wireguard-linux/drivers/net/ethernet/airoha, branch stable

net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param()

2026-10-06T00:45:01Z

CPU accesses QDMA via the bus. When multiple modules are using the bus simultaneously, CPU access to QDMA may encounter bus timeouts and fails, resulting in QDMA configuration failures and potentially causing packet transmission issues. In order to mitigate the issue, introduce a retry mechanism to airoha_qdma_set_trtcm_param routine in order to ensure the configuration is correctly applied to the hardware. It's enough to try a second time for the TRTCM config to be actually applied to make sure we are not in the middle of bucket handling as it does operate on fixed time slot internally. Fixes: ef1ca9271313b ("net: airoha: Add sched HTB offload support") Signed-off-by: Leto Liu (刘涛) [ improve commit description, drop memory block, apply better loop logic] Signed-off-by: Christian Marangi Link: https://patch.msgid.link/20260930065855.46171-1-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski

net: airoha: npu: cancel wdt_work after releasing the WDT IRQ

2026-09-24T02:16:30Z

airoha_npu_remove() calls cancel_work_sync() on each core's wdt_work, but the watchdog IRQ that queues it is requested with devm_request_irq() and is freed only after .remove() returns. airoha_npu_wdt_handler() can therefore schedule_work() again once the cancel has returned. struct airoha_npu, which contains the work, is devm_kzalloc()'d and is freed in that same unwind, so the late work dereferences freed memory. Register the work with devm_work_autocancel() before devm_request_irq() and drop .remove(). Devres runs in reverse order, so the IRQ is freed before cancel_work_sync(), including when probe fails. A cancel left in .remove() cannot get that order. Initializing the work first also stops a pending watchdog interrupt from queuing an uninitialized work item. Probe currently calls INIT_WORK() only after devm_request_irq(). This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: 23290c7bc190 ("net: airoha: Introduce Airoha NPU support") Cc: stable@vger.kernel.org # 6.15+ Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260922000914.542068-1-mhun512@gmail.com Signed-off-by: Jakub Kicinski

net: airoha: enable RX_DONE interrupt for RX queue 31

2026-09-03T09:40:51Z

RX queue 31 has always been allocated and filled by airoha_qdma_init_rx() since RX_DONE_INT_MASK spans queues 0-31, but none of the RX_IRQ* _BANK_PIN_MASK values covered BIT(31). As a consequence the RX_DONE interrupt for queue 31 was never enabled, airoha_qdma_rx_process() never ran on that queue and its buffers were never reaped. Route RX queue 31's RX_DONE interrupt to IRQ bank 1 so that the queue is drained and its buffers returned to the page pool. Fixes: f252493e1835 ("net: airoha: Enable multiple IRQ lines support in airoha_eth driver.") Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260830-airoha-rxdone-rxq31-v1-1-830a91503f2f@kernel.org Signed-off-by: Paolo Abeni

net: airoha: npu: fix missing streaming DMA mask

2026-08-27T15:36:47Z

The driver calls dma_set_coherent_mask() but never dma_set_mask(), leaving the streaming DMA mask at the bus default. On the non-coherent EN7581 platform (Cortex-A53), this causes the NPU mailbox to hang after approximately 41 calls when using streaming DMA mappings. Replace dma_set_coherent_mask() with dma_set_mask_and_coherent() to set both the streaming and coherent DMA masks, matching standard driver practice. Fixes: 6f884eb87a79 ("net: airoha: Fix DMA direction for NPU mailbox buffer") Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260814110017.2795022-1-pawlik.dan@gmail.com/ Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260809152813.585797-1-pawlik.dan@gmail.com/ Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260805070851.2885888-1-pawlik.dan@gmail.com/ Signed-off-by: Daniel Pawlik Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260820085941.380401-1-pawlik.dan@gmail.com Signed-off-by: Jakub Kicinski

net: airoha: npu: load the firmware without the sysfs fallback

2026-08-17T18:26:49Z

airoha_npu_load_firmware() maps a missing firmware file to -EPROBE_DEFER so that the NPU can be brought up once the rootfs carrying /lib/firmware has been mounted. That mapping holds only as long as request_firmware() reports -ENOENT. It does not when the sysfs fallback is in play. With CONFIG_FW_LOADER_USER_HELPER_FALLBACK set, or with the fallback armed at runtime through /proc/sys/kernel/firmware_config/force_sysfs_fallback, request_firmware() hands the request to a userspace helper, waits out the full loading_timeout and returns -ETIMEDOUT. The -ENOENT test no longer matches, dev_err_probe() turns the result into a hard failure, and the NPU is left unbound after stalling the boot for 60 seconds: airoha-npu 1e900000.npu: Direct firmware load for airoha/en7581_npu_rv32.bin failed with error -2 airoha-npu 1e900000.npu: Falling back to sysfs fallback for: airoha/en7581_npu_rv32.bin airoha-npu 1e900000.npu: error -ETIMEDOUT: failed to run npu firmware airoha-npu 1e900000.npu: probe with driver airoha-npu failed with error -110 Clearing FW_LOADER_USER_HELPER in the configuration is not a dependable guard against this, because unrelated drivers select it. On the affected build the symbol was turned back on by LEDS_LP55XX_COMMON, even though the platform had explicitly disabled it. Use request_firmware_direct() instead. It sets FW_OPT_NOFALLBACK_SYSFS, so a missing file is reported as -ENOENT whatever the firmware loader is configured to do, and the deferred probe path works as intended. Two consequences are worth stating plainly. The helper is not merely bypassed for the boot-before-rootfs case. fw_run_sysfs_fallback() returns early on FW_OPT_NOFALLBACK_SYSFS, so this driver's firmware requests can no longer be served by a usermode helper at all, including on a system where that is the only delivery route; having no second firmware source, the driver would defer forever there. That is a deliberate trade-off: the -ENOENT to -EPROBE_DEFER mapping was written to wait for a filesystem, and the sysfs helper interface has had no in-tree consumer since udev dropped firmware loading. request_firmware_direct() also sets FW_OPT_NO_WARN, which drops the only message naming the file that failed to load. Report it from the driver instead, so the name lands in the deferred probe reason and shows up in the "deferred probe pending" line emitted at driver_deferred_probe_timeout. The generic report in airoha_npu_probe() goes away with it, since it would otherwise overwrite that reason with a message naming nothing; of the paths it covered, devm_ioremap_resource() reports itself and the malformed firmware-name property now does too. Measured on a Nokia XG-040G-MD with FW_LOADER_USER_HELPER=y and FW_LOADER_USER_HELPER_FALLBACK=y forced on, two images from the same tree differing only by this patch: without: fallback at 2.477s -> -ETIMEDOUT at 64.555s -> probe failed with -110, preinit at 69.6s, NPU unbound with: no fallback, NPU fw version 1456.62 at 3.665s, preinit at 7.6s Cc: stable+noautosel@kernel.org # never worked Signed-off-by: Vitaliy Sochnev Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski

net: pass net_device_path_ctx to dev_fill_forward_path()

2026-08-10T11:02:06Z

Refactor dev_fill_forward_path() to take a struct net_device_path_ctx pointer instead of a (dev, daddr) pair, so the caller can build and populate the context up front and keep it after the forward path walk. This allows additional fields (e.g. vlan and ether_type) to be carried in the context and shared with ndo_fill_forward_path implementations, instead of being reconstructed on the stack inside the core helper. Update the mtk_ppe_offload, airoha_ppe and nf_flow_table_path callers to allocate and fill the context before invoking dev_fill_forward_path(). The network topology resolution behaviour is unchanged. This is a preliminary patch to enable HW flowtable offload for IPv4 over IPv6 tunnels. Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Signed-off-by: Pablo Neira Ayuso

Merge tag 'nf-next-26-07-31' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

2026-08-05T23:26:00Z

Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for net-next: 1) Update conncount to use the original tuple after ct lookup to ensure consistent counting, from Fernando F. Mancera. 2) Remove redundant net_device field in info structure that helps parse the flowtable path discovery. 3) Move net_device to flowtable check to the flowtable discovery path parser. This is preparation work to pass the tunnel dst_entry via .fill_forward_path. 4) Update DSA .fill_forward_path to break at the user DSA, since the conduit DSA is not used in the datapath. This slighly simplifies the flowtable path discovery parser. 5) Do not advance index in the path stack prematurely, otherwise it points to uninitialized slots on error. Not an issue currently but it could be once tunnel dst_entry is passed via .fill_forward_path. 6) Pass the tunnel dst_entry via dev_fill_forward_path(). 7) Update ipip and ip6ip6 tunnels to pass the dst_entry through dev_fill_forward_path(). 8) Call skb_valid_dst() before accessing skb_dst() to ensure dst_entry is not a template. 9) Use UNACK timeout when RST packet does not match the expected window while in ESTABLISHED state, the existing approach the CLOSE state timeout which is only 10 seconds. Adopt a more conservative timeout by default for this case. * tag 'nf-next-26-07-31' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets netfilter: nf_tables: call skb_valid_dst() before skb_dst() netfilter: flowtable: release tunnel route on error when building forward path net: pass dst via net_device_path in dev_fill_forward_path() net: do not advance stack index from dev_fwd_path() net: dsa: stop at the user device in .fill_forward_path netfilter: flowtable: consolidate flowtable device check netfilter: flowtable: consolidate net_device field in nft_forward_info struct netfilter: conncount: normalize tuple and zone on successful ct lookup ==================== Link: https://patch.msgid.link/20260731153402.851224-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski

net: airoha: fix ARRAY_SIZE() division by zero on UP builds

2026-08-04T23:59:08Z

airoha_alloc_gdm_device() initializes the txq_lock[] array iterating over ARRAY_SIZE(dev->txq_lock). ARRAY_SIZE() expands to sizeof(dev->txq_lock) / sizeof((dev->txq_lock)[0]), but on UP builds (CONFIG_SMP unset, CONFIG_DEBUG_SPINLOCK unset) arch_spinlock_t is an empty struct, so sizeof(spinlock_t) is zero and the expression is a compile-time division by zero (undefined behavior), reported by clang as "division by zero is undefined [-Wdivision-by-zero]". Since the array is statically sized with AIROHA_NUM_NETDEV_TX_RINGS, use the named constant as loop bound instead of ARRAY_SIZE(). Fixes: 78a35725e533 ("net: airoha: defer GDM3/GDM4 WAN mode and GDM2 loopback to QoS offload") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202607311850.6p0ZUVq4-lkp@intel.com/ Signed-off-by: Lorenzo Bianconi Reviewed-by: Nick Desaulniers Link: https://patch.msgid.link/20260731-airoha-spinlock-array-fix-v1-1-863a7e239a5f@kernel.org Signed-off-by: Jakub Kicinski

net: pass dst via net_device_path in dev_fill_forward_path()

2026-07-31T12:47:03Z

Add dst_entry to tunnel device path, this will allow us to remove a duplicated route lookup. This is a preparation patch to retrieve the tunnel route directly from the .fill_forward_path. This new dst_entry in the tunnel will be used by a follow up patch. Since dst_release() works fine on NULL interface, this is still noop until the flowtable starts using this. Add a new dev_fill_forward_path_release() function to drop the refcount on the tunnel device route and use it in case of error out. Export it so to drop the refcount on the tunnel route at a later stage. Adjust existing drivers that recycle dev_fill_forward_path() to call dev_fill_forward_path_release() for safety reasons. Acked-by: Lorenzo Bianconi Signed-off-by: Pablo Neira Ayuso

net: airoha: defer GDM3/GDM4 WAN mode and GDM2 loopback to QoS offload

2026-07-30T09:36:46Z

GDM3 and GDM4 ports require GDM2 loopback to be enabled for hardware QoS offload to function. Without it, HTB and ETS offload on these ports do not work. Previously, GDM3/GDM4 ports were automatically configured as WAN with GDM2 loopback enabled during ndo_init(). Add the capability to configure GDM3/GDM4 as WAN/LAN on demand when QoS offload is created or destroyed. Hook airoha_enable_qos_for_gdm34() into TC_HTB_CREATE so that requesting HTB offload on a GDM3/GDM4 LAN port switches it to WAN mode and enables GDM2 loopback. Introduce the AIROHA_DEV_F_TX_QOS flag to track whether a device has an active TX HTB qdisc; set it in airoha_tc_setup_qdisc_htb() on successful TC_HTB_CREATE and clear it on TC_HTB_DESTROY. The device keeps its WAN role after qdisc teardown so that its configuration is preserved until another device explicitly needs the WAN role for QoS offload. If another GDM3/GDM4 device already holds the WAN role without an active TX qdisc, demote it to LAN before promoting the requesting device. Skip the demotion when the requesting device is itself already the WAN device. Since airoha_dev_set_qdma() can now be called on a running device to migrate between QDMA blocks, make dev->qdma an RCU pointer so the TX path can safely dereference it without holding RTNL. When migrating between QDMA blocks, stop TX queues, swap the pointer via rcu_assign_pointer(), then synchronize_rcu() to ensure no in-flight ndo_start_xmit holds the old pointer. Serialize netdev_tx_completed_queue() calls via per-TX-queue spinlocks txq_lock[] so that both the old and new QDMA NAPI instances can complete packets concurrently on the same netdev TX queues without racing on dql_completed(). Hold flow_offload_mutex in airoha_enable_qos_for_gdm34() and airoha_disable_qos_for_gdm34() around the dev->flags update, airoha_dev_set_qdma() and GDM2 loopback configuration, serializing against concurrent airoha_ppe_hw_init() in the TC_SETUP_CLSFLOWER offload path. Introduce airoha_qdma_deref() helper that wraps rcu_dereference_protected() with a lockdep condition accepting either rtnl_lock or flow_offload_mutex, and use it across all control-path dereferences of the RCU-protected dev->qdma pointer. Add airoha_disable_gdm2_loopback() to disable GDM2 hw loopback. Tested-by: Madhur Agarwal Reviewed-by: Alexander Lobakin Reviewed-by: Simon Horman Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260725-airoha-ethtool-priv_flags-v12-3-5136a30b2157@kernel.org Signed-off-by: Paolo Abeni