[PATCH net 4/5] net: wwan: iosm: pass the DL command parameter by pointer

From: Fang Xieyan <hidden>
Date: 2026-11-12 12:52:19
Also in: lkml
Reply to: Fang Xieyan, 2026-11-12

ipc_mux_dl_cmdresps_decode_process() takes the twelve byte union
mux_cmd_param by value, so every received command copies the whole union
out of the skb even when the command type only needs one member of it.
The driver also builds its answers inside the received block:
ipc_mux_dl_cmd_decode() writes the link status response into cmdh->param
of the skb and reads it back a few lines later, and
ipc_mux_dl_acbcmd_decode() writes into it as well.

Take the parameter as a const pointer, and keep the link status response
of the lite path in a local variable. The aggregated path does not need a
parameter pointer at all: it passes a size of zero to
ipc_mux_dl_acb_send_cmds(), so nothing is ever copied from it and the
write into cmdh->param had no effect.

The bytes handed to the UL path are unchanged, the lite path still sends
the four byte response field and the aggregated path still sends none.

Reviewed-by: Guanglei Zhu <redacted>
Signed-off-by: Fang Xieyan <redacted>
---
 drivers/net/wwan/iosm/iosm_ipc_mux_codec.c | 29 ++++++++++------------
 1 file changed, 13 insertions(+), 16 deletions(-)

diff --git a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
index 2c4f175233a1..aea4cd9ec20d 100644
--- a/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c
+++ b/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c

@@ -184,7 +184,7 @@ void ipc_mux_netif_tx_flowctrl(struct mux_session *session, int idx, bool on)
 }
 
 static int ipc_mux_dl_cmdresps_decode_process(struct iosm_mux *ipc_mux,
-					      union mux_cmd_param param,
+					      const union mux_cmd_param *param,
 					      __le32 command_type, u8 if_id,
 					      __le32 transaction_id)
 {

@@ -194,7 +194,7 @@ static int ipc_mux_dl_cmdresps_decode_process(struct iosm_mux *ipc_mux,
 	case MUX_CMD_OPEN_SESSION_RESP:
 	case MUX_CMD_CLOSE_SESSION_RESP:
 		/* Resume the control application. */
-		acb->got_param = param;
+		acb->got_param = *param;
 		break;
 
 	case MUX_LITE_CMD_FLOW_CTL_ACK:

@@ -318,7 +318,7 @@ static void ipc_mux_dl_cmd_decode(struct iosm_mux *ipc_mux, struct sk_buff *skb)
 	__le32 trans_id = cmdh->transaction_id;
 	int size;
 
-	if (ipc_mux_dl_cmdresps_decode_process(ipc_mux, cmdh->param,
+	if (ipc_mux_dl_cmdresps_decode_process(ipc_mux, &cmdh->param,
 					       cmdh->command_type, cmdh->if_id,
 					       cmdh->transaction_id)) {
 		/* Unable to decode command response indicates the cmd_type

@@ -333,14 +333,15 @@ static void ipc_mux_dl_cmd_decode(struct iosm_mux *ipc_mux, struct sk_buff *skb)
 			/* Decoded command may need a response. Give the
 			 * response according to the command type.
 			 */
+			union mux_cmd_param response = {};
 			union mux_cmd_param *mux_cmd = NULL;
 			size_t size = 0;
 			u32 cmd = MUX_LITE_CMD_LINK_STATUS_REPORT_RESP;
 
 			if (cmdh->command_type ==
 			    cpu_to_le32(MUX_LITE_CMD_LINK_STATUS_REPORT)) {
-				mux_cmd = &cmdh->param;
-				mux_cmd->link_status_resp.response =
+				mux_cmd = &response;
+				response.link_status_resp.response =
 					cpu_to_le32(MUX_CMD_RESP_SUCCESS);
 				/* response field is u32 */
 				size = sizeof(u32);

@@ -500,26 +501,22 @@ static void ipc_mux_dl_acbcmd_decode(struct iosm_mux *ipc_mux,
 	u32 fctl_dis = IOSM_AGGR_MUX_CMD_FLOW_CTL_DISABLE;
 	u32 fctl_ena = IOSM_AGGR_MUX_CMD_FLOW_CTL_ENABLE;
 	u32 fctl_ack = IOSM_AGGR_MUX_CMD_FLOW_CTL_ACK;
-	union mux_cmd_param *cmd_p = NULL;
 	u32 cmd = link_st;
 	u32 trans_id;
 
 	if (!ipc_mux_dl_cmds_decode_process(ipc_mux, &cmdh->param,
 					    cmdh->command_type, cmdh->if_id,
 					    cmdh->cmd_len, size)) {
-		size = 0;
-		if (cmdh->command_type == cpu_to_le32(link_st)) {
-			cmd_p = &cmdh->param;
-			cmd_p->link_status_resp.response = MUX_CMD_RESP_SUCCESS;
-		} else if ((cmdh->command_type == cpu_to_le32(fctl_ena)) ||
-				(cmdh->command_type == cpu_to_le32(fctl_dis))) {
+		if (cmdh->command_type == cpu_to_le32(fctl_ena) ||
+		    cmdh->command_type == cpu_to_le32(fctl_dis))
 			cmd = fctl_ack;
-		} else {
+		else if (cmdh->command_type != cpu_to_le32(link_st))
 			return;
-			}
+
 		trans_id = le32_to_cpu(cmdh->transaction_id);
+		/* No response parameter is sent in the aggregated protocol. */
 		ipc_mux_dl_acb_send_cmds(ipc_mux, cmd, cmdh->if_id,
-					 trans_id, cmd_p, size, false, true);
+					 trans_id, NULL, 0, false, true);
 	}
 }

@@ -571,7 +568,7 @@ static void ipc_mux_dl_acb_decode(struct iosm_mux *ipc_mux, struct sk_buff *skb)
 		     skb->len - next_cmd_index < hdr_len))
 			break;
 
-		if (ipc_mux_dl_cmdresps_decode_process(ipc_mux, cmdh->param,
+		if (ipc_mux_dl_cmdresps_decode_process(ipc_mux, &cmdh->param,
 						       cmdh->command_type,
 						       cmdh->if_id,
 						       cmdh->transaction_id)) {

-- 
2.50.1

`h`	back out one level
`j`	next message in thread / next series-diff position
`k`	previous message in thread / previous series-diff position
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help