summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-06-13dpaa2-switch: move FDB selection for leave path into a helperIoana Ciornei
Move the FDB selection for when a port leaves bridge into a new helper - dpaa2_switch_fdb_for_leave(). This will hopefully make the dpaa2_switch_port_set_fdb() function easier to read and follow. The new helper only determines the FDB to be used, any updates into the private port structure still gets done in the set_fdb() function. No changes in the actual behavior are intended. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260610150912.1788482-5-ioana.ciornei@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13dpaa2-switch: move FDB selection for join path into a helperIoana Ciornei
The dpaa2_switch_port_set_fdb() function handles the setup of the FDB for both changeupper cases: join and leave. Move the code block which handles the join path into a new helper - dpaa2_switch_fdb_for_join() - with the hope that the entire function will become easier to read and extend with other use cases in the future. This new helper just determines and returns what FDB should be used for a specific port, the cleanup of the old FDB and the actual setup in the per port structure remains in the dpaa2_switch_port_set_fdb() function. No changes in the actual behavior are intended. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260610150912.1788482-4-ioana.ciornei@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13dpaa2-switch: factor out the FDB in-use check into a helperIoana Ciornei
The dpaa2_switch_port_set_fdb() function is hard to follow and open-coding the in-use check into it makes it even harder to read. Factor out that code block into a new helper - dpaa2_switch_fdb_in_use_by_others(). Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260610150912.1788482-3-ioana.ciornei@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13dpaa2-switch: change dpaa2_switch_port_set_fdb() function prototypeIoana Ciornei
Since there dpaa2_switch_port_set_fdb() never fails and its return value was never checked, change its prototype to return void. Also, instead of determining if the DPAA2 port is joining or leaving an upper based on the value of the 'bridge_dev' parameter, add the 'linking' parameter to explicitly specify the action. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260610150912.1788482-2-ioana.ciornei@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-14spi: Fix mismatched DT property access typesRob Herring (Arm)
The SPI drivers read properties whose bindings use normal uint32 cells. Using boolean or u16 helpers makes the access look like a different DT encoding and causes the property checker to flag the call sites. Use presence checks for unsupported properties and read numeric cell properties through u32 helpers before assigning to driver fields. Assisted-by: Codex:gpt-5-5 Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260612215017.1884893-1-robh@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-13igc: fix typos in commentsMaximilian Pezzullo
Fix spelling errors in code comments: - igc_diag.c: 'autonegotioation' -> 'autonegotiation' - igc_main.c: 'revisons' -> 'revisions' (two occurrences) Signed-off-by: Maximilian Pezzullo <maximilianpezzullo@gmail.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Joe Damato <joe@dama.to> Tested-by: Avigail Dahan <avigailx.dahan@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260609213559.178657-16-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13igb: fix typos in commentsMaximilian Pezzullo
Fix spelling errors in code comments: - e1000_nvm.c: 'likley' -> 'likely' - e1000_mac.c: 'auto-negotitation' -> 'auto-negotiation' - e1000_mbx.h: 'exra' -> 'extra' - e1000_defines.h: 'Aserted' -> 'Asserted' Signed-off-by: Maximilian Pezzullo <maximilianpezzullo@gmail.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Joe Damato <joe@dama.to> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260609213559.178657-15-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13e1000e: limit endianness conversion to boundary wordsAgalakov Daniil
[Why] In e1000_set_eeprom(), the eeprom_buff is allocated to hold a range of words. However, only the boundary words (the first and the last) are populated from the EEPROM if the write request is not word-aligned. The words in the middle of the buffer remain uninitialized because they are intended to be completely overwritten by the new data via memcpy(). The previous implementation had a loop that performed le16_to_cpus() on the entire buffer. This resulted in endianness conversion being performed on uninitialized memory for all interior words. Fix this by converting the endianness only for the boundary words immediately after they are successfully read from the EEPROM. Found by Linux Verification Center (linuxtesting.org) with SVACE. Co-developed-by: Iskhakov Daniil <dish@amicon.ru> Signed-off-by: Iskhakov Daniil <dish@amicon.ru> Signed-off-by: Agalakov Daniil <ade@amicon.ru> Tested-by: Avigail Dahan <avigailx.dahan@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260609213559.178657-14-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13e1000: limit endianness conversion to boundary wordsAgalakov Daniil
[Why] In e1000_set_eeprom(), the eeprom_buff is allocated to hold a range of words. However, only the boundary words (the first and the last) are populated from the EEPROM if the write request is not word-aligned. The words in the middle of the buffer remain uninitialized because they are intended to be completely overwritten by the new data via memcpy(). The previous implementation had a loop that performed le16_to_cpus() on the entire buffer. This resulted in endianness conversion being performed on uninitialized memory for all interior words. Fix this by converting the endianness only for the boundary words immediately after they are successfully read from the EEPROM. Found by Linux Verification Center (linuxtesting.org) with SVACE. Co-developed-by: Iskhakov Daniil <dish@amicon.ru> Signed-off-by: Iskhakov Daniil <dish@amicon.ru> Signed-off-by: Agalakov Daniil <ade@amicon.ru> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260609213559.178657-13-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13e1000e: Use __napi_schedule_irqoff()Matt Vollrath
The __napi_schedule_irqoff() macro is intended to bypass saving and restoring IRQ state when scheduling is requested from an IRQ handler, where hard interrupts are already disabled. Use this macro in all three interrupt handlers. This was tested on a system with an I218-V and MSI interrupts. Because this is an optimization, I was interested in measuring the impact, so I added ktime_get() time measurement to e1000_intr_msi and a print of the last sample in the watchdog task. For each test case I ran a bi-directional iperf3 to saturate the line. With some help from awk, here are the statistics. 49 samples each, all units ns previous: min 678 max 1265 mean 879.429 median 806 stddev 137.188 noirq: min 707 max 1165 mean 811.857 median 790 stddev 89.486 According to this informal comparison, the mean time to handle an interrupt from start to finish is improved by about 8% under load. Signed-off-by: Matt Vollrath <tactii@gmail.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Michal Cohen <michalx.cohen@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260609213559.178657-12-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13igc: use napi_schedule_irqoff() instead of napi_schedule()Daiki Harada
Replace napi_schedule() with napi_schedule_irqoff() in the interrupt handler path in igc driver Tested on Intel Corporation Ethernet Controller I226-V. Suggested-by: Kohei Enju <kohei@enjuk.jp> Signed-off-by: Daiki Harada <daiky0325@gmail.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Dima Ruinskiy <dima.ruinskiy@intel.com> Tested-by: Moriya Kadosh <moriyax.kadosh@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260609213559.178657-11-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13igb: use napi_schedule_irqoff() instead of napi_schedule()Daiki Harada
Replace napi_schedule() with napi_schedule_irqoff() in the interrupt handler path in igb driver Tested on QEMU with igb NIC emulation (-nic user,model=igb) Suggested-by: Kohei Enju <kohei@enjuk.jp> Signed-off-by: Daiki Harada <daiky0325@gmail.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260609213559.178657-10-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13e1000e: use ktime_get_real_ns() in e1000e_systim_reset()Aleksandr Loktionov
Replace ktime_to_ns(ktime_get_real()) with the direct equivalent ktime_get_real_ns() in e1000e_systim_reset(). Using the combined helper avoids the unnecessary intermediate ktime_t variable and makes the intent clearer. Suggested-by: Jacob Keller <jacob.e.keller@intel.com> Suggested-by: Simon Horman <horms@kernel.org> Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Avigail Dahan <avigailx.dahan@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260609213559.178657-9-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13igb: use ktime_get_real helpers in igb_ptp_reset()Aleksandr Loktionov
Replace ktime_to_ns(ktime_get_real()) with the direct equivalent ktime_get_real_ns() and ktime_to_timespec64(ktime_get_real()) with ktime_get_real_ts64() in igb_ptp_reset(). Using the combined helpers makes the intent clearer. Suggested-by: Jacob Keller <jacob.e.keller@intel.com> Suggested-by: Simon Horman <horms@kernel.org> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260609213559.178657-8-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13ixgbe: e610: remove redundant assignmentPiotr Kwapulinski
Remove unnecessary code. No functional impact. Signed-off-by: Piotr Kwapulinski <piotr.kwapulinski@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260609213559.178657-6-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13net/intel: Replace manual array size calculation with ARRAY_SIZEJakub Raczynski
There are still places in the code where manual calculation of array size exist, but it is good to enforce usage of single macro through the whole code as it makes code bit more readable. While at it, beautify condition surrounding it by reversing check and remove unnecessary casting. Signed-off-by: Jakub Raczynski <j.raczynski@samsung.com> Reviewed-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260609213559.178657-5-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() testCorinna Vinschen
This is just a simple cleanup fix. Commit 35a2443d0910f ("iavf: Add waiting for response from PF in set mac") introduced a duplicate ether_addr_equal() check, so the current code tests the new MAC twice against the former MAC. Remove the outer ether_addr_equal() test, remnant of commit c5c922b3e09b ("iavf: fix MAC address setting for VFs when filter is rejected") Signed-off-by: Corinna Vinschen <vinschen@redhat.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Rafal Romanowski <rafal.romanowski@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260609213559.178657-4-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13ice: remove redundant checks from PTP initNatalia Wochtman
Remove unnecessary condition checks in ice_ptp_setup_adapter() and ice_ptp_init(). They are duplicated in ice_pf_src_tmr_owned(). Change ice_ptp_setup_adapter() to return void. Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Natalia Wochtman <natalia.wochtman@intel.com> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260609213559.178657-3-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13idpf: Replace use of system_unbound_wq with system_dfl_wqMarco Crivellari
This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Tested-by: Samuel Salin <Samuel.salin@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20260609213559.178657-2-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13octeontx2-af: npc: cn20k: Allocate npc_priv and dstats dynamically.Ratheesh Kannoth
Replace the file-scope static npc_priv with a kcalloc'd struct filled from hardware bank/subbank geometry at init (num_banks is no longer a const compile-time constant; drop init_done and use a non-NULL npc_priv pointer for liveness). Thread npc_priv_get() / pointer access through the CN20K NPC code paths, extend teardown to kfree the root struct on failure and in npc_cn20k_deinit, and adjust MCAM section setup to use the discovered subbank count. Allocate MCAM debugfs dstats via devm_kzalloc instead of a static matrix, and use the allocated backing store consistently when computing deltas (including the counter rollover compare). Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260609040453.711932-10-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13octeontx2: cn20k: Respect NPC MCAM X2/X4 profile in flows and DFT allocRatheesh Kannoth
Default CN20K NPC rule allocation now keys off the active MCAM keyword width: use X4 with a bank-masked reference index when the silicon uses X4 keys, and X2 with the raw index otherwise (replacing the previous always-X2 / eidx + 1 behaviour). In the AF flow-install path, flows that need more than 256 key bits query the NPC profile; if the platform is fixed to X2 entries, fail with -EOPNOTSUPP instead of requesting X4. Otherwise select X4 for the MCAM alloc. On the PF, cache and pass the profile kw_type from npc_get_pfl_info through otx2_mcam_pfl_info_get(), and use it when allocating MCAM entries for RSS/defaults and when installing ethtool flows on CN20K, including masking the reference index for X4 slot layout. Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260609040453.711932-9-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13octeontx2-af: npc: Support for custom KPU profile from filesystemRatheesh Kannoth
Flashing updated firmware on deployed devices is cumbersome. Provide a mechanism to load a custom KPU (Key Parse Unit) profile directly from the filesystem at module load time. When the rvu_af module is loaded with the kpu_profile parameter, the specified profile is read from /lib/firmware/kpu and programmed into the KPU registers. Add npc_kpu_profile_cam2 for the extended cam format used by filesystem-loaded profiles and support ptype/ptype_mask in npc_config_kpucam when profile->from_fs is set. Usage: 1. Copy the KPU profile file to /lib/firmware/kpu. 2. Build OCTEONTX2_AF as a module. 3. Load: insmod rvu_af.ko kpu_profile=<profile_name> Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260609040453.711932-8-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13octeontx2: cn20k: Coordinate default rules with NIX LF lifecycleRatheesh Kannoth
Add NIX_LF_DONT_FREE_DFT_IDXS so the PF can send NIX LF free during hw reinit or teardown without the AF freeing CN20K default NPC rule indexes while the driver still owns that state (otx2_init_hw_resources and otx2_free_hw_resources). On CN20K, allocate default NPC rules from NIX LF alloc before nix_interface_init, roll back with npc_cn20k_dft_rules_free on failure, and free from NIX LF free when the new flag is not set. Tighten rvu_mbox_handler_nix_lf_alloc error handling: use a single rc, propagate qmem_alloc and other errors, and set -ENOMEM only when kcalloc fails (remove the blanket -ENOMEM at the free_mem path). Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260609040453.711932-7-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13octeontx2-af: npc: cn20k: add subbank search order controlRatheesh Kannoth
CN20K NPC MCAM is split into 32 subbanks that are searched in a predefined order during allocation. Lower-numbered subbanks have higher priority than higher-numbered ones. Add a runtime "srch_order" to control the order in which subbanks are searched during MCAM allocation. Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260609040453.711932-6-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13octeontx2-af: npc: cn20k: debugfs enhancementsRatheesh Kannoth
Improve MCAM visibility and field debugging for CN20K NPC. - Extend "mcam_layout" to show enabled (+) or disabled state per entry so status can be verified without parsing the full "mcam_entry" dump. - Add "dstats" debugfs entry: for enabled MCAM indices, print hit deltas since the prior read by comparing hardware counters to a per-entry software baseline and advancing that baseline after each read (hardware counters are not cleared). - Add "mismatch" debugfs entry: lists MCAM entries that are enabled but not explicitly allocated, helping diagnose allocation/field issues. Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260609040453.711932-3-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13octeontx2-af: enforce single RVU AF probeRatheesh Kannoth
On Octeon series SoCs, the AF is an integrated device within the SoC, and hardware resources such as NPC, NIX and related blocks are global and coordinated by the AF driver. Physical and virtual functions request those resources via AF mailbox messages, so two AF driver instances cannot both own that global state; firmware exposes only one AF PCI function at boot and any further octeontx2-af PCI probe returns -EBUSY so software matches the single-AF model. Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Link: https://patch.msgid.link/20260609040453.711932-2-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13net/stmmac: Apply MTL_MAX queue limit if config missingJakub Raczynski
When "snps,rx-queues-to-use" or "tx-queues-to-use" config in DTS is provided current code will apply U8_MAX value for queues_to_use if there is input of higher value. But actual maximum number of supported queues is set via macro MTL_MAX_RX_QUEUES and MTL_MAX_TX_QUEUES, which currently have value of 8. This value of U8_MAX will be capped to value provided by core in DMA capabilities (dma_conf), but it does so only if core provides it. This is true for XGMAC (dwxgmac2) and some GMAC (dwmac4), but not for (dwmac1000). This capping is at later stage in stmmac_hw_init(), and during stmmac_mtl_setup() we might parse fields outside allocated memory if queues_to_use is over defines MTL_MAX_ values, for example following rx_queues_cfg is array of size of MTL_MAX_RX_QUEUES. Fix this by capping value to MTL_MAX during config parsing. Reported-by: Sashiko <sashiko-bot@kernel.org> Signed-off-by: Jakub Raczynski <j.raczynski@samsung.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260611113358.3379518-3-j.raczynski@samsung.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13net/stmmac: Apply TBS config only to used queuesJakub Raczynski
While opening stmmac driver, there is enabling of TBS (Time-Based Scheduling) option in dma config. Currently this is executed for all possible TX queues via MTL_MAX_TX_QUEUES macro, but actual number of queues used might differ. While setting this is generally harmless, since memory for MTL_MAX_TX_QUEUES is allocated, it is incorrect, because it prepares config for unused queues. Change this to apply tbs config only to tx_queues_to_use. Co-developed-by: Chang-Sub Lee <cs0617.lee@samsung.com> Signed-off-by: Chang-Sub Lee <cs0617.lee@samsung.com> Signed-off-by: Jakub Raczynski <j.raczynski@samsung.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260611113358.3379518-2-j.raczynski@samsung.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13net: airoha: Fix debugfs new-tuple display for IPv4 ROUTE entriesWayen.Yan
In airoha_ppe_debugfs_foe_show(), the second switch statement falls through from PPE_PKT_TYPE_IPV4_HNAPT/DSLITE to PPE_PKT_TYPE_IPV4_ROUTE, accessing hwe->ipv4.new_tuple for all three types. However, IPv4 ROUTE (3-tuple) entries do not contain a valid new_tuple — this field is only meaningful for NATted flows (HNAPT/DSLITE). For ROUTE entries, the memory at the new_tuple offset holds routing information, not NAT data, so displaying "new=" produces garbage output. Display new_tuple only for HNAPT and DSLITE, and let IPV4_ROUTE fall through to the default case. Fixes: 3fe15c640f38 ("net: airoha: Introduce PPE debugfs support") Link: https://lore.kernel.org/6a2b40ea.4dd82583.3a5c46.e5a2@mx.google.com Signed-off-by: Wayen.Yan <win847@gmail.com> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/6a2be54b.ef98c1b2.3c3224.2ed8@mx.google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13net: airoha: Fix register index for Tx-fwd counter configurationWayen.Yan
In airoha_qdma_init_qos_stats(), the Tx-fwd counter configuration register uses the same index (i << 1) as the Tx-cpu counter, which overwrites the Tx-cpu configuration. The Tx-fwd counter value register correctly uses (i << 1) + 1, so the configuration register should use the same index. Fix the REG_CNTR_CFG index from (i << 1) to ((i << 1) + 1) so that the Tx-fwd counter is properly configured instead of clobbering the Tx-cpu counter config. Fixes: 20bf7d07c956 ("net: airoha: Add sched ETS offload support") Signed-off-by: Wayen.Yan <win847@gmail.com> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/6a2b40e7.4dd82583.3a5c46.e566@mx.google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13net: airoha: better handle MIBs for GDM ports with multiple devs attachedLorenzo Bianconi
In the context of a GDM port that can have multiple net_devices attached (GDM3 and GDM4), the HW counters (MIBs) are global for the GDM port. This cause duplicated stats reported to the kernel for the related net_device. The SoC supports a split MIB feature where each counter is tracked based on the relevant HW channel (NBQ) to account for this scenario and provide a way to select the related counter on accessing the MIB registers. Enable this feature for GDM3 and GDM4 and configure the relevant HW channel before updating the HW stats to report correct HW counter to the kernel for the related interface. Move the stats struct from port to dev since HW counter are now specific to the network device instead of the GDM port. Refactor airoha_update_hw_stats() to take airoha_eth and airoha_gdm_port parameters since the function operates on the entire port. Co-developed-by: Christian Marangi <ansuelsmth@gmail.com> Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260611-airoha-eth-multi-serdes-stats-v1-1-42442ae42064@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13octeontx2-af: fix NPC mailbox codes in mbox.hRatheesh Kannoth
Several NPC mailbox command IDs in the 0x601x range were assigned out of order. Renumber and reorder the M() definitions so each opcode matches the stable contract expected by userspace tools and applications. Fixes: 4e527f1e5c15 ("octeontx2-af: npc: cn20k: Add new mailboxes for CN20K silicon") Cc: Suman Ghosh <sumang@marvell.com> Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260611083330.1652181-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13ethernet: 3c509: Improve style of pnp_device_id array terminatorUwe Kleine-König (The Capable Hub)
To match how device-id array terminators look like for other device types drop `.id = ""` from it and let the compiler care for zeroing the entry. There are no changes in the compiled drivers, only the source looks nicer. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/a0cd057e6a24b9d355b5e4bdfcdb812cdd1e4652.1781082923.git.u.kleine-koenig@baylibre.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13net: bcmgenet: Use weighted round-robin TX DMA arbitrationOvidiu Panait
Under heavy network traffic, we observed sporadic TX queue timeouts on the Raspberry Pi 4. The timeouts can be reproduced by stress testing the TX path with multiple concurrent iperf UDP streams: iperf3 -c <ip> -u -b0 -P16 -t60 NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 2044 ms NETDEV WATCHDOG: CPU: 3: transmit queue 0 timed out 2004 ms Investigation showed that the timeouts are caused by the priority-based arbiter. Under heavy load the highest priority queue starves the lower priority ones, causing timeouts. The TX strict priority arbiter is not suitable for the default use case where all the traffic gets spread across all the TX queues. Therefore, to fix this, switch the TX DMA arbiter to Weighted Round-Robin, which services all queues, so they do not stall. The weights were chosen to follow the existing priority scheme: q0 gets the smallest weight, while q1-4 get the bulk of the TX bandwidth. Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file") Signed-off-by: Ovidiu Panait <ovidiu.panait.rb@renesas.com> Link: https://patch.msgid.link/20260610085238.56300-1-ovidiu.panait.rb@renesas.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13Merge tag 'clk-microchip-fixes-7.1' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into clk-microchip Pull Microchip clock fixes from Claudiu Beznea: - Fix the GMAC GCLK clock ID for the SAM9X7 SoC - Properly decrement the reference count of a struct device_node in pmc_register_ops() after it is no longer needed - Fix the MPFS peripheral driver registration failures by using the proper size and mapping for the output clocks array [sboyd@kernel.org: These all look non-critical so not taking for clk-fixes] * tag 'clk-microchip-fixes-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: clk: at91: keep securam node alive while mapping it clk: microchip: mpfs-ccc: fix peripheral driver registration failures after oob fix clk: at91: sam9x7: Fix gmac_gclk clock definition
2026-06-13ice: implement E825 TX ref clock control and TXC hardware sync statusGrzegorz Nitka
Build on the previously introduced TXC DPLL framework and implement full TX reference clock control and hardware-backed synchronization status reporting for E825 devices. E825 firmware may accept or override TX reference clock requests based on device-wide routing constraints and link conditions. Because the final selection becomes visible only after a link-up event, the driver splits the observation into two complementary signals: - TXCLK pin state reflects the requested TX reference clock (pf->ptp.port.tx_clk_req). After a link-up, the value is reconciled against the SERDES reference selector by ice_txclk_update_and_notify(); if firmware or auto-negotiation selected a different clock, tx_clk_req is overwritten so that pin state converges to the actual hardware selection. - TXC DPLL lock status reflects hardware synchronization: * LOCKED when an external TX reference is in use * UNLOCKED when falling back to ENET/TXCO, or when a requested external reference has not (yet) been accepted by hardware. Userspace observing only pin state therefore sees user intent, while lock status is the authoritative indicator of whether the requested clock is actually selected and synchronizing. This matches the DPLL subsystem model where pin state describes topology and device lock status describes signal quality. TX reference selection topology: - External references (SYNCE, EREF0) are represented as TXCLK pins - The internal ENET/TXCO clock has no pin representation; when selected, all TXCLK pins are reported DISCONNECTED With this change, TX reference clocks on E825 devices can be reliably selected, observed via standard DPLL interfaces, and monitored for effective synchronization through TXC DPLL lock status. Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Link: https://patch.msgid.link/20260607183045.1213735-14-grzegorz.nitka@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13ice: add Tx reference clock index handling to AN restart commandGrzegorz Nitka
Extend the Restart Auto-Negotiation (AN) AdminQ command with a new parameter allowing software to specify the Tx reference clock index to be used during link restart. This patch: - adds REFCLK field definitions to ice_aqc_restart_an - updates ice_aq_set_link_restart_an() to take a new refclk parameter and properly encode it into the command - keeps legacy behavior by passing REFCLK_NOCHANGE where appropriate This prepares the driver for configurations requiring dynamic selection of the Tx reference clock as part of the AN flow. Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Link: https://patch.msgid.link/20260607183045.1213735-13-grzegorz.nitka@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13ice: implement CPI support for E825CGrzegorz Nitka
Add full CPI (Converged PHY Interface) command handling required for E825C devices. The CPI interface allows the driver to interact with PHY-side control logic through the LM/PHY command registers, including enabling/disabling/selection of PHY reference clock. This patch introduces: - a new CPI subsystem (ice_cpi.c / ice_cpi.h) implementing the CPI request/acknowledge state machine, including REQ/ACK protocol, command execution, and response handling - helper functions for reading/writing PHY registers over Sideband Queue - CPI command execution API (ice_cpi_exec) and a helper for enabling or disabling Tx reference clocks (CPI 0xF1 opcode 'Config PHY clocking') - assurance of CPI transaction serialization into the CPI core. CPI REQ/ACK is a multi-step handshake and must be executed atomically per PHY. Centralize the lock in ice_cpi_exec() and use adapter-scoped per-PHY mutexes, which match the hardware sharing model across PFs. - addition of the non-posted write opcode (wr_np) to SBQ - Makefile integration to build CPI support together with the PTP stack This provides the infrastructure necessary to support PHY-side configuration flows on E825C and is required for advanced link control and Tx reference clock management. Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Link: https://patch.msgid.link/20260607183045.1213735-12-grzegorz.nitka@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13ice: introduce TXC DPLL device and TX ref clock pin framework for E825Grzegorz Nitka
E825 devices provide a dedicated TX clock (TXC) domain which may be driven by multiple reference clock sources, including external board references and port-derived SyncE. To support future TX clock control and observability through the Linux DPLL subsystem, introduce a separate TXC DPLL device (of DPLL_TYPE_GENERIC) and a framework for representing TX reference clock inputs. This change adds a new internal DPLL pin type (TXCLK) and registers TX reference clock pins for E825-based devices: - EXT_EREF0: a board-level external electrical reference - SYNCE: a port-derived SyncE reference described via firmware nodes The TXC DPLL device is created and managed alongside the existing PPS and EEC DPLL instances. TXCLK pins are registered directly or deferred via a notifier when backed by fwnode-described pins. A per-pin attribute encodes the TX reference source associated with each TXCLK pin. At this stage, TXCLK pin state callbacks and TXC DPLL lock status reporting are implemented as placeholders. Pin state getters always return DISCONNECTED, and the TXC DPLL is initialized in the UNLOCKED state. No hardware configuration or TX reference switching is performed yet. This patch establishes the structural groundwork required for hardware-backed TX reference selection, verification, and synchronization status reporting, which will be implemented in subsequent patches. Also signal dpll_init from the fwnode pin init error path so any notifier worker already blocked on it can drain, avoiding a flush_workqueue() deadlock during teardown. Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Link: https://patch.msgid.link/20260607183045.1213735-11-grzegorz.nitka@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13dpll: allow fwnode pins to attempt state change without capability bitGrzegorz Nitka
Pins registered with an fwnode may have .state_on_dpll_set implemented without advertising DPLL_PIN_CAPABILITIES_STATE_CAN_CHANGE upfront. Requiring the bit for fwnode pins ties firmware description to driver implementation details unnecessarily. Relax the capability check in dpll_pin_state_set() and dpll_pin_on_pin_state_set(): when a pin has an associated fwnode, bypass the capability gate and let the ops layer decide, returning -EOPNOTSUPP if .state_on_dpll_set is absent. Non-fwnode pins retain the original strict behavior. This is used later in the series by the SyncE_Ref output pin, which relies on the fwnode path for state control. Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Link: https://patch.msgid.link/20260607183045.1213735-10-grzegorz.nitka@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13dpll: extend pin notifier with notification source IDGrzegorz Nitka
Extend the DPLL pin notification API to include a source identifier indicating where the notification originates. This allows notifier consumers to distinguish between notifications coming from an associated DPLL instance, a parent pin, or the pin itself. A new field, src_clock_id, is added to struct dpll_pin_notifier_info and is passed through all pin-related notification paths. Callers of dpll_pin_notify() are updated to provide a meaningful source identifier based on their context: - pin registration/unregistration uses the DPLL's clock_id, - pin-on-pin operations use the parent pin's clock_id, - pin changes use the pin's own clock_id. As introduced in the commit ("dpll: allow registering FW-identified pin with a different DPLL"), it is possible to share the same physical pin via firmware description (fwnode) with DPLL objects from different kernel modules. This means that a given pin can be registered multiple times. Driver such as ICE (E825 devices) rely on this mechanism when listening for the event where a shared-fwnode pin appears, while avoiding reacting to events triggered by their own registration logic. This change only extends the notification metadata and does not alter existing semantics for drivers that do not use the new field. Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Link: https://patch.msgid.link/20260607183045.1213735-9-grzegorz.nitka@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13dpll: balance create/delete notifications in __dpll_pin_(un)registerGrzegorz Nitka
__dpll_pin_register() emits dpll_pin_create_ntf() internally, but __dpll_pin_unregister() left the matching delete to its callers. The counts then diverge on dpll_pin_on_pin_register() rollback and on dpll_pin_on_pin_unregister(), leaking stale notifications. Emit dpll_pin_delete_ntf() inside __dpll_pin_unregister() and drop the now-redundant call in dpll_pin_unregister(). Fixes: 9431063ad323 ("dpll: core: Add DPLL framework base functions") Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> Link: https://patch.msgid.link/20260607183045.1213735-8-grzegorz.nitka@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13dpll: guard sync-pair removal on full pin unregisterGrzegorz Nitka
__dpll_pin_unregister() wiped the global sync-pair state on every (dpll, ops, priv, cookie) tuple removed from a pin. When a pin is registered multiple times and only one registration is being torn down, this dropped sync-pair pairings still in use by the surviving registrations. Move dpll_pin_ref_sync_pair_del() inside the xa_empty(&pin->dpll_refs) branch so it only runs when the last registration is gone, alongside clearing the DPLL_REGISTERED mark. Fixes: 58256a26bfb3 ("dpll: add reference sync get/set") Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> Link: https://patch.msgid.link/20260607183045.1213735-7-grzegorz.nitka@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister()Grzegorz Nitka
dpll_pin_on_pin_register() emits a creation notification for every parent->dpll_refs entry, but dpll_pin_on_pin_unregister() emitted only one deletion notification outside the loop. When a pin is registered against multiple parent dplls, userspace sees N creates but a single delete and leaks per-dpll state. Move dpll_pin_delete_ntf() into the loop and call it before __dpll_pin_unregister() so the DPLL_REGISTERED mark is still set when dpll_pin_available() is consulted. Fixes: 9d71b54b65b1 ("dpll: netlink: Add DPLL framework base functions") Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> Link: https://patch.msgid.link/20260607183045.1213735-6-grzegorz.nitka@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13dpll: send delete notification before unregister in on-pin rollbackGrzegorz Nitka
The rollback path in dpll_pin_on_pin_register() called __dpll_pin_unregister() before dpll_pin_delete_ntf(). When the unregister dropped the pin's last DPLL reference it cleared the DPLL_REGISTERED mark in dpll_pin_xa, so the subsequent dpll_pin_event_send() failed dpll_pin_available() and aborted with -ENODEV. As a result userspace was never notified of the rollback deletion and remained out of sync with the kernel. Send the delete notification first, matching the order used by dpll_pin_unregister() and dpll_pin_on_pin_unregister(). Fixes: 9d71b54b65b1 ("dpll: netlink: Add DPLL framework base functions") Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Link: https://patch.msgid.link/20260607183045.1213735-5-grzegorz.nitka@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13dpll: fix stale iteration in dpll_pin_on_pin_unregister()Grzegorz Nitka
Neither parent->dpll_refs nor pin->dpll_refs on its own is a correct iteration target at unregister time: - pin->dpll_refs includes DPLLs the child was registered against via a different parent or directly; blind unregister WARNs on the cookie miss in dpll_xa_ref_pin_del(). - parent->dpll_refs reflects the parent's current attachments, not those at child-register time. Another driver may have (un)reg'd the parent against additional DPLLs in the meantime, so we miss registrations that exist and visit DPLLs that have none. Walk pin->dpll_refs and use dpll_pin_registration_find() to filter to entries whose cookie is this parent. Symmetric with dpll_pin_on_pin_register(), correct under any subsequent change to parent->dpll_refs. Fixes: 9431063ad323 ("dpll: core: Add DPLL framework base functions") Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Link: https://patch.msgid.link/20260607183045.1213735-4-grzegorz.nitka@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13dpll: allow registering FW-identified pin with a different DPLLGrzegorz Nitka
Relax the (module, clock_id) equality requirement when registering a pin identified by firmware (pin->fwnode). Some platforms associate a FW-described pin with a DPLL instance that differs from the pin's (module, clock_id) tuple. For such pins, permit registration without requiring the strict match. Non-FW pins still require equality. Keep netlink pin module reporting/filtering safe for this relaxed registration model by caching the module name in the pin object at allocation time and using the cached string in netlink paths. This avoids dereferencing pin->module after provider module teardown. Reviewed-by: Jiri Pirko <jiri@nvidia.com> Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Link: https://patch.msgid.link/20260607183045.1213735-3-grzegorz.nitka@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13dpll: add generic DPLL typeGrzegorz Nitka
Add DPLL_TYPE_GENERIC to represent DPLL devices which do not fit the existing PPS or EEC classes. The UAPI type is intentionally generic. During netdev discussion, maintainers pointed out that introducing identifiers tied to a specific placement or single design does not scale across ASICs and vendors. The role of a DPLL is already inferable from the spawning driver, bus device, and pin topology, without encoding additional purpose-specific taxonomy in the type name. Using a generic type keeps the UAPI extensible and avoids premature naming that may become incorrect as new hardware topologies are exposed through the DPLL subsystem. Expose the new type through UAPI and netlink specification as "generic". Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com> Link: https://patch.msgid.link/20260607183045.1213735-2-grzegorz.nitka@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-13Revert "PCI/MSI: Unmap MSI-X region on error"Yuanhe Shu
This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") added an iounmap(dev->msix_base) on the error path of msix_capability_init() to release the MSI-X region when msix_setup_interrupts() fails. When msix_setup_interrupts() fails, the call chain is: msix_setup_interrupts() -> __msix_setup_interrupts() struct pci_dev *dev __free(free_msi_irqs) = __dev; ... return ret; // __free cleanup fires on error The __free(free_msi_irqs) cleanup calls pci_free_msi_irqs(), which already handles the unmap: void pci_free_msi_irqs(struct pci_dev *dev) { pci_msi_teardown_msi_irqs(dev); if (dev->msix_base) { iounmap(dev->msix_base); // already unmapped here dev->msix_base = NULL; // and set to NULL } } So dev->msix_base is unmapped and set to NULL before msix_setup_interrupts() returns to msix_capability_init(). The "goto out_unmap" introduced by commit 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") then calls iounmap() a second time on a NULL pointer. This was reproduced on Intel Emerald Rapids (192 CPUs) while running tools/testing/selftests/kexec/test_kexec_jump.sh: WARNING: CPU#44 at iounmap+0x2a/0xe0 RIP: 0010:iounmap+0x2a/0xe0 RDI: 0000000000000000 Call Trace: msix_capability_init+0x317/0x3f0 __pci_enable_msix_range+0x21d/0x2c0 pci_alloc_irq_vectors_affinity+0xa9/0x130 nvme_setup_io_queues+0x2a8/0x420 [nvme] nvme_reset_work+0x151/0x340 [nvme] ... RDI=0 confirms iounmap() is called with NULL. Restore the original "goto out_disable" and leave the unmap to the existing __free(free_msi_irqs) cleanup. Fixes: 1a8d4c6ecb4c ("PCI/MSI: Unmap MSI-X region on error") Reported-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Yuanhe Shu <xiangzao@linux.alibaba.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://lore.kernel.org/all/20260610194406.GA380991@bhelgaas/ Link: https://patch.msgid.link/20260611025901.1105209-1-xiangzao@linux.alibaba.com Closes: https://lore.kernel.org/all/4fc6208d-513b-4f41-a13a-4a0829ab50ad@roeck-us.net/
2026-06-13net: wwan: t7xx: check skb_clone in control TXRuoyu Wang
t7xx_port_ctrl_tx() clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned->len, so an skb_clone() failure results in a NULL pointer dereference. Check the clone before using it. If previous fragments were already queued, preserve the driver's existing partial-write behavior by returning the number of bytes submitted so far. Fixes: 36bd28c1cb0d ("wwan: core: Support slicing in port TX flow of WWAN subsystem") Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Link: https://patch.msgid.link/20260612035613.1192486-1-ruoyuw560@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>