summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-02-10Merge tag 'hardening-v7.0-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: "Mostly small cleanups and various scattered annotations and flex array warning fixes that we reviewed by unlanded in other trees. Introduces new annotation for expanding counted_by to pointer members, now that compiler behavior between GCC and Clang has been normalized. - Various missed __counted_by annotations (Thorsten Blum) - Various missed -Wflex-array-member-not-at-end fixes (Gustavo A. R. Silva) - Avoid leftover tempfiles for interrupted compile-time FORTIFY tests (Nicolas Schier) - Remove non-existant CONFIG_UBSAN_REPORT_FULL from docs (Stefan Wiehler) - fortify: Use C arithmetic not FIELD_xxx() in FORTIFY_REASON defines (David Laight) - Add __counted_by_ptr attribute, tests, and first user (Bill Wendling, Kees Cook) - Update MAINTAINERS file to make hardening section not include pstore" * tag 'hardening-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: MAINTAINERS: pstore: Remove L: entry nfp: tls: Avoid -Wflex-array-member-not-at-end warnings carl9170: Avoid -Wflex-array-member-not-at-end warning coredump: Use __counted_by_ptr for struct core_name::corename lkdtm/bugs: Add __counted_by_ptr() test PTR_BOUNDS compiler_types.h: Attributes: Add __counted_by_ptr macro fortify: Cleanup temp file also on non-successful exit fortify: Rename temporary file to match ignore pattern fortify: Use C arithmetic not FIELD_xxx() in FORTIFY_REASON defines ecryptfs: Annotate struct ecryptfs_message with __counted_by fs/xattr: Annotate struct simple_xattr with __counted_by crypto: af_alg - Annotate struct af_alg_iv with __counted_by Kconfig.ubsan: Remove CONFIG_UBSAN_REPORT_FULL from documentation drm/nouveau: fifo: Avoid -Wflex-array-member-not-at-end warning
2026-02-10crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctlyKees Cook
The existing allocation of scatterlists in omap_crypto_copy_sg_lists() was allocating an array of scatterlist pointers, not scatterlist objects, resulting in a 4x too small allocation. Use sizeof(*new_sg) to get the correct object size. Fixes: 74ed87e7e7f7 ("crypto: omap - add base support library for common routines") Signed-off-by: Kees Cook <kees@kernel.org> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-10Merge tag 'v7.0-p1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto update from Herbert Xu: "API: - Fix race condition in hwrng core by using RCU Algorithms: - Allow authenc(sha224,rfc3686) in fips mode - Add test vectors for authenc(hmac(sha384),cbc(aes)) - Add test vectors for authenc(hmac(sha224),cbc(aes)) - Add test vectors for authenc(hmac(md5),cbc(des3_ede)) - Add lz4 support in hisi_zip - Only allow clear key use during self-test in s390/{phmac,paes} Drivers: - Set rng quality to 900 in airoha - Add gcm(aes) support for AMD/Xilinx Versal device - Allow tfms to share device in hisilicon/trng" * tag 'v7.0-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (100 commits) crypto: img-hash - Use unregister_ahashes in img_{un}register_algs crypto: testmgr - Add test vectors for authenc(hmac(md5),cbc(des3_ede)) crypto: cesa - Simplify return statement in mv_cesa_dequeue_req_locked crypto: testmgr - Add test vectors for authenc(hmac(sha224),cbc(aes)) crypto: testmgr - Add test vectors for authenc(hmac(sha384),cbc(aes)) hwrng: core - use RCU and work_struct to fix race condition crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() crypto: xilinx - Fix inconsistant indentation crypto: rng - Use unregister_rngs in register_rngs crypto: atmel - Use unregister_{aeads,ahashes,skciphers} hwrng: optee - simplify OP-TEE context match crypto: ccp - Add sysfs attribute for boot integrity dt-bindings: crypto: atmel,at91sam9g46-sha: add microchip,lan9691-sha dt-bindings: crypto: atmel,at91sam9g46-aes: add microchip,lan9691-aes dt-bindings: crypto: qcom,inline-crypto-engine: document the Milos ICE crypto: caam - fix netdev memory leak in dpaa2_caam_probe crypto: hisilicon/qm - increase wait time for mailbox crypto: hisilicon/qm - obtain the mailbox configuration at one time crypto: hisilicon/qm - remove unnecessary code in qm_mb_write() crypto: hisilicon/qm - move the barrier before writing to the mailbox register ...
2026-02-10Merge tag 'libcrypto-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library updates from Eric Biggers: - Add support for verifying ML-DSA signatures. ML-DSA (Module-Lattice-Based Digital Signature Algorithm) is a recently-standardized post-quantum (quantum-resistant) signature algorithm. It was known as Dilithium pre-standardization. The first use case in the kernel will be module signing. But there are also other users of RSA and ECDSA signatures in the kernel that might want to upgrade to ML-DSA eventually. - Improve the AES library: - Make the AES key expansion and single block encryption and decryption functions use the architecture-optimized AES code. Enable these optimizations by default. - Support preparing an AES key for encryption-only, using about half as much memory as a bidirectional key. - Replace the existing two generic implementations of AES with a single one. - Simplify how Adiantum message hashing is implemented. Remove the "nhpoly1305" crypto_shash in favor of direct lib/crypto/ support for NH hashing, and enable optimizations by default. * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (53 commits) lib/crypto: mldsa: Clarify the documentation for mldsa_verify() slightly lib/crypto: aes: Drop 'volatile' from aes_sbox and aes_inv_sbox lib/crypto: aes: Remove old AES en/decryption functions lib/crypto: aesgcm: Use new AES library API lib/crypto: aescfb: Use new AES library API crypto: omap - Use new AES library API crypto: inside-secure - Use new AES library API crypto: drbg - Use new AES library API crypto: crypto4xx - Use new AES library API crypto: chelsio - Use new AES library API crypto: ccp - Use new AES library API crypto: x86/aes-gcm - Use new AES library API crypto: arm64/ghash - Use new AES library API crypto: arm/ghash - Use new AES library API staging: rtl8723bs: core: Use new AES library API net: phy: mscc: macsec: Use new AES library API chelsio: Use new AES library API Bluetooth: SMP: Use new AES library API crypto: x86/aes - Remove the superseded AES-NI crypto_cipher lib/crypto: x86/aes: Add AES-NI optimization ...
2026-02-10Revert "clk: microchip: core: allow driver to be compiled with COMPILE_TEST"Thomas Bogendoerfer
This reverts commit 026d70dcfe5de1543bb8edb8e50d22dc16863e6b. Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-02-10Revert "clk: microchip: fix typo in reference to a config option"Thomas Bogendoerfer
This reverts commit a6ab150deb4b740334721d18e02ad400a9d888f5. Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-02-10platform/x86: lenovo-wmi-{capdata,other}: Fix HWMON channel visibilityRong Zhang
The LWMI_SUPP_MAY_{GET,SET} macros are fundamentally broken. When I introduced them, I meant to check LWMI_SUPP_VALID *and* the corresponding bits for get/set capabilities. However, `supported & LWMI_SUPP_MAY_{GET,SET}' means *or*, so it accidentally passes the check when LWMI_SUPP_VALID is set. Fix them by only including the corresponding get/set bit without LWMI_SUPP_VALID. Meanwhile, rename them to LWMI_SUPP_{GET,SET} to make them less confusing. Fixes: 67d9a39ce85f ("platform/x86: lenovo-wmi-capdata: Wire up Fan Test Data") Signed-off-by: Rong Zhang <i@rong.moe> Link: https://patch.msgid.link/20260207172327.80111-1-i@rong.moe Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-02-10hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identificationCarl Lee
When MPQ8785 reports VOUT_MODE as VID mode, mpq8785_identify() configures the driver for direct mode. The subsequent pmbus_identify_common() check then fails due to a mismatch between the reported mode and the configured mode, causing device initialization to fail. Override the reported VOUT_MODE to direct mode to keep the driver configuration consistent with the reported mode and allow successful device initialization. This does not change how voltages are interpreted, but avoids a false identification failure caused by mismatched mode handling. Fixes: f20b4a931130c ("hwmon: Add driver for MPS MPQ8785 Synchronous Step-Down Converter") Signed-off-by: Carl Lee <carl.lee@amd.com> Link: https://lore.kernel.org/r/20260210-dt-bindings-hwmon-pmbus-mpq8785-add-mpq8786-support-v3-1-84636ccfe76f@amd.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-02-10Revert "hwmon: (ibmpex) fix use-after-free in high/low store"Guenter Roeck
This reverts commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d. Jean Delvare points out that the patch does not completely fix the reported problem, that it in fact introduces a (new) race condition, and that it may actually not be needed in the first place. Various AI reviews agree. Specific and relevant AI feedback: " This reordering sets the driver data to NULL before removing the sensor attributes in the loop below. ibmpex_show_sensor() retrieves this driver data via dev_get_drvdata() but does not check if it is NULL before dereferencing it to access data->sensors[]. If a userspace process reads a sensor file (like temp1_input) while this delete function is running, could it race with the dev_set_drvdata(..., NULL) call here and crash in ibmpex_show_sensor()? Would it be safer to keep the original order where device_remove_file() is called before clearing the driver data? device_remove_file() should wait for any active sysfs callbacks to complete, which might already prevent the use-after-free this patch intends to fix. " Revert the offending patch. If it can be shown that the originally reported alleged race condition does indeed exist, it can always be re-introduced with a complete fix. Reported-by: Jean Delvare <jdelvare@suse.de> Closes: https://lore.kernel.org/linux-hwmon/20260121095342.73e723cb@endymion/ Cc: Jean Delvare <jdelvare@suse.de> Cc: Junrui Luo <moonafterrain@outlook.com> Fixes: 6946c726c3f4 ("hwmon: (ibmpex) fix use-after-free in high/low store") Reviewed-by: Jean Delvare <jdelvare@suse.de> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-02-10octeon_ep_vf: ensure dbell BADDR updationVimlesh Kumar
Make sure the OUT DBELL base address reflects the latest values written to it. Fix: Add a wait until the OUT DBELL base address register is updated with the DMA ring descriptor address, and modify the setup_oq function to properly handle failures. Fixes: 2c0c32c72be29 ("octeon_ep_vf: add hardware configuration APIs") Signed-off-by: Sathesh Edara <sedara@marvell.com> Signed-off-by: Shinas Rasheed <srasheed@marvell.com> Signed-off-by: Vimlesh Kumar <vimleshk@marvell.com> Link: https://patch.msgid.link/20260206111510.1045092-4-vimleshk@marvell.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10octeon_ep: ensure dbell BADDR updationVimlesh Kumar
Make sure the OUT DBELL base address reflects the latest values written to it. Fix: Add a wait until the OUT DBELL base address register is updated with the DMA ring descriptor address, and modify the setup_oq function to properly handle failures. Fixes: 0807dc76f3bf5 ("octeon_ep: support Octeon CN10K devices") Signed-off-by: Sathesh Edara <sedara@marvell.com> Signed-off-by: Shinas Rasheed <srasheed@marvell.com> Signed-off-by: Vimlesh Kumar <vimleshk@marvell.com> Link: https://patch.msgid.link/20260206111510.1045092-3-vimleshk@marvell.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10octeon_ep: disable per ring interruptsVimlesh Kumar
Disable the MSI-X per ring interrupt for every PF ring when PF netdev goes down. Fixes: 1f2c2d0cee023 ("octeon_ep: add hardware configuration APIs") Signed-off-by: Sathesh Edara <sedara@marvell.com> Signed-off-by: Shinas Rasheed <srasheed@marvell.com> Signed-off-by: Vimlesh Kumar <vimleshk@marvell.com> Link: https://patch.msgid.link/20260206111510.1045092-2-vimleshk@marvell.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net/mlx5e: remove declarations of mlx5e_shampo_{fill_umr,dealloc_hd}Simon Horman
These functions were recently removed by commit 24cf78c73831 ("net/mlx5e: SHAMPO, Switch to header memcpy"), however, their declarations were left behind. This patch removes those declarations. Flagged by review-prompts while I was exercising Orc mode locally. Compile tested only. Signed-off-by: Simon Horman <horms@kernel.org> Reviewed-by: Joe Damato <joe@dama.to> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260206-shampo-v1-1-75b20c6657e5@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()Thomas Fourier
The priv->rx_buffer and priv->tx_buffer are alloc'd together as contiguous buffers in uhdlc_init() but freed as two buffers in uhdlc_memclean(). Change the cleanup to only call dma_free_coherent() once on the whole buffer. Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Fixes: c19b6d246a35 ("drivers/net: support hdlc function for QE-UCC") Cc: <stable@vger.kernel.org> Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com> Link: https://patch.msgid.link/20260206085334.21195-2-fourier.thomas@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: dsa: eliminate local type for tc policersVladimir Oltean
David Yang is saying that struct flow_action_entry in include/net/flow_offload.h has gained new fields and DSA's struct dsa_mall_policer_tc_entry, derived from that, isn't keeping up. This structure is passed to drivers and they are completely oblivious to the values of fields they don't see. This has happened before, and almost always the solution was to make the DSA layer thinner and use the upstream data structures. Here, the reason why we didn't do that is because struct flow_action_entry :: police is an anonymous structure. That is easily enough fixable, just name those fields "struct flow_action_police" and reference them from DSA. Make the according transformations to the two users (sja1105 and felix): "rate_bytes_per_sec" -> "rate_bytes_ps". Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Co-developed-by: David Yang <mmyangfl@gmail.com> Signed-off-by: David Yang <mmyangfl@gmail.com> Link: https://patch.msgid.link/20260206075427.44733-1-mmyangfl@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10serial: caif: fix use-after-free in caif_serial ldisc_close()Jiayuan Chen
There is a use-after-free bug in caif_serial where handle_tx() may access ser->tty after the tty has been freed. The race condition occurs between ldisc_close() and packet transmission: CPU 0 (close) CPU 1 (xmit) ------------- ------------ ldisc_close() tty_kref_put(ser->tty) [tty may be freed here] <-- race window --> caif_xmit() handle_tx() tty = ser->tty // dangling ptr tty->ops->write() // UAF! schedule_work() ser_release() unregister_netdevice() The root cause is that tty_kref_put() is called in ldisc_close() while the network device is still active and can receive packets. Since ser and tty have a 1:1 binding relationship with consistent lifecycles (ser is allocated in ldisc_open and freed in ser_release via unregister_netdevice, and each ser binds exactly one tty), we can safely defer the tty reference release to ser_release() where the network device is unregistered. Fix this by moving tty_kref_put() from ldisc_close() to ser_release(), after unregister_netdevice(). This ensures the tty reference is held as long as the network device exists, preventing the UAF. Note: We save ser->tty before unregister_netdevice() because ser is embedded in netdev's private data and will be freed along with netdev (needs_free_netdev = true). How to reproduce: Add mdelay(500) at the beginning of ldisc_close() to widen the race window, then run the reproducer program [1]. Note: There is a separate deadloop issue in handle_tx() when using PORT_UNKNOWN serial ports (e.g., /dev/ttyS3 in QEMU without proper serial backend). This deadloop exists even without this patch, and is likely caused by inconsistency between uart_write_room() and uart_write() in serial core. It has been addressed in a separate patch [2]. KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in handle_tx+0x5d1/0x620 Read of size 1 at addr ffff8881131e1490 by task caif_uaf_trigge/9929 Call Trace: <TASK> dump_stack_lvl+0x10e/0x1f0 print_report+0xd0/0x630 kasan_report+0xe4/0x120 handle_tx+0x5d1/0x620 dev_hard_start_xmit+0x9d/0x6c0 __dev_queue_xmit+0x6e2/0x4410 packet_xmit+0x243/0x360 packet_sendmsg+0x26cf/0x5500 __sys_sendto+0x4a3/0x520 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0xc9/0xf80 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f615df2c0d7 Allocated by task 9930: Freed by task 64: Last potentially related work creation: The buggy address belongs to the object at ffff8881131e1000 which belongs to the cache kmalloc-cg-2k of size 2048 The buggy address is located 1168 bytes inside of freed 2048-byte region [ffff8881131e1000, ffff8881131e1800) The buggy address belongs to the physical page: page_owner tracks the page as allocated page last free pid 9778 tgid 9778 stack trace: Memory state around the buggy address: ffff8881131e1380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881131e1400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8881131e1480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881131e1500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881131e1580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== [1]: https://gist.github.com/mrpre/f683f244544f7b11e7fa87df9e6c2eeb [2]: https://lore.kernel.org/linux-serial/20260204074327.226165-1-jiayuan.chen@linux.dev/T/#u Reported-by: syzbot+827272712bd6d12c79a4@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a4a7550611e234f5@google.com/T/ Fixes: 56e0ef527b18 ("drivers/net: caif: fix wrong rtnl_is_locked() usage") Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com> Reviewed-by: Jijie Shao <shaojijie@huawei.com> Link: https://patch.msgid.link/20260206074450.154267-1-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: ethernet: marvell: skge: remove incorrect conflicting PCI IDEthan Nelson-Moore
The ID 1186:4302 is matched by both r8169 and skge. The same device ID should not be in more than one driver, because in that case, which driver is used is unpredictable. I downloaded the latest drivers for all hardware revisions of the D-Link DGE-530T from D-Link's website, and the only drivers which contain this ID are Realtek drivers. Therefore, remove this device ID from skge. In the kernel bug report which requested addition of this device ID, someone created a patch to add the ID to skge. Then, it was pointed out that this device is an "r8169 in disguise", and a patch was created to add it to r8169. Somehow, both of these patches got merged. See the link below. Link: https://bugzilla.kernel.org/show_bug.cgi?id=38862 Fixes: c074304c2bcf ("add pci-id for DGE-530T") Cc: stable@vger.kernel.org Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Link: https://patch.msgid.link/20260206071724.15268-1-enelsonmoore@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: ftgmac100: Use devm_mdiobus_alloc/devm_of_mdiobus_registerJacky Chou
Make use of devm_ methods to allocate and register mdiobus to simplify cleanup. Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-15-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: ftgmac100: Fix wrong netif_napi_del in releaseAndrew Lunn
netif_napi_add() is called in open. There is a symmetric call to netif_napi_del() in stop. Remove to wrong call to netif_napi_del() in release. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-14-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: ftgmac100: Simplify condition on HW arbitrationAndrew Lunn
The MAC ID is sufficient to indicate this is a ast2600. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-13-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: ftgmac100: Remove redundant PHY_POLLAndrew Lunn
When an MDIO bus is allocated, the irqs for each PHY are set to polling. Remove the redundant code in the MAC driver which does the same. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-12-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: ftgmac100: Move DT probe into a helperAndrew Lunn
By moving all the DT probe code into a helper, the complex if else if else structure can be simplified. No functional change intended. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-11-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: ftgmac100: Simplify legacy MDIO setupAndrew Lunn
There are old device trees which place the PHY nodes directly in the MAC nodes, rather than within an MDIO container node. The probe logic indicates that the use of NCSI and the legacy placement of PHYs is mutually exclusive. Hence priv->use_ncsi cannot be true, so there is no reason to set it false. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-10-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: ftgmac100: Always register the MDIO bus when it existsAndrew Lunn
Both the Aspeed 2400 and 2500 and the original faraday version of the MAC have MDIO bus controllers as part of the MAC. Since it exists, always registering it makes the code simpler, and causes no harm. If there is no mdio node in device tree, of_mdiobus_register() will fall back to mdiobus_register(), making it safe. AST2600 uses an external MDIO controller and does not have an embedded MDIO bus in the MAC. For such configurations, the legacy MII probe path must not be entered without a registered mii_bus. Add an explicit check to fail gracefully when no MDIO bus is present, preventing a NULL pointer dereference while keeping the intended behavior for platforms without embedded MDIO. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-9-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: ftgmac100: Move NCSI probe code into a helperAndrew Lunn
To help reduce the complexity of the probe function, move the NCSI probe code into a helper. The refactoring results in improved cleanup of the fixed PHY in error paths. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-8-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: ftgmac100: Simplify error handling for ftgmac100_initial_macAndrew Lunn
ftgmac100_initial_mac() does not allocate any resources. All resources by the probe function up until this call point use devm_ methods. So just return the error code rather than use a goto. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-7-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: ftgmac100: Use devm_clk_get_enabledAndrew Lunn
Make use of devm_ methods to request and enable clocks to simplify cleanup. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-6-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: ftgmac100: Use devm_request_memory_region/devm_ioremapAndrew Lunn
Make use of devm_ methods to request and remap the device memory to simplify cleanup. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-5-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: ftgmac100: Use devm_alloc_etherdev()Andrew Lunn
Make use of devm_alloc_etherdev() to simplify cleanup. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-4-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: ftgmac100: Replace all of_device_is_compatible()Andrew Lunn
Now that the priv structure includes the MAC ID, make use of it instead of the more expensive of_device_is_compatible(). Signed-off-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-3-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: ftgmac100: Add match data containing MAC IDAndrew Lunn
The driver supports 4 different versions of the FTGMAC core. Extend the compatible matching to include match data, which indicates the version of the MAC. Default to the initial Faraday device if DT is not being used. Lookup the match data early in probe to keep error handing simple. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-2-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: ftgmac100: List all compatiblesAndrew Lunn
As a step towards cleanup the probe function, list each compatible the driver supports. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com> Link: https://patch.msgid.link/20260206-ftgmac-cleanup-v5-1-ad28a9067ea7@aspeedtech.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: sunhme: Fix sbus regressionRené Rebe
Commit cc216e4b44ce ("net: sunhme: Switch SBUS to devres") changed explicit sized of_ioremap with BMAC_REG_SIZEs to devm_platform_ioremap_resource mapping all the resource. However, this does not work on my Sun Ultra 2 with SBUS HMEs: hme f0072f38: error -EBUSY: can't request region for resource [mem 0x1ffe8c07000-0x1ffe8c0701f] hme f0072f38: Cannot map TCVR registers. hme f0072f38: probe with driver hme failed with error -16 hme f007ab44: error -EBUSY: can't request region for resource [mem 0x1ff28c07000-0x1ff28c0701f] hme f007ab44: Cannot map TCVR registers. hme f007ab44: probe with driver hme failed with error -16 Turns out the open-firmware resources overlap, at least on this machines and PROM version: hexdump /proc/device-tree/sbus@1f,0/SUNW,hme@2,8c00000/reg: 00 00 00 02 08 c0 00 00 00 00 01 08 00 00 00 02 08 c0 20 00 00 00 20 00 00 00 00 02 08 c0 40 00 00 00 20 00 00 00 00 02 08 c0 60 00 00 00 20 00 00 00 00 02 08 c0 70 00 00 00 00 20 And the driver previously explicitly mapped way smaller mmio regions: /proc/iomem: 1ff28c00000-1ff28c00107 : HME Global Regs 1ff28c02000-1ff28c02033 : HME TX Regs 1ff28c04000-1ff28c0401f : HME RX Regs 1ff28c06000-1ff28c0635f : HME BIGMAC Regs 1ff28c07000-1ff28c0701f : HME Tranceiver Regs Quirk this specific issue by truncating the previous resource to not overlap into the TCVR registers. Fixes: cc216e4b44ce ("net: sunhme: Switch SBUS to devres") Signed-off-by: René Rebe <rene@exactco.de> Reviewed-by: Sean Anderson <seanga2@gmail.com> Link: https://patch.msgid.link/20260205.170959.89574674688839340.rene@exactco.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: fec: add AF_XDP zero-copy supportWei Fang
This patch adds AF_XDP zero-copy support for both TX and RX on the FEC driver. It introduces new functions for XSK buffer allocation, RX/TX queue processing in zero-copy mode, and XSK pool setup/teardown. For RX, fec_alloc_rxq_buffers_zc() is added to allocate RX buffers from XSK pool. And fec_enet_rx_queue_xsk() is used to process the frames from the RX queue which is bound to the AF_XDP socket. Similar to the copy mode, the zero-copy mode also supports XDP_TX, XDP_PASS, XDP_DROP and XDP_REDIRECT actions. In addition, fec_enet_xsk_tx_xmit() is similar to fec_enet_xdp_tx_xmit() and is used to handle XDP_TX action in zero-copy mode. For TX, there are two cases, one is the frames from the AF_XDP socket, so fec_enet_xsk_xmit() is added to directly transmit the frames from the socket and the buffer type is marked as FEC_TXBUF_T_XSK_XMIT. The other one is the frames from the RX queue (XDP_TX action), the buffer type is marked as FEC_TXBUF_T_XSK_TX. Therefore, fec_enet_tx_queue() could correctly clean the TX queue base on the buffer type. Also, some tests have been done on the i.MX93-EVK board with the xdpsock tool, the following are the results. Env: i.MX93 connects to a packet generator, the link speed is 1Gbps, and flow-control is off. The RX packet size is 64 bytes including FCS. Only one RX queue (CPU) is used to receive frames. 1. MAC swap L2 forwarding 1.1 Zero-copy mode root@imx93evk:~# ./xdpsock -i eth0 -l -z sock0@eth0:0 l2fwd xdp-drv pps pkts 1.00 rx 414715 415455 tx 414715 415455 1.2 Copy mode root@imx93evk:~# ./xdpsock -i eth0 -l -c sock0@eth0:0 l2fwd xdp-drv pps pkts 1.00 rx 356396 356609 tx 356396 356609 2. TX only 2.1 Zero-copy mode root@imx93evk:~# ./xdpsock -i eth0 -t -s 64 -z sock0@eth0:0 txonly xdp-drv pps pkts 1.00 rx 0 0 tx 1119573 1126720 2.2 Copy mode root@imx93evk:~# ./xdpsock -i eth0 -t -s 64 -c sock0@eth0:0 txonly xdp-drv pps pkts 1.00 rx 0 0 tx 406864 407616 Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260205085742.2685134-16-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: fec: improve fec_enet_tx_queue()Wei Fang
To support AF_XDP zero-copy mode in the subsequent patch, the following adjustments have been made to fec_tx_queue(). 1. Change the parameters of fec_tx_queue(). 2. Some variables are initialized at the time of declaration, and the order of local variables is updated to follow the reverse xmas tree style. 3. Remove the variable xdpf and add the variable tx_buf. Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260205085742.2685134-15-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: fec: add fec_alloc_rxq_buffers_pp() to allocate buffers from page poolWei Fang
Currently, the buffers of RX queue are allocated from the page pool. In the subsequent patches to support XDP zero copy, the RX buffers will be allocated from the UMEM. Therefore, extract fec_alloc_rxq_buffers_pp() from fec_enet_alloc_rxq_buffers() and we will add another helper to allocate RX buffers from UMEM for the XDP zero copy mode. In addition, fec_alloc_rxq_buffers_pp() only initializes bdp->bufaddr and does not initialize other fields of bdp, because these will be initialized in fec_enet_bd_init(). Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260205085742.2685134-14-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: fec: move xdp_rxq_info* APIs out of fec_enet_create_page_pool()Wei Fang
Extract fec_xdp_rxq_info_reg() from fec_enet_create_page_pool() and move it out of fec_enet_create_page_pool(), so that it can be reused in the subsequent patches to support XDP zero copy mode. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260205085742.2685134-13-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: fec: remove the size parameter from fec_enet_create_page_pool()Wei Fang
Remove the size parameter from fec_enet_create_page_pool(), since rxq->bd.ring_size already contains this information. Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260205085742.2685134-12-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: fec: use switch statement to check the type of tx_bufWei Fang
The tx_buf has three types: FEC_TXBUF_T_SKB, FEC_TXBUF_T_XDP_NDO and FEC_TXBUF_T_XDP_TX. Currently, the driver uses 'if...else...' statements to check the type and perform the corresponding processing. This is very detrimental to future expansion. To support AF_XDP zero-copy mode, two new types will be added in the future, continuing to use 'if...else...' would be a very bad coding style. So the 'if...else...' statements in the current driver are replaced with switch statements. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260205085742.2685134-11-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: fec: remove unnecessary NULL pointer check when clearing TX BD ringWei Fang
The tx_buf pointer will not NULL when its type is FEC_TXBUF_T_XDP_NDO or FEC_TXBUF_T_XDP_TX. If the type is FEC_TXBUF_T_SKB, dev_kfree_skb_any() will do NULL pointer check. So it is unnecessary to do NULL pointer check in fec_enet_bd_init() and fec_enet_tx_queue(). Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260205085742.2685134-10-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: fec: transmit XDP frames in bulkWei Fang
Currently, the driver writes the ENET_TDAR register for every XDP frame to trigger transmit start. Frequent MMIO writes consume more CPU cycles and may reduce XDP TX performance, so transmit XDP frames in bulk. Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260205085742.2685134-9-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: fec: add tx_qid parameter to fec_enet_xdp_tx_xmit()Wei Fang
Remove fec_enet_xdp_get_tx_queue() from fec_enet_xdp_tx_xmit() and add the tx_qid parameter to it. Then, calculate the TX queue ID for XDP_TX frames in fec_enet_rx_queue_xdp(). This way, the TX queue ID only needs to be calculated once for XDP_TX frames during each NAPI polling. And since the number of RX queues and TX queues in FEC is generally equal, the RX queue ID can be directly used as the TX queue ID. In exceptional cases, fec_enet_xdp_get_tx_queue() is used to calculate the TX queue ID. Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260205085742.2685134-8-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: fec: add fec_enet_rx_queue_xdp() for XDP pathWei Fang
Currently, the processing of XDP path packets and protocol stack packets are both mixed in fec_enet_rx_queue(), which makes the logic somewhat confusing and debugging more difficult. Furthermore, some logic is not needed by each other. Such as the kernel path does not need to call xdp_init_buff(), XDP path does not support swap_buffer(), because fec_enet_bpf() returns "-EOPNOTSUPP" for those platforms which need swap_buffer()), and so on. This prevents XDP from achieving its maximum performance. Therefore, XDP path packets processing has been separated from fec_enet_rx_queue() by adding the fec_enet_rx_queue_xdp() function to optimize XDP path logic and improve XDP performance. The XDP performance on the iMX93 platform was compared before and after applying this patch. Detailed results are as follows and we can see the performance has been improved. Env: i.MX93, packet size 64 bytes including FCS, only single core and RX BD ring are used to receive packets, flow-control is off. Before the patch is applied: xdp-bench tx eth0 Summary 396,868 rx/s 0 err,drop/s Summary 396,024 rx/s 0 err,drop/s xdp-bench drop eth0 Summary 684,781 rx/s 0 err/s Summary 675,746 rx/s 0 err/s xdp-bench pass eth0 Summary 208,552 rx/s 0 err,drop/s Summary 208,654 rx/s 0 err,drop/s xdp-bench redirect eth0 eth0 eth0->eth0 311,210 rx/s 0 err,drop/s 311,208 xmit/s eth0->eth0 310,808 rx/s 0 err,drop/s 310,809 xmit/s After the patch is applied: xdp-bench tx eth0 Summary 409,975 rx/s 0 err,drop/s Summary 411,073 rx/s 0 err,drop/s xdp-bench drop eth0 Summary 700,681 rx/s 0 err/s Summary 698,102 rx/s 0 err/s xdp-bench pass eth0 Summary 211,356 rx/s 0 err,drop/s Summary 210,629 rx/s 0 err,drop/s xdp-bench redirect eth0 eth0 eth0->eth0 320,351 rx/s 0 err,drop/s 320,348 xmit/s eth0->eth0 318,988 rx/s 0 err,drop/s 318,988 xmit/s Signed-off-by: Wei Fang <wei.fang@nxp.com> Link: https://patch.msgid.link/20260205085742.2685134-7-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: fec: improve fec_enet_rx_queue()Wei Fang
This patch has made the following adjustments to fec_enet_rx_queue(). 1. The function parameters are modified to maintain the same style as subsequently added XDP-related interfaces. 2. Some variables are initialized at the time of declaration, and the order of local variables is updated to follow the reverse xmas tree style. 3. Replace variable cbd_bufaddr with dma. Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260205085742.2685134-6-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: fec: add fec_build_skb() to build a skbWei Fang
Extract the helper fec_build_skb() from fec_enet_rx_queue(), so that the code for building a skb is centralized in fec_build_skb(), which makes the code of fec_enet_rx_queue() more concise and readable. Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260205085742.2685134-5-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: fec: add rx_shift to indicate the extra bytes padded in front of RX frameWei Fang
The FEC of some platforms supports RX FIFO shift-16, it means the actual frame data starts at bit 16 of the first word read from RX FIFO aligning the Ethernet payload on a 32-bit boundary. The MAC writes two additional bytes in front of each frame received into the RX FIFO. Currently, the fec_enet_rx_queue() updates the data_start, sub_len and the rx_bytes statistics by checking whether FEC_QUIRK_HAS_RACC is set. This makes the code less concise, so rx_shift is added to represent the number of extra bytes padded in front of the RX frame. Furthermore, when adding separate RX handling functions for XDP copy mode and zero copy mode in the future, it will no longer be necessary to check FEC_QUIRK_HAS_RACC to update the corresponding variables. Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260205085742.2685134-4-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: fec: add fec_rx_error_check() to check RX errorsWei Fang
Extract fec_rx_error_check() from fec_enet_rx_queue(), this helper is used to check RX errors. And it will be used in XDP and XDP zero copy paths in subsequent patches. Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260205085742.2685134-3-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: fec: add fec_txq_trigger_xmit() helperWei Fang
Currently, the workaround for FEC_QUIRK_ERR007885 has three call sites, so add the helper fec_txq_trigger_xmit() to make the code more concise and reusable. Signed-off-by: Wei Fang <wei.fang@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260205085742.2685134-2-wei.fang@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: arcnet: com20020-pci: use module_pci_driverEthan Nelson-Moore
The only thing this driver's init/exit functions do is call pci_register/unregister_driver, and in the case of the init function, print an unnecessary message. Replace them with module_pci_driver to simplify the code. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260205070632.37516-1-enelsonmoore@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-10net: dsa: mxl-gsw1xx: validate chip IDDaniel Golle
No check for actually present hardware is being performed in the probe function of the mxl-gsw1xx switch driver. So even if the switch isn't present at the configured MDIO bus address the driver wrongly tells the user that a "GSWIP version 0 mod 0" was found, outputting errors about PHY capabilities not matching. Read and validate the chip MANU_ID and PNUM_ID registers and output information while probing, but return an error and abort probing in case the hardware is not actually present. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://patch.msgid.link/3194d3d3bb0b51f08755d392e1fdf7bb6dc49608.1769916962.git.daniel@makrotopia.org Reviewed-by: Vladimir Oltean <olteanv@gmail.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-10 15:55:09 +0000