: Make pinctrl 'reset' optional
Commit e469b87e0fb0d ("dt-bindings: net: dsa: microchip: Add strap
description to set SPI mode") required both 'default' and 'reset' pinctrl
states for all compatible devices. However, this requirement should be only
applicable to KSZ8463.
Make the 'reset' pinctrl state optional for all other Microchip DSA
devices while keeping it mandatory for KSZ8463.
Fix below CHECK_DTBS warnings:
arch/arm64/boot/dts/freescale/imx8mp-skov-basic.dtb: switch@5f (microchip,ksz9893): pinctrl-names: ['default'] is too short
from schema $id: http://devicetree.org/schemas/net/dsa/microchip,ksz.yaml#
Signed-off-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Marco Felsch <m.felsch@pengutronix.de> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260106143620.126212-1-Frank.Li@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
- ping: fix ICMP out SNMP stats double-counting with ICMP sockets
- bonding: preserve NETIF_F_ALL_FOR_ALL across TSO updates
- bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
- eth: bnxt: fix potential data corruption with HW GRO/LRO"
* tag 'net-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (70 commits)
arp: do not assume dev_hard_header() does not change skb->head
net: enetc: fix build warning when PAGE_SIZE is greater than 128K
atm: Fix dma_free_coherent() size
tools: ynl: don't install tests
net: do not write to msg_get_inq in callee
bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup
net: usb: pegasus: fix memory leak in update_eth_regs_async()
net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset
wifi: mac80211: collect station statistics earlier when disconnect
wifi: mac80211: restore non-chanctx injection behaviour
wifi: mac80211_hwsim: disable BHs for hwsim_radio_lock
wifi: mac80211: don't iterate not running interfaces
wifi: mac80211_hwsim: fix typo in frequency notification
wifi: avoid kernel-infoleak from struct iw_point
net: airoha: Fix schedule while atomic in airoha_ppe_deinit()
selftests: netdevsim: add carrier state consistency test
net: netdevsim: fix inconsistent carrier state after link/unlink
selftests: drv-net: Bring back tool() to driver __init__s
net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy
...
Jakub Kicinski [Thu, 8 Jan 2026 16:54:54 +0000 (08:54 -0800)]
Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue
Tony Nguyen says:
====================
Intel Wired LAN Driver Updates 2026-01-06 (idpf)
This series contains updates to idpf driver only.
Emil fixes issues related to resets; among them timeouts, NULL pointer
dereferences, and memory leaks.
Sreedevi resolves issues around RSS; mainly involving operations when
the interface is down and resets. She also addresses some incomplete
cleanups for ntuple filters and interrupts.
Erik fixes incomplete output of ntuple filters.
Josh sets restriction of Rx buffer size to follow hardware restrictions.
Larysa adds check to prevent NULL pointer dereference when RDMA is not
enabled.
* '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:
idpf: fix aux device unplugging when rdma is not supported by vport
idpf: cap maximum Rx buffer size
idpf: Fix error handling in idpf_vport_open()
idpf: Fix RSS LUT NULL ptr issue after soft reset
idpf: Fix RSS LUT configuration on down interfaces
idpf: Fix RSS LUT NULL pointer crash on early ethtool operations
idpf: fix issue with ethtool -n command display
idpf: fix memory leak of flow steer list on rmmod
idpf: fix error handling in the init_task on load
idpf: fix memory leak in idpf_vc_core_deinit()
idpf: fix memory leak in idpf_vport_rel()
idpf: detach and close netdevs while handling a reset
idpf: keep the netdev when a reset fails
====================
Wei Fang [Wed, 7 Jan 2026 09:12:04 +0000 (17:12 +0800)]
net: enetc: fix build warning when PAGE_SIZE is greater than 128K
The max buffer size of ENETC RX BD is 0xFFFF bytes, so if the PAGE_SIZE
is greater than 128K, ENETC_RXB_DMA_SIZE and ENETC_RXB_DMA_SIZE_XDP will
be greater than 0xFFFF, thus causing a build warning.
This will not cause any practical issues because ENETC is currently only
used on the ARM64 platform, and the max PAGE_SIZE is 64K. So this patch
is only for fixing the build warning that occurs when compiling ENETC
drivers for other platforms.
Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202601050637.kHEKKOG7-lkp@intel.com/ Fixes: e59bc32df2e9 ("net: enetc: correct the value of ENETC_RXB_TRUESIZE") Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260107091204.1980222-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Jakub Kicinski [Thu, 8 Jan 2026 16:49:24 +0000 (08:49 -0800)]
Merge tag 'wireless-2026-01-08' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless
Johannes Berg says:
====================
Couple of fixes:
- mac80211:
- long-standing injection bug due to chanctx rework
- more recent interface iteration issue
- collect statistics before removing stations
- hwsim:
- fix NAN frequency typo (potential NULL ptr deref)
- fix locking of radio lock (needs softirqs disabled)
- wext:
- ancient issue with compat and events copying some
uninitialized stack data to userspace
* tag 'wireless-2026-01-08' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
wifi: mac80211: collect station statistics earlier when disconnect
wifi: mac80211: restore non-chanctx injection behaviour
wifi: mac80211_hwsim: disable BHs for hwsim_radio_lock
wifi: mac80211: don't iterate not running interfaces
wifi: mac80211_hwsim: fix typo in frequency notification
wifi: avoid kernel-infoleak from struct iw_point
====================
Jakub Kicinski [Tue, 6 Jan 2026 16:34:26 +0000 (08:34 -0800)]
tools: ynl: don't install tests
make's install target is meant for installing the production
artifacts, AFAIU. Don't install test_ynl_cli and test_ynl_ethtool
from under the main YNL install target. The install target
under tests/ is retained in case someone wants the tests
to be installed.
Fixes: 308b7dee3e5c ("tools: ynl: add YNL test framework") Reviewed-by: Hangbin Liu <liuhangbin@gmail.com> Reviewed-by: Donald Hunter <donald.hunter@gmail.com> Link: https://patch.msgid.link/20260106163426.1468943-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
msg_get_inq is an input field from caller to callee. Don't set it in
the callee, as the caller may not clear it on struct reuse.
This is a kernel-internal variant of msghdr only, and the only user
does reinitialize the field. So this is not critical for that reason.
But it is more robust to avoid the write, and slightly simpler code.
And it fixes a bug, see below.
Callers set msg_get_inq to request the input queue length to be
returned in msg_inq. This is equivalent to but independent from the
SO_INQ request to return that same info as a cmsg (tp->recvmsg_inq).
To reduce branching in the hot path the second also sets the msg_inq.
That is WAI.
This is a fix to commit 4d1442979e4a ("af_unix: don't post cmsg for
SO_INQ unless explicitly asked for"), which fixed the inverse.
Also avoid NULL pointer dereference in unix_stream_read_generic if
state->msg is NULL and msg->msg_get_inq is written. A NULL state->msg
can happen when splicing as of commit 2b514574f7e8 ("net: af_unix:
implement splice for stream af_unix sockets").
Breno Leitao [Tue, 6 Jan 2026 14:31:14 +0000 (06:31 -0800)]
bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup
When bnxt_init_one() fails during initialization (e.g.,
bnxt_init_int_mode returns -ENODEV), the error path calls
bnxt_free_hwrm_resources() which destroys the DMA pool and sets
bp->hwrm_dma_pool to NULL. Subsequently, bnxt_ptp_clear() is called,
which invokes ptp_clock_unregister().
Since commit a60fc3294a37 ("ptp: rework ptp_clock_unregister() to
disable events"), ptp_clock_unregister() now calls
ptp_disable_all_events(), which in turn invokes the driver's .enable()
callback (bnxt_ptp_enable()) to disable PTP events before completing the
unregistration.
bnxt_ptp_enable() attempts to send HWRM commands via bnxt_ptp_cfg_pin()
and bnxt_ptp_cfg_event(), both of which call hwrm_req_init(). This
function tries to allocate from bp->hwrm_dma_pool, causing a NULL
pointer dereference:
Xiang Mei [Tue, 6 Jan 2026 03:41:00 +0000 (20:41 -0700)]
net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset
`qfq_class->leaf_qdisc->q.qlen > 0` does not imply that the class
itself is active.
Two qfq_class objects may point to the same leaf_qdisc. This happens
when:
1. one QFQ qdisc is attached to the dev as the root qdisc, and
2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get()
/ qdisc_put()) and is pending to be destroyed, as in function
tc_new_tfilter.
When packets are enqueued through the root QFQ qdisc, the shared
leaf_qdisc->q.qlen increases. At the same time, the second QFQ
qdisc triggers qdisc_put and qdisc_destroy: the qdisc enters
qfq_reset() with its own q->q.qlen == 0, but its class's leaf
qdisc->q.qlen > 0. Therefore, the qfq_reset would wrongly deactivate
an inactive aggregate and trigger a null-deref in qfq_deactivate_agg:
The framer driver defines framer_pm_runtime_put() to return an int,
but that return value is never used. It also passes the return value
of pm_runtime_put() to the caller which is not very useful.
Returning an error code from pm_runtime_put() merely means that it has
not queued up a work item to check whether or not the device can be
suspended and there are many perfectly valid situations in which that
can happen, like after writing "on" to the devices' runtime PM "control"
attribute in sysfs for one example.
Modify phy_pm_runtime_put() to discard the pm_runtime_put() return
value and change its return type to void.
No intentional functional impact.
This will facilitate a planned change of the pm_runtime_put() return
type to void in the future.
net: cadence: macb: Discard pm_runtime_put() return value
Passing pm_runtime_put() return value to the callers is not particularly
useful.
Returning an error code from pm_runtime_put() merely means that it has
not queued up a work item to check whether or not the device can be
suspended and there are many perfectly valid situations in which that
can happen, like after writing "on" to the devices' runtime PM "control"
attribute in sysfs for one example. It also happens when the kernel is
configured with CONFIG_PM unset.
Accordingly, update at91ether_close() to simply discard the return
value of pm_runtime_put() and always return success to the caller.
This will facilitate a planned change of the pm_runtime_put() return
type to void in the future.
net: ethernet: ti: am65-cpsw: Discard pm_runtime_put() return value
Printing error messages on pm_runtime_put() returning negative values
is not particularly useful.
Returning an error code from pm_runtime_put() merely means that it has
not queued up a work item to check whether or not the device can be
suspended and there are many perfectly valid situations in which that
can happen, like after writing "on" to the devices' runtime PM "control"
attribute in sysfs for one example.
Accordingly, update am65_cpsw_ethtool_op_begin() and cpsw_ethtool_op_begin()
to simply discard the return value of pm_runtime_put().
This will facilitate a planned change of the pm_runtime_put() return
type to void in the future.
Linus Torvalds [Thu, 8 Jan 2026 15:44:48 +0000 (07:44 -0800)]
Merge tag 'hid-for-linus-2026010801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
Pull HID fixes from Jiri Kosina:
- build fix for HID-BPF (Benjamin Tissoires)
- fix for potential buffer overflow in i2c-hid (Kwok Kin Ming)
- a couple of selftests/hid fixes (Peter Hutterer)
- fix for handling pressure pads in hid-multitouch (Peter Hutterer)
- fix for potential NULL pointer dereference in intel-thc-hid (Even Xu)
- fix for interrupt delay control in intel-thc-hid (Even Xu)
- fix finger release detection on some VTL-class touchpads (DaytonCL)
- fix for correct enumeration on intel-ish-hid systems with no sensors
(Zhang Lixu)
- assorted device ID additions and device-specific quirks
* tag 'hid-for-linus-2026010801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (21 commits)
HID: logitech: add HID++ support for Logitech MX Anywhere 3S
HID: Elecom: Add support for ELECOM M-XT3DRBK (018C)
HID: quirks: work around VID/PID conflict for appledisplay
HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
selftests/hid: add a test for the Digitizer/Button Type pressurepad
selftests/hid: use a enum class for the different button types
selftests/hid: require hidtools 0.12
HID: multitouch: set INPUT_PROP_PRESSUREPAD based on Digitizer/Button Type
HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
HID: Intel-thc-hid: Intel-thc: Add safety check for reading DMA buffer
hid: intel-thc-hid: Select SGL_ALLOC
selftests/hid: fix bpf compilations due to -fms-extensions
HID: bpf: fix bpf compilation with -fms-extensions
HID: Intel-thc-hid: Intel-thc: Fix wrong register reading
HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
HID: intel-ish-hid: Reset enum_devices_done before enumeration
HID: intel-ish-hid: Update ishtp bus match to support device ID table
HID: Intel-thc-hid: Intel-thc: fix dma_unmap_sg() nents value
HID: playstation: Center initial joystick axes to prevent spurious events
...
Baochen Qiang [Mon, 22 Dec 2025 02:29:07 +0000 (10:29 +0800)]
wifi: mac80211: collect station statistics earlier when disconnect
In __sta_info_destroy_part2(), station statistics are requested after the
IEEE80211_STA_NONE -> IEEE80211_STA_NOTEXIST transition. This is
problematic because the driver may be unable to handle the request due to
the STA being in the NOTEXIST state (i.e. if the driver destroys the
underlying data when transitioning to NOTEXIST).
Move the statistics collection to before the state transition to avoid
this issue.
During the transition to use channel contexts throughout, the
ability to do injection while in monitor mode concurrent with
another interface was lost, since the (virtual) monitor won't
have a chanctx assigned in this scenario.
It's harder to fix drivers that actually transitioned to using
channel contexts themselves, such as mt76, but it's easy to do
those that are (still) just using the emulation. Do that.
Miri Korenblit [Wed, 7 Jan 2026 13:37:36 +0000 (14:37 +0100)]
wifi: mac80211: don't iterate not running interfaces
for_each_chanctx_user_* was introdcued as a replacement for
for_each_sdata_link, which visits also other chanctx users that are not
link.
for_each_sdata_link skips not running interfaces, do the same for
for_each_chanctx_user_*
Benjamin Berg [Wed, 7 Jan 2026 13:36:51 +0000 (14:36 +0100)]
wifi: mac80211_hwsim: fix typo in frequency notification
The NAN notification is for 5745 MHz which corresponds to channel 149
and not 5475 which is not actually a valid channel. This could result in
a NULL pointer dereference in cfg80211_next_nan_dw_notif.
Fixes: a37a6f54439b ("wifi: mac80211_hwsim: Add simulation support for NAN device") Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Reviewed-by: Ilan Peer <ilan.peer@intel.com> Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260107143652.7dab2035836f.Iacbaf7bb94ed5c14a0928a625827e4137d8bfede@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Eric Dumazet [Thu, 8 Jan 2026 10:19:27 +0000 (10:19 +0000)]
wifi: avoid kernel-infoleak from struct iw_point
struct iw_point has a 32bit hole on 64bit arches.
struct iw_point {
void __user *pointer; /* Pointer to the data (in user space) */
__u16 length; /* number of fields or size in bytes */
__u16 flags; /* Optional params */
};
Make sure to zero the structure to avoid disclosing 32bits of kernel data
to user space.
Fixes: 87de87d5e47f ("wext: Dispatch and handle compat ioctls entirely in net/wireless/wext.c") Reported-by: syzbot+bfc7323743ca6dbcc3d3@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/695f83f3.050a0220.1c677c.0392.GAE@google.com/T/#u Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260108101927.857582-1-edumazet@google.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
====================
net: phy: realtek: various improvements for 2.5GE PHYs
This series improves the RealTek PHY driver, mostly for 2.5GE PHYs.
It implements configuring SGMII and 2500Base-X in-band auto-negotiation
and improves using the PHYs in Clause-22-only mode.
Note that the rtl822x_serdes_write() function introduced by this series
is going to be reused to configure polarities of SerDes RX and TX lanes
once series "PHY polarity inversion via generic device tree properties"
has been applied.
Access to other registers on MDIO_MMD_VEND2 is important for more than
just configuring autonegotiation, it is also used to setup ALDPS or to
disable the PHY responding to the MDIO broadcast address 0. Both will be
implemented by follow-up patches.
The address translation function for registers on MDIO_MMD_VEND2 into
paged registers can potentially also be used to describe other paged
access in a more consistent way, but that mostly makes sense on PHYs
which also support Clause-45, so this series doesn't convert all the
existing paged access on RealTek's 1GE PHYs which do not support
Clause-45.
====================
Daniel Golle [Mon, 5 Jan 2026 16:39:26 +0000 (16:39 +0000)]
net: phy: realtek: get rid of magic number in rtlgen_read_status()
Use newly introduced helper macros RTL822X_VND2_TO_PAGE and
RTL822X_VND2_TO_PAGE_REG to access RTL_VEND2_PHYSR register over Clause-22
paged access instead of using magic numbers.
Daniel Golle [Mon, 5 Jan 2026 16:38:59 +0000 (16:38 +0000)]
net: phy: realtek: use paged access for MDIO_MMD_VEND2 in C22 mode
RTL822x cannot access MDIO_MMD_VEND2 via MII_MMD_CTRL/MII_MMD_DATA. A
mapping to use paged access needs to be used instead. All other MMD
devices can be accessed as usual.
Implement phy_read_mmd and phy_write_mmd using paged access for
MDIO_MMD_VEND2 in Clause-22 mode instead of relying on
MII_MMD_CTRL/MII_MMD_DATA. This allows eg. rtl822x_config_aneg to work
as expected in case the MDIO bus doesn't support Clause-45 access.
Daniel Golle [Mon, 5 Jan 2026 16:38:29 +0000 (16:38 +0000)]
net: phy: move mmd_phy_read and mmd_phy_write to phylib.h
Helper functions mmd_phy_read and mmd_phy_write are useful for PHYs
which require custom MMD access functions for some but not all MMDs.
Move mmd_phy_read and mmd_phy_write function prototypes from
phylib-internal.h to phylib.h to make them available for PHY drivers.
Daniel Golle [Mon, 5 Jan 2026 16:38:12 +0000 (16:38 +0000)]
net: phy: realtek: implement configuring in-band an
Implement the inband_caps() and config_inband() PHY driver methods to
allow configuring the use of in-band-status with SGMII and 2500Base-X on
RTL8226 and RTL8221B 2.5GE PHYs.
This series aims to make the PTP handling a bit more generic to ease the
addition of PTP support for the KSZ8463 in an upcoming series. It is not
intented to change any behaviour in the driver here.
Patches 1 & 2 focus on IRQ handling.
Patches 3 to 9 focus on register access.
net: dsa: microchip: Wrap timestamp reading in a function
Timestamps are directly accessed through a register read in the
interrupt handler. KSZ8463's logic to access it will be a bit more
complex because the same interrupt can be triggered by two different
timestamps being ready.
Wrap the timestamp's reading in a dedicated function to ease the
KSZ8463's integration in upcoming patches.
net: dsa: microchip: Use regs[] to access REG_PTP_MSG_CONF1
Accesses to the PTP_MSG_CONF1 register are done through a hardcoded
address which doesn't match with the KSZ8463's register layout.
Add a new entry for the PTP_MSG_CONF1 register in the regs[] tables.
Use the regs[] table to retrieve the PTP_MSG_CONF1 register address
when accessing it.
Remove the macro defining the address to prevent further use.
net: dsa: microchip: Use regs[] to access REG_PTP_SUBNANOSEC_RATE
Accesses to the PTP_SUBNANOSEC_RATE register are done through a
hardcoded address which doesn't match with the KSZ8463's register
layout.
Add a new entry for the PTP_SUBNANOSEC_RATE register in the regs[]
tables.
Use the regs[] table to retrieve the PTP_SUBNANOSEC_RATE register
address when accessing it.
Remove the macro defining the address to prevent further use.
net: dsa: microchip: Use regs[] to access REG_PTP_RTC_SUB_NANOSEC
Accesses to the PTP_RTC_SUB_NANOSEC register are done through a
hardcoded address which doesn't match with the KSZ8463's register
layout.
Add a new entry for the PTP_RTC_SUB_NANOSEC register in the regs[]
tables.
Use the regs[] table to retrieve the PTP_RTC_SUB_NANOSEC register
address when accessing it.
Remove the macro defining the address to prevent further use.
net: dsa: microchip: Use regs[] to access REG_PTP_RTC_SEC
Accesses to the PTP_RTC_SEC register are done through a hardcoded
address which doesn't match with the KSZ8463's register layout.
Add a new entry for the PTP_RTC_SEC register in the regs[] tables.
Use the regs[] table to retrieve the PTP_RTC_SEC register address
when accessing it.
Remove the macro defining the address to prevent further use.
net: dsa: microchip: Use regs[] to access REG_PTP_RTC_NANOSEC
Accesses to the PTP_RTC_NANOSEC register are done through a hardcoded
address which doesn't match with the KSZ8463's register layout.
Add a new entry for the PTP_RTC_NANOSEC register in the regs[] tables.
Use the regs[] table to retrieve the PTP_RTC_NANOSEC register address
when accessing it.
Remove the macro defining the address to prevent further use.
net: dsa: microchip: Use regs[] to access REG_PTP_CLK_CTRL
Accesses to the PTP_CLK_CTRL register are done through a hardcoded
address which doesn't match with the KSZ8463's register layout.
Add a new entry for the PTP_CLK_CTRL register in the regs[] tables.
Use the regs[] table to retrieve the PTP_CLK_CTRL register address
when accessing it.
Remove the macro defining the address to prevent further use.
The PTP irq_chip operations use an hardcoded IRQ offset in the bit
logic. This IRQ offset isn't the same on KSZ8463 than on others switches
so it can't use the irq_chip operations.
Convey the interrupt bit offset through a new attribute in struct ksz_irq
The IRQ logic of the KSZ8463 differs from that of other KSZ switches.
It doesn't have a 'mask' register but an 'enable' one instead. The
common IRQ framework can still be used though as soon as we reverse
the logic (using '1' to enable interrupts instead of '0') for KSZ8463
cases.
Move the initialization of the kirq->masked outside of
ksz_irq_common_setup() to keep this function truly common when
IRQ support for the KSZ8463 is added.
HID: logitech: add HID++ support for Logitech MX Anywhere 3S
I've acquired a Logitech MX Anywhere 3S mouse, which supports HID++ over
Bluetooth. Adding its PID 0xb037 to the allowlist enables the additional
features, such as high-resolution scrolling. Tested working across multiple
machines, with a mix of Intel and Mediatek Bluetooth chips.
net: airoha: Fix schedule while atomic in airoha_ppe_deinit()
airoha_ppe_deinit() runs airoha_npu_ppe_deinit() in atomic context.
airoha_npu_ppe_deinit routine allocates ppe_data buffer with GFP_KERNEL
flag. Rely on rcu_replace_pointer in airoha_ppe_deinit routine in order
to fix schedule while atomic issue in airoha_npu_ppe_deinit() since we
do not need atomic context there.
HID: Elecom: Add support for ELECOM M-XT3DRBK (018C)
Wireless/new version of the Elecom trackball mouse M-XT3DRBK has a
product id that differs from the existing M-XT3DRBK.
The report descriptor format also seems to have changed and matches
other (newer?) models instead (except for six buttons instead of eight).
This patch follows the same format as the patch for the M-XT3URBK (018F)
by Naoki Ueki (Nov 3rd 2025) to enable the sixth mouse button.
dmesg output:
[ 292.074664] usb 1-2: new full-speed USB device number 7 using xhci_hcd
[ 292.218667] usb 1-2: New USB device found, idVendor=056e, idProduct=018c, bcdDevice= 1.00
[ 292.218676] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 292.218679] usb 1-2: Product: ELECOM TrackBall Mouse
[ 292.218681] usb 1-2: Manufacturer: ELECOM
René Rebe [Fri, 28 Nov 2025 12:46:41 +0000 (13:46 +0100)]
HID: quirks: work around VID/PID conflict for appledisplay
For years I wondered why the Apple Cinema Display driver would not
just work for me. Turns out the hidraw driver instantly takes it
over. Fix by adding appledisplay VID/PIDs to hid_have_special_driver.
Fixes: 069e8a65cd79 ("Driver for Apple Cinema Display") Signed-off-by: René Rebe <rene@exactco.de> Signed-off-by: Jiri Kosina <jkosina@suse.com>
Kwok Kin Ming [Wed, 31 Dec 2025 18:18:26 +0000 (02:18 +0800)]
HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
`i2c_hid_xfer` is used to read `recv_len + sizeof(__le16)` bytes of data
into `ihid->rawbuf`.
The former can come from the userspace in the hidraw driver and is only
bounded by HID_MAX_BUFFER_SIZE(16384) by default (unless we also set
`max_buffer_size` field of `struct hid_ll_driver` which we do not).
The latter has size determined at runtime by the maximum size of
different report types you could receive on any particular device and
can be a much smaller value.
Fix this by truncating `recv_len` to `ihid->bufsize - sizeof(__le16)`.
The impact is low since access to hidraw devices requires root.
Signed-off-by: Kwok Kin Ming <kenkinming2002@gmail.com> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Peter Hutterer [Sun, 21 Dec 2025 23:43:37 +0000 (09:43 +1000)]
selftests/hid: add a test for the Digitizer/Button Type pressurepad
We have to resort to a bit of a hack: python-libevdev gets the
properties from libevdev at module init time. If libevdev hasn't been
rebuilt with the new property it won't be automatically populated. So we
hack around this by constructing the property manually.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Peter Hutterer [Sun, 21 Dec 2025 23:43:36 +0000 (09:43 +1000)]
selftests/hid: use a enum class for the different button types
Instead of multiple spellings of a string-provided argument, let's make
this a tad more type-safe and use an enum here.
And while we do this fix the two wrong devices:
- elan_04f3_313a (HP ZBook Fury 15) is discrete button pad
- dell_044e_1220 (Dell Precision 7740) is a discrete button pad
Peter Hutterer [Sun, 21 Dec 2025 23:43:35 +0000 (09:43 +1000)]
selftests/hid: require hidtools 0.12
Not all our tests really require it but since it's likely pip-installed
anyway it's trivial to require the new version, just in case we want to
start cleaning up other bits.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Peter Hutterer [Sun, 21 Dec 2025 23:43:34 +0000 (09:43 +1000)]
HID: multitouch: set INPUT_PROP_PRESSUREPAD based on Digitizer/Button Type
A Digitizer/Button Type value of 1 indicates the device is a
pressurepad, see
https://learn.microsoft.com/en-us/windows-hardware/design/component-guidelines/touchpad-windows-precision-touchpad-collection#device-capabilities-feature-report
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Chris Chiu [Fri, 2 Jan 2026 06:56:43 +0000 (06:56 +0000)]
HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
Another Chicony Electronics HP 5MP Camera with USB ID 04F2:B882
reports a HID sensor interface that is not actually implemented.
Add the device to the HID ignore list so the bogus sensor is never
exposed to userspace. Then the system won't hang when runtime PM
tries to wake the unresponsive device.
Signed-off-by: Chris Chiu <chris.chiu@canonical.com> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
selftests/hid: fix bpf compilations due to -fms-extensions
Similar to commit 835a50753579 ("selftests/bpf: Add -fms-extensions to
bpf build flags") and commit 639f58a0f480 ("bpftool: Fix build warnings
due to MS extensions")
The kernel is now built with -fms-extensions, therefore
generated vmlinux.h contains types like:
struct slab {
..
struct freelist_counters;
};
Use -fms-extensions and -Wno-microsoft-anon-tag flags
to build bpf programs that #include "vmlinux.h"
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
HID: bpf: fix bpf compilation with -fms-extensions
Similar to commit 835a50753579 ("selftests/bpf: Add -fms-extensions to
bpf build flags") and commit 639f58a0f480 ("bpftool: Fix build warnings
due to MS extensions")
The kernel is now built with -fms-extensions, therefore
generated vmlinux.h contains types like:
struct slab {
..
struct freelist_counters;
};
Use -fms-extensions and -Wno-microsoft-anon-tag flags
to build bpf programs that #include "vmlinux.h"
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
====================
net: netdevsim: fix inconsistent carrier state after link/unlink
This series fixes netdevsim's inconsistent behavior between carrier
and link/unlink state.
More specifically, this fixes a bug that the carrier goes DOWN although
two netdevsim were peered, depending on the order of peering and ifup.
Especially in a NetworkManager-enabled environment, netdevsim test fails
because of this.
The first patch fixes the bug itself in netdevsim/bus.c by adding
netif_carrier_on() into a proper function. The second patch adds a
regression test for this bug.
====================
Yohei Kojima [Mon, 5 Jan 2026 15:17:33 +0000 (00:17 +0900)]
selftests: netdevsim: add carrier state consistency test
This commit adds a test case for netdevsim carrier state consistency.
Specifically, the added test verifies the carrier state during the
following operations:
1. Unlink two netdevsims
2. ifdown one netdevsim, then ifup again
3. Link the netdevsims again
4. ifdown one netdevsim, then ifup again
These steps verifies that the carrier is UP iff two netdevsims are
linked and ifuped.
Yohei Kojima [Mon, 5 Jan 2026 15:17:32 +0000 (00:17 +0900)]
net: netdevsim: fix inconsistent carrier state after link/unlink
This patch fixes the edge case behavior on ifup/ifdown and
linking/unlinking two netdevsim interfaces:
1. unlink two interfaces netdevsim1 and netdevsim2
2. ifdown netdevsim1
3. ifup netdevsim1
4. link two interfaces netdevsim1 and netdevsim2
5. (Now two interfaces are linked in terms of netdevsim peer, but
carrier state of the two interfaces remains DOWN.)
This inconsistent behavior is caused by the current implementation,
which only cares about the "link, then ifup" order, not "ifup, then
link" order. This patch fixes the inconsistency by calling
netif_carrier_on() when two netdevsim interfaces are linked.
This patch fixes buggy behavior on NetworkManager-based systems which
causes the netdevsim test to fail with the following error:
# timeout set to 600
# selftests: drivers/net/netdevsim: peer.sh
# 2025/12/25 00:54:03 socat[9115] W address is opened in read-write mode but only supports read-only
# 2025/12/25 00:56:17 socat[9115] W connect(7, AF=2 192.168.1.1:1234, 16): Connection timed out
# 2025/12/25 00:56:17 socat[9115] E TCP:192.168.1.1:1234: Connection timed out
# expected 3 bytes, got 0
# 2025/12/25 00:56:17 socat[9109] W exiting on signal 15
not ok 13 selftests: drivers/net/netdevsim: peer.sh # exit=1
This patch also solves timeout on TCP Fast Open (TFO) test in
NetworkManager-based systems because it also depends on netdevsim's
carrier consistency.
selftests/net: packetdrill: add minimal client and server tests
Introduce minimal tests. These can serve as simple illustrative
examples, and as templates when writing new tests.
When adding new cases, it can be easier to extend an existing base
test rather than start from scratch. The existing tests all focus on
real, often non-trivial, features. It is not obvious which to take as
starting point, and arguably none really qualify.
Add two tests
- the client test performs the active open and initial close
- the server test implements the passive open and final close
The optional and required hints in the tcp_congestion_ops are information
for the user of this interface to signalize its importance when
implementing these functions.
However, cong_avoid comment incorrectly tells that it is required,
in reality congestion control must provide one of either cong_avoid or
cong_control.
In addition, min_tso_segs has not had any comment optional/required
hints. So mark it as optional since it is used only in BBR.
Shivani Gupta [Mon, 5 Jan 2026 00:59:05 +0000 (00:59 +0000)]
net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy
syzbot reported a crash in tc_act_in_hw() during netns teardown where
tcf_idrinfo_destroy() passed an ERR_PTR(-EBUSY) value as a tc_action
pointer, leading to an invalid dereference.
Guard against ERR_PTR entries when iterating the action IDR so teardown
does not call tc_act_in_hw() on an error pointer.
Vivian Wang [Sun, 4 Jan 2026 06:00:04 +0000 (14:00 +0800)]
net: spacemit: Remove broken flow control support
The current flow control implementation doesn't handle autonegotiation
and ethtool operations properly. Remove it for now so we don't claim
support for something that doesn't really work. A better implementation
will be sent in future patches.
Breno Leitao [Mon, 5 Jan 2026 15:28:26 +0000 (07:28 -0800)]
net: gve: convert to use .get_rx_ring_count
Convert the Google Virtual Ethernet (GVE) driver to use the new
.get_rx_ring_count ethtool operation instead of handling
ETHTOOL_GRXRINGS in .get_rxnfc. This simplifies the code by moving the
ring count query to a dedicated callback.
The new callback provides the same functionality in a more direct way,
following the ongoing ethtool API modernization.
net: sfp: return the number of written bytes for smbus single byte access
We expect the SFP write accessors to return the number of written bytes.
We fail to do so for single-byte smbus accesses, which may cause errors
when setting a module's high-power state and for some cotsworks modules.
Let's return the amount of written bytes, as expected.
Fixes: 7662abf4db94 ("net: phy: sfp: Add support for SMBus module access") Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260105151840.144552-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
projects / thirdparty / kernel / linux.git / log
