summaryrefslogtreecommitdiff
path: root/drivers/net/ethernet/intel
AgeCommit message (Collapse)Author
15 hoursMerge branch 'headers' of git://git.infradead.org/users/willy/pagecache.gitMark Brown
# Conflicts: # net/ceph/osd_client.c
30 hoursMerge branch '100GbE' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== ice: expose TSPLL state on E825 through dpll subsystem Grzegorz Nitka says: On E825 devices that own the source timer, the TSPLL can lose lock when the TCXO or TIME_REF signal is disrupted. This series adds monitoring and recovery for that condition, then surfaces the lock status and clock source selection through the dpll subsystem. It also fixes the clock_id generation for E825 generic DPLL devices so userspace can unambiguously map each DPLL device to its owning interface. Patch 1 adds TSPLL lock monitoring to ice_ptp_periodic_work(). Placing it there ensures recovery runs regardless of whether DPLL init succeeded or CONFIG_DPLL is enabled. Lock state is cached in pf->ptp.tspll_locked via WRITE_ONCE()/READ_ONCE() for consumption by the DPLL worker. Patch 2 registers the TSPLL as a DPLL_TYPE_GENERIC device for E825 owner PFs, with a fwnode-backed "time_ref" input pin. The pin state_on_dpll_set callback switches the clock source between TIME_REF and TCXO. Lock status is read from pf->ptp.tspll_locked; UNLOCKED is reported unconditionally when the clock source is TCXO to reflect the free-running oscillator state. Patch 3 changes the clock_id generation for E825 TX-CLK and TSPLL DPLLs. Previously they used the board-level PCIe DSN, which is identical for all interfaces sharing the same NAC/quad, so userspace could not tell them apart. The new scheme derives the clock_id from the permanent port MAC (with a dedicated tag bit distinguishing TSPLL from TX-CLK), while other DPLL objects (EEC/PPS and non-E825 paths) keep the board-level DSN-derived clock_id. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ice: use per-interface clock_id for E825 generic DPLLs ice: add TSPLL DPLL device and TIME_REF pin for E825 ice: monitor TSPLL lock from PTP periodic worker ==================== Link: https://patch.msgid.link/20260908222428.872254-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
31 hoursidpf: support pacing offloadWillem de Bruijn
If skb->tstamp is in the future, program this future delivery txtime in the transmit descriptor. TCP pacing offload is only offloaded if SK_PACING_FQ is negotiated and the FQ offload_horizon is configured. But device support for pacing offload must be more robust: it can also be reached through SO_TXTIME. Bounds check txtime. Only packets with timestamp between now and the horizon (max_pacing_offload_horizon) are offloaded when pacing offload is enabled on the device via pacing_offload. Negotiate the feature with the device using virtchnl. Support is conditional on - splitq mode, where tx and tx completion queues are separate, so completions can be returned out of order. - flow scheduling mode, where completions can arrive out of order. - PTP to ensure the NIC clock is synced to CLOCK_TAI. These features are negotiated per adapter, but expect all vports to uniformly request splitq (req_[rt]x_splitq) and flow scheduling (flow_sch_en) when available. Packets beyond the horizon are sent immediately with the overflow bit set. On device reset, EDT capabilities are re-negotiated with firmware. If re-negotiation succeeds, dev->max_pacing_offload_horizon is refreshed. If pacing offload is no longer supported, dev->max_pacing_offload_horizon is set to 0. Must not be called from netpoll due to ktime_get. But netpoll does not generate packets with EDT, so no explicit test is needed. Do not fail device initialization on EDT init error. Log an error, but continue without EDT, similar to PTP. Cc: Tony Nguyen <anthony.l.nguyen@intel.com> Cc: Przemek Kitszel <przemyslaw.kitszel@intel.com> Cc: Joshua A Hay <joshua.a.hay@intel.com> Cc: intel-wired-lan@lists.osuosl.org Cc: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260910171131.2532487-5-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 daysMerge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc3). Conflicts: drivers/net/dsa/mt7530.c 3c18e3c9a54e ("net: dsa: mt7530: populate lpi_interfaces to fix EEE support") 10d9d8328e8a ("net: dsa: mt7530: replace mt7530_read with regmap_read") Adjacent changes: drivers/net/bonding/bond_alb.c 1746ef2e2df2 ("bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()") 4cef95f72bbd ("bonding: fix u32 overflow in compute_gap()") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 daysMerge tag 'net-7.3-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Nothing too exciting, usual stream of fixes. Including fixes from Netfilter, Bluetooth and WPAN. Current release - new code bugs: - Bluetooth: hci_sync: fix not setting CE length properly - eth: enic: match mailbox replies to request numbers Previous releases - regressions: - tunnels: drop stale dst when building an ICMP error for PMTUD - ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings() (bug in the rtnl_lock -> RCU conversion) - eth: bnxt_en: - fix crashes on Thor2 due to OOB coalescing buffer accesses - prevent queue stop with deferred completions Previous releases - always broken: - eth: - ice: don't dereference pointers from TP_printk() - fix OOB writes on ethtool flow rule dump in 3 drivers - mlx5: fix FEC configuration with RS_544_514_INTERLEAVED_QUAD - dsa: tag_brcm: legacy FCS: request needed tailroom Misc: - net: cap tx_queue_len at S16_MAX to prevent oversized ring alloc - ipv6: flowlabel: cap duplicate leases per socket" * tag 'net-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (164 commits) selftests: tc-testing: test action batch failure cleanup net/sched: act_api: release all action references on NEWACTION failure openvswitch: fix wrong flag value in get_ipv6_ext_hdrs() ipmr: account multicast table and route memory net: phy: dp83td510: handle the active-high LED polarity mode net: macb: initialize PTP state before registering clock net: hsr: enable promiscuous mode on interlink port with fwd offload ipv6: fix fib6 walker UAF on seq stop net: stmmac: fix TX descriptor availability check for TSO traffic net/rds: fix tcp stream corruption with large pages net: mana: restore the XDP program pointer when pre-allocation fails net: phy: dp83867: handle the active-high LED polarity mode octeontx2-af: fix PF/CGX debugfs PCI bus lookup net: net_failover: Fix the deadlock in net_failover_slave_name_change() net: phy: mediatek-ge: disable EEE on the MT7530 PHY tcp: reject non zerocopy devmem tx net: ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support net: dsa: mt7530: populate lpi_interfaces to fix EEE support net: hinic: fix mailbox segment buffer overflow net: sun4i-emac: fix missing of_node_put() for phy_node ...
6 daysixgbevf: fix typo "enble" in commentHemanth Selam
Fix a typo in comments, found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260907095446.27290-4-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
6 daysice: fix typos in commentsHemanth Selam
Fix typos in comments, found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260907095446.27290-3-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
6 daysi40e: fix typos in commentsHemanth Selam
Fix typos in comments, found with scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260907095446.27290-2-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
7 daysfm10k: Remove obsolete 32-bit DMA mask fallbackRuizhe Zhou
The DMA API guarantees support for masks of 32 bits or wider and explicitly identifies retrying a 32-bit mask after a wider request as incorrect: https://docs.kernel.org/core-api/dma-api-howto.html#dma-addressing-capabilities Remove the obsolete fallback while retaining the error check so that a genuine DMA setup failure is still reported and aborts initialization. Signed-off-by: Ruizhe Zhou <zhouruizhe@resnics.com> Link: https://patch.msgid.link/20260903084339.870562-8-zhouruizhe@resnics.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
7 dayseth: ice: don't dereference pointers from TP_printk()Jakub Kicinski
After forwarding net-next during the v7.3 merge window we started seeing: TRACE EVENT ERROR: Event ice_tx_dim_work has double dereference in TP_printk: REC->q_vector->tx.tx_ring->q_index WARNING: kernel/trace/trace_events.c:420 at test_double_dereference.cold+0x39/0x4b this is due to extra checks added in tracing subsystem in commit b5cc230af5e5 ("tracing: Warn when an event dereferences a pointer in TP_printk()"). Printing happens long after the event was recorded, by which point the pointers may be invalid (the ring or the dim instance). Copy the eight scalars into the event instead. Fixes: 3089cf6d3caa ("ice: add tracepoints") Signed-off-by: Jakub Kicinski <kuba@kernel.org> Tested-by: Alexander Nowlin <alexander.nowlin@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
7 daysice: add missing xa_destroy for sched_node_idsJacob Keller
Commit 16dfa49406bc ("ice: Introduce new parameters in ice_sched_node") added a sched_node_ids xarray to the port info structure, but never called xa_destroy on it. Since xarrays can allocate internal memory, this can result in a memory leak even if every element in the xarray has been removed. The xarray is currently embedded in the port_info structure. This appears to have been done because its use is within functions that take the port_info as a primary argument. However, this complicates managing the lifecycle of the field. The port_info structure is allocated in ice_init_hw() using devm, and it is not released until the devm cleanup when the driver is unloaded. The ice_init_hw() function is called in many places, including devlink reload, and possibly during DDP load after updating the Tx scheduler layout. Adding a call of xa_destroy to the ice_deinit_hw() causes Sashiko to raise multiple concerns due to potential ordering issues and possible ways that port_info could be a dangling reference. To handle this, move the sched_node_ids out of port_info and into the hw structure. All users of the array already have a pointer to hw anyways, and there is only one sched_node_ids per adapter. While here, remove the overly verbose comment explaining the nature of the sched_node_ids xarray. Add the missing xa_destroy to the cleanup path and to ice_deinit_hw(), ensuring that we properly release the xarray memory. This was caught by Sashiko during development of unrelated code. Fixes: 16dfa49406bc ("ice: Introduce new parameters in ice_sched_node") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
7 daysidpf: account for VLAN header when parsing RSC packet headerJoshua Hay
While parsing the header of a Receive Side Coalesced (RSC) packet, check if a VLAN tag is present and adjust the header parsing accordingly. Otherwise, Rx TCP traffic is completely broken for any VLAN interface whose underlying interface has RSC (rx-gro-hw) enabled. We only need to worry about one VLAN header since Rx packets with multiple VLAN headers are not candidates for RSC. Fixes: 3a8845af66edb ("idpf: add RX splitq napi poll support") Signed-off-by: Joshua Hay <joshua.a.hay@intel.com> Reviewed-by: Emil Tantilov <emil.s.tantilov@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
7 daysidpf: disable PTM on probe failure and on removeMyeonghun Pak
idpf_probe() enables PCIe Precision Time Measurement with pci_enable_ptm(), which takes a reference on the device and on every PTM-capable device up the path to the PTM Root. Neither the probe error path nor idpf_remove() drops that reference, so the PTM enable counts of this device and of its upstream path stay elevated with no bound driver, and the device's PTM control bits remain set. pcim_enable_device() only arranges for pci_disable_device() and does not undo the PTM enable. Add the matching pci_disable_ptm() to the common unwind path. pci_enable_ptm() failure is not fatal here, so guard the call with pcie_ptm_enabled(): pci_disable_ptm() decrements dev->ptm_enable_cnt unconditionally and then recurses upstream, so calling it after a failed enable would drive this device's count negative and wrongly decrement parents shared with other endpoints. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: 8d5e12c5921c ("idpf: add initial PTP support") Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> [TN moved call due to commit 6b284aa2ddf3 ("idpf: refactor idpf to use libie_pci APIs")] Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
7 daysidpf: disable DIM work before freeing q_vectorsMyeonghun Pak
idpf never drains the Tx/Rx DIM works before freeing the memory they live in. tx_dim and rx_dim are embedded in struct idpf_q_vector, they are queued from the NAPI poll via net_dim(), and idpf_vport_intr_rel() ends with kfree(rsrc->q_vectors). Nothing in the driver cancels them. idpf_tx_dim_work() and idpf_rx_dim_work() then run on freed memory: idpf_vport_intr_write_itr() writes the ITR register through q_vector->intr_reg.tx_itr / rx_itr, void __iomem pointers loaded out of the freed q_vector. No configuration is needed to get there -- IDPF_ITR_IS_DYNAMIC() is defined as (itr_mode) and idpf_vport_alloc() initialises both modes to IDPF_ITR_DYNAMIC. Draining after idpf_vport_intr_napi_dis_all() is not enough on its own. idpf_net_dim() is called from inside the "if (napi_complete_done(napi, work_done))" branch of the poll, and napi_complete_done() has already cleared NAPIF_STATE_SCHED by then. napi_disable_locked() waits only while (val & (NAPIF_STATE_SCHED | NAPIF_STATE_NPSVC)), so napi_disable() can return while the poll tail is still queueing the work, and a plain cancel_work_sync() would be re-armed behind the drain. Use disable_work_sync(): schedule_work() on a work with a non-zero disable count is dropped by clear_pending_if_disabled() before __queue_work() is reached. Move idpf_init_dim() to idpf_vport_intr_alloc() so the works are initialised on every path that can reach the drain -- the three "goto intr_deinit" sites between idpf_vport_intr_init() and idpf_vport_intr_ena() get there without the enable side having run. Nothing re-enables them: rsrc->q_vectors is freed on every exit from idpf_vport_open() and on every idpf_vport_stop(), so the count dies with the object. It is a race, not a deterministic failure -- net_dim() only schedules once DIM_NEVENTS events have accumulated and the profile index changes. A KASAN ifup/ifdown loop under load is the way to see it. Fixes: c2d548cad150 ("idpf: add TX splitq napi poll support") Fixes: 3a8845af66ed ("idpf: add RX splitq napi poll support") Cc: <stable@vger.kernel.org> # see patch description, needs adjustments for <= 6.9 Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
8 daysice: use per-interface clock_id for E825 generic DPLLsGrzegorz Nitka
On E825, the TX-CLK and TSPLL DPLL devices are registered as DPLL_TYPE_GENERIC. Their clock_id was derived from the board-level PCIe DSN, which is identical for all interfaces sharing the same NAC/quad. As a result, userspace (e.g. 'dpll device show') reports several DPLL devices with the same clock_id and no board or signal label, making it impossible to unambiguously map a DPLL device to the interface it belongs to. Since these DPLLs are per-interface, use the permanent port MAC as the clock_id basis for E825 generic DPLLs: * TX-CLK uses the plain MAC-derived value. * TSPLL on the source-timer owner PF uses the same MAC-derived value with a dedicated tag bit, so it stays distinct from TX-CLK while remaining stable per interface. Other DPLL objects (EEC/PPS and non-E825 paths) keep the board DSN-derived clock_id. When the permanent MAC is not yet valid, fall back to the existing board-level clock_id to preserve init behavior. Reviewed-by: Przemyslaw Korba <przemyslaw.korba@intel.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Tested-by: Alexander Nowlin <alexander.nowlin@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
8 daysice: add TSPLL DPLL device and TIME_REF pin for E825Grzegorz Nitka
This extends the E825 advanced sync-timing support introduced by the tx-clk series, which added the TXC DPLL device for TX reference clock control. The TSPLL, the source timer PLL, is now also exposed through the dpll subsystem so that its lock status and clock source selection are visible and controllable from userspace. On E825 devices the TSPLL is the source timer PLL, distinct from the EEC and PPS DPLLs used on E810. Register it as a DPLL_TYPE_GENERIC device for owner PFs. Add struct ice_dplls::tspll_in, a fwnode-backed input pin named "time_ref". The state_on_dpll_get callback queries ICE_CGU_R23 via ice_tspll_get_clk_src() and returns CONNECTED when TIME_REF is selected as clock source, DISCONNECTED otherwise. The state_on_dpll_set callback switches the source between TIME_REF and TCXO via the new ice_tspll_set_cfg() helper. Registration is deferred via the dpll notifier path if the pin is not yet visible in the subsystem at probe time. Initialize TSPLL DPLL state from direct clock-source/lock reads so the first published state reflects hardware and prev_dpll_state matches. During periodic polling, the DPLL worker consumes READ_ONCE(pf->ptp.tspll_locked), maintained and recovered by the PTP periodic worker. When the TSPLL clock source is TCXO (TIME_REF pin not selected), UNLOCKED is reported unconditionally to reflect the free-running state of the oscillator regardless of the raw lock bit. To avoid stale lock-status reads after synchronous source changes, the set callback now refreshes tspll.dpll_state immediately and emits a DPLL change notification when the cached state changed. If a TSPLL reconfiguration is applied but the PLL has not yet re-acquired lock, treat the internal -EAGAIN result as success so the PTP periodic worker can complete recovery, while real -EBUSY failures from reset/SBQ paths still propagate to userspace. The TSPLL userspace reconfiguration path (state_on_dpll_set) and the PTP periodic worker (ice_ptp_tspll_monitor) both read TSPLL HW state and write the pf->ptp.tspll_locked cache consumed by the DPLL worker. Serialize both with pf->dplls.lock across their HW-read -> cache-write sequence; otherwise a preempted monitor could overwrite an accurate cache update from the DPLL callback with stale HW state. The mutex lifetime is lifted to PF-features scope (initialized in ice_init_features() before ice_ptp_init(), destroyed in ice_deinit_features() after ice_ptp_release()) so the PTP monitor can take it unconditionally regardless of DPLL init state. Extend ice_dpll_deinit_txclk_pins() with a "flush" parameter so the E825 init error path for the TSPLL fwnode pin can tear down TXCLK pins without flushing pf->dplls.wq. If the flush ran here, notifier work items queued during earlier init steps would be blocked on pf->dplls.dpll_init, which is only completed at the unregister_pins label reached after this teardown. destroy_workqueue() at that label drains the queued items safely. Existing full-teardown callers pass flush=true and keep current behavior. Reviewed-by: Przemyslaw Korba <przemyslaw.korba@intel.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Tested-by: Alexander Nowlin <alexander.nowlin@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
8 daysice: monitor TSPLL lock from PTP periodic workerGrzegorz Nitka
On E825 devices that own the source timer, the TSPLL can lose lock when the TCXO or TIME_REF signal is disrupted. Recovery requires re-enabling the TSPLL via CGU register writes; without it, the PHC keeps running on a degraded reference indefinitely. The DPLL periodic worker (ice_dpll_periodic_work()) would be a natural home for this monitoring, but placing it there has two problems: 1. ice_dpll_init_e825() sets ICE_FLAG_DPLL only after all initialization steps succeed. If any earlier step fails, the driver would run without any TSPLL recovery mechanism. 2. When CONFIG_DPLL=n, the DPLL worker is compiled out and TSPLL recovery would be silently absent. Add the monitor to ice_ptp_periodic_work() instead, which always runs on E825 owner PFs regardless of DPLL init state or config. Introduce two small helpers, ice_tspll_lost_lock_e825c() and ice_tspll_restart_e825c(), which encapsulate the CGU register reads/writes required to observe and recover the TSPLL. Cache the observed lock state in pf->ptp.tspll_locked using WRITE_ONCE()/READ_ONCE() so a follow-up change can consume it from the DPLL periodic worker (for user-space notification via dpll_device_change_ntf()) and drop the redundant poll+recovery from that path. Precise synchronization is not required: both workers converge on the same value within one poll period. Reviewed-by: Przemyslaw Korba <przemyslaw.korba@intel.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Tested-by: Alexander Nowlin <alexander.nowlin@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
11 daystreewide: refresh kmalloc_obj() conversionsKees Cook
This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook <kees+treewide@kernel.org>
2026-09-01i40e: Avoid repeating RX filter warningChris Packham
When the i40e runs out of space for RX filters the driver switches to promiscuous mode and warns that it has done so. In scenarios with a large number of these filters this can generate a lot of warnings. For example: $ dmesg -c > /dev/null $ ip link add dev br0 type bridge vlan_filtering 1 vlan_default_pvid 1 $ ip link set dev eth7 master br0 $ bridge vlan add vid 1 dev eth7 pvid untagged self $ bridge vlan add vid 2-4094 dev eth7 tagged $ dmesg [ 25.601705] i40e 0000:01:00.1: Error LIBIE_AQ_RC_ENOSPC, forcing overflow promiscuous on PF [ 25.601833] i40e 0000:01:00.1: Error LIBIE_AQ_RC_ENOSPC, forcing overflow promiscuous on PF [ 25.601961] i40e 0000:01:00.1: Error LIBIE_AQ_RC_ENOSPC, forcing overflow promiscuous on PF [ 25.602088] i40e 0000:01:00.1: Error LIBIE_AQ_RC_ENOSPC, forcing overflow promiscuous on PF [ 25.602216] i40e 0000:01:00.1: Error LIBIE_AQ_RC_ENOSPC, forcing overflow promiscuous on PF [ 25.602344] i40e 0000:01:00.1: Error LIBIE_AQ_RC_ENOSPC, forcing overflow promiscuous on PF ... Use test_and_set_bit() so that the warning is only issued when the driver enables promiscuous mode and not on the addition of subsequent RX filters. Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-09-01i40e: add support for bpf_xdp_metadata_rx_vlan_tag()Kohei Enju
Introduce i40e_xdp_rx_vlan_tag() which takes the same approach as i40e_process_skb_fields() to extract the VLAN tag from the RX descriptor. Tested with X710 adapter using xdp_hw_metadata, and confirmed that VLAN tags match between bpf_xdp_metadata_rx_vlan_tag() and skb->vlan_proto/vlan_tci. Signed-off-by: Kohei Enju <kohei@enjuk.jp> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Patryk Holda <patryk.holda@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-09-01i40e: add support for bpf_xdp_metadata_rx_hash()Kohei Enju
Introduce i40e_xdp_rx_hash() which takes the same approach as i40e_rx_hash() to extract the hash from RX descriptors. Tested with X710 adapter using xdp_hw_metadata, and verified hash consistency between bpf_xdp_metadata_rx_hash() and skb->hash. Signed-off-by: Kohei Enju <kohei@enjuk.jp> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Patryk Holda <patryk.holda@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-09-01i40e: prepare for XDP metadata ops supportKohei Enju
Prepare 'struct i40e_xdp_buff' that contains an xdp_buff and a pointer to i40e_rx_desc in order to pass the RX descriptor to the XDP kfuncs. Also in ZC path, use XSK_CHECK_PRIV_TYPE() to ensure i40e_xdp_buff doesn't exceed the offset of cb in xdp_buff_xsk. No functional changes. Signed-off-by: Kohei Enju <kohei@enjuk.jp> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Patryk Holda <patryk.holda@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-25drivers/net: Remove includes of pagemap.hMatthew Wilcox (Oracle)
Networking drivers have no need to use the page cache. Remove explicit includes which means that drivers/net/ are now completely independent of pagemap.h. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
2026-08-24xsk: honor XDP_TX_METADATA in zero-copy pathStanislav Fomichev
The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDP_TX_METADATA. Pass descriptor options through the metadata helpers and ignore metadata unless the option is set. This does not fix the existing per-WQE metadata handling for mlx5 MPWQEs. Only the descriptor that starts a session passes through xsk_tx_metadata_request() and configures offload state shared by the batch. Metadata on descriptors joining an open session is therefore not validated and does not configure its requested offloads. In addition, a non-NULL metadata pointer from such a descriptor is treated as a timestamp completion request even when XDP_TXMD_FLAGS_TIMESTAMP is not set, so its metadata union can be overwritten with an unrequested timestamp. Fixing mixed metadata states within one MPWQE requires a separate change. Fixes: 48eb03dd2630 ("xsk: Add TX timestamp and TX checksum offload support") Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com> Signed-off-by: Stanislav Fomichev <sdf@fomichev.me> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Link: https://patch.msgid.link/20260819160535.1472459-3-sdf@fomichev.me Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-18Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Merge in late fixes in preparation for the net-next PR. Conflicts: drivers/dpll/dpll_core.c drivers/dpll/dpll_netlink.c 33f016b23a219 ("dpll: fix NULL deref in dpll_device_ops() during teardown race") b1d0c412088e3 ("dpll: add STATE_CONNECTED_OVERRIDE pin capability") https://lore.kernel.org/aoR9YYY2P5--3x0N@sirena.org.uk https://lore.kernel.org/aoR9VmKllVGwmQn_@sirena.org.uk No adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17Merge branch '200GbE' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Introduce iXD driver Larysa Zaremba says: This patch series adds the iXD driver, which supports the Intel(R) Control Plane PCI Function on Intel E2100 and later IPUs and FNICs. It facilitates a centralized control over multiple IDPF PFs/VFs/SFs exposed by the same card. The reason for the separation is to be able to offload the control plane to the host different from where the data plane is running. This is the first phase in the release of this driver where we implement the initialization of the core PCI driver. Subsequent phases will implement advanced features like usage of idpf ethernet aux device, link management, NVM update via devlink, switchdev port representors, data and exception path, flow rule programming, etc. The first phase entails the following aspects: 1. Additional libie functionalities: Patches 1-5 introduce additional common library API for drivers to communicate with the control plane through mailbox communication. A control queue is a hardware interface which is used by the driver to interact with other subsystems (like firmware). The library APIs allow the driver to setup and configure the control queues to send and receive virtchnl messages. The library has an internal bookkeeping (XN API) mechanism to keep track of the send messages. It supports both synchronous as well as asynchronous way of handling the messages. The library also handles the timeout internally for synchronous messages using events. This reduces the driver's overhead in handling the timeout error cases. The current patch series supports only APIs that are needed for device initialization. These include APIs in the libie_pci module: * Allocating/freeing the DMA memory and mapping the MMIO regions for BAR0, read/write APIs for drivers to access the MMIO memory and libie_cp module: * Control queue initialization and configuration * Transport initialization for bookkeeping * Blocking and asynchronous mailbox transactions Once the mailbox is initialized, the drivers can send and receive virtchnl messages to/from the control plane. The modules above are not supposed to be linked with the main libie library, but do share the folder with it. 2. idpf: Patches 6-11 refactor the idpf driver to use the libie APIs for control queue configuration, virtchnl transaction, device initialization and reset and adjust related code accordingly. 3. ixd: Patches 12-15 add the ixd driver and implement multiple pieces of the initialization flow as follows: * Add the ability to load * A reset is issued to ensure a clean device state, followed by initialization of the mailbox * Device capabilities: As part of initialization, the driver has to determine what the device is capable of (ex. max queues, vports, etc). This information is obtained from the firmware and stored by the driver. * Enable initial support for the devlink interface * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ixd: add devlink support ixd: add the core initialization ixd: add reset checks and initialize the mailbox ixd: add basic driver framework for Intel(R) Control Plane Function idpf: print a debug message and bail in case of non-event ctlq message idpf: make mbx_task queueing and cancelling more consistent idpf: refactor idpf to use libie control queues idpf: refactor idpf to use libie_pci APIs idpf: remove unused code for getting RSS info from device idpf: remove 'vport_params_reqd' field libie: add bookkeeping support for control queue messages libie: add control queue support libeth: allow to create fill queues without NAPI libie: add PCI device initialization helpers to libie virtchnl: move virtchnl and virtchnl2 headers to 'include/linux/net/intel' ==================== Link: https://patch.msgid.link/20260812212532.905873-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17net: add READ_ONCE()/WRITE_ONCE() annotations for dev->num_tcEric Dumazet
Several fast-path and control-path lockless readers access dev->num_tc (e.g., skb_tx_hash(), netdev_txq_to_tc(), netdev_get_num_tc(), and qdisc/driver lookups) while concurrent writers update dev->num_tc during TC setup, device reset, or channel configuration. Add READ_ONCE() and WRITE_ONCE() annotations to prevent compiler reordering and load/store tearing when accessing dev->num_tc. Update inline helpers in netdevice.h (netdev_get_num_tc(), netdev_set_prio_tc_map(), and netdev_get_sb_channel()) as well as writers and lockless readers in core networking code and drivers. Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260812085440.3917924-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17net: prevent torn reads in netdev_tc_txqEric Dumazet
netdev_set_tc_queue() (and related helpers/drivers such as netdev_bind_sb_channel_queue(), netdev_reset_tc(), and netdev_unbind_sb_channel()) perform separate 16-bit writes to dev->tc_to_txq[tc].count and dev->tc_to_txq[tc].offset. Furthermore, memset() in netdev_reset_tc() and netdev_unbind_sb_channel() provides no guarantee of performing full 32-bit word stores. Concurrent lockless readers (e.g. skb_tx_hash(), netdev_txq_to_tc(), ixgbe_select_queue(), taprio, mqprio, FPE drivers) can observe torn values where offset and count belong to inconsistent configurations. Redefine struct netdev_tc_txq to embed count and offset inside a union with a u32 combined field, allowing atomic manipulation via READ_ONCE() and WRITE_ONCE(). Update all lockless readers and writers across the kernel to use READ_ONCE() and WRITE_ONCE() on the combined field. Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260812085440.3917924-2-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-12ixd: add devlink supportAmritha Nambiar
Enable initial support for the devlink interface with the ixd driver. The ixd hardware is a single function PCIe device. So, the PCIe adapter gets its own devlink instance to manage device-wide resources or configuration. $ devlink dev show pci/0000:83:00.6 $ devlink dev info pci/0000:83:00.6 pci/0000:83:00.6: driver ixd serial_number 00-a0-c9-ff-ff-23-45-67 versions: fixed: device.type MEV running: fw.mgmt.api 2.0 Signed-off-by: Amritha Nambiar <amritha.nambiar@intel.com> Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Tested-by: Bharath R <Bharath.r@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12ixd: add the core initializationLarysa Zaremba
As the mailbox is setup, initialize the core. This makes use of the send and receive mailbox message framework for virtchnl communication between the driver and device Control Plane (CP). To start with, driver confirms the virtchnl version with the CP. Once that is done, it requests and gets the required capabilities and resources needed such as max vectors, queues, vports etc. Use a unified way of handling the virtchnl messages, where a single function handles all related memory management and the caller only provides the callbacks to fill the send buffer and to handle the response. Place generic control queue message handling separately to facilitate the addition of protocols other than virtchannel in the future. Co-developed-by: Amritha Nambiar <amritha.nambiar@intel.com> Signed-off-by: Amritha Nambiar <amritha.nambiar@intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Tested-by: Bharath R <Bharath.r@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12ixd: add reset checks and initialize the mailboxLarysa Zaremba
At the end of the probe, trigger hard reset, initialize and schedule the after-reset task. If the reset is complete in a pre-determined time, initialize the default mailbox, through which other resources will be negotiated. Co-developed-by: Amritha Nambiar <amritha.nambiar@intel.com> Signed-off-by: Amritha Nambiar <amritha.nambiar@intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Bharath R <Bharath.r@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12ixd: add basic driver framework for Intel(R) Control Plane FunctionLarysa Zaremba
Add module register and probe functionality. Add the required support to register IXD PCI driver, as well as probe, remove and shutdown callbacks. Enable the PCI device and request to reserve the memory resources that will be used by the driver. Finally map the BAR0 address space. For now, use devm_kzalloc() to allocate adapter, as it requires the least amount of code. In a later commit, it will be replaced with a devlink alternative. Co-developed-by: Amritha Nambiar <amritha.nambiar@intel.com> Signed-off-by: Amritha Nambiar <amritha.nambiar@intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Tested-by: Bharath R <Bharath.r@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12idpf: print a debug message and bail in case of non-event ctlq messageLarysa Zaremba
Unlike previous internal idpf ctlq implementation, libie_cp calls the default message handler for all received messages that do not have a matching xn transaction, not only for VIRTCHNL2_OP_EVENT. This leads to many error messages printing garbage, because the parsing expected a valid event message, but got e.g. a delayed response for a timed-out transaction. The information about timed-out transactions and otherwise unhandleable messages can still be valuable for developers, so print the information with dynamic debug and exit the function, so the following functions can parse valid events in peace. Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Michal Kubiak <michal.kubiak@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12idpf: make mbx_task queueing and cancelling more consistentLarysa Zaremba
One of the assumptions of libie_cp and pre-refactor idpf control queue handling is such that all Rx processing is handled by a single task, which is to be cancelled before the mailbox destruction. Aside from cancelling, it is also important to make sure that idpf_intr_rel() never reschedules it afterwards. In order to comply, in the init path, do the first queueing of mbx_task in idpf_init_dflt_mbx(), and in deinit and reset, always cancel the task in idpf_deinit_dflt_mbx(), in every single flow call idpf_mb_intr_rel_irq() beforehand. Reviewed-by: Emil Tantilov <emil.s.tantilov@intel.com> Reviewed-by: Michal Kubiak <michal.kubiak@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12idpf: refactor idpf to use libie control queuesPavan Kumar Linga
Support to initialize and configure controlqs, and manage their transactions was introduced in libie. As part of it, most of the existing controlq structures are renamed and modified. Use those APIs in idpf and make all the necessary changes. Previously for the send and receive virtchnl messages, there used to be a memcpy involved in controlq code to copy the buffer info passed by the send function into the controlq specific buffers. There was no restriction to use automatic memory in that case. The new implementation in libie removed copying of the send buffer info and introduced DMA mapping of the send buffer itself. To accommodate it, use dynamic memory for the larger send buffers. For smaller ones (<= 128 bytes) libie still can copy them into the pre-allocated message memory. Those changes result in a pretty big diff, but the changes are fairly trivial and localized. In case of receive, idpf receives a page pool buffer allocated by the libie and care should be taken to release it after use in the idpf. idpf_idc_rdma_vc_send_sync() no longer truncates oversized responses or zeroes *recv_len on error, but this was confirmed to have no practical impact for any existing callers. This refactoring introduces roughly additional 40KB of module storage used for systems that only run idpf, so idpf + libie_cp + libie_pci takes about 7% more storage than just idpf before refactoring. We now pre-allocate small TX buffers, so that does increase the memory usage, but reduces the need to allocate. This results in additional 256 * 128B of memory permanently used, increasing the worst-case memory usage by 32KB but our ctlq RX buffers need to be of size 4096B anyway (not changed by the patchset), so this is hardly noticeable. As for the timings, the fact that we are mostly limited by the HW response time which is far from instant, is not changed by this refactor. Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Co-developed-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12idpf: refactor idpf to use libie_pci APIsPavan Kumar Linga
Use libie_pci init and MMIO APIs where possible, struct idpf_hw cannot be deleted for now as it also houses control queues that will be refactored later. Memory regions are added and removed in layers, so e.g. mailbox and rstat are added first and not removed until teardown. libie_pci stores the regions in the order of addition, so no new locks/checks are required, despite the data structure change. Use libie_cp header for libie_ctlq_ctx that contains mmio info from the start in order to not increase the diff later. Reviewed-by: Madhu Chittim <madhu.chittim@intel.com> Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Co-developed-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12idpf: remove unused code for getting RSS info from deviceLarysa Zaremba
idpf_send_get_set_rss_lut_msg() and idpf_send_get_set_rss_key_msg() do not handle the get=true path properly. Response validation is insufficient, memcpy size is wrong, LE-to-CPU conversion is missing. Fortunately, those functions are never used with get=true. Given how broken this dead code is, it is unlikely to be useful in the future. Rename idpf_send_get_set_rss_lut_msg() to idpf_send_set_rss_lut_msg(), idpf_send_get_set_rss_key_msg() to idpf_send_set_rss_key_msg(), remove the get parameter and remove all get=true cases from the function. Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12idpf: remove 'vport_params_reqd' fieldPavan Kumar Linga
While sending a create vport message to the device control plane, a create vport virtchnl message is prepared with all the required info to initialize the vport. This info is stored in the adapter struct but never used thereafter. So, remove the said field. Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Reviewed-by: Madhu Chittim <madhu.chittim@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12libie: add bookkeeping support for control queue messagesPhani R Burra
Small send control queue message buffers are managed and reused by libie itself, bigger send buffers are consumed. All are tracked with the unique transaction (Xn) ids until they receive response or time out. Responses can be received out of order, therefore transactions are stored in an array and tracked though a bitmap. Rx buffers utilize page_pool. Pre-allocated DMA memory is used where possible. It reduces the driver overhead in handling memory allocation/free and message timeouts. Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Signed-off-by: Phani R Burra <phani.r.burra@intel.com> Co-developed-by: Victor Raj <victor.raj@intel.com> Signed-off-by: Victor Raj <victor.raj@intel.com> Co-developed-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Bharath R <bharath.r@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Co-developed-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12libie: add control queue supportPhani R Burra
Libie will now support control queue setup and configuration APIs. These are mainly used for mailbox communication between drivers and control plane. Make use of the libeth_rx page pool support for managing controlq buffers. Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Signed-off-by: Phani R Burra <phani.r.burra@intel.com> Co-developed-by: Victor Raj <victor.raj@intel.com> Signed-off-by: Victor Raj <victor.raj@intel.com> Co-developed-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Signed-off-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Co-developed-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Tested-by: Bharath R <bharath.r@intel.com> Co-developed-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12libeth: allow to create fill queues without NAPIPavan Kumar Linga
Control queues can utilize libeth_rx fill queues, despite working outside of NAPI context. The only problem is standard fill queues requiring NAPI that provides them with the device pointer. Introduce a way to provide the device directly without using NAPI. Suggested-by: Alexander Lobakin <aleksander.lobakin@intel.com> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Bharath R <bharath.r@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12libie: add PCI device initialization helpers to libiePhani R Burra
idpf and ixd drivers serve different PCI functions on the same device, therefore their PCI configuration flow is very similar. Add support functions for idpf and ixd to configure PCI functionality and access MMIO space. Add a mapping list which can be traversed by a driver, e.g. to pass certain I/O mappings to the auxbus devices. Such list is also traversed by the libie_pci_get_mmio_addr() helper, which allows for easier memory access. Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Signed-off-by: Phani R Burra <phani.r.burra@intel.com> Co-developed-by: Victor Raj <victor.raj@intel.com> Signed-off-by: Victor Raj <victor.raj@intel.com> Co-developed-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Signed-off-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Co-developed-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by: Bharath R <bharath.r@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Co-developed-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-12virtchnl: move virtchnl and virtchnl2 headers to 'include/linux/net/intel'Victor Raj
virtchnl2 headers will be used by both idpf and ixd drivers, so they have to be moved to an include directory. On top of that, it would be useful to place all iavf headers together with other intel networking headers. Move abovementioned intel header files into 'include/linux/net/intel'. While at it, remove the self-include from iavf_types.h. Suggested-by: Alexander Lobakin <aleksander.lobakin@intel.com> Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com> Signed-off-by: Victor Raj <victor.raj@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-11idpf: add missing cpu_to_le32 in idpf_tx_splitq_build_flow_descWillem de Bruijn
idpf_tx_splitq_build_flow_desc performs a 32-bit store to &cmd_dtype to set the 8-bit cmd_dtype and zero the adjacent 3-byte timestamp field in a single operation. Descriptors are in little endian. Add missing cpu_to_le32 and cast to __le32 to ensure the fields are written correctly also on big endian platforms. Fixes: 1a49cf814fe1 ("idpf: add Tx timestamp flows") Signed-off-by: Willem de Bruijn <willemb@google.com> Reviewed-by: Jason Xing <kerneljasonxing@gmail.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-11ice: acquire NVM lock around each flash readRobert Malz
FW caps the NVM read lock at a maximum of 3000ms regardless of the timeout requested via ice_acquire_nvm(). ice_read_flat_nvm() splits a read into multiple ice_aq_read_nvm() commands, one per 4KB sector, all issued under a single lock taken by the caller. Reading a large region can exceed 3000ms, so FW reclaims the lock mid-read and the remaining commands might fail. Move the lock acquire/release into ice_read_flat_nvm() so it brackets each individual ice_aq_read_nvm() command, ensuring the lock is never held across more than one FW read. ice_release_nvm() issues its own AQ command and overwrites hw->adminq.sq_last_status, which some callers inspect after a failed read. Add an optional read_aq_err output parameter to ice_read_flat_nvm() to capture the failing read's AQ error before the release; callers that need it (ice_discover_flash_size() and the ethtool/devlink log paths) use it instead of sq_last_status, others pass NULL. Callers that previously took the lock around ice_read_flat_nvm(), ice_read_sr_word() or ice_read_flash_module() now call them without it. The now-redundant per-block locking in ice_devlink_nvm_snapshot() is dropped. ice_read_sr_word() is now a thin wrapper, so ice_read_sr_word_aq() is folded into it. Fixes: e94509906d6b ("ice: create function to read a section of the NVM and Shadow RAM") Signed-off-by: Robert Malz <robert.malz@canonical.com> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Reviewed-by: Marcin Szycik <marcin.szycik@linux.intel.com> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-11ice: clear the default forwarding VSI rule when releasing a VSIPetr Oros
When a VSI is configured as the switch's default forwarding VSI (ICE_SW_LKUP_DFLT) and is then torn down, the rule is left behind in the switch. ice_vsi_release() no longer removes it, and the SR-IOV VF free path (ice_free_vfs() -> ice_free_vf_res() -> ice_vf_vsi_release() -> ice_vsi_release()) does not disable promiscuous mode either, which only happens on VF reset in ice_vf_clear_all_promisc_modes(). A trusted VF that enters unicast promiscuous mode becomes the default forwarding VSI (this is the default mode, when the PF does not have VF true-promiscuous mode enabled). If the VFs are then destroyed without the VF first leaving promiscuous mode, the ICE_SW_LKUP_DFLT rule for the now-freed VSI is leaked. When VFs are recreated, a VSI reuses the freed hw_vsi_id. If it is assigned a different VSI handle than the leaked rule holds, ice_set_dflt_vsi() does not recognize it as already-default, and ice_add_update_vsi_list() folds the dangling (freed) handle into a VSI list, which the firmware rejects. The VSI handle assigned on re-creation varies, so the failure is intermittent rather than every cycle. Reproduce by repeatedly running the cycle below on the two ports of the same card, where $VF0 and $VF1 are the netdevs of vf 15 once they appear. The VF must be brought up so iavf actually pushes the unicast promiscuous request, and the rule must settle before the VFs are torn down again: echo 16 > /sys/class/net/$PF0/device/sriov_numvfs echo 16 > /sys/class/net/$PF1/device/sriov_numvfs ip link set $PF0 vf 15 trust on ip link set $PF1 vf 15 trust on ip link set $VF0 up ip link set $VF1 up ip link set $VF0 promisc on ip link set $VF1 promisc on sleep 1 echo 0 > /sys/class/net/$PF0/device/sriov_numvfs echo 0 > /sys/class/net/$PF1/device/sriov_numvfs Within a few cycles the ice PF and iavf VF log: Failed to set VSI 25 as the default forwarding VSI, error -22 Turning on/off promiscuous mode for VF 63 failed, error: -22 PF returned error -53 (IAVF_ERR_ADMIN_QUEUE_ERROR) to our request 14 This cleanup used to live in ice_vsi_release() but was dropped by the referenced refactor. Restore it. Clear the default forwarding VSI rule in ice_vsi_release() when this VSI owns it, which covers every teardown path. Fixes: 6624e780a577 ("ice: split ice_vsi_setup into smaller functions") Signed-off-by: Petr Oros <poros@redhat.com> Reviewed-by: Marcin Szycik <marcin.szycik@linux.intel.com> Tested-by: Rafal Romanowski <rafal.romanowski@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-11ice: fall back to SBQ when LL PHY timer interface times outPrzemyslaw Korba
The low-latency (LL) PHY timer interface relies on a tight, atomic poll of the PF_SB_ATQBAL register with a 2ms timeout. After an NVM update / EMPR, FW may need significantly longer than 2ms to start responding to ATQBAL commands. The first PHY adjust or incval write issued by ice_ptp_rebuild_owner() fails with -ETIMEDOUT. Fix this by falling back to the existing SBQ-based PHY register write path when LL times out. This makes sure PTP is initialized when FW takes longer than expected to come back online. Steps to reproduce: ./nvmupdate64e -if devlink -f Update E810 card with nvmupdate64e, and observe dmesg errors: Failed to write PHC increment value, status -110 PTP reset failed, error: -110 (-ETIMEDOUT) Fixes: ef9a64c07294 ("ice: implement low latency PHY timer updates") Signed-off-by: Przemyslaw Korba <przemyslaw.korba@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2026-08-06Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.2-rc7). No conflicts, or adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06igc: fix netdev not re-attached after resume if interface is downPhilipp David
__igc_resume() calls netif_device_attach() only inside the netif_running() branch, so an interface that was down during suspend is never re-attached on resume. It then stays in the not-present state that __igc_shutdown() set via netif_device_detach(): ethtool reports ENODEV and every attempt to bring the interface up fails the netif_device_present() check in __dev_open() with -ENODEV, silently, since __igc_resume() returns 0. Only reloading the driver recovers the device. This is easy to hit in practice because NetworkManager brings managed interfaces down before sleep unless Wake-on-LAN is configured, making the adapter unusable after every suspend/resume cycle with WoL disabled. Re-attach the netdev on every successful resume, as igb and e1000e do. Fixes: 6f31d6b643a3 ("igc: Refactor runtime power management flow") Cc: stable@vger.kernel.org Signed-off-by: Philipp David <pd-lkml@3b.pm> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Dima Ruinskiy <dima.ruinskiy@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260804222205.1580328-11-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03xsk: validate metadata when processing requestsStanislav Fomichev
The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata between those operations and bypass the original validation. Validate the metadata in xsk_tx_metadata_request() and use the resulting flags snapshot for every feature check. Read request fields once so all zero-copy drivers process only values observed after successful validation. Fixes: ca4419f15abd ("xsk: Add launch time hardware offload support to XDP Tx metadata") Cc: Cen Zhang (Microsoft) <blbllhy@gmail.com> Signed-off-by: Stanislav Fomichev <sdf@fomichev.me> Link: https://patch.msgid.link/20260727161959.885642-7-sdf@fomichev.me Signed-off-by: Jakub Kicinski <kuba@kernel.org>